Microsoft Wants Security Hard-Wired in Your Computer

washingtonpost.com

Microsoft Wants Security Hard-Wired in Your Computer

By Leslie Walker

Thursday, June 27, 2002; Page E01

It's tough to plug holes in a ship's hull once it is at sea, or to reattach an airplane's wing in flight. Yet that's akin to what the computer industry has been trying to do with security: append layer after layer of protection onto the world's increasingly connected computer networks, all as one big afterthought after another.

Afterthoughts on that scale rarely work, and so we read daily about a fresh crop of electronic heists, filched identities, hacked Web sites and destructive computer viruses.

Now Microsoft Corp. is saying "Let's start over." The company whose software helped launch the personal computing revolution three decades ago announced this week that it wants to redesign the computer so it will have built-in security and privacy functions, including some etched onto special chips to be manufactured by Intel Corp. and Advanced Micro Devices Inc.

The hyper-ambitious project, code-named Palladium, is supposed to create a platform on which Microsoft and other developers could write all sorts of new software applications for managing security, privacy, copyrights and, yes, even spam.

The idea, said project manager Mario Juarez, is to create a virtual vault inside the Windows operating system. In it, each user could create personal "safe-deposit boxes" for storing encrypted information. The information would be accessible only to those software programs, Web sites and people that the computer recognized as being authorized to see it.

The notion of hard-wired authentication rings alarms for conspiracists who sense a plot by which Microsoft might exert even more control over what kind of software could run on future computers. The Redmond behemoth dismisses such talk as silly.

"No one will necessarily, by design, have to call up Microsoft or the government to get authorization," Juarez said. "It is merely an architecture. You will be able to create whatever kind of rules you want for each separate application."

Some technologists are skeptical for other reasons, noting that Microsoft is infamous for releasing software riddled with huge, hacker-friendly holes.

"Why should we trust them that this will be any different?" said Bruce Schneier, a cryptography specialist who wrote the book "Secrets and Lies: Digital Security in a Networked World."

Yet some consumer advocates and champions of personal privacy cautiously support Palladium. Nobody questions that more security is needed as computing continues its steady march online.

"It has the potential to put users in more control over their information if it's done right," said Ari Swartz, associate director of the D.C.-based nonprofit Center for Democracy and Technology.

It could turn out that Microsoft's new initiative is little more than a PR campaign to buff up a corporate image devastated by a long-running antitrust case and hackers taking continual glee at exposing weaknesses in the company's software.

But whatever the reason, Microsoft is on a tear about security. In January founder Bill Gates sent a memo to the entire staff, telling them that the company's "highest priority" would henceforth be making its products secure, rather than adding new features.

Company executives soon made the rounds with press and analysts to talk up their "trustworthy computing" initiative.

Craig Mundie, senior vice president for advanced technologies, said in a May interview that Microsoft was so committed to security that it stopped work on several new software products for two months. During that time, 9,000 programmers did nothing but retrain, rethink security and reinspect code, Mundie said.

That's the backdrop for Palladium, which appears to be as much idea as project at this point. Juarez acknowledged in an interview this week that while code writing has begun, it will be several years before Palladium becomes a product, and even longer before software applications are written to take advantage of it. There are many hurdles to overcome, not the least of which involve getting computer makers to install the chip, helping users to understand the system (they could turn it on or off, Juarez said,) and persuading developers to create products that run on it.

But if it succeeds, Palladium could make it easier for people to authenticate themselves to business partners, friends, and merchants -- and vice versa. It also could make it easier for media companies to write applications to distribute their content with stronger anti-copying protection.

Skeptics question whether Microsoft is really creating something to empower consumers or whether it is trying to engineering new ways to elbow out competitors.

"This is all about protectionism," said Schneier, the cryptography expert. "It's all about making sure Linux doesn't run on the new hardware," he said, referring to the rival operating system.

But former National Security Agency officer Ira Winkler said the concept seems fundamentally sound because it would embed security directly into devices, potentially making it more ubiquitous and requiring less work from computer users.

"Security has to be a basic part of information technology," Winkler said. "If you leave it to a user to secure themselves, they won't do it."

I tend to agree with Winkler and with Robert Douglas, chief executive of American Privacy Consultants, who thinks Bill Gates is taking dead aim at one of the biggest roadblocks along the way to the much-hyped world of ubiquitous computing.

"A lot of it comes down to the fact that consumer just don't feel secure using the Internet for their critical transactions," Douglas said. "Gates has realized that unless trust can be built into these systems, the ultimate abilities of the Internet are never going to be realized."

Leslie Walker's e-mail address is walkerl@washpost.com.