Comment Articles

The CCIA report - why the remedies are unfair

John Carroll ZDNet.com

Published: 10 Oct 2003 16:20 BST

This is part three in a three-part series detailing my objections to a recent Computer & Communications Industry Association (CCIA) report, titled CyberInsecurity: The Cost of Monopoly. In part one, I explained that the flip-side to a software monoculture is a market with high economics of scale, generating cost savings that may outweigh the risks. In part two, I listed my objections to various aspects of the content of the report, specifically, an obsession with the CCIA's core mission to overturn the antitrust settlement between the DoJ and Microsoft, as well as a propensity to misrepresent Microsoft's actions and conditions in the market in order to paint Microsoft in a negative light.

In this instalment, I criticise the remedies proposed by the authors of the report, and suggest that these remedies are impractical, if not unfair, given realities of the software market. I note that the primary beneficiary of many of these proposals will be the software companies who count themselves members of the CCIA. Lastly, I close with some parting thoughts.

Software Liability
The authors propose that Microsoft be made liable for all security problems which arise from its software. Furthermore, they make it very clear that this should only apply to Microsoft: "Where that monoculture is maintained and enforced by lock-in, as it is with Windows today, responsibility for failure lies with the entity doing the locking-in" in other words, Microsoft. This shouldn't surprise anyone, as making all software companies liable would run counter to the interests of the software companies who are members of the CCIA. Besides, this is Microsoft, and the technology Lilliputians have the right to tie Gulliver in as many knots as they want (and everyone knows applications written for Oracle databases, as an example, are instantly transferable to SQL Server).

No company WANTS flaws in their code, Microsoft included, but software IS different than hardware. The sheer number of alternative ways to write software means that the number of potential flaws is that much larger. Furthermore, software tends to be more transient given that its flexibility makes it useful as a way to avoid changes to hardware. For instance, software modems are a way to roll out new modems faster, as software is easier to develop than new hardware.