Microsoft's Bizarre And Misleading Statement About Google In Gov't Procurement Fight

from the well,-well, dept

You may recall the interesting case from late last year, in which Google sued the government, claiming that the Department of the Interior set up a bid for a cloud-based apps service in a way that only Microsoft could win. However, recently, Microsoft made a big stink on its blog, claiming that Google lied in claiming its Apps solution was accredited under FISMA, the Federal Information Security Management Act. Google quickly shot back claiming that its offering absolutely was FISMA certified.

The news coverage on all of this has been a bit confusing, as there's a lot of back and forth with seriously conflicting claims, though Groklaw does a nice job trying to piece together the truth. In the end, it appears that a Justice Department official was confused, mainly because Google got FISMA approval for Google Apps Premiere, and then introduced a product subset of that, with additional security features, called Google Apps for Government. The DoJ seemed to assume that this meant there was no FISMA on the new offering, and Microsoft ran with it. However, as the GSA quickly made clear, it agrees with Google:

Google Apps for Government uses the Google Apps Premier infrastructure but adds additional controls in order to meet requirements requested by specific government agencies. The original FISMA certification remains intact while GSA works with Google to review the additional controls.

Of course, even the GSA seems a bit confused about all of this. While the above statement was the official position of the GSA, in a Senate hearing on the matter, a GSA official described it slightly differently:

"In July 2010, GSA did a FISMA security accreditation for 'Google Apps Premier.' That's what the Google product was called, and it passed our FISMA accreditation process. We actually did that so other agencies could use the Google product. If we do one accreditation, it's leveraged across many agencies. Since that time, Google has introduced what they're calling 'Google Apps for Government.' It's a subset of Google Apps Premier, and as soon as we found out about that, as with all other agencies, we have what you would normally do when a product changes, you re-certify it. So that's what we're doing right now, we're actually going through a re-certification based on those changes that Google has announced with the 'Apps for Government' product offering."

Leading to a bunch of headlines claiming that the GSA disagrees with Google. However, if you read both statements in context, you realize that it appears the GSA does, in fact, agree with Google. What the latter statement notes is that the new subset product needs to be re-certified, but nowhere does he say that it lost its ongoing certification. The official GSA statement above that confirms the initial certification remains intact.

In other words, nothing to see here. A lot of people got confused, but Google has the FISMA certification.

Oh, and an important sidenote in all of this: the Microsoft product which "won" the DoI bid does not have FISMA certification. Yes, you read that correctly. Microsoft is mocking Google for not having FISMA certification (which the product actually did have), while leaving out the bit about how their own product does not. In fact, the government's own filings in the case highlights that it's fine if Microsoft doesn't have FISMA certification now, because it can get it later:

Pursuant to FISMA, an agency may certify and accredit the security of an information system after testing its controls to ensure they work properly. In soliciting a private external cloud, DOI is requesting offerors to propose implementation of its pre-existing technology to meet DOI's specific needs. Accordingly, it follows that such a cloud cannot possibly obtain certification or accreditation because it has not yet been implemented to meet DOI's needs or actually tested. Thus, the lack of FISMA certification for DOI's personalized cloud is not a sign of lax security, as plaintiffs suggest; rather, it is a necessary step in acquiring a dedicated cloud.

In other words, no matter who wins, there will be customization done which will need re-certification... exactly as Google is having done now. In other words, there's no story here. None.

And yet, the Google haters came out quickly on this one. Not only did that Senate hearing happen almost immediately, but the group Consumer Watchdog, which seems to spend all its time coming up with bogus reasons to attack Google, rushed out a press release demanding a further investigation:

"Making misrepresentations to government agencies, particularly involving security clearance, again shows the arrogance of Google engineers, who give little respect to civil society and its accepted rules of conduct. We again urge your committee to hold hearings."

Except, of course, Google did not make misrepresentations to the government agencies. This has nothing to do with Google engineers -- arrogant or not. In fact, you could argue that Consumer Watchdog is actually "making misrepresentations to government agencies" with the letter it sent demanding an investigation.

Filed Under: fisma, government, gsa
Companies: google, gsa, microsoft