Update, 4:54 PM EDT: A correction to the DOD contract announcement is pending. Microsoft will only be providing access to code through Microsoft employees, and "access rights to source code" are not included in the contract language. Our original story continues below; it will be updated with the corrected statement from DOD is available.
Update, 5:37 PM EDT: A DISA spokesperson told Ars, that contrary to some interpretations of the contracting announcement, "The Department of Defense does not, and will not, have access to Microsoft's proprietary source codes. The METSS-II contract is a sole-source follow-on contract to continue and leverage Microsoft support services."
The US Department of Defense announced yesterday that the Defense Information Systems Agency (DISA)—the DOD's internal IT provider—had awarded Microsoft a $927 million, five-year contract to provide what it calls "Microsoft Blue Badge Cardholder Support." The contract is a combination of site license, consulting services, access to Microsoft developers, and actual source code [Update,5:37 pm: that access is through Microsoft employees—not direct access]. "These services require access rights to Microsoft's proprietary (closed-source) code, which is licensed under exclusive legal right of Microsoft, and are required to support the Department of Defense's mission," the Department of Defense announcement read.
"Blue Badge Cardholder Support" essentially means direct support from Microsoft's internal employees—not from outsourced contractors (who wear orange badges on the Microsoft campus). The contract gives Microsoft a channel to bill for the direct support provided to DOD for its client, server, and software deployments. This contract is a follow-on to a similar contract DISA awarded Microsoft in June of 2013—a $412 million contract that had its cap raised to $575 million in 2015.
Having direct access to Microsoft's code has played a major role in DISA's push toward bringing all of DOD into an internal, cloud-based e-mail system pioneered by the Army. It also gives DISA a means by which to understand how Microsoft's products work—and potentially request modifications of them for DOD's specific use. "The core requirements [for the contract] are for [Microsoft] to provide… consulting services that include software developers and product teams to leverage a variety of proprietary resources and source code, and Microsoft premier support services such as tools and knowledge bases, problem resolution assistance from product developers, and access to Microsoft source code when applicable to support Department of Defense's mission," the contract notice explained.
Update, 5:37 PM EDT: Microsoft provides for code review by governments through its "Transparency Centers"—one in Redmond, Washington, and one in Brussels, Belgium, with a third center announced in September to be built in China. The contract with DISA, however, is intended solely to be to provide support for Microsoft products deployed by DOD—not to provide security review access. Any changes in features requested by DOD would be rolled into Microsoft's generally available products.
reader comments
81