Groklaw: Microsoft Cloud Services Aren't FISMA Certified 152
doperative writes with this excerpt from Groklaw: "If you were as puzzled as I was by the blog fight, as Geekwire calls it, between Google and Microsoft over whether or not Google was FISMA certified, then you will be glad to know I gathered up some of the documents from the case, Google et al v. USA, and they cause the mists to clear. I'll show you what I found, but here's the funny part — it turns out it's Microsoft whose cloud services for government aren't FISMA certified. And yet, the Department of the Interior chose Microsoft for its email and messaging cloud solution, instead of Google's offering even though Google today explains that in [actuality] its offering actually is. It calls Microsoft's FUD 'irresponsible.'"
Voice from the Other Side? (Score:2, Insightful)
Re: (Score:2)
This is really strange that they're coming up with good stuff like this right before going away.
Re: (Score:2)
This is really strange that they're coming up with good stuff like this right before going away.
<George Castanza>Leaving on a high note!</George Castanza>
Re: (Score:1)
Just like Manny Ramirez!
Re:Voice from the Other Side? (Score:5, Informative)
Not if this is the trend. Where are the links to the original sources - DOI RFQ, Google's complaint, the DOJ brief, and the amicus briefs? This was the worst bit of reporting I have seen from Groklaw, and I believe Google's suit is valid.
If you read the RFQ you can see that the DOI did not issue a competitive request as they should have, but that FISMA certification was to be achieved after the contract was issued so it is a non-issue.
Google's complaint is whiny and overlong and full of irrrelevant facts that only weaken their position.
The DOJ brief said the Government is presumed to act fairly so Google's suit should be dismissed. The DOJ has our best and brightest?
But instead of dealing with the real issues it is about distractions. What is this, Reality TV?
Re: (Score:2)
But instead of dealing with the real issues it is about distractions. What is this, Reality TV?
Well since your talking about our government I am forced to ask one question. Is that a rhetorical question?
Re: (Score:2)
...This was the worst bit of reporting I have seen from Groklaw,...
Well to be fair, Groklaw already put in it's notice and is probably slacking the last bit till it's out of here.
Getting worse by the minute (Score:3)
Re:Getting worse by the minute (Score:5, Insightful)
Now it's really starting to look like some serious BS was going on.
A lot of government procurement involves someone writing a list of requirements that can only be met by one company.
Sometimes it happens at the agency level, sometimes the requirements are attached to congressional appropriations.
Either way, it happens. A lot.
Re: (Score:2)
Either way, it happens. A lot.
Is that somehow mutually exclusive with it being "serious BS"?
Re: (Score:2)
No, I think the issue was with the "starting to look" part. The start was long ago. We're well into this being run-of-the-mill behavior in government contracting.
Re: (Score:2)
Big F*cking Surprise (Score:1, Insightful)
This is precisely why I tried modding the original FUD article down in the firehose. Anyone with half a clue and more than a few years experience in computing could have told you that Microsoft was most likely lying.
Re: (Score:1)
His lips are moving!
Perhaps, like Jon Kyl's remarks, this was "Not intended to be a factual statement!"
Re: (Score:2, Insightful)
Standards games (Score:2)
All vendors play these games, Nicrosoft just happens to be damned good at it.
Remember their EAL certification on NT? So long as there wasn't a network port or floppy drive installed on the machine, that part buried in the fine print of course.
Or adding the POSIX subsystem to NT to meet a bid spec. Because of course whoever wrote the spec never imagined somebody would write a whole POSIX implementation, get it certified POSIX and then just ignore it. Because I don't think anyone can point to a single damn
Re: (Score:2)
I'd say it's on those days that she (or he, let's not be restrictive) isn't buried in a grave with a stake through their thoracic cavity (where their heart used to be), their heads cut off and their mouth stuffed with garlic.
Perhaps we should nuke Redmond from orbit, just to be sure.
Re: (Score:1, Informative)
Actually, I don't recall a single place where MS said their offering was FISMA certified. They weren't saying "Our offering is and Google's isn't, so choose us!" they were saying "Google is saying their oiffering is certified but it's not; they're lying to you." So far as I've seen, this is true. Microsoft never tried to hide that their offering wasn't certified yet, they're just a vendor calling out their competitor for lying to the client (the government).
Re: (Score:2, Interesting)
The reason MS falsely claimed that Google wasn't certified was to deflect attention away from their own lack. MS not having certification is just the motive for the lie.
Re: (Score:1)
Re: (Score:3, Informative)
What Google said was completely true. Microsoft had a mole inside the government who claimed Google was lying but it was the mole and Microsoft who were lying, not Google. The GSA, who is responsible for FISMA certification said Google's offering was certified. FTFA:
We [Google] take the federal government's security requirements seriously and have delivered on our promise to meet them. What's more, we've been open and transparent with the government, and it's irresponsible for Microsoft to suggest otherwise.
Let's look at the facts. We received FISMA authorization for Google Apps from the General Services Administration (GSA) in July 2010. Google Apps for Government is the same technology platform as Google Apps Premier Edition, not a separate system. It includes two added security enhancements exclusively for government customers: data location and segregation of government data. In consulting with GSA last year, it was determined that the name change and enhancements could be incorporated into our existing FISMA certification. In other words, Google Apps for Government would not require a separate application.
This was reflected in yesterday's Congressional testimony from the GSA: "...we're actually going through a re-certification based on those changes that Google has announced with the 'Apps for Government' product offering."
FISMA anticipates that systems will change over time and provides for regular reauthorization -- or re-certification -- of systems. We regularly inform GSA of changes to our system and update our security documentation accordingly. The system remains authorized while the changes are evaluated by the GSA. We submitted updates earlier this year that included, among other changes, a description of the Google Apps for Government enhancements.
Re: (Score:2)
Re: (Score:2)
Huh, Microsoft only repeated what the DoJ said:
On December 16, 2010, counsel for the Government learned that, notwithstanding Googles
representations to the public at large, its counsel, the GAO, and this Court, it appears that
Googles Google Apps for Government does not have FISMA certification.
Re: (Score:3)
What Google said was entirely true, as you'll find if you RTFA. Yes there's a lot of words there, but if you can't be bothered to read them, don't bother to comment.
Not quite (Score:2)
The reason MS falsely claimed that Google wasn't certified was to deflect attention away from their own lack.
Untrue. FISMA certification in advance was not a requirement, and so was irrelevant to the contract at issue. MS raised the issue about Google to distract attention from the fact that Google's substantive claims about the contract being improperly given to Microsoft without allowing competing bids was correct.
Re: (Score:3)
Great! So can we kill the marketing departments now? Please?
I have it on good authority that these mindless jerks will be the first ones up against the wall when the Revolution comes.
Re:Big F*cking Surprise (Score:4, Informative)
Re: (Score:2)
So far as I've seen, this is true. Microsoft never tried to hide that their offering wasn't certified yet
Steve, is that you? Naaa, can't be. It's been a while since you've been reported as throwing chairs so even if you're on your meds no way the response would be that calm.
It's as far as you've seen because you've got Microsoft logos painted on your glasses. Read the article. The GSA stated that Google's offering was FISMA certified since July 2010. Since they're the ones who do the certifications I'd say that makes a pretty strong case as to who's lying here (it's Microsoft, in case you're still too dense to
Re: (Score:2)
Microsoft never tried to hide that their offering wasn't certified yet, they're just a vendor calling out their competitor for lying to the client (the government).
Except that it is and was [businessinsider.com] certified, according to the GSA (which issues the certifications).
Re: (Score:1)
I had assumed the reason that they mentioned Microsoft's cloud services not being FISMA certified was that the government is still using Microsoft's services...or did I misunderstand something?
Re: (Score:2)
"As far as you've seen" must not involve reading TFA you're commenting on.
Re: (Score:2)
You forgot their "Get the Facts" Campaign already?
This was known... (Score:1)
I believe part of Google's complaint was that additional cost in the government's Microsoft solution was going towards funding in the process of achieving FISMA certification (apologies, but no citation).
Dilbert on Certification (Score:4, Funny)
NOT goatse [dilbert.com]
Re: (Score:1)
Same cartoon without crap. [dilbert.com]
And she thought that groklaw was not worth doing (Score:5, Insightful)
Re: (Score:2)
That seems unwise. If they pay her then all we'll ever hear is how she's on their payroll, regardless of the quality of the work she does.
If the problem is money then if anything, we should pay her. Anyone feel like starting a "Save Groklaw" fund?
Re: (Score:2)
Re: (Score:3)
As far as I recall, money isn't the issue. She just wants to move on and do something else with her life. Which is understandable.
Uh, Where is the news here? (Score:4, Insightful)
Re: (Score:2, Insightful)
I mean no offense, but as a student of history, aren't FUD and Microsoft synonymous?
This FUD got Google dragged before the US Senate, so it's pretty newsworthy.
Re: (Score:2)
I mean no offense, but as a student of history, aren't FUD and Microsoft synonymous?
This FUD got Google dragged before the US Senate, so it's pretty newsworthy.
Yeah, it's not like the House where just about anybody can get dragged before it.
Re:Uh, Where is the news here? (Score:5, Informative)
"I mean no offense, but as a student of history, aren't FUD and Microsoft synonymous?"
As a student of history you should know that FUD was an IBM invention, Microsoft is just an advanced student.
Re: (Score:2)
If you want to be pedantic, the tactic has been in use for nearly all of human history, and the acronym was coined by Gene Amdahl (but yes, he was talking about IBM).
Did Microsoft ever claim it was? (Score:5, Insightful)
Am I not mistaken that Microsofts original claim was that Google claimed to be but were not, essentially calling out their lie? Did Microsoft also claim they were and this proves them to be lying as well?
Re: (Score:3, Interesting)
Re: (Score:2)
no, the claim was not implied.
it was inferred in your case.
Re: (Score:2, Insightful)
Microsoft never claimed that their offering was certified. Their claim was that Google was lying by claiming a certification that Google didn't have.
Apparently some people who have more hatred for MS than reading comprehension skill have twisted this into a claim that Google was pretending to have a certification that MS already has. That's not the case.
Re: (Score:2, Insightful)
Microsoft never claimed that their offering was certified. Their claim was that Google was lying by claiming a certification that Google didn't have.
And that claim by Microsoft was in fact the lie, and Google wasn't lying.
Re: (Score:2)
According to the GSA it does.
FTFA
Google now has responded with a blog post, The Truth about Google Apps and FISMA:
In a breathless blog post, Microsoft recently suggested we intentionally misled the U.S. government over our compliance with the Federal Information Security Management Act (FISMA). Microsoft claims we filed a separate FISMA application for Google Apps for Government, then leaps to the conclusion that Google Apps for Government is not FISMA certified. These allegations are false.
We take the federal government’s security requirements seriously and have delivered on our promise to meet them. What’s more, we’ve been open and transparent with the government, and it’s irresponsible for Microsoft to suggest otherwise.
Let’s look at the facts. We received FISMA authorization for Google Apps from the General Services Administration (GSA) in July 2010. Google Apps for Government is the same technology platform as Google Apps Premier Edition, not a separate system. It includes two added security enhancements exclusively for government customers: data location and segregation of government data. In consulting with GSA last year, it was determined that the name change and enhancements could be incorporated into our existing FISMA certification. In other words, Google Apps for Government would not require a separate application.
This was reflected in yesterday’s Congressional testimony from the GSA: “...we're actually going through a re-certification based on those changes that Google has announced with the ‘Apps for Government’ product offering.”
FISMA anticipates that systems will change over time and provides for regular reauthorization—or re-certification—of systems. We regularly inform GSA of changes to our system and update our security documentation accordingly. The system remains authorized while the changes are evaluated by the GSA. We submitted updates earlier this year that included, among other changes, a description of the Google Apps for Government enhancements.
We’ve been very transparent about our FISMA authorization. Our documentation has always been readily available for any government agency to review, and dozens of officials from a range of departments and agencies have availed themselves of the opportunity to learn more about how we keep our customers’ data secure.
We’ll continue to update our documentation to reflect new capabilities in Google Apps. This continuous innovation is an important reason government customers select our service. We’re confident that Microsoft will also re-authorize their applications on a regular basis, once they receive FISMA authorization. We look forward to continuing to work with governments around the world to bring them the many benefits of cloud computing.
Posted by Eran Feigenbaum, Director of Security, Google Enterprise
Re:Did Microsoft ever claim it was? (Score:4, Insightful)
Apparently some people who have more hatred for MS than reading comprehension skill have twisted this into a claim that Google was pretending to have a certification that MS already has. That's not the case.
No, apparently people with the ability to actually read and comprehend have to explain how Microsoft lied and had their non-security certified solution chosen over one that had a security certification. You see, I'll type slowly, Microsoft claimed Google's product wasn't certified. But the GSA, who does the certifying mind you, said that Google's product is and was certified. So clearly Microsoft lied. And I think people want it explained why a government agency that was looking for a solution to reduce security breaches chose a solution that was not certified (Microsoft's) over one that was certified (Google's).
That's what the summary says. That wasn't so difficult now, was it?
If you're gonna try to be snarky at about reading comprehension it'd be better if you actually tried reading with a little comprehension first.
Your post exemplifies how Groklaw FUDs gullible people into believing nonsense. First of all the headline, summary and Groklaw are flat out twisting the facts about 'it turns out MS is the one without certification' as if MS claimed it, which it never ever did, at any point. Groklaw is the one lying by implying that MS said it's offering was FISMA certified. If you're quoting the summary, then you're the one that's being misled.
You're the one that needs to read, and not read just Groklaw even if you think it's a good source, because it's not and it's blindly anti MS biased and will twist and hide facts to support anything anti-MS and will cheerlead the other side and hide all their faults regardless of merits.
If you do so, you will see that Google wanted to throw federal data along with other private customers' data in the same servers and infrastructure. So if there was a breach because of the private customer, federal data would be compromised and told the DOI to shove it when it was objected. MS agreed to have a dedicated infrastructure for the DoI (the reason it was more expensive) so the DoI notified that it was restricting bids to resellers of MS's offering. AFTER all this, Google announced Apps for Govt with a separate cloud for Federal, State and County government data(which the DoI may not be still happy with because of State data getting intermingled).
Re: (Score:2, Troll)
No, you are the one being disingenuous. Neither Groklaw nor the summary imply
Re: (Score:1)
Oh dear, oh dear. Hello Mr Microsoft-Shill.
Your post exemplifies how Groklaw FUDs gullible people into believing nonsense. First of all the headline, summary and Groklaw are flat out twisting the facts about 'it turns out MS is the one without certification' as if MS claimed it
No one, not any of those sources you accuse, say that MS claimed to have certification. Merely that it was funny to discover Microsoft did not. Quote:
"I'll show you what I found, but here's the funny part -- it turns out it's Microsoft whose cloud services for government aren't FISMA certified."
If you do so, you will see that Google wanted to throw federal data along with other private customers' data in the same servers and infrastructure.
False. Google's proposal had federal data on servers alongside other US government customers. Not alongside private customers.
AFTER all this, Google announced Apps for Govt with a separate cloud for Federal, State and County government data(which the DoI may not be still happy with because of State data getting intermingled).
Again false, Mr Shill.
Re: (Score:2)
What's up with the all the shill accusations? What should I call you? A freetard? Or an iFangirl?
False. Google's proposal had federal data on servers alongside other US government customers. Not alongside private customers.
Go read the documents of the case instead of blindly following Slashdot and Groklaw, you will find a it's a different world out there.
In the summer of 2009, during his development of the draft Project Plan, Mr. ...
Corrington met with both Google and Microsoft to discuss the Unified Messaging project, and to
understand the capabilities of the companies’ respective cloud offerings. AR 150, 184. At the
time, Microsoft offered two different models of the Business Productivity Online Suite
(“BPOS”) – BPOS-Standard, a multi-tenant, public cloud, and BPOS-Dedicated, a single-tenant
Case 1:10-cv-00743-SGB Document 42-1 Filed 12/27/10 Page 10 of 64
- 6 -
cloud with infrastructure that is dedicated solely to one organization.2 In contrast, Google only
offered Google Apps, a multi-tenant, public cloud with infrastructure that is shared among
various cloud users. During DOI’s meeting with Microsoft in August 2009, Microsoft confirmed
that it could provide a cloud with infrastructure dedicated solely to DOI. AR 184. The record
establishes that Google did not, and would not, provide DOI with this same assurance during
their meeting with DOI in the summer of 2009. AR 150.
Consistent with DOI’s initial market research, the September 28, 2009 version of
the draft Project Plan proposed that DOI utilize Microsoft’s dedicated cloud offering to deliver a
single email system to all DOI users. AR 1098. The Department’s research at that point in time
had revealed that BPOS-Dedicated was the only available cloud solution that met this
requirement.
On February 18, 2010, Mr. Corrington, along with Mr. Bernard Mazer, DOI’s ...
Chief Information Officer (who at the time was the CIO for the U.S. Fish and Wildlife Service),
and Mr. Andrew Jackson, DOI’s Deputy Assistant Secretary for Technology, Information and
Business Services, met with Google officials, including the company’s Vice President of North
America, regarding the planned Unified Messaging project. AR 85, 150. During the meeting,
Case 1:10-cv-00743-SGB Document 42-1 Filed 12/27/10 Page 12 of 64
- 8 -
Google advised DOI that Google would not offer a single-tenant cloud. AR 150 (“no single
tenant offering would be available”).
On April 28, 2010, Mr. Corrington and Mr. Mazer attended a Google Apps ...
Summit for government IT leaders to learn more about the cloud offering that Google could offer
to DOI. AR 97-98, 150. After the presentation, Mr. Mazer and Mr. Corrington shared certain
security concerns that DOI believed required the Department to implement a cloud solution with
a dedicated infrastructure. The Google officials responded by objecting to the premise that DOI
required a dedicated cloud, and again refused to offer DOI a dedicated cloud. AR 150
However, when DOI specifically asked Google about whether the company was able to ...
provide the service on a dedicated infrastructure, Google again replied that it was “incapable of
supporting a dedicated solution and proceeded to argue against the merits of a dedicated
infrastructure.”
After the meeting, on June 17, 2010, Google sent another letter to DOI that ...
argued that the Department was defining its requirements too narrowly and continued
specifically to object to DOI’s expressed preference for a dedicated cloud with a physically
isolated computing infrastructure. AR Tab 5.
In February 2010, Microsoft publicly announced plans to offer BPOS-Federal, a ..
cloud computing solution specifically for the Federal government. BPOS-Federal is a modified
version of Microsoft’s existing BPOS-Dedicated cloud, with additional enhancements to meet
Case 1:10-cv-00743-SGB Document 42-1 Filed 12/27/10 Page 14 of 64
- 10 -
the privacy and security requirements of the Federal government. Like BPOS-Dedicated,
BPOS-Federal offers a dedicated cloud infrastructure that is not shared with other organizations.4
On June 29, 2010, completed a market research analysis for DOI. During ...
its research, considered thirteen firms that provide messaging systems, including
Microsoft and Google, to determine if each firm was capable of meeting the Department’s
requirements, including the requirement for either a DOI-only or a Federal-only cloud.
AR 169-72. concluded that only Microsoft’s BPOS-Federal met all of DOI’s
requirements. AR 171. In particular, determined that Google was unable to meet DOI’s
requirement for an external, private cloud. Id. This independent research confirmed internal
research conducted by DOI.
standard service offering that meets all of DOI’s requirements.” AR 756.
On August 30, 2010, DOI issued a Limited Source Justification in accordance
with Federal Acquisition Regulation (“FAR”) Subpart 8.4 to limit competition to resellers of
BPOS-Federal. The Limited Source Justification, which was approved by the Contracting
Officer, the Competition Advocate, the Head of the Contracting Activity, and the Senior
Procurement Executive, explained that through its market research, DOI had determined that
“although many companies can provide messaging services in general, they either cannot
provide services that address the complexity of messaging requirements within DOI, or they
could not meet the degree of security required by DOI.” AR 848. The Limited Source
Justification also made clear that “because of the rapidly changing nature of information
technology, DOI will periodically evaluate the marketplace for externally hosted email and
collaboration services to identify alternative sources for these services.” AR 849.6
Shortly after DOI’s standardization decision, Google publicly announced the ,7 DOI conducted supplemental market research to assess the impact of these two
availability of its planned government-wide cloud (consisting of infrastructure that is shared
6 In other words, DOI has not adopted a “once Microsoft, forever Microsoft” attitude as
alleged by Plaintiffs, (Pls. Br. at 32), but rather has committed to continuing to evaluate viable
alternatives as they become available.
Case 1:10-cv-00743-SGB Document 42-1 Filed 12/27/10 Page 17 of 64
- 13 -
among federal, state, and local government customers), and also publicly announced that this
cloud had received certification from the General Services Administration (“GSA”) pursuant to
the Federal Information Security Management Act (“FISMA”). See, e.g., AR 783 (referencing
Google’s website announcement of the availability of Google Apps for Government); see also
Attach. 1 hereto, cited in AR 783 (“Google Apps for Government, now with FISMA
certification.”). In response to this Google announcement –
announcements on the Department’s prior decision to implement a unified messaging system
using BPOS-Federal. AR Tab 21. On August 20, 2010, Mr. Corrington and Mr. Mazer
completed this supplemental market research and concluded that Google’s recent announcements
did not warrant a change in the July 15, 2010 standardization decision because Google’s
government-wide cloud continued to present an unacceptable risk to DOI. AR 784. This
supplemental market research was then presented to Mr. Jackson and Ms. Debra Glass, Chief of
DOI’s Acquisition Management Division IV. AR 783.
So regardless of what your sources want to twist the facts, the decision was about dedicated vs. community cloud. It's sad to see how out of touch many are from reality, because of publications like Slashdot and Groklaw play to their audience to drive page hits and twist facts an
Re: (Score:2)
What's up with the all the shill accusations? What should I call you? A freetard? Or an iFangirl?... Oh hello, Mr. Clueless FreeTard, or maybe Mr. Google Shill
The shill accusation is accurate. It's in your history of posting. Microsoft has your drool on it's corporate balls. You can do whatever name calling you like in return, if it makes you feel better. But don't don't whine about my accusation of you being a shill, because it only shows you up as being a hypocrite too.
And if you had read my previous posts you'd see I'm no friend of Google, Linux, nor "freetards". Quite the contrary. Which rather punctures your accusations anyway.
Go read the documents
I'd be very happy to discuss th
Re: (Score:2)
Here: http://www.groklaw.net/pdf2/SoftchoiceOppMotforJonAdminRecord.pdf [groklaw.net]
PS: I am no shill, the closest I was to Microsoft was when I was in Seattle, interviewing for Amazon for a Linux based position. My posting history is like that because it's fun to point out the other side of things.
Re: (Score:2)
And this whole thing is about Google calling MS liars for saying that Google wasn't FISMA when they actually are.
Google now has responded with a blog post, The Truth about Google Apps and FISMA:
In a breathless blog post, Microsoft recently suggested we intentionally misled the U.S. government over our compliance with the Federal Information Security Management Act (FISMA). Microsoft claims we filed a separate FISMA application for Google Apps for Government, then leaps to the conclusion that Google Apps for Government is not FISMA certified. These allegations are false.
We take the federal government’s security requirements seriously and have delivered on our promise to meet them. What’s more, we’ve been open and transparent with the government, and it’s irresponsible for Microsoft to suggest otherwise.
Let’s look at the facts. We received FISMA authorization for Google Apps from the General Services Administration (GSA) in July 2010. Google Apps for Government is the same technology platform as Google Apps Premier Edition, not a separate system. It includes two added security enhancements exclusively for government customers: data location and segregation of government data. In consulting with GSA last year, it was determined that the name change and enhancements could be incorporated into our existing FISMA certification. In other words, Google Apps for Government would not require a separate application.
This was reflected in yesterday’s Congressional testimony from the GSA: “...we're actually going through a re-certification based on those changes that Google has announced with the ‘Apps for Government’ product offering.”
FISMA anticipates that systems will change over time and provides for regular reauthorization—or re-certification—of systems. We regularly inform GSA of changes to our system and update our security documentation accordingly. The system remains authorized while the changes are evaluated by the GSA. We submitted updates earlier this year that included, among other changes, a description of the Google Apps for Government enhancements.
We’ve been very transparent about our FISMA authorization. Our documentation has always been readily available for any government agency to review, and dozens of officials from a range of departments and agencies have availed themselves of the opportunity to learn more about how we keep our customers’ data secure.
We’ll continue to update our documentation to reflect new capabilities in Google Apps. This continuous innovation is an important reason government customers select our service. We’re confident that Microsoft will also re-authorize their applications on a regular basis, once they receive FISMA authorization. We look forward to continuing to work with governments around the world to bring them the many benefits of cloud computing.
Posted by Eran Feigenbaum, Director of Security, Google Enterprise
Re: (Score:1, Troll)
No, but this is Slashdot and the reality distortion field is the rule where certain topics are concerned.
The poster sending it is not surprising, neither are the anti-microsoft drones replying, but it surprises me that the editors would let a story like this through. I mean, seriously, the last story in here talked about how part of MS's proposal involved the certification process, and the problem was Google was claiming they were cheaper and didn't need the certification.
Google was, and is, the one lying.
T
Re:Did Microsoft ever claim it was? (Score:5, Informative)
Re: (Score:1)
There is no gaffe. I know from first-hand experience that PJ spends a couple of days researching before she publishes anything. And I also know that she prefers to go straight to the original sources (such as the gov't) instead of quoting all the other journalists.
Re: (Score:2)
Then why do we have the misleading article, summary and misleading headline here? "turns out MS didn't have certification"? Huh? When did MS ever claim to have certification? It's just made up by Groklaw.
Re:Did Microsoft ever claim it was? (Score:4, Informative)
You do, huh? Then explain why PJ is making a big fuss over something that never happened.
Microsoft wasn't saying that Google should not be chosen because they weren't FISMA certified, they said that the Department of Justice, in court documents, stated that Google Apps for Goverment was not certified, and that the DOJ claimed that the GSA did not view them as certified. This is not an implication that their (MS's) product was certified, just that Google's wasn't as Google claimed. Somehow PJ inferred a claim that wasn't there, and then proceeded to make a big stink about said non-existent claim. Yeah, that's good research.
Googles response seems a bit odd. They claim that their Google Apps Premier certification carried over to the Google Apps for Government product, even though they admit that GAfG has several significant differences from GAP that requires it to be recertified, and that recertification was not yet complete. It's a bit like driving on a temporary drivers license, technically you have a valid license, but it's under review.
Claiming that GAfG was FISMA certified in their bid, and failing to mention that it needed to complete recertification was certainly misleading (the term Microsoft used). What if GAfG was chosen (specifically because Google had claimed it was certified) and then it failed recertification? What if the changes Google made proved to be insecure?
I think it's certainly understandable that Microsoft interpreted the need for recertification as admission that GAfG wasn't certified. That would seem the logical conclusion. If GAfG was still certified through the GAP certification, then that would be an incorrect (but logical) assumption.. especially given that the DOJ documents made the claim of lacking certification.
People in the blogosphere seem to be quick to throw the word "lied" around. Even Microsoft didn't say google Lied. In fact, Microsoft merely stated the fact that the Department of Justice made the claim that GAfG wasn't certified. The DOJ also made the claim that the GSA didn't view GAfG as certified. So it was apparently the DOJ that was wrong about the GSA's views.
Brain Exploded (Score:1)
The Facts? (Score:3)
Re: (Score:2)
Since when is a legal brief by one of the litigating parties an unbiased source of "facts"?
If you actually read the article you'll find that it's clearly stated that the initial information is from a Google brief and therefore may be biased. And then you'll find in the update to the article that the GSA, who grants the certifications in question, clearly states that Google's claims in the brief are true. That may be just a slightly less biased source supporting Google's claims in the brief.
Re: (Score:3)
However, the Department of Justice rejected Googles claim that it was certified, and they claimed the GSA did not view it as certified. So, both sides seem to be at odds over what the GSA actually did or didn't do.
Wrong terminology (Score:1, Insightful)
Re: (Score:2)
"Fraudulent" is the part where they claimed that Google service lacks certification.
Making such claims while not having certification themselves, is the "irresponsible" part, as bringing it up implies that Microsoft has it, and that is the reason why it is supposedly superior.
Editors! (Score:2)
"If you were as puzzled as I was by the blog fight, as Geekwire calls it, between Google and Microsoft over whether or not Google was FISMA certified, then you will be glad to know I gathered up some of the documents from the case, Google et al v. USA, and they cause the mists to clear. I'll show you what I found, but here's the funny part — it turns out it's Microsoft whose cloud services for government aren't FISMA certified. And yet, the Department of the Interior chose Microsoft for its email and messaging cloud solution, instead of Google's offering even though Google today explains that in actually its offering actually is. It calls Microsoft's FUD 'irresponsible.'"
Editors!
Re: (Score:2)
Can't blame the editors, that's a typo by PJ.
Re: (Score:2)
Protip: They do [wikipedia.org].
Error was in original (Score:2)
Same correction I posted on groklaw, but never applied to original text.
PJ is busy, ya know?
re:Microsoft Cloud Services Aren't FISMA Certified (Score:1)
I like how the Groklaw article ends -- to quote
-quote-
Guys, don't you realize by now that Microsoft is Microsoft? You don't remember Get the Facts? All those "independent" studies that found Microsoft products to be the best thing since someone invented the wheel? Forewarned is forearmed.
-end quote-
keep in mind that .You will be assimilated . Resistance is futile !
" We are the Microsoft
Quiet, citizen! (Score:1)
Dept of Interior and IT (Score:2)
M$ spreading FUD & Lies? (Score:2)
Now that's something new ... has never happened before, better take note!
Re:filter (Score:4, Informative)
Yes. It's really simple. When those words enter your brain through your eyes, set your brain not to send a signal to your hand to click "Reply".
HTH.
Re: (Score:3)
Ok, done. Now what?
Re: (Score:2)
Debug it.
Cuz...dayum.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
>It calls Microsoft's FUD 'irresponsible.'
Compared to their responsible FUD which is much better.
Business as usual between business and government - business sells based upon MOU and promises they'll weasel around, while government rarely goes back to review the contract.
Re: (Score:3)
Re:Crowd pleasing article (Score:5, Informative)
Groklaw is actually wrong on the basic fact of certification. Google Apps for Government is not FISMA certified and google itself has stated it hopes to get the certification "updated soon"
Groklaw is right on this. Google Apps has been FISMA certified, and as such Google Apps for governments is too since it's the same platform. What they want to have updated is the explicit mention of 'google apps for govs' which is currently not in the certs.
Re: (Score:1)
having one product FISMA certified does not immediately make other products "utilizing the same platform" fall under the same certification.
The certification process explicitly states which exact products are certified when it is given.
This is why Google has asked that the certification be updated to include the Google Apps for Government.
Thus, the Google Apps for Government is not, currently, FISMA certified, although it appears to be in the process of obtaining such certification.
Re: (Score:1)
FTFA:
We [Google] take the federal government's security requirements seriously and have delivered on our promise to meet them. What's more, weve been open and transparent with the government, and it's irresponsible for Microsoft to suggest otherwise.
Let's look at the facts. We received FISMA authorization for Google Apps from the General Services Administration (GSA) in July 2010. Google Apps for Government is the same technology platform as Google Apps Premier Edition, not a separate system. It includes two added security enhancements exclusively for government customers: data location and segregation of government data. In consulting with GSA last year, it was determined that the name change and enhancements could be incorporated into our existing FISMA certification. In other words, Google Apps for Government would not require a separate application.
This was reflected in yesterday's Congressional testimony from the GSA: "...we're actually going through a re-certification based on those changes that Google has announced with the 'Apps for Government' product offering."
FISMA anticipates that systems will change over time and provides for regular reauthorization -- or re-certification -- of systems. We regularly inform GSA of changes to our system and update our security documentation accordingly. The system remains authorized while the changes are evaluated by the GSA. We submitted updates earlier this year that included, among other changes, a description of the Google Apps for Government enhancements.
Re: (Score:2)
GSA confirmed it was covered by the same certification.
Re:ask me if I care? (Score:5, Insightful)
Not quite. Google is actually pretty competent in a lot of their service offerings, and they don't try to hold all your data hostage to proprietary technologies. That alone is quite a sharp contrast.
It was tactful of Google to call microsoft's FUD "irresponsible" without condemning the government workers who chose to go with microsoft in violation of their own policies. It's probably likely that points to another very large difference between Google and microsoft -- Google isn't into bribing IT decision makers, they rely on the strength of their offerings.
Re: (Score:3)
Google isn't into bribing IT decision makers, they rely on the strength of their offerings.
These days, that practically *is* bribery right there -- oo, your software actually *does what it says on the tin*?? You mean I no longer have to guess which parts of your documentation are outright lies? Want!
'Course, the fact that I'm armpits-deep in trying to figure out MSO 2003 to 2007 formatting cruft issues might color my judgment somewhat. CSS makes a *lot* more sense than Microsoft's never-quite-baked styling. And don't get me started on the abomination that is Office "Open" XML, which I've rec
Re: (Score:3, Insightful)
Re: (Score:3)
... Google isn't into bribing IT decision makers, they rely on the strength of their offerings.
That's not how free market works!!! You bride your way to the top.
Dang you Google!!!! Actually offering products that work and people might want!
Get with the program!
Re:ask me if I care? (Score:4, Insightful)
Hey, if the government chose my competetors in clear violation of the rules, I sure as heck would sue too. It's one thing if the government had a fair choice between them, and chose microsoft. But as we are seeing here, this isn't happening. They arbitrarially decided on microsoft in violation of the policies, all while allowing Google to think it had a chance early on.
Re: (Score:3)
Only a microsoftie or fanboi could feel that way. Anyone rational would, as others have pointed out, be pleased that Google is suing. I don't want my tax dollars squandered on inferior technology and lost productivity due to incompetent implementations. You wouldn't either, if you had any sense.
Re: (Score:2)
Theyre suing them because they werent even considered, which was in violation of the rules the tender was supposed to be conducted under.
Re: (Score:2)
Sigh. No, they are suing them for not even considering Google, which contravened the rules of the tender.
Re: (Score:2)
and they were caught scanning and archiving personal WiFi data, which they didn't admit to until the German government threatened an audit.
Bullshit. Google came forward and said that they made a mistake, that is what started the whole thing. Germany then tried to demand the data, which would have been illegal for them to obtain. Google is the one who came forward saying "oops, looks like we collected this data, we would like to destroy it as it was not meant to be collected" the German government wouldn't let them destroy the data, it was too valuable to them.
http://www.reuters.com/article/2010/06/22/urnidgns002570f3005978d80025774a00595fb- [reuters.com]
Re: (Score:2)
RTFA. GSA says that Google's is certified. If there's anyone to believe in this case, it is the GSA.
Re: (Score:2)
Microsoft did not say Google apps for government was certified. It said the Department of justice made that claim in official court documents, which it in fact did. Since many of the documents were sealed, and there was no evidence that countered the DOJ's claim, one cannot say that Microsoft intentionally lied.
Re: (Score:2)
That should read Microsoft did not say Google apps for government was NOT certified.