Ni Guangnan: China should suspend purchases and use of Windows 10 China Government Edition pending security review (translation)

(Chinese original follows / 中文在后)

See also related items: 核心安全审查专家回应Windows10政府版被建议禁用:现阶段强行切换系统并非最佳选择,  倪光南炮轰Win10政府版没过审查 微软合作方回应

*  *  *

The Government Should Suspend Purchase and Use of Windows 10 Government Edition

By Ni Guangnan

Southern Metropolis Daily, June 8, 2017, Page: AA15

A few days ago, Microsoft Greater China CEO Alain Crozier said the China Government Edition of Windows 10, produced according to the “secure and controllable” principle, had already undergone user testing at three major enterprises, proving that it is reliably secure and thus ready for wide deployment. Reports followed saying “Windows 10 Government Edition Has Completed Domestic Security Testing.” People should ask: Why are they making a big deal out of Windows 10 passing “user testing” and “security testing”?

As everyone knows, China’s Cybersecurity Law has officially gone into effect. It requires: “Critical information infrastructure operators purchasing network products and services that might impact national security shall undergo a national security review organized by the State cybersecurity and Informatization departments and relevant departments of the State Council.” In contrast to this regulation, it’s not difficult to see that claiming Windows 10 passed “user testing” or “security testing” is probably designed to give create the false impression that Windows 10 Government Edition has already passed “national security review,” in order to open the door to government procurement.

According to the Security Review Measures for Network Products and Services issued by the Cyberspace Administration of China, cybersecurity review has strict procedures, for instance requiring third-party evaluation by a nationally recognized cybersecurity review organization.

In 2015, before the establishment of the joint venture between China Electronics Technology Group Corporation (CETC) and Microsoft, Microsoft issued Windows 10 Government Edition. At that point, the Security Review Measures for Network Products and Services were being drafted, and on related aspects Windows 10 Government Edition underwent a round of cybersecurity review and did not pass. Since then, Windows 10 Government Edition has never again undergone this kind of review. No matter what kind of “user testing” or “security testing” it later went through, therefore, it still has not passed cybersecurity review.

Experts specifically point out that Windows 10 has subjectively and objectively not passed cybersecurity review, because:

(1) Although China does not lack operating system experts, because Windows is closed-source, proprietary software, no expert outside Microsoft can be fully familiar with it. It is not realistic, then, to rely on a few experts not fully familiar with Windows to accurately estimate the security and controllability of Windows 10 Government Edition with only a short period in which to examine 100 million lines of source code.

(2) Undertaking security review of software at minimum requires access to the software’s refactorable (可重构的) and complete source code, but Microsoft has never provided China with Windows’ complete source code, let alone allowed it to refactor. If a piece of software has millions of lines of non-open source code, it is like a black box, and there is fundamentally no way to accurately estimate its security and controllability.

Today, no substantive change has resulted from experts making the above points. Even if Windows 10 Government Edition again undergoes cybersecurity review, the degree of difficulty will not decrease. Furthermore, because the structure of Windows 10 incorporates trustworthy computing, reviewing it requires verifying that it complies with the Electric Signature Law (电子签名法) and the Provisions on the Administration of the Use of Commercial Encryption Products (商用密码管理条例). Additionally, it requires surveying how domestic and international information security firms integrate trustworthy computing and antivirus software with Windows 10 and deal with the issue of unfair competition. Clearly Windows 10 Government Edition must again undergo cybersecurity review in what will be a protracted process.

In 2005 and 2014, because Windows Vista and Windows 8 were not controllable, the government ordered a halt of purchases. In 2015, Microsoft quickly updated editions and released Windows 10. Several authoritative Chinese security evaluation organizations concluded that, “the Windows 8.1 and Windows 10 kernel are basically the same, there were not more substantial changes, and to a great extent the upgrade was for the sake of commercial publicity.” (This evaluation only determined whether the two editions were the same and did not touch upon security and controllability estimation, and so it was relatively easy to complete.)

In conclusion, seeing that Windows 10, Windows 8, and Windows 10 Government Edition have not passed cybersecurity review, relevant issues will hopefully be given attention, and government procurement and use of Windows 10 (including Windows 10 Government edition) should be prohibited according to law.

Ni Guangnan, a member of the first class of academicians of the Chinese Academy of Engineering, is devoted to indigenous and controllable core information technologies and industries, and has received lifetime achievement awards from the Chinese Information Processing Society of China and the China Computer Federation. 

Translated by Graham Webster.

建议政府停止采购和使用“Win10政府版”

来源:南方都市报 2017年06月08日 版次:AA15 作者:倪光南

开放专栏

日前,微软大中华区CEO柯睿杰表示:基于“安全可控”原则打造的中国政府版W in10正处于上市销售前的准备当中,该版本Win10已经通过3家大型企业的用户测试,证明该版本系统拥有可靠的安全性,接下来将进行大规模的部署。接着有报道呼应说,“Win10政府版已经在国内完成安全测试”。人们要问:他们为什么要大肆宣传Win10通过“用户测试”、“安全测试”呢?

众所周知,我国《网络安全法》已正式施行,它要求“我国关键信息基础设施的运营者采购网络产品和服务,可能影响国家安全的,应当通过国家网信部门会同国务院有关部门组织的国家安全审查”。对照这个法规,人们不难理解,宣传Win10通过“用户测试”、“安全测试”,可能是想造成“Win10政府版”已通过国家安全审查的假象,从而为它进入政府采购敞开大门。

按照网信办发布的《网络产品和服务安全审查办法》,网络安全审查有严格的程序,并需由国家统一认定网络安全审查第三方机构,承担网络安全审查中的第三方评价工作。

2015年,早在CETC与微软的合资公司成立前,微软就做出了“Win10政府版”。那时,《网络产品和服务安全审查办法》正在制订中,有关方面对“Win10政府版”进行了一次网络安全审查,结果没有通过。此后,对“Win10政府版”并没有再做此类审查。因此,不管后来它做了什么“用户测试”、“安全测试”,它至今仍是一个没有通过网络安全审查的产品。

那时专家们还特别指出,当前不具备对Win10进行网络安全审查的主客观条件,因为:

一、中国虽然不缺少操作系统专家,不过因为Windows是不开放源代码的专有软件,微软以外的专家谁也无法精通W indow s.现在想指望一些不精通Windows的人,在短时间里对亿行源代码规模的“Win10政府版”的安全性、可控性作出准确评估,显然是不现实的。

二、要对一个软件进行安全审查至少应获得该软件的可重构的全部源代码,但微软从未对中方提供过W indow s的全部源代码,更谈不上可重构了。而如果一个软件有数以百万计的源代码不开放,这就像一个黑盒子,根本无法对其安全性、可控性作出准确评估。

今天,专家陈述的上述情况并没有发生实质变化,即使对“Win10政府版”再作网络安全审查,其难度也没有减少。而且由于Win10的架构集成了可信计算,审查需验证它与我国《电子签名法》和《商用密码管理条例》的合法、合规性。此外,还需调查国内外信息安全厂商对Win10捆绑可信计算和杀毒软件、实施不正当竞争的投诉问题。可见,“Win10政府版”要想再作网络安全审查,也将是旷日持久的事。

在2005年和2014年,我国政府因Vista和Win8不可控,都明令禁止采购。后来到2015年,微软快速更新版本号,推出了Win10.对此,我国几家权威安全测评机构进行测评后认为,“Win8 .1与Win10内核基本一致,并不存在较大幅度的变化,而版本号的大幅度升级更多是为了商业宣传的需要”。(按:这里的测评只需判断两者是否一致,不涉及安全性、可控性的评估,因而较易实施。)

综上所述,鉴于Win10等同于Win8以及“Win10政府版”并未通过网络安全审查,希望有关方面予以关注,应依法继续禁止政府采购和使用Win10(包括“Win10政府版”在内)。

倪光南(中国工程院首批院士,一直致力于自主可控的信息核心技术和产业,曾获得中国中文信息学会与中国计算机学会终身成就奖)