IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
STATE OF NEW YORK ex. rel .
Attorney General ELIOT SPITZER, et al. ,
Civil Action No. 98-1233 (CKK)
DIRECT TESTIMONY OF JIM ALLCHIN
TABLE OF CONTENTS
Concerns Related to Disclosure of Information About Security Mechanisms in Windows Operating Systems..................................................................................................... 6
The Need for Section III.J.1 of the Proposed Consent Decree............................................................................................. 6
Computer Viruses.................................................................................. 12
Security Concerns with the Non-Settling States Proposed Remedy....................................................................................... 17
Microsofts .NET Platform for Web Services........................................................... 18
Microsofts .NET Vision.............................................................................. 21
How .NET Works....................................................................................... 24
The Relationship Between .NET and Java.................................................... 29
Microsoft Did Not Destroy Distribution Channels for JVMs.................................................................................................. 31
My name is Jim Allchin. I am the Group Vice President for Platforms at Microsoft Corporation. I have overall responsibility for the technical architecture, engineering and product delivery for all of Microsofts Windows operating systems, for portions of Microsofts new .NET initiative in the area of Web services, for Microsofts family of server applications such as the SQL Server database and Exchange email and collaboration product, and for Microsofts new media technologies. I am also responsible for delivering the developer tools, frameworks and product support to fulfill the promise of Microsofts .NET vision of interconnected software providing services across the Internet. The approximately 10,000 employees in my group build software platforms that consumers and businesses use as integral aspects of their day-to-day activities.
I am a member of the Senior Leadership Team at Microsoft, which is comprised of senior executives who are charged with developing Microsofts core direction as a company in the rapidly evolving computer industry. I am also a member of the Business Leadership Team at Microsoft, which is responsible for broad strategic and business planning for the entire company.
A major concern at Microsoft in recent years has been computer security, and that issue receives significant management attention at Microsoft. In an email sent to all employees on January 15, 2002, Bill Gates announced a Trustworthy Computing initiative designed to make all of Microsofts products more secure. A copy of that email is attached hereto as Defendants Exhibit 1608. In addition, Microsoft has a section of its Web site devoted exclusively to security issues ( see www.microsoft.com/security/ ) and we have created tools like the Microsoft Baseline Security Analyzer that users can download free-of-charge and use to increase the security of their computers. The strength of our commitment to improving security is demonstrated by the fact that we required essentially the entire Windows organization to be trained in new security techniques and processes earlier this year, and then focused on conducting an intensive review of our software code to locate potential security vulnerabilities.
As Group Vice President of Platforms, I communicate regularly with microprocessor manufacturers, such as Intel and AMD, concerning a range of issues. We discuss reliability, performance, security, simplicity, new developments in technology, new scenarios we can enable for customers, and many other topics. Among the most important of those issues is security. In fact, Microsoft has been working very closely with Intel and AMD over the last few years to determine methods to improve computer security through a combination of mechanisms in their hardware and our software.
I also communicate regularly with the larger OEMs to discuss a host of issues, including the customer support calls they receive, plans for future versions of Windows, new technology developments, improving customer satisfaction, and how to generate additional consumer demand for personal computers. Building more security into our combined products is something Microsoft discusses with OEMs on a routine basis, both from the standpoint of their providing security mechanisms to their customers and also for them to use in protecting their own businesses.
I also meet on a regular basis with corporate customers to discuss what they would like to see in future versions of Windows and to obtain their feedback on the features of our current client and server operating systems. It is hard to have a discussion with a corporate account (or a government account) where security is not a critical topic. Microsoft itself is the subject of massive (seemingly endless) attacks on our computing network (both Internet sites such as and our internal corporate network). We know through our analysis of these attacks that the hackers responsible are very clever and malicious. Through my interactions with media companies, I am aware that they also feel an acute need to protect their digital content (e.g., music and movies) from misappropriation. Further, many corporate and government accounts have relied, and will continue to rely, on our software to protect their sensitive documents, plans and engineering data.
Viruses are also a serious security concern for Microsofts customers. For example, after the well-publicized Melissa and I Love You viruses, there has been very significant concern among our corporate customers about the threat posed by such viruses to the security of their computing networks. In addition to my own interactions with corporate customers, I receive feedback from the Microsoft sales force about the significance corporate customers attribute to improving computer security. Based on my experience as Group Vice President of Windows, I know that computer security is a critically important issue to computer users in general.
I do a variety of things to keep my finger on the pulse of what Microsofts customers want and need from the products supplied by my group. For example, last Friday I spent time listening in on customer support calls about Windows that customers make to Microsofts technical support lines. By listening to these calls, I learn about features of Windows that may be confusing or difficult for novice computer users. This direct feedback is valuable to me in overseeing the design of future versions of Windows. I also review videos of customers trying to perform basic tasks using Windows operating systems. From these videos, I see first-hand how consumers actually use our products, which features they use and which ones they ignore, which features they find intuitive and which features confuse them, and which features they like and which features they find frustrating.
I do frequent online chats on the Internet where hundreds of users ask me questions about our products. In addition to answering their questions, I ask the chat audience questions about aspects of Microsoft products they like and do not like, things they find confusing, and features they would like us to add. I spend time in Internet newsgroups relating to Microsoft products, especially Windows operating systems. I also personally review feedback from beta testers when new products are under development, and I meet with groups of information technology professionals from corporate accounts (and others) who provide us with direction on new functionality they want to see in our products (or issues they want us to address). All of this information allows me to understand how Windows (and other Microsoft products) are currently being used and how we can build better products for consumers in the future.
Our goal is to make Windows straightforward and simple to use, even for customers with no technical education. Having a great out-of-box experience with a new personal computer is a very important part of meeting that goal. For users with no background in computers, a Windows PC should be as easy to use as a television or a stereo system, but still offer all of the power and functionality of a general purpose computing device. We have made substantial progress in that direction, but we are always trying to improve the experience of using Windows. Making further progress in this area is a central aspect of my job.
I joined Microsoft in 1990. In the almost 12 years that I have worked for Microsoft, I have led the engineering and marketing efforts for a variety of Microsofts operating systems, including Windows XP, Windows 2000, several prior versions of Windows NT, and several versions of the Windows 9x operating system. As a result of this experience, I have in-depth knowledge of the manner in which Microsoft designs, develops and tests its Windows operating systems.
Prior to joining Microsoft, I was the Senior Vice President and Chief Technology Officer of Banyan Systems, Inc., a software company that developed, among other products, a server operating system called Vines. I worked at Banyan for approximately seven years. During that time, Novell was the leading supplier of server operating systems, and Microsoft was a small player in that segment of the software business. I came to Microsoft to take on the challenge of building world-class operating systems that could compete with both Novells NetWare and various flavors of UNIX, including HP-UX from Hewlett-Packard, AIX from IBM and Solaris from Sun Microsystems. It has been a long struggle, but we made great strides with the Windows 2000 Server family in providing the reliability, availability and scalability that corporate customers demand and the rich feature set and ease-of-use that have made Windows desktop operating systems so popular with consumers.
I received a B.S. from the University of Florida in 1973, an M.S. from Stanford University in 1980, and a Ph.D. from the Georgia Institute of Technology in 1983. All of my degrees are in Computer Science.
I have been programming computers since 1 969, when I was in high school. Given my many years of experience in the field, I have a thorough understanding of the various technical issues raised by the non-settling States proposed remedy. Because a large number of those technical issues have been addressed by other Microsoft witnesses, I will only focus on three discrete areas: (i)
the growing importance of security to software in general and to general purpose operating systems in particular, (ii)
the emergence of Web services as a new computing paradigm that promises to transform the way in which we use computers, and (iii)
the distribution potential for Java virtual machines.
Concerns Related to Disclosure of Information About
Security Mechanisms in Windows Operating Systems
A. The Need for Section III.J.1 of the Proposed Consent Decree
Computer security is an extremely important issue to computer users generally, including users of Windows operating systems. These security concerns are shared by individual users as well as by our corporate and government accounts. Because the majority of computers today are connected to corporate intranets and/or to the Internet, the risks are greatly increased that valuable information stored on computers will be stolen and that computers will be subjected to malicious attacks, like any of the well-known recent denial of service attacks and viruses that inflicted large costs on computer users around the world. As I explained previously, Microsoft is taking computer security very seriously. We recently instituted a new program to increase the security of our Windows operating systems and are devoting substantial development resources to the task. We see this as a necessity because customers are demanding greater security in our software products to protect their data, their computing networks and their intellectual property.
In recognition of the great importance of protecting the security of customers computer installations, the API and protocol disclosure requirements of the Proposed Consent Decree are limited in part by Section III.J.1, which I understand has been referred to in this proceeding as the security carve out. Section III.J.1 provides that Microsoft need not disclose (a) portions of APIs or Documentation or portions or layers of Communications Protocols the disclosure of which would compromise the security of a particular installation or group of installations of anti-piracy, anti-virus, software licensing, digital rights management, encryption or authentication systems, including without limitation, keys, authorization tokens or enforcement criteria. Because the functionality described in the security carve out is important to large segments of Microsofts customer base, preventing this functionality from being compromised is in our customers interest.
Contrary to mischaracterizations provided by opponents of the Proposed Consent Decree, Section III.J.1 is not a sweeping exception to the disclosure obligations imposed by Sections III.D and III.E of the Proposed Consent Decree. Rather, the security carve out enables Microsoft to safeguard our customers computer installations without denying competitors information they might want to use to create even higher levels of interoperability between Windows client operating systems and non-Microsoft server operating systems. Section III.J.1 essentially addresses three major security concerns, all of which pose serious problems for both Microsoft and its customers: (i)
viruses; and (iii)
There are many hackers in the world, many of whom are very skilled computer programmers (albeit with malicious motives). These hackers are constantly attempting to break the security of computer networks in general and Windows operating systems in particular. Corporate customers, government agencies and other institutions suffer severe economic and other harm whenever hackers manage to compromise the security of their computing networks. For example, banks and other financial institutions have literally billions of dollars moving through electronic payments networks that are protected from misappropriation by a variety of security mechanisms. If hackers could circumvent those security mechanisms, the current trend toward more electronic banking, with all of its associated benefits, would be endangered.
It is no exaggeration to say that the national security is also implicated by the efforts of hackers to break into computing networks. Computers, including many running Windows operating systems, are used throughout the United States Department of Defense and by the Armed Forces of the United States in Afghanistan and elsewhere. It is obviously important that computers being used in military operations be secure from external attacks and eavesdropping.
Security mechanisms must walk a careful balance between being open for review and being secret to protect specific information.
Many eyes examining the specification of a security protocol or a reference implementation of that protocol will eventually lead to a better protocol, but not on any fixed schedule.
In fact, the MIT implementation of the Kerberos security protocol may be the most extensively reviewed implementation of Kerberos, but there were still fundamental coding errors that warranted an urgent fix to the implementation years after the software code had been made available to the general public.
On the other side of the balance, it is generally a good practice not to disclose specifics of the implementation of a security mechanism.
By analogy, a jewelry store might show off its safe to customers, with thick steel walls and complicated locks.
However, the jewelry store would not post safety inspection schedules, fire alarm tests, or similar information relating to its safe. Such disclosures would provide no benefit to the jewelry store, and these disclosures would increase the risk of someone impersonating a safety inspector or fire marshal robbing the jewelry store. Similarly, the jewelry store would not publish the wiring diagrams for the alarm system protecting the safe.
From a purely academic perspective, I generally agree with Professor Appel that the best security mechanisms are those that are published broadly and subjected to extensive peer review. From a commercial perspective, however, it is necessary to go beyond this (especially with the technology available in todays hardware). Microsoft often uses security mechanisms that have been published and reviewed broadly; Kerberos is an example. In addition, we collaborate on and author new security mechanisms that we make available for review. However, even well-reviewed algorithms or protocols have later been found to have security vulnerabilities, so care needs to be taken even in the use of such protocols or algorithms. In addition, with customers demanding ever more security in Microsoft products, we cannot wait for years of academic review of our new security work. We are innovating in the security area rapidly. As a result, we want to make sure we do not provide hackers any more information than necessary about the security mechanisms in Windows operating systems. Providing such information just makes it a little easier to compromise the security mechanisms in Windows, and the stakes for our customers are too high for Microsoft to take such a risk.
Professor Appels disdain for what he derides as security through obscurity ignores that his preferred method of achieving security solely through the confidentiality of a key was conceived in an environment in which the key and any intermediate computation involving use of that key were assumed to be absolutely confidential.In fact, a well-recognized failing of security mechanisms is not the efficacy of the cryptographic system (safeguarded by the design principle of relying only on a key for security) but instead the manner in which keys are distributed and used.
Using the anti-piracy mechanisms in Windows as an example, the assumption that a key and any intermediate computation involving use of that key will be maintained in absolute confidence is completely unfounded. Widely available tools such as kernel debuggers can be used to examine essentially any software process occurring on a personal computer. As a result, obscuring techniques are used to hide keys, and intermediate computation involving use of those keys, as thoroughly as possible.
That is why software-based
Digital Rights Management (DRM) systems rely heavily on maintaining the secrecy of their implementing technology.
There seem to be three central tenets to Professor Appels approach to computer security: (1)
only unbreakable security mechanisms have any utility, (2)
only publicly disclosed security mechanisms are unbreakable, and (3)
publicly disclosed security mechanisms can solve all security issues. This analysis has intuitive appeal, but it is unrealistic.Although I, like many security experts, would prefer a model where the key and intermediate computation involving use of that key is not protected primarily by obscurity, there is no other practical alternative today without additional hardware support.
While many such obscurity based systems have been hacked, many others have survived for extended periods of time, far longer than would have been possible if obscuring techniques had been made public.
Professor Appel may not think the additional security provided by such obscuring techniques is worth the bother, but most commercial software vendors and their customers seem to disagree.
This is why Microsoft took the position in the October settlement talks that the Proposed Consent Decree should exclude from Sections III.D and III.E the portions of APIs and portions or layers of protocols whose disclosure would compromise the security of an installation or group of installations of Windows operating systems. While we regard that exclusion as important, it is much narrower than critics of the Proposed Consent Decree assert. In fact, because the amount of information covered by the security carve out is quite limited, there is no basis for the assertion that the exclusion will swallow the rule.
I would also like to respond to the testimony of Steven McGeady, formerly of Intel. He mixes two very different types of security together, and by making a mistaken assumption, he reaches a flawed conclusion.
Mr. McGeady lumps authentication and digital rights management together, stating that [f]or any specific use of a security system , an individual user supplies a unique and personal authentication token or key when creating or transmitting a file, or establishing their identity. (McGeady
72 (emphasis added).)
McGeady says is true of typical client-server or peer-to-peer authentication, where one computer is trying to access a resource owned by another computer.
I agree that in such circumstances, in which interoperability is important, open security protocols can be beneficial. That is why Microsoft supports the use of Kerberos for authentication. It is also why we have concluded that none of the protocols used to authenticate Windows clients to Windows servers qualifies for the exemption under Section III.J.1 of the Proposed Consent Decree.
What Mr. McGeady chooses to ignore is a rapidly growing area of computer security involving digital rights management.
As I noted above, DRM systems enable a digital content provider to transmit content like music or movies securely over a network.
In this new arena, the client-server aspect of security is the least interesting; any authentication protocol can be used.
What the digital content provider is worried about is that its content will be redistributed to other parties that have not paid for the right to play/use it. DRM addresses this concern.
In a DRM system, a standard or proprietary algorithm is implemented in an obfuscated way to protect digital content. DVD players utilize just such a mechanism. The format in which data is encoded on a DVD is widely known; however, the algorithms and keys used to decode that data are a tightly-held secret.
Likewise, while the protocol used by the DRM system in Windows could be made available for licensing under Section III.E of the Proposed Consent Decree, the algorithms and keys used to decode information transmitted using that protocol will fall under Section III.J.1 of the Proposed Consent Decree.
Computer viruses are a major problem for users of Microsoft operating systems and software products generally. The incidence of computer viruses has grown dramatically with the rise of the Internet. In the past, viruses were typically spread on floppy disks that got moved from one computer to another. Now that such a high percentage of computers are attached to networks, viruses can be transmitted via email or instant messaging programs or through code that is downloaded from Web sites. Computer viruses can be extremely malicious, destroying data on a users hard drive or, in the most extreme cases, deleting operating system files that are crucial to its operation. In a computer connected to a network, viruses can also steal sensitive or commercially valuable data and transmit that data to competitors, criminals or adversaries. Viruses impose very large economic costs on corporate customers, government agencies and other institutions as well as on individual consumers.
Microsoft has designed its Windows operating systems to provide a certain level of security from the threat of virus attacks that could destroy users data or lead to the misappropriation of such data. These technologies are important because all users want the data stored in their computers to be safe from destruction and theft. For example, well-publicized viruses such as Melissa, I Love You, and FunLove are estimated to have caused hundreds of millions of dollars (or billions by some estimates) in damage to corporate customers around the world. Microsoft cooperates with the Federal Bureau of Investigation and other law enforcement agencies in efforts to identify the source of viruses, and Microsoft works with our customers and vendors of anti-virus software to seek to protect computers from attacks by viruses. After the events of September 11, 2001, concern about computer virus attacks mounted by terrorist organizations has grown more acute.
The more creators of viruses know about how anti-virus mechanisms in Windows operating systems work, the easier it will be to create viruses to disable or destroy those mechanisms. We encourage customers to use third-party anti-virus software to increase the anti-virus protections provided by Windows itself, but those protections remain an important first line of defense against virus attacks. The standard Windows security model allows the owner, sometimes termed the administrator, of a computer to create, change, or delete any file.
For Windows 2000 and Windows XP, we realized that we had to provide an additional level of protection to prevent the deletion of critical components of the operating system.
Starting with Windows 2000, we introduced a technology called Windows File Protection (WFP).
With WFP, even an administrator cannot easily tamper with the files that comprise the operating system.
Thus, even if a virus that modifies or deletes operating system files is inadvertently run by the administrator, the operating system files will not be destroyed; WFP will restore a damaged file from a copy stored in a memory cache.
Although there are still ways to circumvent WFP, the need to do so increases the complexity of the virus and, by extension, limits the number of people capable of creating such a virus.
To this end, we have determined that the disclosure of certain APIs related to WFP would greatly reduce the protection offered by WFP. As a result, we believe those APIs would fall under the exemption of Section III.J.1 even if they were otherwise required to be disclosed under Section III.D.
Microsoft has developed and is continuing to develop anti-piracy technology. The goal of our work is to protect a copyright holders intellectual property. We are working on this technology for third parties that want to protect their digital content ( e.g. music, videos, etc.) and for Microsoft itself to protect its own software from unauthorized use. Ensuring that digital content is protected against piracy is critical to enable personal computers to continue to evolve as tools that consumers can use to acquire, organize and play/use digital content. This promises to make personal computers more interesting and fun to use as well as more secure.
Software piracy is rampant throughout the world. In recent years, massive numbers of counterfeit copies of Windows operating systems have been produced and sold worldwide. Piracy of Windows operating systems is a big business in various parts of the world, and Microsoft has worked with law enforcement agencies to break up entire criminal enterprises that use sophisticated techniques to evade the anti-piracy mechanisms associated with Windows operating systems. Although the extent of the losses is difficult to measure with certainty, we estimate that the software industry loses tens of billions of dollars per year in revenues as a result of software piracy. It is again a matter of common sense that the more software pirates know about how the anti-piracy mechanisms in Windows operating systems work, the easier it will be for those software pirates to steal from Microsoft. Moreover, when ways to exploit Microsofts anti-piracy mechanisms are discovered, that information spreads quickly through postings on the Web that are viewed by potentially thousands of people. Such rapid dissemination of information on a global basis permits greater numbers of people to use Microsofts software without paying for it.
Software piracy is not limited to mass counterfeiting rings, however. Piracy also includes casual copying, or the installation of a single copy of a Windows operating system product on more than one computer. For example, assume that a customer purchases a copy of Windows XP at retail and installs it on her computer. If that customer then lends the CD-ROM containing Windows XP to a neighbor, and the neighbor then installs Windows XP on her computer, the second installation of Windows XP on the neighbors computer is unauthorized and generates no revenue to Microsoft. Microsoft prices its software based on its use on a single computer, and thus installing a single copy of Windows on multiple computers is not permitted under our license agreements. Such casual copying, which many consumers do not recognize as the misappropriation of Microsofts intellectual property, accounts for a portion of our losses to piracy. Like shoplifting in retail stores, casual copying of software can result in higher prices to paying customers if it is allowed to go unchecked.
To combat casual copying of Windows, Microsoft included in Windows XP an anti-piracy technology called Windows Product Activation (WPA). WPA is designed to verify that the copy of Windows XP being installed on a computer has been legitimately licensed from Microsoft. Microsoft sends the customer a confirmation ID that is then used to activate Windows XP.
If Microsoft were required to disclose unselectively the technology used to implement WPA, it would be easier be to make multiple unauthorized copies of Windows XP. Preserving the integrity of WPA as an anti-piracy mechanism protects Microsofts licensing revenues. Although Microsoft explains many aspects of WPA on its Web site, see , we do not disclose the actual mechanism used to accomplish that activation because that would better enable unscrupulous people to evade WPA entirely. Under the non-settling States proposed remedy, it is possible that Microsoft would be required to disclose the way WPA works under Section 4 given the breadth of the definition of Microsoft Middleware Products to which the disclosure obligation would apply.
The second form of piracy that is a major concern to Microsoft is the unauthorized copying of digital content ( e.g. , songs on CD or movies on DVD) that is copyrighted by third parties, such as record companies or movie studios. Web systems such as BearShare and Morpheus enable end users to exchange songs, music videos, and other digital content over the Internet without necessarily paying any royalties to the record companies or movie studios who own the copyrights to that content. Owners of such digital content are anxious to prevent their intellectual property from being misappropriated in this manner, and their willingness to distribute their content over the Internet for use on personal computers is affected by the strength of the safeguards that operating systems such as Windows can provide to prevent misappropriation of such content. This is why Microsoft added digital rights management software to Windows XP (as explained earlier) to prevent the misappropriation of digital content by persons who have not paid for the right to play or display such content.
If Microsoft were required to disclose all of the APIs and technical information relating to the digital rights management software in Windows XP, as the non-settling States seem to suggest, then it would be much easier to misappropriate copyrighted content being played or displayed on personal computers running Windows XP. That would injure content owners that rely on the digital rights management software in the operating system to protect their valuable intellectual property. Congress appears to recognize the potential benefits of maintaining the confidentiality of such security mechanisms by prohibiting certain reverse engineering practices under the Digital Millennium Copyright Act, although it would appear that Professor Appel thinks the Act is unconstitutional ( see Trial Tr. at 3206-07).
B. Security Concerns with the Non-settling States Proposed Remedy
Section 4 of the non-settling States proposed remedy contains no exceptions for disclosure of APIs or other technical information relating to anti-piracy, anti-virus, software licensing, digital rights management or security. For all of the reasons discussed above, I believe that the disclosures mandated by Section 4 would make it easier for hackers to break into computer networks, for malicious individuals or organizations to spread destructive computer viruses, and for unethical people to pirate both Windows operating systems and a broad range of third-party digital content.
III. Microsofts .NET Platform for Web Services
I understand that Jonathan Schwartz of Sun Microsystems has testified in this proceeding on the general subject of Web services. I have reviewed his testimony and want to respond to a number of assertions he made that are incorrect and, in some cases, directly contradict Suns own public statements. ( See DX
In general, Mr. Schwartzs definition of Web services is inconsistent with the definition currently used by others in the computer industry, even others within Sun Microsystems. In particular, defining a Web service as any service delivered across the Web (Schwartz
25)including the downloading and viewing of static text from a Web pageis mistaken. Web services are something new, having emerged over approximately the last four years. There are probably as many definitions of Web services as there are companies building them, but almost all definitions have these things in common:
Web services expose useful functionality from one computer to another through a standard Web-based protocol, typically the Simple Object Access Protocol (SOAP).
Web services make no assumption that the messages sent from one computer to another will be displayed to users, and can exist completely independently of Web browsing software.
Web services are defined by the messages they send and receive, not by the platform on which the software program that provides the Web service is running or the programming language that software program is running.
Web services provide a way to describe their interfaces in enough detail to allow a programmer to build a client application that can talk to them. This description is usually provided in an eXtensible Markup Language (XML) format called a Web Services Description Language (WSDL) document.
Web services may be registered so that other software programs that want to use a particular type of Web service can find it, typically using Universal Discovery Description and Integration (UDDI).
By using Web services built on XML, SOAP, WSDL and UDDI, software programs not only can share data, but also can invoke functionality supplied by one another without regard to how they were built or the operating system on which they are running. For example, a shopping Web site might elect to use the credit card authorization Web service provided by a third-party provider rather than investing the time and effort required to create and run such a service on its own. Moreover, Web services share some of the key characteristics that made the Web itself so successful: (i)
they are simple enough for large numbers of developers to learn how to create; (ii)
they rely on industry standards so that any developer can implement them; and (iii)
they already enjoy broad (and growing) support in the industry.
Web services represent fundamental building blocks in the move to distributed computing on the Internet. In fact, the very essence of what the industry is doing with Web services is to create a distributed computing environment beyond the limitations of viewing static Web pages. That is what we mean at Microsoft when we describe the new .NET initiative as an emerging platform for Web services. In contrast, when Mr. Schwartz claims that Web browsing software is a lynchpin of Web services ( see Schwartz
50-51), he is using the term Web services to refer to anything one might do on the Internet. That obscures the fact that many real Web services will involve no user interaction whatsoever. For example, the Web services model permits an automobile manufacturers computer system to communicate via the Internet with a piston suppliers computer to place new orders without any human intervention. There is no Web browsing software involved at all.
Many Web services need not be accessed via Web browsing software because they can be accessed directly by other software programs. And many Web services will not be accessed by consumers at all. As a result, Web browsing software will play no role in the creation, delivery or use of many Web services. It is therefore incorrect for Mr. Schwartz to assert that the Internet Explorer components of Windows operating systems allow Microsoft to control the gateway to Web services. (Schwartz
101.) There is no gateway to Web services in general, and Microsoft certainly has no control over access to all of the Web services that we see being developed. In fact, that is the beauty of the Web services model: software programs running on different operating systems on different hardware can all interoperate with one another as long as they adhere to industry standards like SOAP and WSDL.
Mr. Schwartzs statements are also misleading in a broader sense. To the extent that Web browsing software could serve as a gateway (Schwartz
51) for some users of some Web services, what really matters is that such Web browsing software supports basic standards underlying Web services. Accordingly, the Web browsing software used to provide a user interface to Web services that are accessible to users need not be the Internet Explorer components of Windows, although we will continue to work to make Windows a first-class platform for both developing and using Web services. But our work to improve Internet Explorer and other components of Windows to increase their support for XML and other Web service protocols does not prevent Netscape Navigator or other Web browsing software from doing the same.
Further, Mr. Schwartz describes as critical to Web services two language-centric features: a common programming model and widely distributed platforms for execution. (Schwartz
41.) He later suggests that the programming platform controlled by his company, Java, is particularly well-suited to such use. (Schwartz
52.) But Web services do not depend on having the same programming platform or the same programming model present on the computers that are communicating with one another. Because Web services use platform-neutral protocols and descriptions such as SOAP and WSDL, software programs written in different programming languages and running on different operating systems can communicate with one another just fine. For example, the piston suppliers Web service could be programmed in Java or C# or COBOL and could be running on Solaris or Linux or Windows 2000, and a client of that Web service inside the procurement department of the automobile manufacturer could not tell the difference.
Mr. Schwartzs discussion of Microsofts approach to Web services ignores a fundamental fact: if Web services are to succeed, then the various pieces of Microsofts Web services platformincluding the Internet Explorer components of Windowsmust be built to support XML and other industry standards. We have no intention of altering Internet Explorer so that it can access only Web services developed using Microsoft technology, and it would be antithetical to the goals of our .NET initiative for us to do so.
A. Microsofts .NET Vision
What is commonly referred to as .NET is a series of new Microsoft technologies designed to make it easier to connect disparate information, people, systems, and devices. It enables an unprecedented level of software integration through the use of Web services: small, discrete, building-block applications that connect to each otheras well as to other, larger applicationsvia the Internet or other networks. As I explain below, XML can be thought of as both a companion, and a successor, to HTML, the dominant language for rendering Web pages. XML is a language that permits developers not merely to render information (like HTML does), but to describe and share information in ways that are vital to everything from smoothly processing a commercial transaction over the Internet to ensuring that a new telephone number for an employee is automatically updated in all of the various lists and databases of a major corporation. There are a number of business and technological reasons why Microsoft believes that developing .NET technologies will enable the creation of broadly useful Web services.
.NET is a wide-ranging initiative that encompasses software for building, deploying, operating, integrating, and consuming Web services. Microsoft is investing heavily in .NET because it believes that Web services will make a whole range of intelligent devicesnot just personal computersfar more functional for and appealing to consumers.
At the moment, the Internet is comprised largely of static Web pages that make vast quantities of information available to users but are essentially incapable of interacting directly with one another. Microsoft hopes that Web services will change the fundamental nature of the Internet, making it possible for software code running on different computers to cooperate in performing complex tasks on behalf of different categories of consumers, from large corporate enterprises to individuals.
.NET is based on the fundamental premise that any computer should be able to talk to any other computer, regardless of the operating system or other software running on those two computers and regardless of the programming language in which different software programs are written. Microsoft believes that the broad interoperability made possible by .NET will make software vastly more valuable to home and business users than if software continued to exist as a series of relatively isolated islands of functionality. Thus, at root, the goal of .NET is exactly the opposite of the one Mr. Schwartz posits. We are not trying to force anyone to use Microsoft products; we are instead seeking to make our products more attractive through innovation and by increasing their ability to interoperate with a broad range of existing software code, which can reside on everything from an IBM mainframe to a Palm handheld device.
In the past, software programs were often written to run on a single type of device, such as a personal computer running Windows or Apples Mac OS. Given the broad connectivity now provided by wired and wireless networks, however, software programs increasingly seek to take advantage of multiple computing resourceswithout regard to whether those resources are found on personal computers, servers, personal digital assistants or cell phones. The interactions among these devices and their ability to access and act upon information at any time and from any place are increasingly important to both business and home users. In my experience, consumers are annoyed by the fact that their cell phone cannot interoperate with their personal computer, requiring them manually to reenter all of their telephone numbers into a new cell phone even though those numbers are already stored in the address book of an email program on the users personal computer.
For business users in particular, it is important to be able to integrate data that reside on multiple devices. While most business users have solutions that address the need for interoperability in the context of client-server computing, the world of Web services will allow orchestration of collections of computer systems allowing greater efficiency. This application level interoperability is very important to customers trying to tie together different kinds of software programs in their computing networks, many of which are legacy products or were custom-built to run the customers business. Web services provide one means by which disparate blocks of software code running on different computers can, over the Internet or an internal corporate network, work together and share data. Using Web services, the sort of orchestration I am talking about can occur between far flung organizations across computing systems owned and operated by different entities.
.NET is Microsofts effort to build a software infrastructure that will make it easier for developers to create Web services that provide customers with such integrated solutions. The ability to work together and share data will extend not just to computers that run Microsoft operating systems, but to all computers that support XML and related industry standards. Because our vision depends on industry standards, we are cooperating with a range of industry partners like Hewlett-Packard and IBM, and key parts of our technology have already been contributed to recognized standard-setting bodies like the European Computer Manufacturers Association.
B. How .NET Works
At the core of Microsofts .NET vision is XML. A deceptively simple format for describing data, XML is revolutionizing the way computers talk to one another. In contrast to HTML, which provides a picture of data in a particular layout, XML organizes data in a computer-friendly manner. With HTML, if another application wants to make use of information displayed on a Web page, it must scrape the data based on its understanding of where on the Web page the data appear. This is a very fragile mechanism; if the layout of the Web page changes, the data being scraped will no longer be the data that the application needs. With XML, information can be organized in accordance with a self-describing schema, for example, an insurance claim form with fields for the name of the policyholder, the policy number, the date of loss, etc. No matter how the appearance of the claim form changes on the users screen, if the data in the form are represented in XML, another software program could access the information in particular fields that it needs.
With HTML, data can be viewed using Web browsing software, but there is no defined and dependable way for applications to make use of the data. With XML, data can be transformed and annotated in ways that other software programs can easily understand. This interactive nature of XML makes it possible to customize information for different devicesin contrast to HTML, which is essentially read-only and is transmitted in the same form to different devices. XML is a language broadly used and supported in the industry, and to my knowledge, all companies seeking to develop Web services platforms (including Sun) make extensive use of XML.
Additional industry standards supported by Microsoft are also important for Web services. These include SOAP, WSDL and UDDI, which collectively round out the underpinnings for .NET. Microsoft has been a major contributor to all of these technologies and has actively promoted the adoption of SOAP and WSDL as standards by the World Wide Web Consortium (W3C). In addition, Microsoft is a leading supporter of the consortium of software companies that support UDDI.
SOAP provides a mechanism for applications to exchange structured information between computing devices in a decentralized environment using XML. SOAP is much more flexible than traditional remote invocation mechanisms like the Distributed Component Object Model for COM objects, the Internet Inter-ORB Protocol for CORBA objects or RMI for Java objects. In the past, different vendors have supported or implemented different technologies (including the three just mentioned) for facilitating the interaction between different applications. Microsoft believes that SOAP represents an improvement over these existing technologies because it is (i)
neutral as to programming models, (ii)
able to support asynchronous communications, (iii)
extensible via XML, (iv)
self describing, and (v)
designed for flexible content-based processing. As a result, Microsoft has worked hard not only to implement SOAP in Microsoft products, but also to promote its adoption as an industry standard and its use by a wide variety of software vendors.
WSDL provides a standard way for Web services to document the SOAP messages they accept and generate. It can be thought of as the piece of a Web services platform that keeps track of SOAP messages. Other blocks of software code need the information supplied by WSDL so that they know how to interact with a Web service. WSDL has been submitted to the W3C so that it can be broadly adopted by the industry. Using SOAP and WSDL, software programs running on a wide variety of devices and platforms can interact with Web services developed on the .NET platform.
UDDI is designed to facilitate the discovery of various Web services in a way that is independent of the particular platform providing those services. You can think of UDDI as something akin to the Yellow Pages for Web services. UDDI, which seeks to solve a variety of challenges in conducting business transactions over the Internet, is an ongoing development project that involves companies like IBM, Oracle and Sun Microsystems, in addition to Microsoft.
Beyond the technological advances they represent, there are also important business implications of Microsofts support for XML, SOAP and the like. Mr. Schwartz appears to recognize these implications only partially. Technologies like SOAP and WSDL allow Web services to be accessed across the Internet for consumption by a wide variety of software programs on many different computing devices. As Mr. Schwartz appears to acknowledge, this breadth permits developers to offer their products to a much larger audience of potential customers. ( See Schwartz
29-32.) What Mr. Schwartz ignores, however, is that the use of technologies like XML and SOAP will also give consumers a broad array of choices among Web services. That is, far from forcing consumers to use Microsofts implementation of Web services, Microsofts promotion of industry standards like SOAP and WSDL is actually enabling Microsofts competitors to deliver more Web services choices, not fewer to consumers. Microsoft fully expects that a large number of software companies will go into the business of providing all sorts of Web services to business and home users. And we expect that the benefits arising from Web services will drive demand for our software generally, as well as for products supplied by a wide range of other companies.
It is an undeniable fact that Web services can be implemented on any platform that provides support for XML, SOAP and related industry standards. For example, there are already dozens of implementations of SOAP. .NET is Microsofts effort to establish a first-class Web services platform, and Microsoft is working very hard to convince a wide variety of partners and customers to embrace its .NET vision. But Microsofts efforts in that regard do not impair the ability of other companies to create their own Web services platforms, and they are doing just thatincluding IBM with its Websphere platform and Sun Microsystems with its SunONE platform. We are at the early phases of this technology area, and there is much more innovation required to make the dream come true. The opportunities are abundant.
Each of the standards essential to the .NET platform is available to the industry at large. Microsoft does not own those standards or control their development. The general concept of a Web services platform is certainly less proprietary than Suns Java technology, which Sun Microsystems has never turned over to an established industry standard-setting body.
There is no doubt, as Mr. Schwartz repeatedly states (Schwartz
57, 75, 123), that Microsofts .NET initiative and Suns Java platform represent competing visions of the best way to develop and deliver distributed business applications. Our approach is fundamentally different than Suns. Sun Microsystems sees Java runtimes running on every computing platform, from Java 2 Enterprise Edition implementations running on servers, to Java 2 Standard Edition implementations running on desktop computers, to Java 2 Micro Edition implementations running on non-PC devices like cell phones, all communicating with each other using Remote Methods Invocation (RMI), a proprietary Java protocol. In contrast, Microsoft sees Web services as software code running on a wide range of computing platforms nativelywith no need for any common runtime installedcommunicating with each other using industry standards like XML and SOAP.
The design and the purpose of .NET is to create a platform that can make Web services available to customers running all manner of devices (not merely PCs); running all manner of operating systems (whether or not those operating systems run on PCs or were developed by Microsoft); and providing all manner of applications (again, whether or not those applications are developed by Microsoft or run on Windows). Keeping .NET closed or rigging it to favor Microsoft (in the hypothetical ways that Mr. Schwartz suggests) would defeat the purpose of .NET, and customers would not accept our solution. That is especially true given that IBM and other companies are pursuing their own visions of Web services platforms.
C. The Relationship Between .NET and Java
As I noted earlier, Microsofts .NET initiative and Sun Microsystems Java technology are not perfect equivalents of one another, certainly not in the oversimplified sense implied by Mr.
Schwartz. ( See Schwartz
57, 75, 123.) The interoperability made possible by Microsofts vision for Web services stands in stark contrast to the Java platform. Sun Microsystems seeks to impose homogeneity through the installation of a proprietary runtime, called a Java virtual machine (JVM), on all computers. Web services in the sense envisioned by Microsoft with .NET allow integration of different software programs through an XML-based contract that does not require installation of a common runtime like a JVM on all computers.
Microsofts .NET Framework is one element of Microsofts .NET initiative. The .NET Framework is a new foundation for building software, including Web services, that will run on Windows today. The .NET Framework is a major improvement over the Java platform in a number of ways.
First, unlike Java, .NET was architected from the ground up around XML and Web services. The concept of universal data interchange using XML is deeply embedded in the fabric of both the .NET Framework and Visual Studio .NET. Visual Studio.NET is a set of tools that software developers can use to write software programs that will run with Microsofts .NET Framework. As a result, software code written using these Microsoft technologies can be exposed as Web services with practically no effort. In contrast, neither XML nor Web services existed at the time Java was created. Although Java is being upgraded to support XML and Web services, they are a much less integral aspect of the Java platform. When writing Java applications, developers have to understand what portions of the core Java APIs have been superceded by new XML and Web services APIs, and then carefully pick and choose the right APIs for their application. Unlike .NET, Java does not automatically guide developers toward writing software code that can be exposed as Web services.
Second, interoperability is a key differentiator between our work on.NET and the Java platform. Microsoft has invested substantial time and resources in providing great interoperability between .NET and older technologies, allowing our customers to leverage their existing stock of applications.
In contrast, Suns strategy of promoting creation of 100% pure Java applications actually discourages interoperability with customers existing applications written in other programming languages.
Third, the .NET Framework supports a number of different programming languages, not just Java. This permits developers to write in the programming language they are most familiar with, and to mix and match code written in different languages as part of the same software program. In contrast, Suns strategy promotes the use of a single programming language, i.e., Java.
Fourth, it is our view that the .NET Framework has much better software development tools than the Java platform, permitting a greater number of developers to create applications quickly and easily. In February 2002, Microsoft released Visual Studio .NET. Microsoft spent more than three years and hundreds of millions of dollars developing Visual Studio .NET. We believe that Visual Studio .NET will revolutionize the way software programs are developed, and the new tools are generating very positive feedback from the developer community.
Finally, we believe that the .NET Framework runs software programs faster using fewer system resources than does a JVM. The testimony by Richard Green of Sun Microsystems that Microsofts claims regarding superior performance were fabricated is simply false. ( See Trial Tr. at 283-86.) Using objective testing criteria, Microsoft has shown that the .NET Framework outperforms Suns JVM when running Suns standard Java Pet Store demonstration application. Sun refuses to run standard industry benchmarks that would permit direct comparisons of the relative performance of .NET and Java applications. A discussion of the controversy surrounding the results of our performance tests comparing .NET and Java applications is attached hereto as Defendants Exhibit 1612.
Microsoft Did Not Destroy Distribution Channels for JVMs.
I understand that Richard Green of Sun Microsystems testified that Microsoft distributed an incompatible version of the Java platform with its Windows operating systems. (Green
103.) This issue was addressed in detail during the liability phase of the trial. The Court of Appeals determined that it was not illegal for Microsoft to develop and distribute our JVM just because it was incompatible with Suns specification. As the Court of Appeals noted, Microsofts JVM does allow applications to run more swiftly and does not itself have any anticompetitive effect. Therefore, we reverse the District Courts imposition of liability for Microsofts development and promotion of its JVM. (253 F.3d at 75.)
Mr. Green also asserts that Microsoft breached its license agreement with Sun by distributing its incompatible Java runtime and tools. (Green
100; see also
110.) This assertion was the focus of contract claims asserted in a case that Sun brought against Microsoft in 1997. Microsoft and Sun agreed to settle that case before trial, so neither the court nor a jury ever made a final determination of the merits of those claims. The settlement, however, did provide Microsoft with a limited license to continue distribution of its existing JVM.
Mr. Green also testified that Microsoft has either destroyed or shut down all of the most efficient and effective desktop distribution channels for the Java platform. Its exclusion of the JRE from Windows XP could be the final nail in the coffin. (Green
107; see also
102.) (For clarity, I note that JREshort for Java runtime environmentis often used interchangeably with JVM.) Somewhat inconsistent with this statement, however, is Mr. Greens acknowledgement that some OEMs have decided to independently install a copy of the Microsoft VM on the PCs that they make and sell. (Green
Microsofts decision not to make its JVM part of the default installation of Windows XP is the subject of a lawsuit that Sun filed against Microsoft on March 8, 2002 in Federal District Court in the Northern District of California, San Jose Division, captioned Sun Microsystems, Inc. v. Microsoft Corporation , Civil Action No. C02‑01150 PVT. It is my understanding that the complaint in that case is in evidence as Defendants Exhibit 1032. Among other things, Sun is seeking a preliminary injunction in this new case requiring Microsoft to distribute Suns JVM with every copy of Windows and every copy of Internet Explorer. ( See DX 1033.) Because that litigation is ongoing, I will respond only to Mr.
Greens assertion that Microsoft destroyed or shut down all of the most efficient and effective desktop distribution channels for the JVM. That is not true.
As an initial matter, Mr. Green discounts the ability of users to download a JVM from the Internet. (Green
104.) He implies that it would take 15 minutes to an hour for a user to download a JVM before every usage of a Java program. The reality is that a user would experience that delay only once because after the JVM is installed on a PC, it is available for use with any Java program. Moreover, it is fairly common today to have software programs of the same general size as a JVM downloaded in huge numbers. For example, the Adobe Acrobat reader which has been downloaded by millions of consumers is over 8 megabytes of software code. The delay discussed by Mr. Green represents a very pessimistic scenario of a customer with a low-speed dialup connection to the Internet. Most business users and growing numbers of consumers have broadband Internet connections that would permit a JVM to be downloaded in a matter of seconds.
Another point to consider is that software programs (whether installed by an OEM or downloaded by the user from the Internet) often have to be updated by downloading a new version from the Internet. For example, Microsoft has already addressed one security issue for its JVM this year by providing a new version that can be downloaded from the Windows Update Web site. Providing such updates is pragmatically unavoidable and is standard practice on the Internet. Depending on the type of update required, it may be necessary for the user to download the entire software program again, and that is often the case. So downloading is not only a viable option for initial distribution of software products, it is a necessary mechanism for providing up-to-date technology to consumers.
Mr. Green argues that it is not feasible for Sun to depend on OEMs to distribute its JVM to consumers. (Green
105.) I have a number of issues with this contention. Mr.
Green claims that it would be prohibitively expensive and ultimately futile for Sun to contact each OEM individually. Microsoft distributes approximately 80% of Windows operating systems through roughly 20 OEMs, and, as Mr. Green concedes, the top few OEMs account for a large majority of new PCs sold. A company with Suns resources could readily contact 20 OEMs. This is especially true if Mr. Green is correct that there is consumer demand for having a JVM preinstalled on new computers. (Green
Green also contradicts himself when he notes that various OEMs are preinstalling Microsofts JVM on their new computers. (Green
109.) If they are willing to do that, then presumably they would be willing to preinstall Suns JVM instead of or in addition to Microsofts JVM. In short, if Mr.
Green is correct that consumers would like to have a JVM on their new computers, then Sun should have no difficulty persuading OEMs to meet that demand.
Microsoft itself has taken several steps to make its own JVM readily available as part of Windows XP. First , although Microsoft does not require OEMs to install the JVM when they preinstall Windows XP on new machines, Microsoft provides the JVM to OEMs with Windows XP and has authorized them to preinstall the JVM at their option . A copy of the form of letter Microsoft sent to OEMs in July 2001 is attached as Defendants Exhibit 1637. Based on information available to Microsoft, almost all leading OEMsincluding Compaq, Dell, Gateway, Hewlett-Packard, IBM, NEC, Sony and Toshibaare exercising the option to preinstall our JVM. This means that most purchasers of new computers with Windows XP will have a preinstalled JVM available for their use. Second , users who upgrade to Windows XP from prior versions of Windows that contained a JVM can continue to use their existing JVM (whether from Microsoft or another vendor) because that JVM will not be deleted during the upgrade installation of Windows XP. Third , users who purchase a new personal computer with Windows XP on which a JVM has not been installed yet, or users who perform a clean installation of Windows XP on an older machine, will be offered the option of seamlessly and automatically downloading Microsofts JVM the first time they view a Web page that contains a Java applet. This install-on-demand capability is used for other features in Windows XP. Of course, as I noted before, once Microsofts JVM has been downloaded, it is installed as part of Windows and remains available for future use. Fourth , Windows XP users who elect not to download Microsofts JVM automatically can download that JVM from Microsofts Web site at any time. ( See DX 1606.) Ironically, Sun is demanding in its new lawsuit that Microsoft stop making its JVM available as part of Windows XP in the ways I have described.
In addition to Microsofts continued distribution of JVMs, vendors such as Sun and IBM make JVMs available for use with Windows, including making those JVMs available for downloading from the Internet. ( See DX 1607.) Of course, as I have mentioned, Sun or other JVM developers are free to seek agreements with OEMs to preinstall their JVMs instead of or in addition to the Microsoft JVM on new personal computers containing Windows XP.
In short, if consumers want to use Microsofts JVM or a JVM supplied by Sun or other vendors on Windows XP, there are many JVMs available to them to choose from, and many (if not all) of those JVMs are available free of charge.
I declare under penalty of perjury that the foregoing is true and correct to the best of my knowledge.
Executed in Redmond, Washington on May 3, 2002.