Microsoft Accuses Google Of Lying About Security Certifications

Google insists it hasn't mislead anyone about the security certification of Google Apps For Government.
Top 15 Google Apps For Business
Slideshow: Top 15 Google Apps For Business
(click image for larger view and for full slideshow)
Google's lawsuit against the Department of the Interior over a $59 million hosted email and collaboration contract that allegedly favored Microsoft took an unexpected turn on Monday when Microsoft charged Google with making false statements about its services.

In a blog post, David Howard, corporate VP and deputy general counsel at Microsoft, chided Google for misstating the certification status of Google Apps for Government, citing recently posted government legal filings.

"It's time for Google to stop telling governments something that is not true," Howard wrote.

The court documents, he said, state that while the GSA has granted FISMA certification to Google Apps Premiere (since renamed Google Apps For Business), the GSA has not granted certification for Google Apps for Government.

"On December 16, 2010, counsel for the Government learned that, notwithstanding Google's representations to the public at large, its counsel, the GAO, and this Court, it appears that Google's Google Apps for Government does not have FISMA certification," the government's motion says in a footnote on page 13.

Google's website presently states the contrary: "Google Apps for Government, now with FISMA certification." And Google makes similar claims in other documents.

Google responded by saying that the judge's decision to grant an injunction in January blocking the contract is what's important here. The company said the distinction between Google Apps For Business and Google Apps For Government is not meaningful in terms of security controls. And as for the inconsistent documentation, that's being fixed.

"This case is about the Department of Interior limiting its proposal to one product that isn't even FISMA certified, so this question is unrelated to our request that DOI allow for a true competition when selecting its technology providers," said David Mihalchik, business development executive for Google Enterprise, in an emailed statement. "Even so, we did not mislead the court or our customers. Google Apps received a FISMA security authorization from the General Services Administration in July 2010. Google Apps for Government is the same system with enhanced security controls that go beyond FISMA requirements. As planned we're working with GSA to continuously update our documentation with these and other additional enhancements."

Google filed its lawsuit because it claims the Department of the Interior's Request for Quotations (RFQ) "specified that only the Microsoft Business Productivity Online Suite-Federal (BPOS-Federal) could be proposed."

No-bid contracts are allowed under certain conditions. However, Google's lawsuit claims that the Department of the Interior's Limited Source Justification directive is not lawful. The judge's decision to grant a preliminary injunction to halt the contract suggests that Google's claim has at least some merit.

Google raised similar objections, albeit informally, when the State of California last year chose Microsoft BPOS as its new hosted email service.