Skip to main content

Microsoft gets a $927 million holiday present from the U.S. Department of Defense

Microsoft's holiday present from defense department doesn't include source code

vulnerable pentagon servers the united states department of defense
Image used with permission by copyright holder
A number of things came together for Microsoft in 2016. The Windows 10 Anniversary Edition was released, the number of users switching to Windows 10 exceeded 400 million, Surface made money and headlines, and the company managed its transition from Windows maker to “cloud-first, mobile-first” productivity company while retaining profitability.

Large organizations seem to agree that Microsoft is doing some good things, as a number of them are making significant investments in the company’s products and services. One such organization is the U.S. Department of Defense, which announced that it’s just signed a deal with Microsoft for $927 million worth of services and support over the next five years.

This isn’t your typical technical support and software maintenance contract. Rather, it’s an Enterprise Technical Support Services contract that provides a host of Microsoft services. All of Microsoft’s premier support resources such as tools, knowledge bases, and problem-solving assistance from Microsoft product developers. The agreement itself caused a minor controversy as it implied that access to Microsoft source code was part of the deal.

The specific terms of the source code access are described in the agreement as follows: ” These services require access rights to Microsoft’s proprietary (closed-source) code, which is licensed under exclusive legal right of Microsoft, and are required to support the Department of Defense’s mission.” The assumption was that source code access was an important aspect of the agreement between Microsoft and the DoD’s Defense Information Systems Agency (DISA).

However, Microsoft and DISA reached out to us to clarify that the announcement was incorrect regarding the DoD’s access to Microsoft’s code. A DISA spokesperson issued a statement, saying, “The Department of Defense does not, and will not, have access to Microsoft’s proprietary source codes. The METSS-II contract is a sole-source follow-on contract to continue and leverage Microsoft support services.” And so, the $927 million is for service and support and not access to Microsoft source code.

Under the agreement, the DoD will receive Microsoft’s “Blue Badge Cardholder” support, meaning that the government agency will receive direct support from actual Microsoft employees who carry blue badges, not contractors. According to the agreement, the DISA was clearly interested in going directly to Microsoft, as the agreement was the result of a “noncompetitive, firm-fixed price, single award” process.

Microsoft has significant dealings with the U.S. government, including the DoD in general, and so it’s no surprise to see a contract of this magnitude. Nevertheless, we’re sure that the $927 million agreement is a nice holiday present for the company as it closes out a very successful 2016.

Article originally published in December 2016. Updated on 12-22-2016 by Mark Coppock: Clarified that Microsoft’s agreement with DISA does not provide access to Microsoft’s proprietary source code.

Mark Coppock
Mark has been a geek since MS-DOS gave way to Windows and the PalmPilot was a thing. He’s translated his love for…
A dangerous new jailbreak for AI chatbots was just discovered
the side of a Microsoft building

Microsoft has released more details about a troubling new generative AI jailbreak technique it has discovered, called "Skeleton Key." Using this prompt injection method, malicious users can effectively bypass a chatbot's safety guardrails, the security features that keeps ChatGPT from going full Taye.

Skeleton Key is an example of a prompt injection or prompt engineering attack. It's a multi-turn strategy designed to essentially convince an AI model to ignore its ingrained safety guardrails, "[causing] the system to violate its operators’ policies, make decisions unduly influenced by a user, or execute malicious instructions," Mark Russinovich, CTO of Microsoft Azure, wrote in the announcement.

Read more