Fear Grows About Software Security 	By JOHN SCHWARTZ 

As . . . . . . . .     . . . . . . . . . increasingly move their software development tasks . . .  . .     . . . . .     . . .     . . . . . . .     to computer programming companies here and . . . . . ., new concerns are being raised about . . .     . . . . . . . .     . . . .     . . . . . . . . . . . 
Some of these concerns over the practice, . . . . .     . .     . . . . . . . . . . . , are being raised by people . . . .     . .     . . . . . . .     . . . .     . . . . . . . . . - for example, programmers who have seen their livelihoods shift to . . . .     . . . . . . . . .     . . . . . . . . . .     . . . . . . . . . And the companies . . . . . . . . .  outsourcing services argue that they . . . .     . . .     . . . . . . . . .     . . . . . . . . . . .     . .  limit risk. But the question of whether the booming business in exporting high-tech jobs is heightening the risk of theft, . . . . . . . .     . . . . . . . . . . . . . . . . . . from rogue programmers . . .     . . . .     . . . . . . . in discussions at . . .     . . . . .     . . . . . , before . . . . . . . .  and . .     . . . . . . . . . . . 
While operations in some countries, . . . .     . . .     . . . . . .     . . . . . .     . . . . . . .     . .     . . . . . . . , are considered . . . . . . . . .     . . . .  for such software outsourcing, nervousness is beginning to grow at companies and in the government about the possibility of abuse by . . . . . . .     ,  . . . . . . . . .     . . . . .     . . . . . .     . .     . . . . . . . . . . . . . . . . . in nations like Pakistan, the Philippines and Russia. David McCurdy, a . . . . . .     . . . . . . . . . . . . and executive director of the Internet Security Alliance, an industry group, said that although he considered himself a ". . . . . . . . . . . " with a strong belief in . . .     . . . . . . . .     . .     . . . . . .     . . . . . . . . , he believed that the risk from . . . . . . . .     . . . . . . . . . . . . was "the most serious of the industry-based issues that . . . .     . . . . . . . .     . . . . ." 
The issue has been discussed quietly at . . .     . . . . . . .     . . . . . .     . .     . . . . . . . . . . , said Howard Schmidt, vice chairman of the president's critical infrastructure . . . . . . . . .     . . . . . . . At the White House, he said, "this has come up as part of a broader discussion of . . . .     . .     . .     . . . trust and reliability" in computer systems. 
He said, however, that . . .     . . . . . . was . . . . . . . . . . .     . . . . . . , not simply the . . . . . . . .  kind, and cited spies . . . .  Aldrich H. Ames and Robert Hanssen as examples of how . . . . . . . . .  could do just as much damage to the nation . . . .     . . . . . . . as outsiders could. It is easy to see why companies find the economics of outsourcing compelling ; . . . .     . . . . . . . . can be 25 to 40 percent. Forrester Research of Cambridge, Mass., predicted . .     .     . . . . . .     . . . . . . . that the acceleration in outsourcing would result in 3.3 million . . . . . . . . .     . . . . . moving . . . . . . . .  by 2015, an exodus reminiscent of the . . . .     . .     . . . . . . . .     . . . .-. . . . . .     . . . . . that moved to East Asia . .     . . .     . . . . . . . Forrester estimates that 70 percent of these jobs . . . .     . . . .     . .     . . . . . , 20 percent to the Philippines and 10 percent to China. 
Offshore outsourcing got its trial run in preparations for the Year 2000 changeover. Much of that work was done overseas, and although industry experts warned that foreign programmers might commit crimes or lay the groundwork for terrorism, no evidence of sabotage was found, said Jay Ehrenreich, senior manager for cybercrime prevention and response at PricewaterhouseCoopers, the consulting firm. After that experience, he said, many companies felt comfortable sending software work overseas. 
Programmers say the confidence is not justified. " Anyone tells you that 'offshoring' computer systems does not put the infrastructure at risk is lying," said Ken O'Neil, a programmer who lives on Long Island. O'Neil and other programmers talk of "sleeper bugs" that could be set to go off at a later date, or back doors that would let intruders in to shuttle money around, steal fractions of a penny from millions of transactions or shutdown the system entirely. They warn of risks from political instability, organized crime and terror cells, and even from governments that might demand the ability to spy. 
Some of the newly expressed concern is part of a long-running and acrimonious fight by programmers to hold on to their jobs in the face of relaxed immigration standards for technical workers and increased outsourcing. They attack the rise in special visas for immigrant engineers, known as H1-B visas, and the trend toward sending jobs overseas. United States technology services companies are also expanding their overseas outsourcing offerings. Electronic Data Systems provides outsourcing services in 93 "solution centers" that it has opened around the world since 1990. Paul D. Clark, the chief information security and privacy executive for the company, said EDS understood that the threat of sabotage in outsourcing is real. That is why the company adheres to security and testing standards wherever code is written, he said. "Whether it's India or Indiana, it doesn't make any difference." 

from The New York Times, Sunday, January 12, 2003

	Fear Grows About Software Security 	By JOHN SCHWARTZ 

As American companies increasingly move their software development tasks out of their own offices to computer programming companies here and abroad, new concerns are being raised about the security risks involved . 
Some of these concerns over the practice, known as outsourcing, are being raised by people with an obvious self-interest - for example, programmers who have seen their livelihoods shift to less expensive operations overseas. And the companies providing outsourcing services argue that they take all necessary precautions to limit risk. But the question of whether the booming business in exporting high-tech jobs is heightening the risk of theft, sabotage or cyberterrorism from rogue programmers has been raised in discussions at the White House, before Congress and in boardrooms. 
While operations in some countries, like the United States, Britain and India, are considered generally safe for such software outsourcing, nervousness is beginning to grow at companies and in the government about the possibility of abuse by hackers, organized crime agents and cyberterrorists in nations like Pakistan, the Philippines and Russia. DavidMcCurdy, a former congressman and executive director of the Internet Security Alliance, an industry group, said that although he considered himself a "free trader" with a strong belief in the benefits of global commerce, he believed that the risk from offshore outsourcing was "the most serious of the industry-based issues that this country faces." 
The issue has been discussed quietly at the highest levels of government, said Howard Schmidt, vice chairman of the president's critical infrastructure protection board. At the White House, he said, "this has come up as part of a broader discussion of how do we get trust and reliability" in computer systems. 
He said, however, that the issue was outsourcing itself, not simply the overseas kind, and cited spies like Aldrich H. Ames and Robert Hanssen as examples of how Americans could do just as much damage to the nation from within as outsiders could. It is easy to see why companies find the economics of outsourcing compelling ; cost savings canbe 25 to 40 percent. Forrester Research of Cambridge, Mass., predicted in a recent report that the acceleration in outsourcing would result in 3.3 million American jobs' moving offshore by 2015, an exodus reminiscent of the tide of American blue-collar jobs that moved to East Asia in the 1980's. Forrester estimates that 70 percent of these jobs will move to India, 20 percent to the Philippines and 10 percent to China. 
Offshore outsourcing got its trial run in preparations for the Year 2000 changeover. Much of that work was done overseas, and although industry experts warned that foreign programmers might commit crimes or lay the groundwork for terrorism, no evidence of sabotage was found, said Jay Ehrenreich, senior manager for cybercrime prevention and response at PricewaterhouseCoopers, the consulting firm. After that experience, he said, many companies felt comfortable sending software work overseas. 
Programmers say the confidence is not justified. " Anyone tells you that 'offshoring' computer systems does not put the infrastructure at risk is lying," said Ken O'Neil, a programmer who lives on Long Island. O'Neil and other programmers talk of "sleeper bugs" that could be set to go off at a later date, or back doors that would let intruders in to shuttle money around, steal fractions of a penny from millions of transactions or shutdown the system entirely. They warn of risks from political instability, organized crime and terror cells, and even from governments that might demand the ability to spy. 
Some of the newly expressed concern is part of a long-running and acrimonious fight by programmers to hold on to their jobs in the face of relaxed immigration standards for technical workers and increased outsourcing. They attack the rise in special visas for immigrant engineers, known as H1-B visas, and the trend toward sending jobs overseas. United States technology services companies are also expanding their overseas outsourcing offerings. Electronic Data Systems provides outsourcing services in 93 "solution centers" that it has opened around the world since 1990. Paul D. Clark, the chief information security and privacy executive for the company, said EDS understood that the threat of sabotage in outsourcing is real. That is why the company adheres to security and testing standards wherever code is written, he said. "Whether it's India or Indiana, it doesn't make any difference." 

from The New York Times, Sunday, January 12, 2003