ie8 fix
Click Here

Googling Google

Christopher Dawson

Google's FISMA certification: A technicality, misunderstanding or outright lie?

By | April 12, 2011, 9:20pm PDT

Summary: A question about Google’s security certification for its Government Apps product - and the response from Google about it - is putting the company under an uncomfortable spotlight.

Google has suddenly found itself in hot water, exposed - by Microsoft, no less - for being a “liar, liar” when it comes to the security certification it has been touting for its Google Apps for Government offering.

After all, the revelation that Google’s product, in fact, was not certified to be compliant under the Federal Information Security Management Act (FISMA) is pretty major. In part, that’s because it’s the Apps suite that was tailor-made for government agencies and security - extra security, actually - was one of its biggest selling points.

Now, before anyone gets into some panic over government data no longer being secure, there’s little concern that Apps for Government isn’t secure or that it won’t eventually get its FISMA certification. Apps for Government, as Google explains it, is a more secure subset of Google Apps Premier, a product that obtained FISMA certification well before Government was announced last summer. With that rationale, it’s no wonder that Google thought it was OK to go around and start touting Apps for Government as being FISMA-certified.

Unfortunately, the truth got in the way.

Google might have been naive about the way the government’s FISMA certification process works and just assumed that since Premier was already certified, then Government must be certified, as well. But as we now know - thanks to Microsoft’s discovery of a court document that tells otherwise - that’s not how the certification process works.

Google says it has not applied for FISMA certification for Apps for Government, but instead is “updating the existing authorization.” At a hearing in Washington earlier today, an official with the General Services Administration said that a product has to be re-certified if it changes - and, in essence, Government is a altered version of Premier. That official said Google’s products are going through a re-certification based on the changes, according to a report on the Business Insider blog.

Google can spin this any way it wants but, at the end of the day, it has been deceptive in marketing Google Apps for Government as being FISMA-certified. Ignorance of the process is no excuse.

Simply said, Google - a company that has spent millions of dollars and countless hours developing this suite of applications specifically for government agencies - shouldn’t be making assumptions about something as significant as FISMA-certification, especially when that’s one of the biggest selling points over the competition. (Microsoft is currently awaiting FISMA-certification for its cloud apps offering, as well.) The only thing Google had to do was ask. Plain and simple.

Instead, Google has done itself a world of harm by making assumptions about government process. It’s not only created a feeling of uncertainty around the security of its product but also created a perception of itself as a company that flirts with the truth for the sake of scoring a government contract. Does it really need to give its critics even more reason to argue that its motives are evil?

Sure, when all is said and done, Google will likely be granted FISMA certification for Apps for Government - but the damage will have already been done. Google says its product is FISMA-certified - but how do we really know? Google needs government agencies to take them on their word - but, for the moment, there’s not much value behind that word.

Maybe we’re splitting hairs here. Maybe this was just a technicality. Maybe it was all a misunderstanding. But as long as Google continues to stick by that lame argument about a certification for Premier also applying to Government, the company won’t be able to shake the “Liar, Liar” image that it now has.

And the longer it waits to take its lumps, the harder it will be to shake that image.

Related:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Sam has been a professional journalist for more than 20 years and has spent the last dozen years covering the tech beat. Today, he is a Silicon Valley-based writing consultant and freelance writer.

Disclosure

Sam Diaz

Sam Diaz has nothing to disclose.

Biography

Sam Diaz

Sam Diaz has been a technology and business blogger, reporter and editor at ZDNet, the Washington Post and San Jose Mercury News and Fresno Bee for more than a dozen years. He is a Silicon Valley-based writing consultant, freelancer and quoted technology expert. For more information about Sam, visit about.me/sam-diaz or www.sam-diaz.com.

48
Comments

Join the conversation!

Just In

RE: Google's FISMA certification: A technicality, misunderstanding or outright lie?
3shao 20th Sep
@Will Farrell thank you for sharing grin chanel replica replica chanel bag fake chanel bags
IF MS considers itself to be so damn ethical, how it it goes back and has another look at its "GetTheFacts" website . . . and then apologises the world for its own lies. And wouldn't it be nice if MS also apologised for telling us all about the "specials and extras" that it would release for Vista Ultimate . . . you know, the ones that never arrived! If Google has lied, deliberately lied, then it should be dealt-with. But let us never forget that MS has a much longer history of lying than Google.
0 Votes
+ -
@ptorning
and just say "sorry" when their caught? That is exactly what you're saying, isn't it?
0 Votes
+ -
It's a start
Mr. Copro Encephalic to You 13th Apr 2011
@Will Farrell
Microsoft, Google, and everyone else should at _least_ fess up and apologize. I have not seen this happen yet with either. I think ptorning's point is the irony of a prolific liar calling another, presumably less prolific, liar out. It's not lost on most of us.

He also states:

"If Google has lied, deliberately lied, then is should be dealt-with."

Which would suggest that apologizing is not enough. So are you posting for posting's sake? If not, I missed the value-add of your post.
@Mr Corpo

Thankyou! You are the only person who understood my use of irony and who seems to have read the very important words, "If Google has lied, deliberately lied, then it should be dealt-with." I thought that those words made my post moron-proof, but from the posts below, it seems that I was wrong.
@Will Farrell thank you for sharing grin chanel replica replica chanel bag fake chanel bags
0 Votes
+ -
@ptorning Are you that lame?
@ptorning

you fail to see that this has nothing to do with what microsoft did in their past. this has everything to do with what google is doing now. they falsely claim they're certified when their not. that should illegal.

and you're trying to defend google? seriously? when clearly they're in the wrong here? there are some sick people in this world.
@blazing_smiley_face

Do you understand basic English. If so, what do you think that these words mean, "If Google has lied, deliberately lied, then it should be dealt-with." They were in my original post, there for anyone to read. The words are simple and basic, but perhaps even simple and basic words are too much for people like you and Mr Dee and others. In no way have I supported Google; not one word. All I did was point-out the irony of MS calling a competitor a liar.
@ptorning
If my competitor is a compulsive liar or a thief, this does not give legitimacy to my lying or theft. So, bringing MS behavior related to the matter is irrelevant and uncalled for... That being said, however, the bloggers' tone, perception, and apparent intent about the "guilt" of Google is blown out of proportion. Yes, as much I understand from the news, Google was technically at fault for assuming the FISMA certification of a product which was much more securer and well past the criteria of FISMA certification on the basis of their previous certification for the Premier Apps. It is foolish to speculate that this is remotely related to being insecure. It is a premature thinking that they would do something like this deliberately despite of putting so much efforts and resources into this. Yes, it may be a mark on their credibility but I don't think that it is an irreparable damage, instead gives them an opportunity to improve on such fronts.
@ashwinipn
"If my competitor is a compulsive liar or a thief, this does not give legitimacy to my lying or theft."

I agree. You might note that my original post includes the line, "If Google has lied, deliberately lied, then it should be dealt-with." I'm not sure how much clearer I can make it!
0 Votes
+ -
Message has been deleted.
mwagner1 Updated - 14th Apr 2011
0 Votes
+ -
Nice to see the appologist up early today
Will Farrell 13th Apr 2011
@mwagner1 (original)
Sounds like Microsoft slander by Goofle.
@mwagner1

if the government who makes the purchasing of the apps will most likely know who is certified from who isn't, correct? therefore, since google apps for goverment is not certified that is why they were left out of the bidding process which is the process google is saying it was unlawfully left out of. Microsoft proved that was a lie and in fact the reason why google was left out is that google doesn't have proper certification.

this whole article sounds like one from one of the BIGGEST google apologist i've seen in many months.
@blazing_smiley_face It's easy to imagine "the government" as a single sentient entity that knows what its right and left hands are doing, but that's not reality. I guarantee that if you were the average bureaucrat in the Department of Redundancy Department and you wanted to find out whether Google Maps meets FISMA, you would spend at least four hours trying to find the office where such knowledge resides, another two hours tracking down the individual who knows, only to discover that they don 't really know. I am not making this up; this is what life is really like inside the Federal Government. It is so big, and has so many moving parts, that even if you know how something works today, it will have changed by tomorrow.

You've probably seen the news stories about how if you call the IRS five times to ask a question, you will get five different answers, and sometimes all five will be wrong. Now imagine you work for Google and you call to find out whether your certification on one product applies to a new version. I'm just sayin'... It could happen.
@Robert Hahn
that I understand, but if u read the OP's post, then you would see what I used that as my opening
The list goes on and on. Buzz. WiFi sniffing. FISMA. Google Books (who thought opt-out was a smart idea? Down right evil and stupid beyond belief).

Google hires some of the smartest engineers out there but they often move too fast without thinking. When you are a small company, you can get away with lots of these things. When you are one of the largest companies on the planet, however, you really need to have oversight of your processes.

What scares me about Page as CEO, he has stated he wants to remove even more oversight. As a share holder, this really scares me.
0 Votes
+ -
@Bruizer
anono 13th Apr 2011
I completely agree. I really like Google as a company, but they can't, as Page put it, behave like a start up because they are no longer a start up. I understand he wants Google to have its innovation edge back but I really think a lot of their products are incomplete and not well thought out in some ways (including legal). They need to narrow their focus on key products.
0 Votes
+ -
So why does the US govt dept buy software WITHOUT FISMA certification in no bid contracts?

That's what they did, that department decided to standardize on Microsoft online office offering, knowing it had no FISMA certification, not any package of it.

Now they're looking for i not dotted and t's not crossed to cover themselves, and it's nice spin, but it's not the full story.
0 Votes
+ -
@guihombre

Simple question. Or just not understanding how certification processes work in general.
@guihombre ... They bought Microsoft online Federal which DOES have FISMA. FISMA is the minimum standard, DOI determined that with ISO 27001, SAS 70 Type II and a host of other processes and procedures, BPOS-F is vastly more secure than Google Apps. Please get your facts straight.
0 Votes
+ -
BPOS Not Compliant either
hoaxoner 13th Apr 2011
@rballard@...
look it up. BPOS-F is not found to be compliant, yet. Both systems, BPOS-F and GA-G are both 'in process'. Face it, the government was unethical. Shocker.
@rballard@... Agreed, but let's not get too hyped up about being ISO certified. Having been through several ISO certifications, in the simplest words, for ISO certification all you do is write down what you actually are currently doing in the most positive way/s you can think of to state it.
If ISO likes the papers, or even reads them, then you're all set. Grammar and proper English skills plus a truthful description of what the processes are for when they come to inspect you are all it takes. ISO certifiation just means you wrote down what you're doing, they came to see if that's how you did it, and if they liked it, along with your prose, you're "in".
I'm not a FISMA expert, but Google Apps for Government is the same product as Google Apps for Business (formerly named Google Apps Premier). I think the restrictions on where the data lives(within the same data center) is the only difference, but I'm pretty sure it is still in the same data centers on infrastructure that originally was FISMA certified- just the infrastructure has been limited to government only data for google apps for government client on certain physical machines. It seems like they just need an update to naming...
@techgirlria From what I've read that apppears to be the case. Its a rose by any other name type of deal. Its the same certified system plus more security. In the end I believe all the flap about Thomas will be ignored.
0 Votes
+ -
government processes
rjs6143@... 13th Apr 2011
"Ignorance of the process is no excuse".. "Instead, Google has done itself a world of harm by making assumptions about government process." This sounds to me like a clear case of Google being targeted by MS over anything. A stupid technicality. GOVT does not follow their own processes I can tell you this from inside experience and we are consistently TRYING to keep up with ever-changing security requirements without any success. So 'following the process is not just plain and simple as it seems'... Google did what anyone would do in a government process try to figure out what the F*K the damn over-complicated process wants from you, then do your best at it.
Let's remind everyone that MS software still has no FISMA, but again, why government rules should apply to them as well?
@kirovs@...
where as Google had to lie about theirs.
It also did what they needed it to, Google's didn't.
@Will Farrell
Oh, my good friend, the MS apologist.
As far as lawyers are concerned- maybe they lied. From technical perspective- they did not.
"It also did what they needed it to, Google's didn't. "
And you know that because you have done comparative evaluation during a bidding process....???
@Will Farrell
no, I was refenceing the earlier story done on it that started the whole thing: They wanted the MS solution as it did what they wanted/needed it to, Google's didn't so they didn't even ask Google to bid it (why invite Bayliner to a cruise ship quote?)
0 Votes
+ -
@Will Farrell
It turns out that Google has been telling the truth after all, and that it is MS that is lying:

http://www.groklaw.net/article.php?story=20110413220154117

http://www.businessinsider.com/dear-microsoft-you-owe-google-an-apology-2011-4
For microsoft, who has done more damage to the internet since it's public inception with it's crappy, insecure, virus ridden operating systems, for microsoft to make any accusations of insecurity based on technicalities is the height of hypocrisy. The only lame argument is from microsoft, as usual.
Never really understood how pointing to someone else's bad behavior excuses yours. I'm not a big fan of either Microsoft or Google but it seems the haters are out as usual. It appears that Google lied - mislead - whatever you want to call it and Microsoft called them out on it. Would it make a difference if some other company exposed it?
0 Votes
+ -
RE: Some other company
Badgered 13th Apr 2011
@Joe Dufflebag Would it make a difference if some other company exposed it?

Well, it might stop the "but THEY'RE worse" comments (depending on which other company we're talking about). But the excuses would still be there.
0 Votes
+ -
Look at it this way
klumper 14th Apr 2011
@Joe Dufflebag
Never really understood how pointing to someone else's bad behavior excuses yours.

They learned from the best. wink Now they're battling to see who can be worse.

Google: Do No Evil We're Sorry -- Again
Google = greed.

Copied or stole IP and source code from other companies and used it for their own monetory gain.

Their regard for privacy is pathetic.

One has to wonder what are they stealing from those androdid phone owners. Google check out, NFC.. dear oh dear....

Looking for shortcuts to quick sucess...Google's place should be in the dustbin
0 Votes
+ -
...
hoaxoner 13th Apr 2011
@owlnet
Get out much?
0 Votes
+ -
Gotcha war continues...
navigator@... Updated - 13th Apr 2011
Well, I read that official blog announcement by Google regarding FISMA certification for Google Apps and the release of Google Apps for Government. If you read it carefully, the Google blog entry only states that Google Apps was granted FISMA certification and that Google Apps for Government was being introduced. Now the casual reader could easily conflate the FISMA certification for Google Apps with FISMA certification for the announcement of Google Apps for Government, but the article does not explicitly make that claim. At worse, Google may have incorrectly assumed that FISMA certification for Google Apps covered their introduction of Google Apps for Government. If not, then Google must submit Google Apps for Government for FISAM certification. Does anybody reasonably think they won't get it? This is just another skirmish in the gotcha war between Google and Microsoft. Last month, I think Google was accusing Microsoft of stealing Google search results and passing them off as their own in Bing. Everyone should take a deep breath and relax.
0 Votes
+ -
just a technicality
Trufagus 13th Apr 2011
It is pretty easy to catch any of these companies in big, outright lies, so I"m surprised we are focusing so much on a lie that is actually just a technicality.

Google's lie was a technicality. It is pretty clear why they consider GApps for Gov's certification to be, at the very least, a foregone conclusion.
Looking at the comments above am having my doubts on how many folks know about software testing. Any changes to the application & the entire app undergoes a series of regression tests before it is certified as for for use. Whether more capabilities have been added or if the modified application is even more stringent etc is a moot question. The testing process must be followed. This is normal software engineering & not rocket science. FISMA follows the same principle, that if you change any part of the code, you need to get it certified again. I refuse to believe that Google is unaware of this process. They knew it & filed it in the court submission accordingly They just acted cute & got caught with their hand in the cookie jar. Doesn't matter if MS brought this to media or if media noticed the court documents, these are just facts.
0 Votes
+ -
FISMA - Process Trumps Logic
TAPhilo 13th Apr 2011
When it comes to anything Government, especially FISMA, what is logical is not what the process is!

Google = Engineers = LOGIC != Government Processes
I've worked in the DoD for 6 years now...ignorance of THAT process is the rule, not the exception. I've worked with information assurance professionals that couldn't explain how something got an accreditation because it was different every time they did it. So mistakenly thinking you have an accreditation is not out of the realm of the possible. I'm not saying they are innocent, only that a strong possibility exists that they just didn't know what they were saying was wrong.
0 Votes
+ -
Google is an evil company run by liars
iPad-awan 13th Apr 2011
and only the idiots will believe otherwise.

Google's engineers are too stupid to compete on merit so they either lie about their crappy product or copy Apple's superior technology. This time, Google got caught trying to deceive the gov't and hardworking taxpayers.
0 Votes
+ -
Subset?
sysop-dr 13th Apr 2011
Since when is a subset of something an alteration? If the government one is truely just a subset of the already certified product then it's certified. That would be like saying Office was certified but if I only use excel then it's not.
Unless there are code changes then it's certified.
0 Votes
+ -
FUD
tkejlboom 13th Apr 2011
Yes, extensive software regression testing is essential every time you make a change. C'est la vie. However, making it necessary to get government re-certification, an entirely different process, for every patch or minor revision would render the government a useless technological backwater. Blackberry does not recertify for every patch or upgrade. Windows has "patch Tuesdays" now, and the government doesn't throw out all their PCs until each patch has gone through federal review. Microsoft, as king of the service pack heap, should definitely have thought twice before going down this road.
0 Votes
+ -
Be Good Google!!!
nktran19@... 13th Apr 2011
It seems to me "Don't be evil" only good for marketing!!!
0 Votes
+ -
google
Altotus 13th Apr 2011
Lost the real estate listings real fast. No announcement. Whats up there?
If Google is evil beyond belief where does this put Microsoft? Evil beyond words?
0 Votes
+ -
Microsoft / Google bashing
lesterbauman 14th Apr 2011
Grow up guys. It used to be the in thing to bash Microsoft. Now it's popular to bash Google. Neither are perfect and both can be arrogant at times. But throwing mud has never solved anything. All it does is make the mudslinger dirty. Think MS or Google really care what we think?

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix