The 2009 Microsoft-EU agreement puts Windows security at risk: here's why

In a recent Wall Street Journal report, a Microsoft representative made a significant statement regarding Windows security, in the aftermath of the chaos caused by the CrowdStrike update. The spokesperson attributes the ease with which bad actors can compromise Windows security to a 2009 agreement between Microsoft and the European Commission. This settlement arose from a complaint and forced Microsoft to grant third-party security software makers the same level of access to the operating system as its applications.

Consequences of equal access to APIs

According to the spokesperson, this equal access implemented to encourage greater competition in the market has produced negative outcomes in terms of safety. A recent example is the incident with CrowdStrike, whose update caused crashes on 8.5 million Windows PCs globally, resulting in inconvenience and economic losses. The agreement stipulated with the European Commission requires Microsoft to make the APIs used in their security products accessible also to third-party software, thus increasing the risk of vulnerability to cyber attacks.

Differences in security management between Microsoft, Apple and Google

While Microsoft must comply with European directives that promote competition even at the expense of security, Apple and Google follow a different path. Apple, with macOS, further limited access to the kernel in 2020, improving the overall security of the operating system although this requires developers to modify their software. Similarly, Google with ChromeOS does not face the same restrictions, which helps keep their systems less vulnerable than Windows.

Future implications and EU regulations

The European Union, aiming to combat anti-competitive behavior by big tech, appears disinclined to lift such restrictions for Microsoft, despite the potential security benefits. As such, Microsoft continues to navigate a challenging regulatory environment that forces the company to balance competition with the security of its operating systems. This scenario represents a significant challenge for Microsoft, which must find innovative solutions to improve Windows security without breaking EU regulations.