To Bundle or Not to Bundle: Thats the Microsoft Security Question

Industry watchers are wagering that some components of Microsoft's anti-spyware and anti-virus offerings could find their way into Windows-unless government regulators crack down.

Download the authoritative guide: The Ultimate Guide to IT Security Vendors

Microsoft Corp. has not yet launched a paid anti-virus product, but questions about software bundling and unfair competition are already swirling in Europe.

Rival Symantec Corp. acknowledged late this week that it has responded to a request for information from European Union regulators regarding the state of the security market and Symantecs role in it.

But some are speculating that EU antitrust officials have bigger fish to fry. Some company watchers believe that Microsoft might be embarking on more product bundling—behavior for which the company recently had its hand slapped by the European Commission.

Symantec officials were careful to note that Symantec has "not filed a formal complaint with the European Commission."

/zimages/2/28571.gifClick here to read about Microsofts A1 consumer security service.

In a statement sent to Ziff Davis Internet News, Symantec spokeswoman Genevieve Haldeman said the company has responded to requests for information from the European regulators.

"As weve said in the past, we will compete with Microsoft in the markets, not in the courts, as long as there is a level playing field," Haldeman added.

But Symantecs informal nudge of the EU gives the regulator time to consider whether a full-blown antitrust case is merited, according to a Dow Jones report on Thursday that cited an unidentified legal source in Europe.

Over the course of the last several years, Microsoft competitors have lodged legal complaints with both the U.S. Department of Justice and the EU over Microsofts decision to integrate a number of previous stand-alone products and technologies into Windows.

/zimages/2/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

Competitors have been agitated over Microsofts bundling of Internet Explorer, Windows Media Player, Outlook Express, Windows Messenger, and Windows Movie Maker, among other technologies, that Microsoft now considers part of the operating system.

Last year, the European Commission ruled that Microsoft must make available a version of Windows, minus Windows Media Player. The Windows XP N product was the result.

Microsoft has not made public its distribution plans for its Windows OneCare consumer security-subscription service; its consumer Windows AntiSpyware product; or its newly minted Windows Client Protection enterprise spyware product.

But some of Microsofts partners and competitors have said they believe the company will bundle at least some parts of one or more of these products into Windows Vista and its successors.

Microsoft could opt to build pieces of its Windows AntiSpyware or its recently rebranded Microsoft Antigen anti-virus offering into Vista, but sell updates as subscription services, according to one scenario partners said they had heard Microsoft officials discuss.

/zimages/2/28571.gifClick here to read more about Windows OneCare.

Microsoft has been equally cryptic about the extent to which it plans to make its anti-spyware technology part of the Internet Explorer 7.0 browser currently being developed.

Partners said earlier this year that Microsoft was promising some level of anti-spyware integration between IE 7.0 and the companys Windows AntiSpyware product, but didnt provide details.

"We think they will build some (of this) technology in," said one Microsoft partner, who requested anonymity. "Anti-spyware is almost a no-brainer. There are so many free anti-spyware products out there now."

The line between whats "free" versus whats a paid add-on product or service is in flux, said Peter OKelly, a senior analyst with The Burton Group.

"I dont think theres some kind of natural law that defines whats in or out of a platform. Times—and mainstream user requirements—change," OKelly said.

"Microsoft is not going to be able to please everybody in this context," OKelly admitted.

"Security and privacy requirements have changed dramatically now that most PCs are Internet-connected. What used to be an optional and specialized product category is now a basic requirement for all users.

"As such, Microsoft will be assailed if it doesnt seek to directly address the challenges, and it will also be scrutinized by specialized vendors that are shifting from complementor to competitor if it does," said OKelly.

John Pescatore, research director at Gartner Inc., said he believes it would be a mistake for Microsoft to bundle its Windows OneCare Live client with the operating system.

And "bundling [anti-virus] into Vista could be a very big deal, very much the same as bundling in Media Player, which EU already reacted to," Pescatore added.

Pescatore added that he has been unable to confirm with Microsoft whether the company plans to bundle anti-virus capabilities into the operating system.

Symantec isnt the only anti-virus vendor paying close attention to Microsofts moves.

"Were watching this very closely, no doubt about it," said Steve Orenberg, president of Kaspersky Labs U.S. unit.

"If they put anti-virus into the operating system, the question of unfair competition has to be asked, especially on the consumer side.

"If consumers feel theyre buying a new Vista computer with anti-virus on it, chances are those home users wont go looking for (Symantecs) Norton."

"Of course, it makes us nervous," Orenberg added. "Anytime something is baked into the operating system, you worry about competing on a level playing field."

Orenberg also raised the issue of registry conflicts that occur when two different anti-virus applications are installed on a computer.

/zimages/2/28571.gifEurope proposes unbundling Media Player. Click here to read more.

"When you buy a new anti-virus product or youre switching protection, you have to uninstall the older application or it creates big conflicts," said Orenberg.

"You cant run two anti-virus products at the same time because everyones using the same registry to boot up. Can you imagine what happens if they actually ship the OS with anti-virus bundled?"

Directions on Microsoft analyst Michael Cherry agreed.

"One key concern is: will any integration on Vista make it impossible or hard for a third-party program to coexist? So that if I bought Vista, but decided that I wanted to run Symantec, McAfee or other third-party products, would I be able to? Or would both pop up messages as they both ran and discovered things to the point where I just gave up and only ran the Microsoft product?" Cherry asked.

Gregg Mastoras, senior security analyst at Sophos Inc., said any vendor in the consumer business should be worried about Redmonds shadow.

"We believe Microsoft will try to bundle some things for consumers. Symantec and McAfee should definitely be worried," Mastoras said. "Knowing Microsofts history, they should be very aggressive about getting prepared."

Analyst Cherry wondered aloud why Microsoft couldnt avoid the whole bundling issue entirely by simply relying on technology it acquired as part of its Sybari anti-virus acquisition.

"To the best of my knowledge, one of the assets that Microsoft got with Sybari was this ability to run multiple engines," Cherry said.

"So why not use that technology in all of their operating systems? That way, Microsoft gets to ship their anti-virus with this service, and then customers can still add additional engines if they want to."

/zimages/2/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Security Center Editor Larry Seltzers Weblog.