Slashdot Mirror
Does Offshoring Threaten Combat Software?
PreacherTom writes, "Pentagon officials report that 'maliciously placed code' could compromise the security of the Defense Department and, ultimately, hurt its ability to fight wars. The culprits: offshore programmers. While the Pentagon has stepped up its vendor screening and software testing of late, it's becoming more difficult and costly to test every line of software code on increasingly sophisticated weapons systems. The task force assigned to this issue will be soon presenting its report, and most likely will determine that offshoring presents too great a risk."
Offshoring will save costs,m and ensure that overseas developers, often with considerably greater knowledge of these systems will be able to develop them. the risks are totalyl negligible. I say we petition the government to offshore more development.
Yours - Cylon number 6
"Pentagon officials report that 'maliciously placed code' could compromise the security of the Defense Department and, ultimately, hurt its ability to fight wars. The culprits: offshore programmers. While the Pentagon has stepped up its vendor screening and software testing of late, it's becoming more difficult and costly to test every line of software code on increasingly sophisticated weapons systems. The task force assigned to this issue will be soon presenting its report, and most likely will determine that offshoring presents too great a risk."
Blaming "offshoring" is a neat wave of the bloody shirt, but I don't think it's relevant to the problem. Take the word "offshoring" out of that quote, and replace it with "outsourcing." Does it still make sense? Let's see:
"Pentagon officials report that 'maliciously placed code' could compromise the security of the Defense Department and, ultimately, hurt its ability to fight wars. The culprits: offshore programmers. While the Pentagon has stepped up its vendor screening and software testing of late, it's becoming more difficult and costly to test every line of software code on increasingly sophisticated weapons systems. The task force assigned to this issue will be soon presenting its report, and most likely will determine that outsourcing presents too great a risk."
Looks like it does.
If the problem is that there aren't enough resources (including time) to do a sufficiently thorough audit of all the code, then it doesn't matter where the code was written, does it? Do we really suppose that a malicious actor would have that much harder a time getting a job for a DoD contractor in the US than overseas? Do we really suppose that it would be that much more difficult to suborn a programmer overseas than here?
Or, more accurately, is it enough more difficult in either case for us to be confident of code written inside the country as opposed to outside?
It's not that I do think that offshored code is trustworthy, it's that I don't think "onshored" code is. And if we can't trust either, what does offshoring have to do with anything?
Reality has a conservative bias: it conserves mass, energy, momentum...
...what if they'd offshored WOPR?
"How about a nice game of Chinese Checkers?"
FATMOUSE + YOU = FATMOUSE
I'm glad the Pentagon finally woke up to reality, where maybe it's not such a hot idea to pay some Indian contract programmers a few bucks an hour to write the firmware for your cruise missiles.
I'm not sure of the exact law, but I believe there is one which basically says, all U.S. defense procurement must come from domestic sources, unless it's some exceptional item that can only be purchased abroad. Maybe we need a law like that for government contracting and outsourcing. Unless there's a demonstratable reason for having to do it offshore, it shouldn't be.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
And this software which we are not allowed to review may have been written by offshore programmers who will know perfectly well that they are doing the job because they are cheaper, and have absolutely no patriotic investment in the US?
I wonder how many other global empires have been brought down by the desire to make a quick buck?
Pining for the fjords
What scares me the most is the fact that they even gave offshoring a consideration!!!
The DOD didn't do it themselves... they outsourced it to contractor 1 who outsourced part 1A and 3B to contractor 2 who outsourced it offshore.
I live in Soviet Canuckistan you insensitive clod!
Maliciously placed software code is already weakening our military and hurting its ability to effectively fight wars. And that code was developed by Diebold right here in the USA.
Hear recorded Slashdot headlines on your phone! New service beta testing. Just call (248) 434-5508
Yes, in fact we can be more confident of US code. When the US Goverment subcontracts to someone in the US, there are two dynamics in our favor...
1. The US does not have kind of economic forces that encourage the kind of high turnover that is typically seen in places like India (as an example). As a former employee of an embedded-systems company, I heard all about the rampant problems that our foreign outsourcing partners had... including competitors who would wave a few more rupees at them and they immediately flee (taking our proprietary knowledge with them).
So, how does this contribute to this discussion about hidden backdoors in Government software? The problem is that higher turnover means less incentive for the contracting company to do their due diligence on the next guy... knowing that at a significant portion of them will be gone within months. It also means an easier time for say an Iranian or Pakistani with a grudge to start working for the same company...
2. It is much easier to ensure you are getting good background checks in the US... the Feds can audit the contractors employees backgrounds... much harder to do on foreign soil.