Ex-DoJ attorney to head Microsoft security

With pressure mounting over security problems with its products, Microsoft is to name a former US Department of Justice (DoJ) attorney as its new chief security strategist.

Scott Charney will replace Howard Schmidt, who left on 28 January to join the Bush administration as vice chairman of the president's Critical Infrastructure Protection Board.

Charney, who supervised 22 federal prosecutors while co-ordinating national and international investigations at the DoJ, has been a partner at PricewaterhouseCoopers (PwC) since 1999. He is expected to start work at Microsoft on 1 April.

Microsoft officials would not confirm the news, but indicated that an announcement on Schmidt's replacement was expected shortly.

Explaining that Charney has an excellent legal background and is a great public speaker, Gartner analyst John Pescatore said: "While he has had a year or two in the 'real' world with PwC, he doesn't have much background in understanding what businesses need in secure and safe computers.

"He will probably be of great help in seeing Microsoft navigate US and European Union regulatory and legislative issues about liability for software faults and defects, and in doing public speaking for Microsoft's cause."

But Pescatore added: "I don't see him as being able to play a major role in helping Microsoft meet its goals for making its software more secure."

Earlier this month, Pescatore criticised the software giant over the security of its products. In a report he advised companies to use alternatives to Microsoft's Internet Information Server after attacks on the product by such programs as the Nimda worm.

Microsoft chairman and chief software architect Bill Gates asked employees two weeks ago to put increased priority on making the company's products "trustworthy".

The Trustworthy Computing initiative includes sending its 7,000 systems programmers to a special security training programme, and Microsoft intends to go back over all the Windows operating system code to detect any security flaws.