Microsoft settles over Passport privacy

The US government has reached a settlement with Microsoft over complaints that the company's Passport authentication service poses a threat to consumers' privacy and security.

As part of the settlement, Microsoft agreed to implement a comprehensive information security programme for Passport and similar services, the Federal Trade Commission announced Thursday.

The proposed consent order prohibits any misrepresentation of information practices in connection with Passport. It requires the software maker to operate and maintain a comprehensive information security programme.

Microsoft must also have its security programme certified as meeting or exceeding the standards in the consent order by an independent professional every two years.

"Good security is fundamental to protecting consumer privacy," Timothy J. Muris, chairman of the FTC, said in a statement. "Companies that promise to keep personal information secure must follow reasonable and appropriate measures to do so. It's not only good business, it's the law."

Microsoft's Passport online authentication system lets people access multiple Web services with a single sign-in. But privacy groups have questioned whether Passport collects too much information and has the security features needed to protect basic information.

Last summer, 13 consumer groups filed a complaint with the FTC alleging that Passport was an example of an "unfair and deceptive trade practice" in violation of federal law. The 20-page complaint urged the FTC to take action against Microsoft, saying the company made it "difficult if not impracticable" for consumers to exercise control over their personal information.

Passport was introduced last year as part of .Net, a much-touted effort to move Microsoft into Internet services.

Who's watching you? Get the latest on spy networks such as Echelon and Carnivore, as well as privacy issues for companies and individuals alike, at ZDNet UK's Privacy News Section.

Have your say instantly, and see what others have said. Go to the ZDNet news forum.

Let the editors know what you think in the Mailroom.

After a Federal investigation into privacy violations by Microsoft's Passport authentication service, the software giant has agreed to settle