Security firms blast Microsoft for free antivirus offer

Two security software makers are complaining about Microsoft using its update service to deliver its free antivirus software to Windows users who don't have such protection on their computers.

No, it's not 1998. And we're talking about allowing customers to choose whether they want the software, rather than bundling a particular browser--say Internet Explorer--on Windows.

Microsoft began making its Security Essentials software available to customers through its Microsoft Update service as an optional download on November 1 for U.S. customers and October 19 for U.K. customers. It offers the download only to customers who do not have an antivirus solution that is detectable by Microsoft's Action Center.

"Despite the broad availability of anti-malware software, we still find that many consumer and small business PCs remain unprotected," the company said in a statement to CNET on Monday. By offering the free antivirus download, "we make it easy for those who want and know they need protection, but for whatever reason have not gotten around to installing it. Now they can download the software when they perform their other system updates without having to search the Web or make a special trip to the store."

Who can argue with a company offering people a free download of security software if they want it? Trend Micro and Panda Security, that's who. Executives from both companies claim the move is anticompetitive because Microsoft is leveraging its update service that downloads software to millions of Windows computers to plant its own antivirus software on systems.

"This will end up in action taken, especially in Europe," Panda Chief Executive Juan Santana told CNET in an interview on Friday afternoon. He stopped short of saying that Panda would lodge an official complaint. "We will monitor the situation," he said.

"Commercializing Windows Update to distribute other software applications raises significant questions about unfair competition," Carol Carpenter, general manager of the consumer and small business group at Trend Micro, told Computerworld late last week. "Windows Update is a de facto extension of Windows, so to begin delivering software tied to updates has us concerned," she said. "Windows Update is not a choice for users, and we believe it should not be used this way."

Reached for comment today, Trend Micro spokesman Alan Wallace told CNET that the company had no further comment beyond what was already reported.

Beyond the anticompetition concerns, Panda Security has other gripes. For instance, Pedro Bustamante, a senior research adviser at Panda, said Microsoft Security Essentials is insufficient protection compared with other free antivirus products that offer multiple layers of security such as Web filtering and behavior blocking. And from a global overall security perspective, Microsoft's plan is flawed because it will only get installed on computers with a valid license to run Windows and will thus leave millions of unlicensed computers unprotected, he wrote in a blog post today.

In addition, the move will create a "monoculture" with millions of computers running the same antivirus software. That means malicious hackers can infect all those machines if they are able to bypass only one antivirus program instead of having to get past multiple programs, Bustamante said.

"In summary, while it's commendable that Microsoft is trying to protect users, offering only 'their' basic MSE antivirus provides neither sufficient protection against today's threats nor does it solve the malware problem of millions upon millions of pirated PCs who will continue spreading viruses. In fact, it can easily achieve the contrary by making it easier for hackers to infect users," Bustamante wrote. "Microsoft should offer the complete portfolio of more advanced and secure alternatives of free antivirus products and time-limited versions of paid security suites, allowing users to choose any of them from the Optional Windows/Microsoft Update."

Several analysts dismissed Bustamante's arguments, as well as the antitrust concerns and said Microsoft's plan was a good thing for Internet security overall and offering any security protection was better than offering none at all.

"I think the vendors are simply complaining because Microsoft is the dominant vendor on PCs in the world," said Don Retallack, research vice president for systems management and security at Directions on Microsoft. "Other security vendors do offer a wider range of tools that go far beyond what Security Essentials provides...so I think there is still a place for other vendors and they're not being squeezed out."

"Microsoft is not bundling (its antivirus software) with the operating system. That's where the line typically is drawn with antitrust issues," said Neil MacDonald, a vice president and fellow at Gartner market research firm. "You could make an argument that it's in the best interest of consumers and the rest of the world to have more people protecting their machines. That's a good thing."

However, a colleague of his had a different take on the matter. Given Microsoft's history fighting antitrust claims, the company would be wise to avoid leveraging its Windows dominance to increase the market share for its other software or avoid even the mere appearance of doing so, said Gartner analyst John Pescatore.

"There is still sensitivity to that issue in Europe even if there isn't in the U.S. If it looks like they're using that solution to bundle in essentially a security program that competes with other players, then there are concerns," he said in an interview. "They still have huge competitive advantage."

Pescatore suggested that Microsoft add other antivirus software to its list of options for its update service. "They would be better off making sure they are helping people install any security software that's out there," he said. "I'm sure Panda and Trend Micro would be happy to participate."

A Microsoft spokeswoman did not immediately have comment to that suggestion or to the antitrust concerns.

Update Nov. 9 at 11:02 a.m. PST: Trend Micro provided an e-mail statement. "In principal, we welcome Microsoft or anyone else entering into the security market to provide more choice for customers--even if it's just baseline protection. As we mentioned previously, our concern is about any mechanism or tactic that may obscure that choice for consumers. While techies may recognize the difference between 'Microsoft Update' and 'Windows Update,' many consumers may not be familiar with this distinction or see any difference between optional and recommended updates from Microsoft."