Re: Y2K trojans, and outsourcing...

["Steven M. Bellovin" <smb () research att com>]

I was part of the NRC committee that produced the "Trust in Cyberspace"
report (http://www.nap.edu/readingroom/books/trust/).  During the press
briefing that accompanied the release of the report, we were asked about
precisely this scenario:  back doors or other Trojan horses being inserted
by consultants or programmers.  My response then was the same as it is now:
I'm far more worried about the accidental bugs that will be introduced
by anyone touching the code, especially when the change is done hurriedly
and by an outsider.