Microsoft became aware that the source code – containing as much as 15% of Windows 2000 and Windows NT 4.0, according to some reports – had been illegally posted to the internet late last week and circulated using file-sharing services.
The software giant immediately launched an internal investigation and called in the FBI. Yesterday it claimed that the leak was not the result of any breach of its internal security or corporate network.
According to reports, investigations are now focusing on one of Microsoft's partner companies, Mainsoft, a Silicon Valley developer that needs access to the code to produce software for firms wanting to run Unix versions of Windows software.
The reason for targeting Mainsoft appears to be that the company is mentioned within the 205MB portion of leaked code that is circulating the internet. However, it is only one of around 500,000 developers with access to parts of the code.
Mike Gullard, Mainsoft's Chairman, issued a brief statement saying: "Mainsoft takes Microsoft's and all our customers' security matters seriously, and we recognize the gravity of the situation. We are cooperating fully with Microsoft and all authorities in their investigation."
Experts are divided on the implications of the leak. Some speculate that the code could help hackers exploit potential vulnerabilities in those systems; others disagree, saying they don't need to code to do this. But Microsoft is taking the matter very seriously.
The company said it is warning those that have already downloaded the code that they are in breach of both copyright legislation and laws protecting the code as a trade secret. It has not said how it is identifying downloaders.
The company has also set up alerts on P2P networks where file-sharing of the code has been taking place.
According to the company: "These alerts are designed to inform any user who conducts specific searches on these networks to locate and download the source code that such activity is illegal".
Tom Pilla, spokesman for Microsoft, told CNET News.com yesterday: "I'm sure that there are many people that don't know that it is illegal to share our source code". He added that the letters do not amount to threats of legal action at this point.