But Catlett read hidden meaning in the unprecedented Microsoft decision, and doesn't see it as evidence of self-regulation's effectiveness. In contrast, the company's undisclosed use of a unique identifier in Microsoft Office documents and Microsoft cookies created during user registration of Windows, had much broader implications. Thus, when an audit was badly needed, Microsoft declined. I think our swift response to the Hotmail incident coupled with inviting a third party review is evidence of our commitment to protecting people's online privacy. The legitimacy of the Hotmail audit will depend on the particular security issues the auditing firm is asked to test.
Management makes some assertion and the acting firm attests to that assertion.
Pilla said he couldn't comment on the specifics of the audit yet. We don't know what the process is, moving forward. He also wouldn't say whether the public would ever get to review the test conducted by the auditing firm. Any reasonable person can take a look at what's going on right now and come to their own conclusion. If you ask me personally, I think this is an example that the system worked.