UK government PCs open to hackers as paid Windows XP support ends

The Government Digital Service will not extend its £5.5m deal with Microsoft to extend support for Windows XP, leaving government computers that still run on the obsolete operating system at risk from hackers.

The service said ending the support meant “weaknesses that are found in unsupported products will remain unpatched and will be exploitable by relatively low-skilled attackers”.

Microsoft withdrew its extended support programme for Windows XP, its 14-year-old operating system, in April 2014. Given the number of Windows XP PCs still being used in government and businesses at the time, Microsoft provided paid-for extended support on a one-off basis.

The Crown Commercial Service bought a year’s extension of support, which includes security updates crucial for keeping hackers at bay, for £5.5m last year to give government departments 12 months to safely migrate from XP.

A year on, the Government Digital Service has decided not to extend that support. The Office of the Chief Technology Officer said: “Technology leaders met last month and took a collective decision to not extend the support arrangement for 2015. The current support agreement ended in April 2015.”

Each government department with XP machines are expected to seek deals for support with Microsoft directly, which could end up costing the taxpayer more.

Thousands of XP computers now vulnerable

While the government’s move away from Windows XP, which each department has had seven years’ warning to complete, was described as having had “good process”, some departments have struggled with the transition.

The Metropolitan Police Service, for instance, sought a support agreement directly from Microsoft, while HM Revenue and Customs is reportedly behind schedule in its transition to Windows 7 and 8.1.

NHS Scotland also has about 2,600 computers still running XP, while the trusts across England and Wales making up NHS services have varying numbers of XP computers.

The Crown Commercial Service said that its deal last year saved the government about £20m by buying in bulk compared to individual departmental deals.

GDS said: “We expect most remaining government devices using Windows XP will be able to mitigate any risks … where this is not possible, they may need to review their own short-term transition support.”

The government’s technology leaders insist that departments behind the curve follow its “obsolete platforms security guidance”, published in April.

“It is vital that all organisations only use software products which are supported by the vendor, and that plans be made to migrate from older products as the end of support period is reached,” the guidance advises.

Windows 10 will be ‘the last version of Windows’