The judge in the case was so miffed at the Interior Department’s conduct related to information security audits that he commenced contempt proceedings.

n You can’t blame a vendor for your mistake. That’s the lesson from the contretemps between the state of New York and the American Civil Liberties Union.

When the ACLU accidentally published information about its donors (something the group had recently lambasted drugmaker Eli Lilly for doing), New York Attorney General Eliot Spitzer was ready to pounce. The ACLU, Cook says, wanted to beg off by noting its security was outsourced to a vendor. But, Cook says, that defense wasn’t going to work. "It was clear that the ACLU was going to be held responsible for the failure of its vendor," he says. The sides ended up settling.

It is into this environment that a 50-year-old victim of identity theft steps in with her own lawsuit?against Microsoft. The woman is arguing that, while Microsoft claims it patches its systems, that’s not good enough. The suit contends that the "eclipsing dominance in desktop software has created a global security risk," says attorney Dana Taschner, who filed the suit and wants to see Windows PC users made part of a class-action lawsuit.

"This will be a very interesting suit to follow," Cook says. "It will answer the question of whether this is a matter of public policy?whether all software vendors have a more affirmative obligation to secure their environments."