Why move to Linux? It's free, of course, but as several commentators have pointed out, a purchase price of zero doesn't necessarily mean that Linux is without costs, including technical support and training. And those costs can be hefty. But there's more to the software cost picture - and when you fill in all the details, Linux starts looking very good indeed.

In this article, I will argue that Linux - and free software generally - provides the best defense against an odious but probably perfectly legal tactic, called technology lock-in, which the software industry routinely uses to coerce their customers into buying even more of the same firm's products. As you'll see, the downstream costs of technology lock-in can be devastating; but they are avoidable. By moving to Linux-based server infrastructures and free software applications, firms can guarantee they'll never again be victimized by technology lock-in, because (as I'll demonstrate) the General Public License (GPL) raises the costs of lock-in tactics to the point at which they're useless to even the most cynical vendors.

In my use of the term, which differs from that of many economists, a technology lock-in strategy is a conscious, deliberate and cynical design strategy in which certain technical features are incorporated within a product's design for no other genuine purpose than to coerce the firm's customers: specifically, to force customers to make huge collateral investments in additional products made by the same firm.

The classic technology lock-in case is IBM's use of CPU microcode against upstart competitor Gene Amdahl, who realized IBM's customers weren't very happy with IBM's mid-1960s processor offerings. A former product manager with IBM, Amdahl realized he could create much faster IBM-compatible processors if dispensed with microcode, a low-level (and inefficient) programming language that enabled IBM to specify a CPU's instruction set in software rather than hardware. Amdahl's processors were indeed much faster, but IBM dropped a bomb on the market by announcing that it would make continuous, unannounced and undocumented changes to its CPU microcode. The clear message from IBM to its customers? If you're running IBM's iron, you'd better not mess around with Amdahl's CPUs, which don't have programmable microcode. You might wind up with a bunch of equipment and software that won't work correctly, and what's more, we won't support it (Pfaffenberger 2000).

Isn't technology lock-in illegal? It's certainly predatory, but predatory marketing practices aren't necessarily illegal unless they're carried out by a firm possessing a monopoly in a given market. Even then, it's very difficult to prove that a given feature has been incorporated for no other genuine purpose than to coerce the firm's customers. IBM could argue that its motives for incorporating microcode into its products were perfectly innocent. Microcode was used, IBM spokesmen said, to ensure software compatibility across IBM's entire product line. And the truth is that the firm probably didn't fully grasp microcode's lock-in potential until Amdahl starting taking their market away with hard-wired CPUs. What started out as a rather kludgy and inefficient engineering solution suddenly became a potent weapon in IBM's campaign to safeguard its mainframe market monopoly. Even when the a feature's lock-in benefits are clearly foreseen, it's darned hard to prove to a jury that a lock-in feature was cynically designed for no other purpose than to coerce the firm's customers. The firm will talk about bringing all this great new technology to their customers - and then they put a few engineers on the stand, the jurors' eyes glaze over, and that's that.

What isn't debatable is the cost of technology lock-in to a firm's customers. A case in point: Bell Atlantic's mid-1980s purchase of AT&T's 5ESS switching systems (discussed in Shapiro and Varian 1999: 105-106). These were great switches, no doubt, but they came with an enormous hidden cost on top of their $3 billion price tag. Here's why. AT&T's 5ESS switches used a proprietary operating system that was available only from AT&T. As a result, AT&T was in a position to dictate the terms for subsequent modifications to Bell Atlantic's systems. For example, when Bell Atlantic wanted to implement toll-free 888 service, AT&T stiffed Bell Atlantic to the tune of $8 billion, more than twice the amount Bell Atlantic initially paid for the switches. Naturally, Bell Atlantic felt rather aggrieved about this situation, but they couldn't afford the massive capital investment that would be needed to switch to another vendor's technology. To put the point bluntly, they were had.

Business schools teach aspiring managers how to sniff out lock-in potential and avoid it at all costs. But sometimes it's difficult to detect a product's lock-in potential, and that's particularly true when you're talking about cutting-edge technology. Still, lock-in is something of a dangerous game to play, especially when it's as blatant as the strategy incorporated into AT&T's switches. That sort of behavior can get you sued - and that's just what happened to AT&T. In 1995, Bell Atlantic took AT&T to court, alleging that AT&T is a monopoly and its use of product lock-in amounted to an illegal predatory practice. Subsequently, the suit was settled out of court for an undisclosed sum.

As the Bell Atlantic example shows, falling victim to a lock-in ploy can have devastating financial consequences, but the strategy isn't without risks to the product's vendor. The courts still haven't decided whether technology lock-in tactics are illegal, even for a monopoly player. Still, if the ploy is too blatant, you could wind up in court. Hence the development of what I call lock-in Lite, a strategy brought to perfection by our friends in Redmond. In lock-in Lite, the technology lock-in features don't exactly force customers to abandon competitors' products, but customers won't get the full benefit of the firm's product unless they go with a one-vendor strategy.

Microsoft's products are loaded with lock-in ploys, and what's more, the firm freely admits it. And why not? Microsoft's attorneys are probably telling Microsoft management that the lock-in Lite strategy is almost certainly legal, even for a company with a decisive market monopoly and antitrust troubles. And they may be correct, in terms of the realities imposed by technologically illiterate judges and juries. Virtually all of the firm's products contain features designed so that customers cannot enjoy the product's full feature set unless they purchase additional products made by the same company; and preferably, they should also move their server infrastructure to an all-NT/2000 solution. The firm has made no secret about its next ambition: to colonize the Internet so that the best benefits will accrue to those who are exclusively committed to Microsoft clients and servers. And what's so terrible about this, Microsoft apologists argue? It seems like mild arm-twisting at best; after all, you can still use Microsoft clients in networks served by UNIX, and you can still use non-Microsoft clients in networks served by Windows 2000. You just won't get the full benefits of Microsoft's glorious products. No harm done, right?

Here's an example of lock-in Lite, Microsoft style: Microsoft's extensions to the Kerberos security protocol. Microsoft implemented Windows 2000 with its own, proprietary extensions to this protocol, an open, public protocol that was developed with U.S. taxpayers' funds. The target is clearly the UNIX server market; high-end UNIX servers are widely thought to provide the best security for mission-critical, sensitive systems, and Kerberos is part of the reason. But Microsoft's extensions to the Kerberos protocol mean that Kerberos-enabled Windows clients will lose some of their features when they interact with UNIX servers. Conversely, non-Microsoft clients will not be able to take advantage of the cool new security tricks that Windows 2000 can do. Microsoft's actions can be additionally defended as a mere extension to a protocol that's experiencing ongoing development; the firm has promised to document the extensions and provide them to the Kerberos standards committee. Microsoft can convincingly portray its behavior as that of an innovative company that contributes to open standardization processes and, for completely understandable reasons, adds value for its customers. What's wrong with that?

Here's what's wrong. Lock-in Lite isn't a knockout punch, but you can get cold-cocked all the same if somebody keeps tapping you thousands of times in the same, vulnerable place. And there isn't just one lock-in Lite ploy in Microsoft's products; they're riddled with them. Microsoft is playing the Kerberos game with its extensions to Java, HTML (see Johnston 2000), CSS, XML (Kobielus 1999), LDAP, XSL, HTML, DNS (see Rash 2000) and other public protocols. The standards-extension process generally begins with Microsoft's affirmation that it really, truly does intend to be a Good Citizen and obey open standards; the firm works with the relevant standards committees and learns all about the fast-evolving technologies. But then they drop the bomb. Some new product comes out, and they've added proprietary extensions. And at what point do lots of lock-in Lites amount to an overall pattern of outrageously predatory behavior? A couple of mosquitoes won't drive you indoors, but 4,000 blood-suckers is another matter entirely. A space-borne pebble won't stop an incoming ICBM, but a billion of them will. Increasingly, the "great experience" you get running Microsoft products boils down to dozens, if not hundreds, of nagging reminders, frustrations, engineered incompatibilities, and unnecessarily convoluted procedures - until you say, "Oh, hell, let's go with NT."

In short, lock-in Lite is just as dangerous for a firm's customers as the balder, more coercive lock-in strategies practiced by IBM in the 1960s and AT&T in the 1980s; its effects are cumulative, but they're no less coercive. Whenever you go with a Microsoft product, you'd better understand you're getting a program with lots of features designed for no other genuine purpose than to nibble away at you until you stop using competitors' stuff. When you see an all-Microsoft shop, you're seeing an organization that's just about been nibbled to death until they got to the "Oh, hell" point. Or maybe they're just not very smart.

The legality of lock-in Lite hasn't yet been determined unambiguously by a court of law - and no such determination may ever be made. But it's increasingly clear that Microsoft's version of lock-in Lite is functioning quite nicely to do all the Bad Things which predatory monopoly behavior is supposed to do, such as discouraging new entrants wishing away from the marketplace.

In many respects, Microsoft's lock-in Lite strategy has the same anti-competitive functions that were once ascribed to vaporware announcements, at least when made by a company with a dominant position in a particular market. The term vaporware refers to a product that doesn't currently exist, and may never exist, at least in the shape and form envisioned in the product announcement. When a company's product dominates a market segment, a vaporware announcement can serve very nicely to discourage would-be competitors from entering the market. Consider Microsoft's recent BizTalk publicity (see Kobelius 1999), which followed hard on the heels of Judge Jackson's findings of guilt in the antitrust case. BizTalk is an XML-driven infrastructure for business-to-business e-commerce. It's the same old game: Microsoft promises that this time it will Be Nice and Observe Standards - and if you believe that, I have a nice bridge I'd like to sell you. But the announcement itself is enough to drive any sane company out of this market. You know what's coming. Microsoft will "leverage" its operating system and Office applications so that customers will get the best BizTalk benefits only if they're using Microsoft clients and servers. And as for the "open" protocols, you'll find out too late that they're probably not going to document them, or document them fully, or document them accurately, or that the standard takes years to come out - and you're dead. This is classic predatory behavior: it discourages competition, drives new technology to the market and saddles the firm's customers with products that aren't competitively priced. (There's no competition, remember?)

These costs are sufficiently severe to raise the question of lock-in Lite's legality, especially when implemented in a billion-pebble, peck-them-to-death mode. But there's more. The overall picture of Microsoft's behavior with respect to open, public protocols discloses that the now-infamous Halloween documents, an internal Microsoft analysis that was leaked two years ago, may reflect the firm's strategy more accurately than its management has been willing to admit. In the Halloween documents, one of the firm's engineers framed a competitive strategy around what he termed de-commodification. Microsoft's competitors, the firm argued, were making inroads into Microsoft's markets by using commodity protocols - open, public protocols you can incorporate into your products to achieve a high degree of interoperability. By "embracing and extending" these protocols, Microsoft can ultimately distort them to the point where the use of any non-Microsoft product will saddle users with less-than-full functionality. And to make sure this happens, Microsoft will not hesitate to use intellectual property protections (trade secrets and patents) to monopolize its proprietary protocol extensions. With the U.S. Patent Office handing out completely unjustifiable patents willy-nilly, it's going to be quite easy for Microsoft to lock up protocol developments that would otherwise have been natural and logical extensions of the public development process. And in the end, the firm will succeed in consigning its competitors to the use of the last century's technology.

Skeptical? Just take a closer look at the Kerberos squabble. Microsoft's extensions to Kerberos "fill in" a portion of the protocol that has never been fully specified, even though the Kerberos development group has been discussing such a specification for years. In an open, public development process, it's likely that some future version of Kerberos would have specified precisely the extension that Microsoft has developed. To keep its competitors from learning just how the extension works, Microsoft has used a variety of intellectual property protection strategies, including appeals to trade-secret law and the Digital Millennium Copyright Act (DMCA), to shield the specifics from public view and discussion - and you can bet there's a patent application in the works. Sure, Microsoft may eventually divulge the extensions and even contribute them to the Kerberos standard, but by then, the damage is already done. A company that's thinking of getting into the Kerberos business is going to realize that the costs of competing in this market have been raised, probably to an intolerable level - and if they're smart, they'll pull out of the market.

If there was ever an example of the need for antitrust legislation, believe me, this is it. Scholars agree that the key to the Internet's meteoric rise, and its incredible wealth-generation potential, lies in open, public nature of its underlying protocols. But this part of the story may be coming to an end. Between Microsoft's lock-in Lite strategy, the Patent Office's laxity, and industry-backed legislation such as the DMCA and UCITA, there's a very real chance that future natural and logical extensions of the underlying Internet technology will be so effectively monopolized by Microsoft that the use of competitors' products will condemn the public to outmoded technology. And as computer and Internet technology increasingly penetrates the consumer market, Microsoft will be in a position to impose what amounts to an unbearable tax on the entire economy. At some point, we'll have to wake up and say, "Enough already!" The fact that Microsoft co-founder Bill Gates already possess more wealth than half the American people combined is reason enough to highlight the dangers.

Increasingly, businesses are figuring out that doing business with Microsoft is just too dangerous; with its stealth lock-in strategies, you're not going to know you've been had until you've already been had. And that's precisely why the free software movement looks increasingly good. If you're running a web server with Red Hat, Apache and PHP, you're dealing with software that doesn't contain any hidden lock-in strategies. As KDE and GNOME move toward more fully developed desktop environments and credible office applications, there's a growing opportunity to wrest control of the desktop away from Microsoft.

But wait a minute. Why couldn't somebody play the same lock-in games with Linux? By definition, GPL-licensed software cannot incorporate lock-in strategies, whether they're bare-fisted or of the stealth variety. The GNU Project's General Public License (GPL) effectively prevents any vendor, no matter how callous, from introducing proprietary extensions to any existing protocol. Under the terms of the GPL, you can use existing GPL-licensed code in derivative products without paying royalties or licensing fees, but you must release your derivative product under the terms of the GPL - which means, for one thing, that everyone can see your source code and incorporate your changes, if they wish.

Still, Linux needs to offer more. Where's the open, XML-based file format that can finally free office software users from Microsoft's file format shenanigans? Are we really committed to adhere to strict W3C standards in our web sites and web-production software? You can talk about Linux's superior reliability, impressive performance and other technical advantages all you want, but businesspeople are starting to understand that standards conformance and the impossibility of implementing lock-in tricks with GPL-licensed code may very well be the strongest card that Linux can play.

Bryan Pfaffenberger (bp@virginia.edu) is a professor in the University of Virginia's new Media Studies department, where he will be teaching two courses this fall: Media Studies 110 (Information Technology and Digital Media) and Media Studies 317 (Intellectual Property and Digital Media). An avid Linux user, he is the author of several books on Linux, including Linux Clearly Explained (Morgan-Kaufmann) and Mastering GNOME (Sybex). He lives in Charlottesville, Virginia, with his family.

Visit the Web Standards Project home page and learn why it's so important to avoid the use of proprietary extensions to HTML, CSS, and XML. Take the Web Interoperability Pledge, and remember Bill Gates' slogan: "One World, One Web, One Program".

Dig into Miguel de Icaza's Gnumeric spreadsheet if you'd like to see where Linux applications ought to be headed. Gnumeric does an excellent job of reading Excel worksheet files, but it translates them into an open, beautifully designed implementation of XML. What does all this mean from the businessperson's point of view? Simple: no tricks in the code - and no tricks in the file format, either. It's all completely open.

Contribute to projects that are creating open file format standards. An example: wvWare (formerly WordView), a library that does an excellent of job of parsing Microsoft Word .DOC files and translating them into CSS-formatted, standards-compliant HTML.

Help educate consumers about the perils involved in Microsoft's forthcoming assault on household privacy, technology independence, and data security. Visit Ralph Nader's Consumer Project on Technology page detailing the consumer's complaint against Microsoft, Corporate Watch's One World Operating System, and the NetAction home page; get informed, get the word out and support these organizations.

Babcock, Charles. "Kerberos Made to Heel to Windows 2000", Interactive Week (March 2, 2000). Available on-line at http://www.zdnet.com/filters/printerfriendly/0,6061,2453171-35,00.html; visited July 6, 2000.

Barr, Joe. "The Gates of Hades", LinuxWorld (April, 2000). Available on-line at http://www.linuxworld.com/linuxworld/lw-2000-04/f_lw-04-vcontrol_3.html; visited July 6, 2000.

Glidden, Derek. 1998. "Open Source and Open Data". Available on-line at http://www.illusionary.com/opendata.html; visited July 6, 2000.

Kobielus, James. "What Microsoft is Doing Right and Wrong with BizTalk", Network World (July 12, 1999); available on-line at http://www.nwfusion.com/archive/1999b/0712kobielus.html; visited July 6, 2000.

Lettice, John. "Linux Server Sales Surge as NT Treads Water", The Register (February 10, 2000).

Johnston, Margret. "Group Blasts Internet Explorer 5.5 for Lack of Web Standards", Infoworld News (April 10, 2000). Available on-line at http://www.infoworld.com/articles/en/xml/00/04/10/000410enwebstandards.xml; visited July 6, 2000.

Liebowitz, S.J., and Stanley Margolis. 1994. "Network Externality: An Uncommon Tragedy", Journal of Economic Perspectives 8:4. Available on-line at http://wwwpub.utdallas.edu/~liebowit/jep.html; visited July 6, 2000.

Liebowitz, S.J., and Stanley Margolis. 1995. "Path Dependence, Lock-In, and History", Journal of Law, Economics, and Organization (April, 1995), pp. 205-206.

Pfaffenberger, Bryan. 2000. "Fear, Uncertainty, and Doubt (FUD): The Rhetoric of Dread in Information Technology Marketing", mss. available on-line at http://www.eh.net/bhc/Conference/fud.html

Rash, Wayne. "Why You Might Decide To Run Away from W2K", Internet Week Online (January 31, 2000). Available on-line at http://www.internetwk.com/columns00/rash013100.htm; visited July 6, 2000.

Rosenberg, Scott. "Microsoft's .Net: Visionary or Vaporware?" Salon (June 30, 2000). Available on-line at http://www.salon.com/tech/col/rose/2000/06/30/microsoft_dotnet/index.html?CP=YAH&DN=110; visited July 6, 2000.

Warsh, David. "Kerberos, the Microsoft Watchdog". Boston Globe (May 30, 2000). Available on-line at http://199.97.97.16/contWriter/cnd7/2000/05/30/cndin/9763-0028-pat_nytimes.html; visited July 6, 2000.