16 ms·
Keeping secrecy the exception, not the rule
- CiPHPerCoder 11y agoOn one hand, I commend Microsoft for doing this. On the other, I wonder if they would if Apple hadn't already stood up to the government?
- joelrunyon 11y agoDoes it matter? IMO if the companies get into a competitive war over privacy, that's a good thing for the consumer.
- CiPHPerCoder 11y agoI fully agree here. I'm just wondering, if Apple hadn't done that, where would we be today? Edward Snowden says, "Courage is contagious." I'm just wondering if this is an example of that, or if they would have done this regardless.
- Aelinsaar 11y agoYeah, demanding that they do it for the right reasons is probably asking for too much.
- vtail 11y agoNote that Ireland case happened long time before: http://bits.blogs.nytimes.com/2014/07/31/judge-rules-that-microsoft-must-turn-over-data-stored-in-ireland/ http://bits.blogs.nytimes.com/2014/07/31/judge-rules-that-mi... "The Microsoft case is believed to be the first time that an American company has fought against a domestic search warrant for data stored overseas."
- CiPHPerCoder 11y agoExcellent point. I didn't check the date on that, and wasn't familiar with the background.
- cjslep 11y agoAs someone far removed from practicing law, what are the ramifications if Microsoft fails? Would nothing change? Would others be barred from ever suing the U.S. Government for the same reason?
- matt_wulfeck 11y agoThere's no lawsuits yet. This is the continuation of a PR battle. If something does go to court the government will probably just stop doing it and try something else (the government loses in this sense but only very narrowly). A lot of these "tools" won't stand up to scrutiny by the Supreme Court because they are so broadly applied, and then the game would stop. Easier just to lose dmall battles but to keep the game going.
- e12e 11y agoAre you saying the first paragraph is a lie? Or is there something else I'm missing? "This morning we filed a new lawsuit in federal court against the United States government to stand up for what we believe are our customers’ constitutional and fundamental rights – rights that help protect privacy and promote free expression." (my emphasis)
- adventured 11y agoMicrosoft did in fact file a lawsuit. That's precisely why it made the news pretty much everywhere. "The lawsuit, filed on Thursday in federal court in Seattle, argues that the government is violating the U.S. Constitution by preventing Microsoft from notifying thousands of customers about government requests for their emails and other documents." http://www.reuters.com/article/us-microsoft-privacy-idUSKCN0XB22U http://www.reuters.com/article/us-microsoft-privacy-idUSKCN0...
- gozur88 11y agoThe right way to deal with this is to set up your system such that you can't turn over customer data because it's encrypted with a key to which only the customer access.
- rodgerd 11y agoAnd then you get legislation requiring backdoors. People need to get their head around the back that this is a political problem and requires political solutions.
- cschep 11y agosurely you agree that this puts the feds in a much tougher spot though? I think we should try to get from a 4 to 5, even if we can't get all the way to 10 right away. We shouldn't just punt on the problem because it's not possible to have an immediately perfect solution. 4 to 5 might mean using keys that only the customer has access to. 7 through 10 might all be political, sure, but let's keep moving.
- ivl 11y agoHad the feds not been so abusive, many of the people who are completely lawful wouldn't be at the point of being okay with the feds having a hard time. I think going tit for tat would be fine, but I totally understand why some people are saying "okay, screw it, we'll just make something no one can get into".
- cschep 11y agoTotally agree! I think we should build impossible to access things AND be actively political. :)
- gozur88 11y agoWell, maybe, but you deal with the legal environment in which you find yourself. Right now, there's no such requirement. You could probably get around one, too, by selling pieces of the system and having the customer use OSS for the rest. That is, sell storage and key dongles while pointing your customer to front end software. The same way they used to sell crushed grapes during prohibition.
- r3bl 11y agoSo, a company that has added telemetry services to 90% of the desktop devices that are impossible to turn off completely (unless you block their entire IP range) is suing someone for not respecting user's privacy? What a joke.
- shkkmo 11y agoMicrosoft's ability to convince it's customer to trust Microsoft with their data is enhanced by protecting that data from third parties (such as the US government).
- EuAndreh 11y agoPrecisely.
- braderhart 11y agoExactly my thoughts. I have no reason to trust Microsoft at this point.
- TheLogothete 11y agoWhat telemetry has to do with private communication? Not a rhetorical question.
- nartz 11y agoGo microsoft!
- StephenConnell 11y agoGood for them. Sounds well thought out.
- tim333 11y agoGlad to see someone being positive if 95% of the way down the comments. I agree with Microsoft that saying you can never say what the government it up to is a violation of free speech and only justified in extreme cases.
- tehwebguy 11y ago> To be clear, we appreciate that there are times when secrecy around a government warrant is needed. This is the case, for example, when disclosure of the government’s warrant would create a real risk of harm to another individual or when disclosure would allow people to destroy evidence and thwart an investigation. So, like, every criminal investigation of a person who uses email?
- victorNicollet 11y agoI'm pretty sure that finished criminal investigations do not require secrecy except in very narrow cases of witness protection.
- drtillberg 11y agoIf the government can require Microsoft to break the contractual and fiduciary commitments to customers to protect data and report on what happens to it, can the government also require individual employees to break their commitments to their employers? Agents show up at data warehouse on 1000 Main Street, tell the employees they are prohibited from contacting their bosses, ever. What is the limiting principle, where does it end?
- newjersey 11y agoIt is unclear whether such an order can prevent someone from quitting their job on the spot. Any real, public court of law would hopefully release someone of such orders once they are no longer in a position to obey it.
- ikeboy 11y agoYou can require them to give you information. Previously promising that you wouldn't give the information doesn't help. Also, their TOS said they'd give data to the government of legally required, so no contract was broken.
- nxzero 11y agoBeside Moxie, is anyone else having success expanding the use of encryption?
- cpeterso 11y agoLet's Encrypt has issued 1.7 million free certificates for more than 3.8 million websites over the past six months. Let's Encrypt also enables companies like WordPress and DreamHost to offer free, easy HTTPS to their customers. https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors.html https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors...
- e12e 11y agoBut if Letsencrypt were served with an NSL demanding access to their signing keys, how would we know?
- zrm 11y agoThat isn't what it's for. You can assume the government (really any government) has control over at least one CA. What Let's Encrypt does against state-level actors is let people easily use HTTPS instead of HTTP without subjecting their users to self-signed certificate warnings. A government could still MITM the connection but that requires an active attack rather than passive surveillance. And active attacks are subject to detection. So it protects against undetectable mass surveillance.
- lorenzhs 11y agoThat would allow the government to issue new certificates, not to decrypt traffic to sites using letsencrypt certificates. Active man in the middle attacks are rather noisy, and things like HPKP exist to prevent such attacks
- DenisM 11y agoCert pinning makes it a difficult and expensive attack to carry out.
- 11y ago
- matt_wulfeck 11y agoThis is a great letter from Microsoft Nouveau and I applaud them for taking a stand. It's on us as citizens to exercise our rights and bring about change and reform. I think we should also remember those that took a stand early and paid the price, such as former Quest CEO Joseph Nacchio who was run under the bus for not being an accomplice to the NSA [1]. 1. https://www.rt.com/usa/qwest-ceo-nsa-jail-604/ https://www.rt.com/usa/qwest-ceo-nsa-jail-604/
- PhantomGremlin 11y agoJoseph Nacchio who was run under the bus Yeah, a link to one of Putin's propaganda sites. Stuff like that happens in Russia, but the following doesn't often happen here: - Co-opt the SEC into bringing charges of financial fraud[1] - convince a federal judge to go along with that, and convict him - convince a majority of a US Appeals court to go along with that Or, alternatively, and probably closer to the truth: Mr. Nacchio was convicted in 2007 on 19 counts of insider trading for illegally selling $52 million worth of stock six years earlier, after insiders warned him that Qwest could not meet its targets. [2] Edit: even better than that was Nacchio's excuse. It's one for the ages: Nacchio claimed that he was not in a rightful state of mind when he sold his shares because of problems with his son, and the imminent announcement of a number of government contracts. [1] [1] https://en.wikipedia.org/wiki/Joseph_Nacchio#Insider_trading.2C_fraud https://en.wikipedia.org/wiki/Joseph_Nacchio#Insider_trading... [2] http://www.nytimes.com/2009/02/26/business/26qwest.html http://www.nytimes.com/2009/02/26/business/26qwest.html
- e12e 11y agoWhat people have been saying, is that if most CEOs do insider trading, and only a few have charges brought against them, then that might indicate an abuse of power. Since the other CEOs (those whose companies wilfully broke the law), weren't investigated, it's a little difficult to be sure so long after the facts. As far as I know, none of them have been indited for helping the US government break the law - arguably a more serious crime than insider trading. The argument is that it's an instance of: "You bring me the man, I'll find you the crime."[1] Now, it could be that in the telecom industry at the time, in the US, there was little or no corruption and insider trading, and Nacchio was an exception. I certainly don't think he was framed. But there are at least some indications that it could have been a "tit for tat" that landed him in prison. [1] (reportedly stated by Stalin's chief of secret police, Lavrentiy Beria -- but I've been able to find a source).
- braderhart 11y agoDoes anyone else find it ironic that this is coming from Microsoft, yet they can't even open source a freaking web browser? Really?
- joshka 11y agoCan you explain why they'd need to given the quantity of existing open source browsers already out there?
- braderhart 11y agoBecause it's a web browser. What kind of proprietary trade secrets are they afraid of when every other browser is open, especially when they are touting the important of encryption and user security? More like they don't want users to know how much information they are actually collecting.
- recursive 11y agoNo.
- golfer 11y agoSecrecy is great for Microsoft when it's in the form of extorting Android OEMs with bogus patents for billions of dollars a year. Or copying Google's search results. But not when complying with government data requests. Got it.
- desbest 11y agolol
- conradev 11y agoI'm glad that Microsoft is speaking up, especially given their past history: http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...
- joeyrobert 11y ago> Over the past 18 months, the U.S. government has required that we maintain secrecy regarding 2,576 legal demands, effectively silencing Microsoft from speaking to customers about warrants or other legal process seeking their data. So should Outlook.com be considered insecure if the US government can access it at any time without you knowing? Microsoft should be able to inform you whether or not your information has been leaked. I hope Microsoft wins.
- duaneb 11y agoEmail should not be considered secure from governments, period, unless you run your own encryption (PGP).
- e12e 11y agoIt just occurred to me, reading: "To be clear, we appreciate that there are times when secrecy around a government warrant is needed. This is the case, for example, when disclosure of the government’s warrant would (...) allow people to destroy evidence and thwart an investigation.", that we shouldn't be too broad in denying the ability to destroy evidence or thwart investigations. Consider charges of conspiracy, or of access to classified material. If the suspect destroys the evidence, and commits/have not already committed any other crimes -- should we really use the resources to investigate and prosecute such thought crimes? We risk loosing sight of the fact that punishment is not a goal, it's a means to an end. Hopefully that end is a free and safe society.
- TheLogothete 11y agoA conspiracy to commit crime is not a thought crime, it's an actual crime. edit: where thought = imaginary
- Karunamon 11y agoWhich is utter crap, since no action has actually taken place and nobody has actually been harmed. I've long held that "conspiracy to X" charges were just a way for the government to throw the book at someone they otherwise wouldn't be able to.
- TheLogothete 11y agoThat completely ignores reality. It is one thing for me to say "let's kill Bill". It is an entirely different thing for me and you to surveil his movements, his schedule, to develop code names, to discuss scenarios for action, to procure means to assassinate him. You can show evidence of serious intent in a conspiracy.
- coke12 11y agoIf I make a plan to murder a person, the police shouldn't have to wait until after the murder to arrest me.
- fluffyhayley 11y agoThnak you for this blog
- ComodoHacker 11y agoI have a growing impression that big tech players have developed a cooperative strategy and coordinate their moves to protect users' data in the cloud. And that movement has no altruistic or politic roots but strong economic ones. They just HAVE to ward off any needle threatening to stick the cloud bubble they made huge bets on. And this is good for the public.
- tim333 11y agoI haven't seen any significant trend of people stopping using cloud services because they are worried about the NSA. I doubt they have to do this stuff. Maybe fighting the government might move useage a few percent. Can't see it being a game changer really.
- studentrob 11y ago> I doubt they have to do this stuff Perhaps they do not have to, but they should if they want to retain and grow customers in the future. Anyone who's been bitten by data theft will tune into this. I imagine that includes any major business. MS is jumping on the bandwagon before it falls behind in the PR campaign. This could be the next campaign similar to environmental friendliness or human rights. It's not enough for tech companies to be "green" or have good factory conditions. Now that they hold so much user data, they must also demonstrate their commitment to security and transparency.
- m_fayer 11y agoAs a contractor working in Germany, I have encountered many small and medium businesses that are leery of American cloud providers for data security reasons, sometimes unreasonably so. They would like to use the clouds but can't bring themselves to do so. It's a little breathtaking to watch Amazon Google or Microsoft pass up significant revenue in real time because of us policy.
- Zelmor 11y agoNice PR spin, but I do not believe their lies. They are just riding the Apple-PR-train, and people are eating it up wholesale. The whole of win10 is open to machinations and spying on you. You even sign your privacy away in their eula. Do not believe their lies. Microsoft is a harmful entity.
- sleepychu 11y ago+they put the handy dandy NSA root cert in their stores, IIRC.
- ikeboy 11y agohttps://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY There were reasonable explanations offered.
- cm2187 11y agoI would tend to think this is more to defend their cloud service, which they see now as a core business. If you are even a small supplier of airbus, after the Snowden revelations, you would be very brave to save any file in a Microsoft/Google/Amazon controlled server. These intrusions are an existential threat for these companies.
- wuschel 11y agoCould you elaborate, with some examples? I am aware of the risks involved in using US cloud services, as every data on the cloud is exposed to hostile access to some point. Basically, keep your mission critical files of the internet. I just would like to have some sources / explanations to your statement.
- HappyTypist 11y agoNSA shared Airbus's R&D designs, technical specifications, etc with Boeing.
- tim333 11y ago
- xerxes777 11y agoIt's funny because Apple, Google and Microsoft are all public companies and government owns most of their shares. It's not even Apple-PR-train.
- tim333 11y ago>government owns most of their shares I think you'll find that's not the case.
- hollander 11y agoThe only reason for the abuse of secrecy, is to keep the abuse secret.
- mikx007 11y agoCan the government force a private business entity to lie to their customer? If not, then why can't Microsoft just setup some sort of service/status report that basically outputs "no" if and only if the government did not access data and "unknown" otherwise.
- joncrocks 11y agoThis sounds very similar to a warrant canary - https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary
- studentrob 11y agoThat sounds like a great technical solution. I still think MS should pursue their case but I wonder why they have not set up the system you're describing, given that another commenter's link suggests it is legal [1] [1] https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary
- iammyIP 11y agoThey force push windows 10 on all fronts with all its telemetric inbuilt leakage and also i suppose some nsa backdoors and after that they write some PR paper like this, put on a cardboard Ubuntu mask and throw around some open source confetti.
- clebio 11y agoThis -- or this topic -- should be the top-level thread. I refuse to use Windows 10, and am not sure what to do going forward for software that I use which only runs on Windows.
- EdSharkey 11y agoTELEMETRY