4 ms·

Microsoft will now snitch on you at work like never before

54 points by jensgk 5y ago

breakingcups 5y ago
This is horribly dystopian. My company is pretty heavily into the Microsoft stack and I'm luckily a heavy voice in the decision making tree, this will never ever get enabled on our tenant. Here's hoping we don't unwittingly feed the ML machine behind this even if we never enable this. I hate this new world.
- GekkePrutser 5y ago
  I wish you were a heavy voice in the decision making tree at our company :'(
  - johnisgood 5y ago
    And a lot of other companies, too. I mean jeez, it is a horrible idea.
- tibbydudeza 5y ago
  Hopefully your vote > HR and CEO
aeternum 5y ago
Lots of embellishment in this article, very little substance or detail on what is actually being tracked.
- loa_in_ 5y ago
  I think it's kind of the point, as we can't really quantify "character". And that's phrasing straight from Microsoft. > Yes, your company will soon have extra-special robots to crawl along after you and observe your every "risky" action. It's not enough to have increased visibility on browsers. You must also have Machine Learning constantly alert for someone revealing your lunch schedule. > Microsoft offers a link to its Insider Risk Management page. This enjoys some delicious phrasing: "Customers acknowledge insights related to the individual user's behavior, character, or performance materially related to employment can be calculated by the administrator and made available to others in the organization." > Yes, even your character is being examined here.
- tomnipotent 5y ago
  Agreed. This is trash opinion journalism that should be marked an opinion piece but isn't. Zero actually useful information.
propogandist 5y ago
The article is light on substance and focuses on a click baity headline, which unfortunately is necessary to get peoples attention to what's happening From reading into the docs a bit, it seems the data MSFT is gathering on users apparently is surfaced in a dashboard, initially anonymized, to help administrators create policies (to get started as part of a Day 0 experience). Once policies are defined, MSFT will start snitching on individual users to org admins, analysts and investigators, depending on the policy that is in place at the organization. The article headline is technically true, in that MSFT is capturing this data today across O365 and Windows products, and they're expanding on what can be done with the data (fundamentally have the machine snitch on the employee). https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-settings?view=o365-worldwide#analytics https://docs.microsoft.com/en-us/microsoft-365/compliance/in...
GekkePrutser 5y ago
I really hate their reports too, their "Insights". Telling me how I should be doing my job and if I used their sacred features enough to be a worthy employee. Once it was telling me I didn't use the @mention feature in Teams enough, stuff like that. You know, that Teams that is constantly crashing or hanging and takes about a minute to launch. Maybe make it actually work before lecturing me on how to use it? Not to mention they use the same standards to evaluate everybody. Whereas in some jobs (e.g. project manager) it's good to be on calls all day whereas with others (e.g. technical roles) it's important to have time to focus. They don't take this into account at all. Of course I turn that crap off. I don't get the reports. But I'm sure it doesn't stop the actual collection of data. And more worrying, it shows there's people at Microsoft who think this stuff is a good idea and totally justifiable. Eeeew. I know they say they don't show identifiable information to the employer. I have to trust them at that because I can't verify it. But collection of personal data is a bad thing whether it has consequences or not. Just knowing it's being collected changes one's behaviour and makes one feel unsafe. This is how a panopticon prison works. Unfortunately some of the higher-ups at our company have been extensively groomed by Microsoft (remember the old saying: Microsoft is much better at talking to your boss than you are!) so I'm sure this will be switched on as soon as they can. Insights reports are already often re-enabled as a friendly 'suggestion', of course the holy Edge has been made the standard browser with its Bing search (tm). This'll be next. I'm not against vigilance against 'insider trust/threat' issues by the way. I know the department that follows up on these and I know some of the things they have come up with were really bad. However I believe this is a typical thing that requires targeted investigation and human detective work, not dragnets and machine learning. The same way I believe this for society in general.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- rmdashrfstar 5y ago
  > […] But collection of personal data is a bad thing whether it has consequences or not. Just knowing it's being collected changes one's behaviour and makes one feel unsafe. This is how a panopticon prison works. For those who are unfamiliar with Panopticon prisons: > The panopticon is a type of institutional building and a system of control designed by the English philosopher and social theorist Jeremy Bentham in the 18th century. The concept of the design is to allow all prisoners of an institution to be observed by a single security guard, without the inmates being able to tell whether they are being watched. > … > Although it is physically impossible for the single guard to observe all the inmates' cells at once, the fact that the inmates cannot know when they are being watched means that they are motivated to act as though they are being watched at all times. Thus, the inmates are effectively compelled to regulate their own behaviour. https://www.wikiwand.com/en/Panopticon https://www.wikiwand.com/en/Panopticon One could easily draw a parallel here. An interesting paragraph here describes the design of the incentive structure within the prison’s management: > [The prison’s designer] thought that the chief mechanism that would bring the manager of the panopticon prison in line with the duty to be humane would be publicity. Bentham tried to put his duty and interest junction principle into practice by encouraging a public debate on prisons. Bentham's inspection principle applied not only to the inmates of the panopticon prison, but also the manager. The unaccountable [prison officer] was to be observed by the general public and public officials. The apparently constant surveillance of the prison inmates by the panopticon manager and the occasional observation of the manager by the general public was to solve the age old philosophic question: "Who guards the guards?"[6] The age old answers to this philosophical question propose that a guardian for the guard to be an absurd idea, or one that plays out only with a plurality of guardians, who guard others against the deception of other guardians’ “noble lies”. > A noble lie is a myth or untruth, often, but not invariably, of a religious nature, knowingly propagated by an elite to maintain social harmony or to advance an agenda. https://en.wikipedia.org/wiki/Noble_lie https://en.wikipedia.org/wiki/Noble_lie
literallyaduck 5y ago
It is time for prosecution of Microsoft and companies using this feature under the wiretapping laws we have on the books. The other users of my network haven't consented to a company or Microsoft monitoring traffic.
- loosetypes 5y ago
  I read the article but didn’t see any mention of inspecting network activity outside of, say, a company laptop but on the same WiFi network while WFH. Do you, or anyone else, know if this happens or is commonplace? For software folks?
nyxaiur 5y ago
If I get my webcam, microphone and usb ports back on my high security laptop I am all for it.
tibbydudeza 5y ago
That is why I run only work stuff in a VM or another separate laptop.
- BizarroLand 5y ago
  Yeah, just wait until your work laptop starts spying on what the other devices on your home network are doing and report that information back to your job. Oh, you used a M$ personal computer at midnight to look at an adult site? Well, your work computer talked to your personal computer and told your boss on you, so we're firing you.
  - adriancr 5y ago
    How would it do that? Wifi isolation/tls everywhere means it cant snoop traffic. Other machines running Linux means no correlation of telemetry. (even if they ran windows it would be complicated legally and technically to do what you say) Even the scenario above if remotely possible you would sue and at discovery it would be interesting / you would win more in settlement.
    - BizarroLand 5y ago
      I can think of a couple of ways. If you use Edge then it could report back using any number of built in telemetry settings (assuming they exist, which I do not know). If you have the setting enabled on your windows machines to share update data then it would be feasible to send additional data with that, although I can admit that both methods would be opening multiple opportunities for M$ to be sued for all sorts of things.

54 points by jensgk 5y ago

This is horribly dystopian. My company is pretty heavily into the Microsoft stack and I'm luckily a heavy voice in the decision making tree, this will never ever get enabled on our tenant. Here's hoping we don't unwittingly feed the ML machine behind this even if we never enable this. I hate this new world.

GekkePrutser 5y ago
I wish you were a heavy voice in the decision making tree at our company :'(
- johnisgood 5y ago
  And a lot of other companies, too. I mean jeez, it is a horrible idea.
tibbydudeza 5y ago
Hopefully your vote > HR and CEO

aeternum 5y ago

Lots of embellishment in this article, very little substance or detail on what is actually being tracked.

loa_in_ 5y ago
I think it's kind of the point, as we can't really quantify "character". And that's phrasing straight from Microsoft. > Yes, your company will soon have extra-special robots to crawl along after you and observe your every "risky" action. It's not enough to have increased visibility on browsers. You must also have Machine Learning constantly alert for someone revealing your lunch schedule. > Microsoft offers a link to its Insider Risk Management page. This enjoys some delicious phrasing: "Customers acknowledge insights related to the individual user's behavior, character, or performance materially related to employment can be calculated by the administrator and made available to others in the organization." > Yes, even your character is being examined here.
tomnipotent 5y ago
Agreed. This is trash opinion journalism that should be marked an opinion piece but isn't. Zero actually useful information.

propogandist 5y ago

The article is light on substance and focuses on a click baity headline, which unfortunately is necessary to get peoples attention to what's happening From reading into the docs a bit, it seems the data MSFT is gathering on users apparently is surfaced in a dashboard, initially anonymized, to help administrators create policies (to get started as part of a Day 0 experience). Once policies are defined, MSFT will start snitching on individual users to org admins, analysts and investigators, depending on the policy that is in place at the organization. The article headline is technically true, in that MSFT is capturing this data today across O365 and Windows products, and they're expanding on what can be done with the data (fundamentally have the machine snitch on the employee). https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-settings?view=o365-worldwide#analytics https://docs.microsoft.com/en-us/microsoft-365/compliance/in...

GekkePrutser 5y ago

I really hate their reports too, their "Insights". Telling me how I should be doing my job and if I used their sacred features enough to be a worthy employee. Once it was telling me I didn't use the @mention feature in Teams enough, stuff like that. You know, that Teams that is constantly crashing or hanging and takes about a minute to launch. Maybe make it actually work before lecturing me on how to use it? Not to mention they use the same standards to evaluate everybody. Whereas in some jobs (e.g. project manager) it's good to be on calls all day whereas with others (e.g. technical roles) it's important to have time to focus. They don't take this into account at all. Of course I turn that crap off. I don't get the reports. But I'm sure it doesn't stop the actual collection of data. And more worrying, it shows there's people at Microsoft who think this stuff is a good idea and totally justifiable. Eeeew. I know they say they don't show identifiable information to the employer. I have to trust them at that because I can't verify it. But collection of personal data is a bad thing whether it has consequences or not. Just knowing it's being collected changes one's behaviour and makes one feel unsafe. This is how a panopticon prison works. Unfortunately some of the higher-ups at our company have been extensively groomed by Microsoft (remember the old saying: Microsoft is much better at talking to your boss than you are!) so I'm sure this will be switched on as soon as they can. Insights reports are already often re-enabled as a friendly 'suggestion', of course the holy Edge has been made the standard browser with its Bing search (tm). This'll be next. I'm not against vigilance against 'insider trust/threat' issues by the way. I know the department that follows up on these and I know some of the things they have come up with were really bad. However I believe this is a typical thing that requires targeted investigation and human detective work, not dragnets and machine learning. The same way I believe this for society in general.

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
rmdashrfstar 5y ago
> […] But collection of personal data is a bad thing whether it has consequences or not. Just knowing it's being collected changes one's behaviour and makes one feel unsafe. This is how a panopticon prison works. For those who are unfamiliar with Panopticon prisons: > The panopticon is a type of institutional building and a system of control designed by the English philosopher and social theorist Jeremy Bentham in the 18th century. The concept of the design is to allow all prisoners of an institution to be observed by a single security guard, without the inmates being able to tell whether they are being watched. > … > Although it is physically impossible for the single guard to observe all the inmates' cells at once, the fact that the inmates cannot know when they are being watched means that they are motivated to act as though they are being watched at all times. Thus, the inmates are effectively compelled to regulate their own behaviour. https://www.wikiwand.com/en/Panopticon https://www.wikiwand.com/en/Panopticon One could easily draw a parallel here. An interesting paragraph here describes the design of the incentive structure within the prison’s management: > [The prison’s designer] thought that the chief mechanism that would bring the manager of the panopticon prison in line with the duty to be humane would be publicity. Bentham tried to put his duty and interest junction principle into practice by encouraging a public debate on prisons. Bentham's inspection principle applied not only to the inmates of the panopticon prison, but also the manager. The unaccountable [prison officer] was to be observed by the general public and public officials. The apparently constant surveillance of the prison inmates by the panopticon manager and the occasional observation of the manager by the general public was to solve the age old philosophic question: "Who guards the guards?"[6] The age old answers to this philosophical question propose that a guardian for the guard to be an absurd idea, or one that plays out only with a plurality of guardians, who guard others against the deception of other guardians’ “noble lies”. > A noble lie is a myth or untruth, often, but not invariably, of a religious nature, knowingly propagated by an elite to maintain social harmony or to advance an agenda. https://en.wikipedia.org/wiki/Noble_lie https://en.wikipedia.org/wiki/Noble_lie

literallyaduck 5y ago

It is time for prosecution of Microsoft and companies using this feature under the wiretapping laws we have on the books. The other users of my network haven't consented to a company or Microsoft monitoring traffic.

loosetypes 5y ago
I read the article but didn’t see any mention of inspecting network activity outside of, say, a company laptop but on the same WiFi network while WFH. Do you, or anyone else, know if this happens or is commonplace? For software folks?

nyxaiur 5y ago

If I get my webcam, microphone and usb ports back on my high security laptop I am all for it.

tibbydudeza 5y ago

That is why I run only work stuff in a VM or another separate laptop.

BizarroLand 5y ago
Yeah, just wait until your work laptop starts spying on what the other devices on your home network are doing and report that information back to your job. Oh, you used a M$ personal computer at midnight to look at an adult site? Well, your work computer talked to your personal computer and told your boss on you, so we're firing you.
- adriancr 5y ago
  How would it do that? Wifi isolation/tls everywhere means it cant snoop traffic. Other machines running Linux means no correlation of telemetry. (even if they ran windows it would be complicated legally and technically to do what you say) Even the scenario above if remotely possible you would sue and at discovery it would be interesting / you would win more in settlement.
  - BizarroLand 5y ago
    I can think of a couple of ways. If you use Edge then it could report back using any number of built in telemetry settings (assuming they exist, which I do not know). If you have the setting enabled on your windows machines to share update data then it would be feasible to send additional data with that, although I can admit that both methods would be opening multiple opportunities for M$ to be sued for all sorts of things.