6 ms·

Microsoft introduces ways of detecting “leavers” in email

87 points by easton 4y ago

car_analogy 4y ago
> Built with privacy by design, usernames are pseudonymized by default, role-based access controls are built in, investigators are explicitly opted in by an admin, and audit logs are in place to ensure user-level privacy. Well nothing to worry about then.
- u2077 4y ago
  Forgot a part: > And employees are opted in without any notice from their employer [edit] Obviously professional communication channels are monitored, but it would still be nice to be informed when policies change. (Anyhow, personal and professional communications should always be kept separate to avoid this issue)
  - alar44 4y ago
    Well no shit, it's company email, there's no expectation of privacy or control here.
    - GekkePrutser 4y ago
      As far as I understand this is not just email, but teams conversations as well (though I'm not sure if it applies to both voice & text or just text, but be aware that Teams already has voice to text built right in!) And also be aware that the 'watercooler' conversation has been replaced with digital forms over the last 2 years, meaning a look over your shoulder to see who's within earshot is no longer sufficient. And it's not always obvious that someone (or something, in this case) may be watching. In the last 2 years most of my comms with my colleagues went from 90% face to face to 80% digital. Big difference. And it's not healthy either to not talk about frustrations at work.
      - alar44 4y ago
        The last place I worked for used this. I didn't care. Now I'm in the position to make this call for my org and I wouldn't use it. This is a tool for org admins, this isn't MS being evil. If your company uses it, be pissed at them if you so choose, not MS.
        car_analogy 4y ago
        Yeah MS is just making and selling tools to make dystopian omnipresent AI surveillance easier and more likely, they're not actually forcing anyone to use them, so it's 100% ok and moral.
        alar44 4y ago
        That's not what this is, stop being so dramatic.
        prepend 4y ago
        That’s sort of what it’s like as the development of these tools is not cool. It’s like people who write spam software who say “it’s really up to spammers who choose to use this software, don’t blame us.” There’s really not a positive reason to identify “leavers.” Their data exfoliation reason is bogus and should be prevented by other reasons anyway.
        alar44 4y ago
        How is it not in a businesses best interest to identify who wants to leave? Are you assuming they'd get fired or something? Maybe they are integral to the company and they'd get a raise or some other perk. Take your tinfoil hat off and get outside.
        GekkePrutser 4y ago
        Still, it's not good when someone has private concerns to intrude on these. This barrier exists for a reason. It will only make coworkers more fake because they will watch more what they say. A panopticon is never good. PS: If my work starts using this I will start doing a "compliance bingo", to try and trigger as many detections as I can every day :) And I will say so publicly.
    - more_corn 4y ago
      There is a reasonable expectation not to be targeted by adversarial AI though. This feature makes a terrible future. I will never recommend a client use MS email again.
  - more_corn 4y ago
    There is no such thing as automatic opt-in. That’s weasel talk. Opt in means you get to choose if you want it. They’re turning it on by default and not telling people. This is the most bullshit thing Microsoft has done in decades.
easton 4y ago
Here’s the actual changelog: https://www.microsoft.com/en-us/microsoft-365/roadmap?rtc=1&filters=Rolling%20out%2CIn%20development&searchterms=Communication%2Ccompliance https://www.microsoft.com/en-us/microsoft-365/roadmap?rtc=1&...
- netsharc 4y ago
  It's the item with the words "leavers classifier" in the title. Hah, creepy technology. I suppose they could do a lot more, like using metrics to measure productivity, and if it's below what the employee usually has, then, maybe they've lost motivation.
  - GekkePrutser 4y ago
    They pretty much do this already. If you opt in to office insights you get mails like "hey you @mentioned your colleagues 22% less this week, maybe you should engage more with your team!".
GekkePrutser 4y ago
What the flying f***.. Is this going to be a standard part of Microsoft 365? Edit: Nope, luckily not. It's part of Microsoft Purview, which is an add-on to M365 by the looks of it: https://www.microsoft.com/en-us/security/business/microsoft-purview https://www.microsoft.com/en-us/security/business/microsoft-... . At least it's not going to bother everyone that uses M365. It probably costs a lot to add on too. Meaning our company will probably not use it. Phew. But whoever's employer does buy this are now constantly going to be scanned for potential malicious activity at work. Sounds like a scene from The Circle, or worse, The Every. Where the characters constantly have to express how happy they are and how aligned with the company because they're insta-fired if they're in the bottom 10%. This was meant to be a work of fiction. 1984 was not a manual, Microsoft. When Microsoft started their data farming with office insights "purely anonymous and intended to help increase your personal performance!!" I always knew it was a way of introducing much worse. But I didn't imagine they'd go this far this quickly, I assumed they'd just use all the data for marketing and misguided employee performance metrics. I say "misguided" since Office insights used the same "healthy" metrics for online meeting hours, concentration hours etc regardless of employees' roles, which obviously differ greatly in the type of work and amount of collaboration. I'm not sure if it still does this by the way, as I turned it off after the first weeks. Which by the way doesn't stop it collecting data, it just stops emailing me about it. It's a totally different thing to accuse employees of wrongdoing based on AI algorithms though. Imagine saying something like "oh god what a day, I hate this place" in a private teams chat after a frustrating meeting. +1 potential leaver point. Or "hey I hope they're going to give us some nice goodies at that event!". +1 suspicious gifts point. A few more points and way to go, you're on the HR shitlist. Sure, Microsoft recommend an "explicitly opted-in investigator" looks at it but who has time to spare these days. It'll just end up a metric on an excel sheet somewhere. I'm sure the data will be "anonymised" but this will probably mean that it will be averaged across a team. Since most of our teams are really small, it's really not that anonymous. And in fact, it makes it even harder to disprove, a low 'leaver' score might be caused by one colleague and put a dark shade over the entire team. I really don't like this at all. I understand that corporate comms tools are not meant to be private. But to me that means someone could look at it in the case of major transgressions. Not to constantly look at it and weigh every word in search of things which aren't even transgressions (as far as I recall, wanting to leave an organisation is still legal). PS: Also... "usernames are pseudonymized by default". What do you mean "by default"???, so it can be switched off to not pseudonymise? I really wonder how legal this is in the EU, especially stricter countries like Germany.
throwaway0a5e 4y ago
I have zero confidence that this system is smart enough to differentiate between all these things and the legitimate variants thereof that companies actually want people doing or discussing and likely outnumber the bad by orders of magnitude.
- fnordpiglet 4y ago
  Dear throwaway0a5e, We have detected overly negative language in your correspondence that we have correlated with being a danger to yourself or others. Due to this we have decided to terminate your employment immediately. Please find attached references to local psychiatrists that may be able to help you with your reeducation. Have a nice day!
  - olyjohn 4y ago
    Don't forget to drink your verification can!
lasereyes136 4y ago
Don't use your work computer for non-work related things, especially looking for another job. Get another computer for your personal use. The company owns those company assets and can do with them what they want. You don't have an expectation of privacy on your company computer.
- GekkePrutser 4y ago
  No you don't. But you do have a working relationship with your colleagues which is increasingly digital (don't forget the huge shift to WFH!) and thus all captured and analysed by software like this. Such human relationships may include banter which may be about how you might like the look of the canteen girl, about frustration at processes, about going for dinner with a vendor. All things which would be flagged under this. This is not your regular "personal use" web usage monitoring which we've all come to loathe.
  - arroz 4y ago
    Yeah i don’t do any of the things you said when using the companies computer and I WFH It is okay to ask for people’s WhatsApp / Facebook and so on to talk about this sort of stuff
  - mr_toad 4y ago
    > how you might like the look of the canteen girl I would never put anything like that in email, or even say it in a teams call. “Never write a letter, and never destroy one.” - Cardinal Richelieu
    - GekkePrutser 4y ago
      Well it's not always bad. I've seen it happen before and they are now happily married :) (Though being a couple at work is kinda weird).
- nicbou 4y ago
  Unless you live in Germany, where you still get to have such expectations, even when using company hardware.
gigel82 4y ago
So this is just Email and Teams, right? This isn't corroborated with intrusive MITM-extracted browser history from work computers, right? Right !? Dear company IT spy overlords, my use of LeetCode is exclusively to learn new interviewing techniques to help me bring in only the best of the best to our amazing company! /s
bpiche 4y ago
Didn’t they acquire Yammer a few years ago? That was a prototype for surveillance social media, if you ask me.
ojosilva 4y ago
This all feels very "pre-crime" dystopian to me, per PKD. Or "thoughtcrime", like Orwell would put it. https://en.wikipedia.org/wiki/Pre-crime https://en.wikipedia.org/wiki/Pre-crime
capguy255 4y ago
Having used the comm compliance tool in m365 and other similar tech - a lot of the comments here seem to miss the point. "Leaver" IT policies are fairly common security practices to limit the risk that someone takes IP or customer lists with them to another job. The point is not to detect whether someone is going to quit but rather to detect unapproved behaviors by someone as they are on the way out the door. There are various compliance tools in Office 365 designed for data retention, eDiscovery, and investigation and this is an offshoot of that. It is more efficient and less obtrusive to target suspect behaviors than to have an analyst or attorney download and review all of an employee's communication and activity. As I've seen communication compliance used, the leaver policy is enabled when a person is marked within an HR system as leaving the company, or when their Active Directory account is disabled. If certain sequences of activity occur such as downloading lots of files from SharePoint and they are copied to a USB drive or to an external file share, or if a file previously owned by the leaving employee is accessed after the AD account is disabled by an external user, it fires off an alert. I'm skeptical about the value of the use of a "classifier" given that there isn't much documentation that explains how it works, how it's trained, and any documented workflow to statistically validate the model. Instead of using "classifiers" you can create custom policies based around keywords, regex patterns, or targeting sequences such as download x # of files then copy then delete. I think it would be interesting if you could build a custom classifier using your own positive and negative examples, define your own score thresholds, train models around specific excerpts rather than on entire emails, and test the classifier using a set of human reviewed data. Regardless though - I'm far less suspicious of the general idea that companies are focused on "inside threats" than whether they understand how things work. Machine learning algorithms are basically just fancy text searching backed by statistical analysis but there are a lot of input variables and also a few different ways to defensibly measure the performance of the tools. The M365 tool doesn't expose much of that and a lot of compliance teams are probably going to be concerned about wasting time chasing false positives.
stimpson_j_cat 4y ago
For sake of discussion: aren't there uses of this that aren't nefarious? Their claim that employees intending to leave "may put the organization at risk of malicious or inadvertent data exfiltration upon departure" is, cynically, corporate bs; but data theft or vandalism isn't entirely unheard of by departing employees. Ever moved your source code to a thumb driver before you left your job, even though your contract technically forbids it, you've signed away the IP rights, etc?
- JonChesterfield 4y ago
  It's weird to assume that noone would copy the data before resigning instead of after resigning though. Especially if your company might immediately garden leave you.
prepend 4y ago
Since it’s Microsoft AI, I assume it will be lousy and full of false positives and predict lots of false negatives. It’s weird how there is no predicted accuracy and no SLA or any measure to hold it to. So should be a frustrating time using the information properly. I assume smart people will ignore the results and idiots will think it means someone will leave.

87 points by easton 4y ago

> Built with privacy by design, usernames are pseudonymized by default, role-based access controls are built in, investigators are explicitly opted in by an admin, and audit logs are in place to ensure user-level privacy. Well nothing to worry about then.

u2077 4y ago
Forgot a part: > And employees are opted in without any notice from their employer [edit] Obviously professional communication channels are monitored, but it would still be nice to be informed when policies change. (Anyhow, personal and professional communications should always be kept separate to avoid this issue)
- alar44 4y ago
  Well no shit, it's company email, there's no expectation of privacy or control here.
  - GekkePrutser 4y ago
    As far as I understand this is not just email, but teams conversations as well (though I'm not sure if it applies to both voice & text or just text, but be aware that Teams already has voice to text built right in!) And also be aware that the 'watercooler' conversation has been replaced with digital forms over the last 2 years, meaning a look over your shoulder to see who's within earshot is no longer sufficient. And it's not always obvious that someone (or something, in this case) may be watching. In the last 2 years most of my comms with my colleagues went from 90% face to face to 80% digital. Big difference. And it's not healthy either to not talk about frustrations at work.
    - alar44 4y ago
      The last place I worked for used this. I didn't care. Now I'm in the position to make this call for my org and I wouldn't use it. This is a tool for org admins, this isn't MS being evil. If your company uses it, be pissed at them if you so choose, not MS.
      - car_analogy 4y ago
        Yeah MS is just making and selling tools to make dystopian omnipresent AI surveillance easier and more likely, they're not actually forcing anyone to use them, so it's 100% ok and moral.
        alar44 4y ago
        That's not what this is, stop being so dramatic.
        prepend 4y ago
        That’s sort of what it’s like as the development of these tools is not cool. It’s like people who write spam software who say “it’s really up to spammers who choose to use this software, don’t blame us.” There’s really not a positive reason to identify “leavers.” Their data exfoliation reason is bogus and should be prevented by other reasons anyway.
        alar44 4y ago
        How is it not in a businesses best interest to identify who wants to leave? Are you assuming they'd get fired or something? Maybe they are integral to the company and they'd get a raise or some other perk. Take your tinfoil hat off and get outside.
        GekkePrutser 4y ago
        Still, it's not good when someone has private concerns to intrude on these. This barrier exists for a reason. It will only make coworkers more fake because they will watch more what they say. A panopticon is never good. PS: If my work starts using this I will start doing a "compliance bingo", to try and trigger as many detections as I can every day :) And I will say so publicly.
  - more_corn 4y ago
    There is a reasonable expectation not to be targeted by adversarial AI though. This feature makes a terrible future. I will never recommend a client use MS email again.
- more_corn 4y ago
  There is no such thing as automatic opt-in. That’s weasel talk. Opt in means you get to choose if you want it. They’re turning it on by default and not telling people. This is the most bullshit thing Microsoft has done in decades.

easton 4y ago

Here’s the actual changelog: https://www.microsoft.com/en-us/microsoft-365/roadmap?rtc=1&filters=Rolling%20out%2CIn%20development&searchterms=Communication%2Ccompliance https://www.microsoft.com/en-us/microsoft-365/roadmap?rtc=1&...

netsharc 4y ago
It's the item with the words "leavers classifier" in the title. Hah, creepy technology. I suppose they could do a lot more, like using metrics to measure productivity, and if it's below what the employee usually has, then, maybe they've lost motivation.
- GekkePrutser 4y ago
  They pretty much do this already. If you opt in to office insights you get mails like "hey you @mentioned your colleagues 22% less this week, maybe you should engage more with your team!".

GekkePrutser 4y ago

What the flying f***.. Is this going to be a standard part of Microsoft 365? Edit: Nope, luckily not. It's part of Microsoft Purview, which is an add-on to M365 by the looks of it: https://www.microsoft.com/en-us/security/business/microsoft-purview https://www.microsoft.com/en-us/security/business/microsoft-... . At least it's not going to bother everyone that uses M365. It probably costs a lot to add on too. Meaning our company will probably not use it. Phew. But whoever's employer does buy this are now constantly going to be scanned for potential malicious activity at work. Sounds like a scene from The Circle, or worse, The Every. Where the characters constantly have to express how happy they are and how aligned with the company because they're insta-fired if they're in the bottom 10%. This was meant to be a work of fiction. 1984 was not a manual, Microsoft. When Microsoft started their data farming with office insights "purely anonymous and intended to help increase your personal performance!!" I always knew it was a way of introducing much worse. But I didn't imagine they'd go this far this quickly, I assumed they'd just use all the data for marketing and misguided employee performance metrics. I say "misguided" since Office insights used the same "healthy" metrics for online meeting hours, concentration hours etc regardless of employees' roles, which obviously differ greatly in the type of work and amount of collaboration. I'm not sure if it still does this by the way, as I turned it off after the first weeks. Which by the way doesn't stop it collecting data, it just stops emailing me about it. It's a totally different thing to accuse employees of wrongdoing based on AI algorithms though. Imagine saying something like "oh god what a day, I hate this place" in a private teams chat after a frustrating meeting. +1 potential leaver point. Or "hey I hope they're going to give us some nice goodies at that event!". +1 suspicious gifts point. A few more points and way to go, you're on the HR shitlist. Sure, Microsoft recommend an "explicitly opted-in investigator" looks at it but who has time to spare these days. It'll just end up a metric on an excel sheet somewhere. I'm sure the data will be "anonymised" but this will probably mean that it will be averaged across a team. Since most of our teams are really small, it's really not that anonymous. And in fact, it makes it even harder to disprove, a low 'leaver' score might be caused by one colleague and put a dark shade over the entire team. I really don't like this at all. I understand that corporate comms tools are not meant to be private. But to me that means someone could look at it in the case of major transgressions. Not to constantly look at it and weigh every word in search of things which aren't even transgressions (as far as I recall, wanting to leave an organisation is still legal). PS: Also... "usernames are pseudonymized by default". What do you mean "by default"???, so it can be switched off to not pseudonymise? I really wonder how legal this is in the EU, especially stricter countries like Germany.

throwaway0a5e 4y ago

I have zero confidence that this system is smart enough to differentiate between all these things and the legitimate variants thereof that companies actually want people doing or discussing and likely outnumber the bad by orders of magnitude.

fnordpiglet 4y ago
Dear throwaway0a5e, We have detected overly negative language in your correspondence that we have correlated with being a danger to yourself or others. Due to this we have decided to terminate your employment immediately. Please find attached references to local psychiatrists that may be able to help you with your reeducation. Have a nice day!
- olyjohn 4y ago
  Don't forget to drink your verification can!

lasereyes136 4y ago

Don't use your work computer for non-work related things, especially looking for another job. Get another computer for your personal use. The company owns those company assets and can do with them what they want. You don't have an expectation of privacy on your company computer.

GekkePrutser 4y ago
No you don't. But you do have a working relationship with your colleagues which is increasingly digital (don't forget the huge shift to WFH!) and thus all captured and analysed by software like this. Such human relationships may include banter which may be about how you might like the look of the canteen girl, about frustration at processes, about going for dinner with a vendor. All things which would be flagged under this. This is not your regular "personal use" web usage monitoring which we've all come to loathe.
- arroz 4y ago
  Yeah i don’t do any of the things you said when using the companies computer and I WFH It is okay to ask for people’s WhatsApp / Facebook and so on to talk about this sort of stuff
- mr_toad 4y ago
  > how you might like the look of the canteen girl I would never put anything like that in email, or even say it in a teams call. “Never write a letter, and never destroy one.” - Cardinal Richelieu
  - GekkePrutser 4y ago
    Well it's not always bad. I've seen it happen before and they are now happily married :) (Though being a couple at work is kinda weird).
nicbou 4y ago
Unless you live in Germany, where you still get to have such expectations, even when using company hardware.

gigel82 4y ago

So this is just Email and Teams, right? This isn't corroborated with intrusive MITM-extracted browser history from work computers, right? Right !? Dear company IT spy overlords, my use of LeetCode is exclusively to learn new interviewing techniques to help me bring in only the best of the best to our amazing company! /s

bpiche 4y ago

Didn’t they acquire Yammer a few years ago? That was a prototype for surveillance social media, if you ask me.

ojosilva 4y ago

This all feels very "pre-crime" dystopian to me, per PKD. Or "thoughtcrime", like Orwell would put it. https://en.wikipedia.org/wiki/Pre-crime https://en.wikipedia.org/wiki/Pre-crime

capguy255 4y ago

Having used the comm compliance tool in m365 and other similar tech - a lot of the comments here seem to miss the point. "Leaver" IT policies are fairly common security practices to limit the risk that someone takes IP or customer lists with them to another job. The point is not to detect whether someone is going to quit but rather to detect unapproved behaviors by someone as they are on the way out the door. There are various compliance tools in Office 365 designed for data retention, eDiscovery, and investigation and this is an offshoot of that. It is more efficient and less obtrusive to target suspect behaviors than to have an analyst or attorney download and review all of an employee's communication and activity. As I've seen communication compliance used, the leaver policy is enabled when a person is marked within an HR system as leaving the company, or when their Active Directory account is disabled. If certain sequences of activity occur such as downloading lots of files from SharePoint and they are copied to a USB drive or to an external file share, or if a file previously owned by the leaving employee is accessed after the AD account is disabled by an external user, it fires off an alert. I'm skeptical about the value of the use of a "classifier" given that there isn't much documentation that explains how it works, how it's trained, and any documented workflow to statistically validate the model. Instead of using "classifiers" you can create custom policies based around keywords, regex patterns, or targeting sequences such as download x # of files then copy then delete. I think it would be interesting if you could build a custom classifier using your own positive and negative examples, define your own score thresholds, train models around specific excerpts rather than on entire emails, and test the classifier using a set of human reviewed data. Regardless though - I'm far less suspicious of the general idea that companies are focused on "inside threats" than whether they understand how things work. Machine learning algorithms are basically just fancy text searching backed by statistical analysis but there are a lot of input variables and also a few different ways to defensibly measure the performance of the tools. The M365 tool doesn't expose much of that and a lot of compliance teams are probably going to be concerned about wasting time chasing false positives.

stimpson_j_cat 4y ago

For sake of discussion: aren't there uses of this that aren't nefarious? Their claim that employees intending to leave "may put the organization at risk of malicious or inadvertent data exfiltration upon departure" is, cynically, corporate bs; but data theft or vandalism isn't entirely unheard of by departing employees. Ever moved your source code to a thumb driver before you left your job, even though your contract technically forbids it, you've signed away the IP rights, etc?

JonChesterfield 4y ago
It's weird to assume that noone would copy the data before resigning instead of after resigning though. Especially if your company might immediately garden leave you.

prepend 4y ago

Since it’s Microsoft AI, I assume it will be lousy and full of false positives and predict lots of false negatives. It’s weird how there is no predicted accuracy and no SLA or any measure to hold it to. So should be a frustrating time using the information properly. I assume smart people will ignore the results and idiots will think it means someone will leave.