9 ms·

To play devil's advocate here, what else would people have Microsoft do? Is there a scenario in which they can successfully resist enabling surveillance feature

To play devil's advocate here, what else would people have Microsoft do? Is there a scenario in which they can successfully resist enabling surveillance features in their products while operating in the US? CALEA applies to telecommunications providers, which is a label that would seem to clearly apply to Skype. http://en.wikipedia.org/wiki/Calea http://en.wikipedia.org/wiki/Calea Are major companies based or operating in the US allowed to provide secure email and/or data storage without options for lawful surveillance from law enforcement? If people do not like these policies and the cooperation from the companies operating them, I think the proper place to direct your anger is at the laws that require them to cooperate.

jlgreco 13y ago
In this particular instance? I would have had them be less misleading about what ways Skype is and is not secure in the first place.
stephengillie 13y ago
As a Microsoft contractor, I'm confused about how to feel and how to move forward. Sometimes I feel like I'll be enabling some of these practices by continuing be a contracted worker, and that this community will in part be blaming me for this situation.
- autodidakto 13y ago
  Give it some time, clarify what exactly you're contributing. Then, if you want a clear conscious, work towards it in a practical way. Be as innocent as a dove, as sly as a fox! That is, you don't need to quit your only mildly, indirectly enabling job right this instance, throwing your family into financial difficulties. But, you do need to work towards untangling yourself as much as your conscious demands.
devindotcom 13y ago
I agree that the anger should be directed at the laws, but the problem is that we are so woefully uninformed about those laws. And not just that we're not paying enough attention - these laws are being formed and executed in secret! How can you take action against something you don't know exists?
- josteink 13y ago
  > And not just that we're not paying enough attention - these laws are being formed and executed in secret! How can you take action against something you don't know exists? You start by demanding that this process, this subversion of democracy, be made illegal. This is the root of the problem: secrecy. Secrecy corrupts as much as power, and absolute secrecy corrupts absolutely.
  - nisse72 13y ago
    I'm inclined to suggest that secret laws are themselves a symptom of an already corrupt government, and simply open the door to further corruption.
- toyg 13y ago
  Secret laws are the death of democracy; not just that, they are the death of the Rule of Law itself. The whole point of having written laws was that everybody could know and challenge them in a fair way, without being reliant on the whim of rulers. "Secret laws" are not laws, they are tyrannical pseudo-rules that belong in the Middle Ages.
  - temac 13y ago
    In France you have a principle that says "Nul n'est censé ignorer la loi", ("no one should ignore the law") that has a double meaning: you can not escape your responsibilities by saying that you ignored a law, and, as a corollary, no law should be purposely hidden from you. Still, I've no doubt that french secret services practice all kind of immoral if not illegal stuffs (at the widest scale they can afford), and they have "interesting" theories about what allows them to do that (or maybe they they are just crazy enough to don't care at all, like the recent declaration about the law not applying at all to those programs seems to says...)
forgotAgain 13y ago
To play devil's advocate here, what else would people have Microsoft do? Is there a scenario in which they can successfully resist enabling surveillance features in their products while operating in the US? Do you think the government would jail someone of Steve Ballmer's stature if he talked openly about what the government has asked of Microsoft. Because of his position he is much more protected from criminal action than almost anyone else. The reason he doesn't reject government requests is more likely that it would be bad for business not that he would suffer legal consequences. ... I think the proper place to direct your anger is at the laws that require them to cooperate. I see the law as allowing them to cooperate. It gives them cover for not protecting the privacy of individual citizens.
- ahlatimer 13y ago
  Do you think the government would jail someone of Steve Ballmer's stature if he talked openly about what the government has asked of Microsoft. Absolutely, but even if they didn't, if you were Steve Ballmer, would you take that risk? They certainly could prosecute you for leaking secret information. That's even assuming that Ballmer knew about it. It could have been that they approached people who were in some position of power on the particular products they were interested in and served them with the order. Some random middle manager at Microsoft certainly has considerably less political pull than Ballmer and would likely go to jail if he/she came out about this, but could still be in the position to direct their team to build whatever features the government demanded. I see the law as allowing them to cooperate. It gives them cover for not protecting the privacy of individual citizens. If it came via a court order, it's definitely a demand. This isn't a marketing gimmick -- if you're served a lawful court order, you either obey it or risk the consequences, up to and including time in jail.
  - toyg 13y ago
    > if you're served a lawful court order ... you challenge it, pulling out from campaign contributions, and making noise in the press. Microsoft (and Google, and Yahoo, and and and) have billions of dollars they could use to resist pretty much any law they wanted to. Every day we complain that modern democracies are captive to moneyed commercial interests, and now we should believe that actually, they're completely powerless, oppressed by Big Bad Government? I don't think so.
toyg 13y ago
> Is there a scenario in which they can successfully resist enabling surveillance features in their products while operating in the US? Replace "in the US" with "in Nazi Germany" or "in Soviet Russia" and you'll see how chilling that sentence is. They're just following orders. It's the utter banality of evil.
Buzaga 13y ago
they're can't be trusted, that's all that matters, how about us that that live outside? MSFT isn't putting a notice on it's homepage for people outside that it can't do anything about our rights, they sell the exact opposite image, and the internet is sold to everyone as a humankind treasure... if they can't do anything about it they could at least be honest, but they all just keep doubling down on the lies
schoen 13y ago
You asked: "Are major companies based or operating in the US allowed to provide secure email and/or data storage without options for lawful surveillance from law enforcement?" Compare 47 USC §1002(b)(3): A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication. Also, (b)(1): This subchapter does not authorize any law enforcement agency or officer— (A) to require any specific design of equipment, facilities, services, features, or system configurations to be adopted by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services; or (B) to prohibit the adoption of any equipment, facility, service, or feature by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services. Finally, (b)(2): The [interception capability] requirements of [...] this section do not apply to [...] information services [...]
- jimbobimbo 13y ago
  Microsoft is not a telecom carrier.
  - jellicle 13y ago
    Actually, it is. Microsoft provides VOIP services, and the FCC and courts have held that that makes it a telecom carrier for the purposes of CALEA.
  - schoen 13y ago
    I agree that the pure VoIP parts of Skype should not be interpreted as telecommunications services under CALEA. I think we agree; I'm quoting these provisions to argue that Microsoft does not have any interception capability mandates for IP-to-IP calls under CALEA.
tippytop 13y ago
These are some of the biggest corporations in the world, with resources to push back on behalf of their users---if they wanted to. Heck, at least Yahoo did something. At some point the PRISM collaborators took a calculated risk that their users would not find out, or if they did, it would be of no consequence to their business. Maybe it was the classified assurances, or maybe the whole "direct access" line for deniability. I may not have any say in NSA programs or secret courts, but I'm still a consumer and techie and can vote with my money and time. I'm gonna do my best not to support companies that actively build a surveillance state.
venomsnake 13y ago
To play devil's advocate here, what else would people have Microsoft do? Is there a scenario in which they can successfully resist enabling surveillance features in their products while operating in the US? Take $5B out of the cash pile. Lobby to dismantle the laws or severely weaken it.
loginalready 13y ago
Protest. Lobby. Seek publicity. Take the government to court. Put up a fight. Note that when the EU data retention directive (which is often used here under the header "see, others are doing it to", even though it doesn't even come close to what the NSA does) was initiated, that's exactly what many telecom providers and ISP's did, before and after this came into affect. It didn't stop it, but it least it has brought it out into the open, making it an (still ongoing) public issue. The remarkable part of what's happening in the US is the utterly quiet and extremely forthcoming complicity of major companies who otherwise don't seem to have any problem throwing a lot of resources at manipulating governments foreign and domestic. And in the case of Microsoft, in it's monopolists heydays, even up to the point of structurally breaking the law. Also, it's not like they are only quiet about it because the law tells them so: they actively deny it, hell, they even advertise with pure lies about the privacy of their services. These companies aren't victims anymore. They are complicit. Lastly, it should be quiet obvious that with absolutely no restriction in the wiretapping of foreign nationals, they are breaking the law in every country they do business in. Those foreigners, like myself, have no voice in US legislation. From my perspective as a non-American, Microsoft is complicit in a full frontal attack on our civil liberties. We can't stop the US government, but we can certainly stop Microsoft e.a. from doing business here.
- bigiain 13y ago
  "Protest. Lobby. Seek publicity. Take the government to court. Put up a fight." I'll let you know how that goes from here in Sydney, Australia. Yeah,I'm not a US citizen. None of the "with a valid court order" weasel-words apply to me.
tptacek 13y ago
CALEA does NOT require Microsoft to provide decryptable communications services; in fact it ensures Microsoft can do exactly the opposite. http://paranoia.dubfire.net/2010/09/calea-and-encryption.html http://paranoia.dubfire.net/2010/09/calea-and-encryption.htm...
- acqq 13y ago
  A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication. Note "unless the encryption was provided by the carrier." Skype is the one that provides encryption here (a carrier) as far as I understand. No user can influence it. You are right that they are allowed to make the systems where users would provide keys themselves and that then the carrier wouldn't be required to assist in the decryption.
  - bigiain 13y ago
    There's readily available examples of crypto software generating key pairs on the client end, and never exposing the private key to the server - GPG/PGP, OpenSSL, tarsnap - and the OpenSSL libraries are used by a whole bunch of other software too (encfs, browsers, web servers, CSR generation…) Any "crypto" which doesn't do secure keygen on the client for "at rest" data storage is now significantly more suspect than before these revaluations. You can explain away whatever you like in terms of "usability" or "most users don't care", but now manyof us are going to read any excuses as "Yeah, the US government has got to our CEO… And he's not gonna be the next Qwest guy…"
  - nathan_long 13y ago
    Which is just a way of saying "we don't require you to do what you can't do." A truly good service would take advantage of that by ensuring they themselves have no access to the communications.
  - deleted 13y ago
    [deleted]

jlgreco 13y ago

In this particular instance? I would have had them be less misleading about what ways Skype is and is not secure in the first place.

stephengillie 13y ago

As a Microsoft contractor, I'm confused about how to feel and how to move forward. Sometimes I feel like I'll be enabling some of these practices by continuing be a contracted worker, and that this community will in part be blaming me for this situation.

autodidakto 13y ago
Give it some time, clarify what exactly you're contributing. Then, if you want a clear conscious, work towards it in a practical way. Be as innocent as a dove, as sly as a fox! That is, you don't need to quit your only mildly, indirectly enabling job right this instance, throwing your family into financial difficulties. But, you do need to work towards untangling yourself as much as your conscious demands.

devindotcom 13y ago

I agree that the anger should be directed at the laws, but the problem is that we are so woefully uninformed about those laws. And not just that we're not paying enough attention - these laws are being formed and executed in secret! How can you take action against something you don't know exists?

josteink 13y ago
> And not just that we're not paying enough attention - these laws are being formed and executed in secret! How can you take action against something you don't know exists? You start by demanding that this process, this subversion of democracy, be made illegal. This is the root of the problem: secrecy. Secrecy corrupts as much as power, and absolute secrecy corrupts absolutely.
- nisse72 13y ago
  I'm inclined to suggest that secret laws are themselves a symptom of an already corrupt government, and simply open the door to further corruption.
toyg 13y ago
Secret laws are the death of democracy; not just that, they are the death of the Rule of Law itself. The whole point of having written laws was that everybody could know and challenge them in a fair way, without being reliant on the whim of rulers. "Secret laws" are not laws, they are tyrannical pseudo-rules that belong in the Middle Ages.
- temac 13y ago
  In France you have a principle that says "Nul n'est censé ignorer la loi", ("no one should ignore the law") that has a double meaning: you can not escape your responsibilities by saying that you ignored a law, and, as a corollary, no law should be purposely hidden from you. Still, I've no doubt that french secret services practice all kind of immoral if not illegal stuffs (at the widest scale they can afford), and they have "interesting" theories about what allows them to do that (or maybe they they are just crazy enough to don't care at all, like the recent declaration about the law not applying at all to those programs seems to says...)

forgotAgain 13y ago

To play devil's advocate here, what else would people have Microsoft do? Is there a scenario in which they can successfully resist enabling surveillance features in their products while operating in the US? Do you think the government would jail someone of Steve Ballmer's stature if he talked openly about what the government has asked of Microsoft. Because of his position he is much more protected from criminal action than almost anyone else. The reason he doesn't reject government requests is more likely that it would be bad for business not that he would suffer legal consequences. ... I think the proper place to direct your anger is at the laws that require them to cooperate. I see the law as allowing them to cooperate. It gives them cover for not protecting the privacy of individual citizens.

ahlatimer 13y ago
Do you think the government would jail someone of Steve Ballmer's stature if he talked openly about what the government has asked of Microsoft. Absolutely, but even if they didn't, if you were Steve Ballmer, would you take that risk? They certainly could prosecute you for leaking secret information. That's even assuming that Ballmer knew about it. It could have been that they approached people who were in some position of power on the particular products they were interested in and served them with the order. Some random middle manager at Microsoft certainly has considerably less political pull than Ballmer and would likely go to jail if he/she came out about this, but could still be in the position to direct their team to build whatever features the government demanded. I see the law as allowing them to cooperate. It gives them cover for not protecting the privacy of individual citizens. If it came via a court order, it's definitely a demand. This isn't a marketing gimmick -- if you're served a lawful court order, you either obey it or risk the consequences, up to and including time in jail.
- toyg 13y ago
  > if you're served a lawful court order ... you challenge it, pulling out from campaign contributions, and making noise in the press. Microsoft (and Google, and Yahoo, and and and) have billions of dollars they could use to resist pretty much any law they wanted to. Every day we complain that modern democracies are captive to moneyed commercial interests, and now we should believe that actually, they're completely powerless, oppressed by Big Bad Government? I don't think so.

toyg 13y ago

> Is there a scenario in which they can successfully resist enabling surveillance features in their products while operating in the US? Replace "in the US" with "in Nazi Germany" or "in Soviet Russia" and you'll see how chilling that sentence is. They're just following orders. It's the utter banality of evil.

Buzaga 13y ago

they're can't be trusted, that's all that matters, how about us that that live outside? MSFT isn't putting a notice on it's homepage for people outside that it can't do anything about our rights, they sell the exact opposite image, and the internet is sold to everyone as a humankind treasure... if they can't do anything about it they could at least be honest, but they all just keep doubling down on the lies

schoen 13y ago

You asked: "Are major companies based or operating in the US allowed to provide secure email and/or data storage without options for lawful surveillance from law enforcement?" Compare 47 USC §1002(b)(3): A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication. Also, (b)(1): This subchapter does not authorize any law enforcement agency or officer— (A) to require any specific design of equipment, facilities, services, features, or system configurations to be adopted by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services; or (B) to prohibit the adoption of any equipment, facility, service, or feature by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services. Finally, (b)(2): The [interception capability] requirements of [...] this section do not apply to [...] information services [...]

jimbobimbo 13y ago
Microsoft is not a telecom carrier.
- jellicle 13y ago
  Actually, it is. Microsoft provides VOIP services, and the FCC and courts have held that that makes it a telecom carrier for the purposes of CALEA.
- schoen 13y ago
  I agree that the pure VoIP parts of Skype should not be interpreted as telecommunications services under CALEA. I think we agree; I'm quoting these provisions to argue that Microsoft does not have any interception capability mandates for IP-to-IP calls under CALEA.

tippytop 13y ago

These are some of the biggest corporations in the world, with resources to push back on behalf of their users---if they wanted to. Heck, at least Yahoo did something. At some point the PRISM collaborators took a calculated risk that their users would not find out, or if they did, it would be of no consequence to their business. Maybe it was the classified assurances, or maybe the whole "direct access" line for deniability. I may not have any say in NSA programs or secret courts, but I'm still a consumer and techie and can vote with my money and time. I'm gonna do my best not to support companies that actively build a surveillance state.

venomsnake 13y ago

loginalready 13y ago

Protest. Lobby. Seek publicity. Take the government to court. Put up a fight. Note that when the EU data retention directive (which is often used here under the header "see, others are doing it to", even though it doesn't even come close to what the NSA does) was initiated, that's exactly what many telecom providers and ISP's did, before and after this came into affect. It didn't stop it, but it least it has brought it out into the open, making it an (still ongoing) public issue. The remarkable part of what's happening in the US is the utterly quiet and extremely forthcoming complicity of major companies who otherwise don't seem to have any problem throwing a lot of resources at manipulating governments foreign and domestic. And in the case of Microsoft, in it's monopolists heydays, even up to the point of structurally breaking the law. Also, it's not like they are only quiet about it because the law tells them so: they actively deny it, hell, they even advertise with pure lies about the privacy of their services. These companies aren't victims anymore. They are complicit. Lastly, it should be quiet obvious that with absolutely no restriction in the wiretapping of foreign nationals, they are breaking the law in every country they do business in. Those foreigners, like myself, have no voice in US legislation. From my perspective as a non-American, Microsoft is complicit in a full frontal attack on our civil liberties. We can't stop the US government, but we can certainly stop Microsoft e.a. from doing business here.

bigiain 13y ago
"Protest. Lobby. Seek publicity. Take the government to court. Put up a fight." I'll let you know how that goes from here in Sydney, Australia. Yeah,I'm not a US citizen. None of the "with a valid court order" weasel-words apply to me.

tptacek 13y ago

CALEA does NOT require Microsoft to provide decryptable communications services; in fact it ensures Microsoft can do exactly the opposite. http://paranoia.dubfire.net/2010/09/calea-and-encryption.html http://paranoia.dubfire.net/2010/09/calea-and-encryption.htm...

acqq 13y ago
A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication. Note "unless the encryption was provided by the carrier." Skype is the one that provides encryption here (a carrier) as far as I understand. No user can influence it. You are right that they are allowed to make the systems where users would provide keys themselves and that then the carrier wouldn't be required to assist in the decryption.
- bigiain 13y ago
  There's readily available examples of crypto software generating key pairs on the client end, and never exposing the private key to the server - GPG/PGP, OpenSSL, tarsnap - and the OpenSSL libraries are used by a whole bunch of other software too (encfs, browsers, web servers, CSR generation…) Any "crypto" which doesn't do secure keygen on the client for "at rest" data storage is now significantly more suspect than before these revaluations. You can explain away whatever you like in terms of "usability" or "most users don't care", but now manyof us are going to read any excuses as "Yeah, the US government has got to our CEO… And he's not gonna be the next Qwest guy…"
- nathan_long 13y ago
  Which is just a way of saying "we don't require you to do what you can't do." A truly good service would take advantage of that by ensuring they themselves have no access to the communications.
- deleted 13y ago
  [deleted]