4 ms·

The sad thing about all of this is that Microsoft were pretty much forced into this position (so we're told) by the authorities. In the process these leaks hav

by iuguy 13y ago

The sad thing about all of this is that Microsoft were pretty much forced into this position (so we're told) by the authorities. In the process these leaks have just destroyed pretty much any credibility Microsoft's online services had, which form large parts of their strategy (according to the recent Ballmer memo). It also makes you wonder about the OS and other software they produce, which isn't a good place for MS to be in.

mtgx 13y ago
On what legal grounds was Microsoft "forced" to provide access to unencrypted data before encryption (effectively nullifying the security that they promised to their customers)? So how were they forced? Legally? Illegally/blackmail? CALEA seems to say that companies don't have to decrypt data for authorities. I guess it's very convenient that they give it to them before they encrypt it then: http://paranoia.dubfire.net/2010/09/calea-and-encryption.html http://paranoia.dubfire.net/2010/09/calea-and-encryption.htm... And this seems to be a "team sport", and that implies willing collaboration, not being forced to do it. More like something "fun" they're doing together.
- tzs 13y ago
  A company doesn't have to decrypt to meet their CALEA obligations. If CALEA is the sole legal authority for a particular communications interception, that would be the end of it. However, I've seen nothing that indicates that CALEA is the legal authority behind the NSA interceptions.
- fnordfnordfnord 13y ago
  >So how were they forced? Well, we can't really know (they won't answer FOIA requests!). We can only make guesses. Could be they were just asked. Western Union gave telegrams to the NSA just for the asking. Some people would argue that Microsoft has enjoyed favorable treatment by the courts. Maybe there was a quid pro quo somewhere along the way. NSA has strategically placed employees/agents in other companies. Why not Microsoft?
mikevm 13y ago
I'm not sure why you're picking on Microsoft. The credibility of pretty much every large US-based tech services company is probably destroyed. The fact that we only saw the big service providers (MS, Google, etc...) on those slides doesn't mean that the other companies are free from the hands of the NSA. Do you think that the NSA has no access to Dropbox?
- testing12341234 13y ago
  I'm not sure why you're picking on Microsoft. One of the key facets of the the Xbox One is the Kinect as an always on device. As another poster pointed out, Microsoft has been quick to answer the privacy related questions that have been asked about this situation with the claim that the system has been built with privacy as a focus. As such, the reliability of those claims in light of this new leak appears to be relevant. For example, given a court order, would Microsoft be required to: 1.) Provide law enforcement with Kinect data. (everything from as simple as "there were two people in the room" to "here is a live stream of the room" 2.) Be bound by gag orders not allowing Microsoft to reveal the existence of item 1. 3.) Be forced/coerced/enticed to provide bulk "wiretapping" of Kinect data. Additionally, there is the question of "expectation of privacy". Many of the current privacy laws are based on this concept. However, could the courts decide that there is no expectation of privacy when a video and audio recording device has been placed in a private area, with full knowledge of the owner, also with knowledge that the data will be sent to a third party? While these items might seem fringe (and before these leaks, I may have agreed), the scope of the current leaks seems to imply that these questions should at least be considered (even if a person chooses ultimately to accept the risk).
- brudgers 13y ago
  Enterprise relies on companies such as RedHat and Oracle to some extent in lieu of conducting code analysis and to certain types of security testing. It would be rather surprising if they were not at least approached by Federal agencies such as NSA and FBI. To put it another way, because Microsoft has a closed source model, the intelligence agencies took the approach described in the article. From that, it may be a mistake to conclude that the strategy pursued with Microsoft was the only strategy pursued. It just happens to be one that would pass across the desk of an analyst, rather than someone on the operations side. Viewed as an intelligence operation, it would be grossly unprofessional of such agencies not to have placed moles within the open source community, or for those moles to be seen as highly skilled contributors on open source projects. The three letter agencies have decades of experience infiltrating both commercial organizations and those motivated by something other than money. I suspect it is easier to turn an open source hacker than a diplomat - not just ideologically but because the open source community lacks a state funded organized counter-intelligence apperatus.
JonFish85 13y ago
I think it's wrong to say Microsoft was "forced" into this. In a sense, they made their own bed. I have to believe that the majority of Microsoft's money is based off of serving governments and huge corporations (Windows + Office). It just makes sense that they'll want to keep those relationships.
- Spooky23 13y ago
  It's not in Microsoft's interest to function as defacto agents of the US government. They are compelled by law to do what the Feds want -- just like would would be if you we're providing a service. Think about the impact of the NSA leaks on Microsoft's business. Globally, every customer or potential customer of Microsoft needs to ask whether they can trust Micrsoft as a business partner. Not a good place to be on for a software company transitioning to a cloud services company.
flyinRyan 13y ago
Good. Big companies are the only thing in the US with even the remotest of hopes of stopping or slowing this down. And they're not going to bother unless it's actually costing them money. So I hope it hurts them, I hope it makes them and all the other companies bleed until they do something.

by iuguy 13y ago

mtgx 13y ago

On what legal grounds was Microsoft "forced" to provide access to unencrypted data before encryption (effectively nullifying the security that they promised to their customers)? So how were they forced? Legally? Illegally/blackmail? CALEA seems to say that companies don't have to decrypt data for authorities. I guess it's very convenient that they give it to them before they encrypt it then: http://paranoia.dubfire.net/2010/09/calea-and-encryption.html http://paranoia.dubfire.net/2010/09/calea-and-encryption.htm... And this seems to be a "team sport", and that implies willing collaboration, not being forced to do it. More like something "fun" they're doing together.

tzs 13y ago
A company doesn't have to decrypt to meet their CALEA obligations. If CALEA is the sole legal authority for a particular communications interception, that would be the end of it. However, I've seen nothing that indicates that CALEA is the legal authority behind the NSA interceptions.
fnordfnordfnord 13y ago
>So how were they forced? Well, we can't really know (they won't answer FOIA requests!). We can only make guesses. Could be they were just asked. Western Union gave telegrams to the NSA just for the asking. Some people would argue that Microsoft has enjoyed favorable treatment by the courts. Maybe there was a quid pro quo somewhere along the way. NSA has strategically placed employees/agents in other companies. Why not Microsoft?

mikevm 13y ago

I'm not sure why you're picking on Microsoft. The credibility of pretty much every large US-based tech services company is probably destroyed. The fact that we only saw the big service providers (MS, Google, etc...) on those slides doesn't mean that the other companies are free from the hands of the NSA. Do you think that the NSA has no access to Dropbox?

testing12341234 13y ago
I'm not sure why you're picking on Microsoft. One of the key facets of the the Xbox One is the Kinect as an always on device. As another poster pointed out, Microsoft has been quick to answer the privacy related questions that have been asked about this situation with the claim that the system has been built with privacy as a focus. As such, the reliability of those claims in light of this new leak appears to be relevant. For example, given a court order, would Microsoft be required to: 1.) Provide law enforcement with Kinect data. (everything from as simple as "there were two people in the room" to "here is a live stream of the room" 2.) Be bound by gag orders not allowing Microsoft to reveal the existence of item 1. 3.) Be forced/coerced/enticed to provide bulk "wiretapping" of Kinect data. Additionally, there is the question of "expectation of privacy". Many of the current privacy laws are based on this concept. However, could the courts decide that there is no expectation of privacy when a video and audio recording device has been placed in a private area, with full knowledge of the owner, also with knowledge that the data will be sent to a third party? While these items might seem fringe (and before these leaks, I may have agreed), the scope of the current leaks seems to imply that these questions should at least be considered (even if a person chooses ultimately to accept the risk).
brudgers 13y ago
Enterprise relies on companies such as RedHat and Oracle to some extent in lieu of conducting code analysis and to certain types of security testing. It would be rather surprising if they were not at least approached by Federal agencies such as NSA and FBI. To put it another way, because Microsoft has a closed source model, the intelligence agencies took the approach described in the article. From that, it may be a mistake to conclude that the strategy pursued with Microsoft was the only strategy pursued. It just happens to be one that would pass across the desk of an analyst, rather than someone on the operations side. Viewed as an intelligence operation, it would be grossly unprofessional of such agencies not to have placed moles within the open source community, or for those moles to be seen as highly skilled contributors on open source projects. The three letter agencies have decades of experience infiltrating both commercial organizations and those motivated by something other than money. I suspect it is easier to turn an open source hacker than a diplomat - not just ideologically but because the open source community lacks a state funded organized counter-intelligence apperatus.

JonFish85 13y ago

I think it's wrong to say Microsoft was "forced" into this. In a sense, they made their own bed. I have to believe that the majority of Microsoft's money is based off of serving governments and huge corporations (Windows + Office). It just makes sense that they'll want to keep those relationships.

Spooky23 13y ago
It's not in Microsoft's interest to function as defacto agents of the US government. They are compelled by law to do what the Feds want -- just like would would be if you we're providing a service. Think about the impact of the NSA leaks on Microsoft's business. Globally, every customer or potential customer of Microsoft needs to ask whether they can trust Micrsoft as a business partner. Not a good place to be on for a software company transitioning to a cloud services company.

flyinRyan 13y ago

Good. Big companies are the only thing in the US with even the remotest of hopes of stopping or slowing this down. And they're not going to bother unless it's actually costing them money. So I hope it hurts them, I hope it makes them and all the other companies bleed until they do something.