8 ms·

Microsoft Says: Come Back with a Warrant, Unless You’re Microsoft

142 points by rdl 13y ago

Locke1689 13y ago
If the EFF wants to continue pretending that they're still primarily a legal outfit, I want one of their lawyers to prepare an actual brief or at least a citation on this matter of law on which they have deigned to hold court. I am of course not a lawyer, but the inability of what is ostensibly a legal advocacy group to fail to attempt a prima facie case on violation of a law is just too pathetic for me to care.
- sytelus 13y ago
  Go back and read Microsoft's privacy policy [1]. Microsoft has inserted following in it: We may access information about you, including the content of your communications to protect the rights or property of Microsoft. In short, you agreed that they can search any of your shit without warrant or permission if they deem that you are a risk to Microsoft in anyway. [1] http://privacy.microsoft.com/en-us/fullnotice.mspx http://privacy.microsoft.com/en-us/fullnotice.mspx
- rdl 13y ago
  Stuff like "HTTPSEverywhere" isn't entirely a legal advocacy matter, either. I don't think EFF needs to constrain itself to legal advocacy to be an effective organization. Making technical and policy recommendations to private companies and individuals (as producers and consumers) seems fine.
  - Locke1689 13y ago
    The article explicitly states a legal opinion -- that Microsoft violated the EPCA. The author is a lawyer. Come on.
    - rdl 13y ago
      "At first blush, Microsoft’s unilateral decision to rifle through its user’s emails sounds like a violation of the Electronic Communications Privacy Act, ECPA. We at EFF have called for critical updates to ECPA’s privacy protections, but the law is fundamentally designed to protect email from this kind of snooping, albeit with some narrow exceptions." The charge is that they violated the spirit but not the letter of ECPA
- josephlord 13y ago
  The point isn't that Microsoft have done anything illegal[0] it is what they have done is crappy and privacy invading. If Microsoft's actions are legal (regardless of whether they should be) any legal case would be bogus and almost certainly lose; achieving nothing. [0] They haven't as far as I am aware.
- pyre 13y ago
  The EFF doesn't constrain themselves to just writing briefs in an effort to make sure that only the current laws on the books are interpreted in a sane fashion. Have you not seen them advocate for policy changes or against poor policy changes (e.g. SOPA)?
- duaneb 13y ago
  > primarily a legal outfit I think I would prefer an ethical one. Most interesting problems are not legal—the law simply reflects the solution. I think the EFF correctly identified this as a problem, even if they aren't going to be fined by the government.
- lawnchair_larry 13y ago
  An activists organization that only defends existing laws would be pretty useless. You're being shortsighted in your expectations here.
cheeze 13y ago
Which is exactly what you agreed to when you signed up for their service. Privacy and Microsoft are mutually exclusive.
- sliverstorm 13y ago
  Kind of the way it is with every service, unless you take extra measures to protect yourself. E.g., PGP, careful selection of data you upload, or just not using any cloud services in the first place.
  - PythonicAlpha 13y ago
    No, normal online providers will have terms that they don't infringe into your privacy rights.
    - sliverstorm 13y ago
      Oh, so you mean unlike Microsoft they pretend they don't infringe on your rights. :)
      - PythonicAlpha 13y ago
        There are many online-services, where there is no such right given to the hosting company to read the data contained in the service. I would say, that such a statement is rather uncommon (may be changed by the eMail providers MS and Google). And: In my opinion, they just pretend! In my country, such a behavior could well be contested in court in my opinion, because we normally have strong rights protecting communications.
- deleted 13y ago
  [deleted]
pktgen 13y ago
Not defending MS at all but what is the alternative for them? What people want is the judicial oversight. But can Microsoft really go to a court and say "hey judge, we're Microsoft, we want a warrant for Microsoft to provide this"?
- deleted 13y ago
  [deleted]
- sliverstorm 13y ago
  Alright Microsoft, your days on the run are over. We, Microsoft, have gotten a subpoena against you. Now cough up that data, us. I mean you.
- glimcat 13y ago
  Ideally, I'd like to see a situation where you (1) have a contract protecting user data which is reasonably enforceable given the power dynamics which exist between the two parties, and (2) it's required for a judge to arbitrate whether a given situation provides justification to breach that contract. Where "judge" is proxy for a nominally impartial third party who nominally has the experience to make an informed decision which reasonably protects the interests of both parties, the public interest, and our stated commitments to civil liberties. And we already make routine use of judges for this function in cases where the data or other artifacts are not possessed by the party who wants extraordinary permission to access them.
- crygin 13y ago
  Agreed -- based on MS's statement they went through a fairly rigorous internal procedure (of course, they could be lying, but it seems fairly unlikely particularly given the regulatory attention MS generally has on it). I don't fully understand what people think they "should" have done to access the emails -- waste a court's time on a meaningless judgement?
  - PythonicAlpha 13y ago
    No, not waste! When you act rightfully, it is never wasting time of the legal system! Because I can do something (without asking anybody else) it needs not to be right!
sergers 13y ago
I would have to agree with MS. Someone sharing proprietary info using your email platform, and its completely in their right as per eua to look at it, then damn right they should have reviewed the leakers account. The guy knowingly received proprietary info. Eff is almost like a troll sometimes For one summer between semesters I worked for a MS call center who handled hotmail which we could read peoples mail if wanted. We didn't as MS has great auditing
- duaneb 13y ago
  > Eff is almost like a troll sometimes It's almost like they're trying to free email from being a corporate black hole.
PythonicAlpha 13y ago
As for me: MS has discredited itself with this behavior. How can I know, that MS will not open my Word or Excel documents that I have in the Online-Office system, because it may contain information of value to its business -- or it may infringe on patents MS holds? So, neither MS online mail products, nor online office systems can be trusted any more! Any business owner should know this and withdraw from usage of any MS owned online systems.
- higherpurpose 13y ago
  Completely agreed. Also, I think starting with Windows 8.1, if you're logged in to Windows with a Microsoft account, your documents get saved automatically to Microsoft's cloud. I would watch out for that, especially if you have sensitive documents.
  - RexRollman 13y ago
    You should what out for that with any cloud service.
    - PythonicAlpha 13y ago
      "good" Online Service providers respect your privacy and also have it in their privacy statement. But after this happening, MS can write anything in their statements, it can not be trusted! (since statements can be changed anyway)
      - judk 13y ago
        Other cloud providers have the same privacy policy, sadly.
      - sequence7 13y ago
        Could you provide a list of "good" online service providers who respect my privacy and have it in their privacy statement so that I know who to trust?
- 13y ago
PythonicAlpha 13y ago
I ask myself, why the rights of the (big) owners of "Intellectual Property" are strengthened all the time, but the rights of the small owners of Private information are reduced and reduced. Something I just can't comprehend.
- josteink 13y ago
  Had you hosted your own email service on your own servers, your rights would be perfectly protected. Nobody is stopping you from doing this. However, this guy used a company's email-service to try to leak proprietary business info about the same company. You can't seriously expect to get away with that.
FD3SA 13y ago
This is equivalent to USPS opening your mail because they were tipped off of wrongdoing against their company, with no evidence whatsoever. Do you have a problem with that? Well too bad, its "their" mail. Randian utopia at its finest.
- mahyarm 13y ago
  What does this have to do with ayn rand or libertarians?
  - chc 13y ago
    Many Randians believe that a free and unregulated capitalist market is the best solution to most problems. This is being put forth as an example of a problem with allowing private corporations such a central role in society without any oversight beyond the "invisible hand" of the market.
    - mahyarm 13y ago
      This is situation I feel would not matter in this case. We live in a very regulated societies and corporations always have had a very central role as it is. Go further into the past and just replace corporations with the elites, the wealthy and the aristocracy. Very regulated and large governments easily produce the series of financial and human rights disasters we have seen in the past decade. It's still buyer beware. Don't use services which say they can look at your email if they want to. Self-interested organizations and people will act self interested, it's a bit of a no-brainer.
    - xtreme 13y ago
      In this example no government oversight would probably work much better. If a carrier starts opening your mails, they would lose their customer base and other services would come up. Also, you could probably stipulate this in the terms of service so that you can have a legal recourse if the carrier violates the contract. With government intervention, all carriers would be subject to government bullying, legal or otherwise. Which scenario would you prefer?
mbreese 13y ago
For Microsoft, this is very much a win the battle, lose the war situation. While they were perfectly within their legal rights to access the Hotmail account, it was horribly bad optics. It just looks bad. And it's stuff like this that makes cloud services a hard sell to a large demographic. So while this may blow over, people will be more paranoid that Microsoft will decide that they have the right to look at your data, just because it exists on their servers. Google isn't much better in this regard. Amazon so far is better positioned because they don't offer any other private "consumer" services that they'd want to review. But really unless you have the hardware in your physical possession, you will always be subject to these problems.
droopybuns 13y ago
Honestly, this whole thing has been such a glorious example of the absolute stupidity and tone-deafness of M.S. It is mind-boggling that they could have shared the kinds of details they did with the press about their behavior. "We busted a criminal. Along the way, we shat in the corner. We got the criminal really good." How in the world could they have missed that second sentence? It's just incredible. My mouth is agape.
higherpurpose 13y ago
What worries me is that FBI or NSA could've established a sort of relationship with Microsoft, where they don't even need to get court orders or warrants, because they can get them from "Microsoft" voluntarily, and Microsoft can just take the data from the users without any other judicial step, and give it to them. Wouldn't this type of loophole work in theory? I wonder if this is what the Snowden documents meant about Microsoft and NSA's "team sport": http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...
myrandomcomment 13y ago
What MS did is in there terms of service. If you do not like it use do not use Hotmail. It is really that simple.
PhantomGremlin 13y ago
Everyone who uses Hotmail, Gmail, Google Drive, OneDrive, Google Docs, Dropbox, Evernote, and countless other similar services needs to keep in mind the following quip (which I stole from somewhere on the Internet): Today's word: The cloud. Explanation: Someone else's computer. I'm a user of various cloud services, but I'm not naive enough to have any expectation of privacy, from either that company or from the NSA. Period. Full stop.
- joseba286 13y ago
  Good point, they can say whatever they want but we should just assume that our data could fall into someone else hands at any moment..
sytelus 13y ago
http://www.scroogled.com/mail http://www.scroogled.com/mail Cough... cough...
briantakita 13y ago
"with intent to convert trade secrets belonging to Microsoft, specifically Microsoft's Activation Server Software Development Kit, to the economic benefit of someone other than Microsoft" "All in violation of Title 18, United States Code, Section 1832(a)(2), (a)(4), and 2." http://www.law.cornell.edu/uscode/text/18/1832 http://www.law.cornell.edu/uscode/text/18/1832 So had Alex Kibkalo simply published this in the public domain, there would be no criminal case?
- otterley 13y ago
  Unlikely. I don't think a reasonable court would conclude that one has to have a specific beneficiary in mind to satisfy the prong of intent to benefit a third party.
raptormissle 13y ago
You've just been MicroShafted. What a bunch of pathetic hypocrites. Spending money on lame smear campaigns against Google while snooping through the emails and documents of their users. It's a pity Google isn't vindictive because if they were they would make this two faces lying company pay. On the plus side, whenever Microshits even try to bring up privacy concerns about Google we can always shut them up by pointing out how their favorite company really does business.

142 points by rdl 13y ago

If the EFF wants to continue pretending that they're still primarily a legal outfit, I want one of their lawyers to prepare an actual brief or at least a citation on this matter of law on which they have deigned to hold court. I am of course not a lawyer, but the inability of what is ostensibly a legal advocacy group to fail to attempt a prima facie case on violation of a law is just too pathetic for me to care.

sytelus 13y ago
Go back and read Microsoft's privacy policy [1]. Microsoft has inserted following in it: We may access information about you, including the content of your communications to protect the rights or property of Microsoft. In short, you agreed that they can search any of your shit without warrant or permission if they deem that you are a risk to Microsoft in anyway. [1] http://privacy.microsoft.com/en-us/fullnotice.mspx http://privacy.microsoft.com/en-us/fullnotice.mspx
rdl 13y ago
Stuff like "HTTPSEverywhere" isn't entirely a legal advocacy matter, either. I don't think EFF needs to constrain itself to legal advocacy to be an effective organization. Making technical and policy recommendations to private companies and individuals (as producers and consumers) seems fine.
- Locke1689 13y ago
  The article explicitly states a legal opinion -- that Microsoft violated the EPCA. The author is a lawyer. Come on.
  - rdl 13y ago
    "At first blush, Microsoft’s unilateral decision to rifle through its user’s emails sounds like a violation of the Electronic Communications Privacy Act, ECPA. We at EFF have called for critical updates to ECPA’s privacy protections, but the law is fundamentally designed to protect email from this kind of snooping, albeit with some narrow exceptions." The charge is that they violated the spirit but not the letter of ECPA
josephlord 13y ago
The point isn't that Microsoft have done anything illegal[0] it is what they have done is crappy and privacy invading. If Microsoft's actions are legal (regardless of whether they should be) any legal case would be bogus and almost certainly lose; achieving nothing. [0] They haven't as far as I am aware.
pyre 13y ago
The EFF doesn't constrain themselves to just writing briefs in an effort to make sure that only the current laws on the books are interpreted in a sane fashion. Have you not seen them advocate for policy changes or against poor policy changes (e.g. SOPA)?
duaneb 13y ago
> primarily a legal outfit I think I would prefer an ethical one. Most interesting problems are not legal—the law simply reflects the solution. I think the EFF correctly identified this as a problem, even if they aren't going to be fined by the government.
lawnchair_larry 13y ago
An activists organization that only defends existing laws would be pretty useless. You're being shortsighted in your expectations here.

cheeze 13y ago

Which is exactly what you agreed to when you signed up for their service. Privacy and Microsoft are mutually exclusive.

sliverstorm 13y ago
Kind of the way it is with every service, unless you take extra measures to protect yourself. E.g., PGP, careful selection of data you upload, or just not using any cloud services in the first place.
- PythonicAlpha 13y ago
  No, normal online providers will have terms that they don't infringe into your privacy rights.
  - sliverstorm 13y ago
    Oh, so you mean unlike Microsoft they pretend they don't infringe on your rights. :)
    - PythonicAlpha 13y ago
      There are many online-services, where there is no such right given to the hosting company to read the data contained in the service. I would say, that such a statement is rather uncommon (may be changed by the eMail providers MS and Google). And: In my opinion, they just pretend! In my country, such a behavior could well be contested in court in my opinion, because we normally have strong rights protecting communications.
deleted 13y ago
[deleted]

pktgen 13y ago

Not defending MS at all but what is the alternative for them? What people want is the judicial oversight. But can Microsoft really go to a court and say "hey judge, we're Microsoft, we want a warrant for Microsoft to provide this"?

deleted 13y ago
[deleted]
sliverstorm 13y ago
Alright Microsoft, your days on the run are over. We, Microsoft, have gotten a subpoena against you. Now cough up that data, us. I mean you.
glimcat 13y ago
Ideally, I'd like to see a situation where you (1) have a contract protecting user data which is reasonably enforceable given the power dynamics which exist between the two parties, and (2) it's required for a judge to arbitrate whether a given situation provides justification to breach that contract. Where "judge" is proxy for a nominally impartial third party who nominally has the experience to make an informed decision which reasonably protects the interests of both parties, the public interest, and our stated commitments to civil liberties. And we already make routine use of judges for this function in cases where the data or other artifacts are not possessed by the party who wants extraordinary permission to access them.
crygin 13y ago
Agreed -- based on MS's statement they went through a fairly rigorous internal procedure (of course, they could be lying, but it seems fairly unlikely particularly given the regulatory attention MS generally has on it). I don't fully understand what people think they "should" have done to access the emails -- waste a court's time on a meaningless judgement?
- PythonicAlpha 13y ago
  No, not waste! When you act rightfully, it is never wasting time of the legal system! Because I can do something (without asking anybody else) it needs not to be right!

sergers 13y ago

I would have to agree with MS. Someone sharing proprietary info using your email platform, and its completely in their right as per eua to look at it, then damn right they should have reviewed the leakers account. The guy knowingly received proprietary info. Eff is almost like a troll sometimes For one summer between semesters I worked for a MS call center who handled hotmail which we could read peoples mail if wanted. We didn't as MS has great auditing

duaneb 13y ago
> Eff is almost like a troll sometimes It's almost like they're trying to free email from being a corporate black hole.

PythonicAlpha 13y ago

As for me: MS has discredited itself with this behavior. How can I know, that MS will not open my Word or Excel documents that I have in the Online-Office system, because it may contain information of value to its business -- or it may infringe on patents MS holds? So, neither MS online mail products, nor online office systems can be trusted any more! Any business owner should know this and withdraw from usage of any MS owned online systems.

higherpurpose 13y ago
Completely agreed. Also, I think starting with Windows 8.1, if you're logged in to Windows with a Microsoft account, your documents get saved automatically to Microsoft's cloud. I would watch out for that, especially if you have sensitive documents.
- RexRollman 13y ago
  You should what out for that with any cloud service.
  - PythonicAlpha 13y ago
    "good" Online Service providers respect your privacy and also have it in their privacy statement. But after this happening, MS can write anything in their statements, it can not be trusted! (since statements can be changed anyway)
    - judk 13y ago
      Other cloud providers have the same privacy policy, sadly.
    - sequence7 13y ago
      Could you provide a list of "good" online service providers who respect my privacy and have it in their privacy statement so that I know who to trust?
13y ago

PythonicAlpha 13y ago

I ask myself, why the rights of the (big) owners of "Intellectual Property" are strengthened all the time, but the rights of the small owners of Private information are reduced and reduced. Something I just can't comprehend.

josteink 13y ago
Had you hosted your own email service on your own servers, your rights would be perfectly protected. Nobody is stopping you from doing this. However, this guy used a company's email-service to try to leak proprietary business info about the same company. You can't seriously expect to get away with that.

FD3SA 13y ago

This is equivalent to USPS opening your mail because they were tipped off of wrongdoing against their company, with no evidence whatsoever. Do you have a problem with that? Well too bad, its "their" mail. Randian utopia at its finest.

mahyarm 13y ago
What does this have to do with ayn rand or libertarians?
- chc 13y ago
  Many Randians believe that a free and unregulated capitalist market is the best solution to most problems. This is being put forth as an example of a problem with allowing private corporations such a central role in society without any oversight beyond the "invisible hand" of the market.
  - mahyarm 13y ago
    This is situation I feel would not matter in this case. We live in a very regulated societies and corporations always have had a very central role as it is. Go further into the past and just replace corporations with the elites, the wealthy and the aristocracy. Very regulated and large governments easily produce the series of financial and human rights disasters we have seen in the past decade. It's still buyer beware. Don't use services which say they can look at your email if they want to. Self-interested organizations and people will act self interested, it's a bit of a no-brainer.
  - xtreme 13y ago
    In this example no government oversight would probably work much better. If a carrier starts opening your mails, they would lose their customer base and other services would come up. Also, you could probably stipulate this in the terms of service so that you can have a legal recourse if the carrier violates the contract. With government intervention, all carriers would be subject to government bullying, legal or otherwise. Which scenario would you prefer?

mbreese 13y ago

For Microsoft, this is very much a win the battle, lose the war situation. While they were perfectly within their legal rights to access the Hotmail account, it was horribly bad optics. It just looks bad. And it's stuff like this that makes cloud services a hard sell to a large demographic. So while this may blow over, people will be more paranoid that Microsoft will decide that they have the right to look at your data, just because it exists on their servers. Google isn't much better in this regard. Amazon so far is better positioned because they don't offer any other private "consumer" services that they'd want to review. But really unless you have the hardware in your physical possession, you will always be subject to these problems.

droopybuns 13y ago

Honestly, this whole thing has been such a glorious example of the absolute stupidity and tone-deafness of M.S. It is mind-boggling that they could have shared the kinds of details they did with the press about their behavior. "We busted a criminal. Along the way, we shat in the corner. We got the criminal really good." How in the world could they have missed that second sentence? It's just incredible. My mouth is agape.

higherpurpose 13y ago

What worries me is that FBI or NSA could've established a sort of relationship with Microsoft, where they don't even need to get court orders or warrants, because they can get them from "Microsoft" voluntarily, and Microsoft can just take the data from the users without any other judicial step, and give it to them. Wouldn't this type of loophole work in theory? I wonder if this is what the Snowden documents meant about Microsoft and NSA's "team sport": http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...

myrandomcomment 13y ago

What MS did is in there terms of service. If you do not like it use do not use Hotmail. It is really that simple.

PhantomGremlin 13y ago

Everyone who uses Hotmail, Gmail, Google Drive, OneDrive, Google Docs, Dropbox, Evernote, and countless other similar services needs to keep in mind the following quip (which I stole from somewhere on the Internet): Today's word: The cloud. Explanation: Someone else's computer. I'm a user of various cloud services, but I'm not naive enough to have any expectation of privacy, from either that company or from the NSA. Period. Full stop.

joseba286 13y ago
Good point, they can say whatever they want but we should just assume that our data could fall into someone else hands at any moment..

sytelus 13y ago

http://www.scroogled.com/mail http://www.scroogled.com/mail Cough... cough...

briantakita 13y ago

"with intent to convert trade secrets belonging to Microsoft, specifically Microsoft's Activation Server Software Development Kit, to the economic benefit of someone other than Microsoft" "All in violation of Title 18, United States Code, Section 1832(a)(2), (a)(4), and 2." http://www.law.cornell.edu/uscode/text/18/1832 http://www.law.cornell.edu/uscode/text/18/1832 So had Alex Kibkalo simply published this in the public domain, there would be no criminal case?

otterley 13y ago
Unlikely. I don't think a reasonable court would conclude that one has to have a specific beneficiary in mind to satisfy the prong of intent to benefit a third party.

raptormissle 13y ago

You've just been MicroShafted. What a bunch of pathetic hypocrites. Spending money on lame smear campaigns against Google while snooping through the emails and documents of their users. It's a pity Google isn't vindictive because if they were they would make this two faces lying company pay. On the plus side, whenever Microshits even try to bring up privacy concerns about Google we can always shut them up by pointing out how their favorite company really does business.