Microsoft: U.S. Constitution is 'suffering' from NSA secrecy

http://news.cnet.com/8301-13578_3-57594011-38/microsoft-u.s-constitution-is-suffering-from-nsa-secrecy/

by declan • 13 years ago

131 47 13 years ago

news.cnet.com

sixothree• 13 years ago

I have to agree Microsoft needs to get out in front of this immediately. I recently had a conversation with a coworker who described the fear she had using her new computer. She used words like worrying, uneasy, and dirty feeling.

Also.

The company said it responds only to orders for "specific accounts and identifiers," and never provides "blanket or indiscriminate access to Microsoft's customer data"

Does not mean they did not provide the mechanism to access encrypted data in transit.

CurtHagenlocher• 13 years ago

I think that's exactly what is said at http://blogs.technet.com/b/microsoft_on_the_issues/archive/2... : "Recent leaked government documents have focused on the addition of HTTPS encryption to Outlook.com instant messaging, which is designed to make this content more secure as it travels across the Internet. To be clear, we do not provide any government with the ability to break the encryption, nor do we provide the government with the encryption keys."

yulaow• 13 years ago

So or Microsoft or Swoden and its data are lying. If i have to put a finger against one of them, i would choose microsoft.

camus• 13 years ago

Does not mean they did not provide the mechanism to access encrypted data in transit.

they are required , by the law , to deny any involvement with the NSA if caught. They are required to lie ,by the law. So at this point you cant believe anything they say.

declan5• 13 years ago

Untrue. AT&T and Verizon never denied NSA involvement: http://news.cnet.com/8301-13578_3-57589012-38/nsa-surveillan...

webwanderings• 13 years ago

Is it just me or does anyone finds this odd:

> When we are legally obligated to comply with demands, we pull the specified content from our servers where it sits in an unencrypted state...

Why would the public's private data sit in unencrypted state on Microsoft's servers? What would be the point of encryption if corporation servers can see what you think you are securing via assumed privacy?

mehrzad• 13 years ago

If it's encrypted, it's harder to sync across devices is what I assume, but I'm not sure. Lavabit seems to be doing fine.

yread2• 13 years ago

It's quite hard to do stuff like full-text search on encrypted data

Spearchucker2• 13 years ago

Erm, no. It's actually quite easy, if you're prepared to do a little more work.

You just create a search index before encrypting the data. Then you encrypt the index. Each time you need to search, you decrypt the index, get a reference to one or more results, fetch those, and decrypt them.

That's trivialising what can become a pretty complex scenario, but it illustrates the point.

jnbiche• 13 years ago

Yes, although there's a cutting-edge form of encryption called homomorphic encryption that would allow full-text search on encrypted data if an implementation is ever perfected. IBM is working on it, among many others:

http://nakedsecurity.sophos.com/2013/05/05/ibm-takes-big-new...

declan5• 13 years ago

How many consumer-focused Internet companies encrypt user data in storage by default -- in a way that the company itself cannot decrypt given a lawful court order? (I'm not talking here about transit HTTPS/TLS encryption.) I don't know of a whole lot.

amirmc• 13 years ago

I'm not being snarky but what gave you the impression it sat there encrypted?

(caveat: I'm not a security expert) Encryption is used for data 'in flight' as well as 'at rest'. As far as I know, very few companies/services go out of their way to encrypt your stuff at rest (it's within their systems/firewall/etc at that point). Even if they did, they hold the encryption keys so can 'see' it anyway.

If you want a situation where a company cannot see your data, you have to hold the encryption keys yourself (nb: knowing the password != holding the encryption key. My rule of thumb for this is if I can do a password reset on a service, then that service can see everything I put into it.)

rlu2• 13 years ago

What I find interesting about all these cases is who knew that this was happening? Were Steve Ballmer/Larry Page/Mark Zuckerberg/etc. as surprised as we were when this all got released? I wouldn't be surprised if they were (with maybe the exception of Mark since it's a smaller company).

yuhong2• 13 years ago

Yea, as I said before it is not likely that any of these people have any security clearance at all.

rlu2• 13 years ago

Sure, but I don't think many people at Microsoft have security clearance to begin with. Like when the NSA reached out to some middle management Joe on the Outlook.com team, he/she probably did not have security clearance.

yuhong2• 13 years ago

OT, but personally I am thinking of tracing this one:

http://slashdot.org/comments.pl?sid=3891677&cid=44076497

An important information from the "confidential" studies here for example would be what kind of monitors were tested.

mtgx• 13 years ago

Both Google and Microsoft need to offer end-to-end encryption/easy to use client-side encryption without having any access to any keys themselves, wherever possible (chat, e-mail, cloud storage). End of story - if they really do "care about our privacy".

Otherwise they're just disingenuous at this point, because they know that while they say that in public, they give access to spy agencies all over the world to a lot of those accounts, that probably have nothing to do with "terrorists". Even if they think all the requests the US government is doing are "legitimate", do they really want to make it just as easy for the Saudi Arabian government or others to do the same?

igravious• 13 years ago

This is what I thought too but as others have pointed out elsewhere in this thread how would they provide additional services on top like search and I don't know what.

Come to think of it though, if the service is free (i.o.w. you are the data and advertisers are the actual customers wouldn't Google/Facebook or whoever be more concerned with the security and privacy of those paying the bills rather than the data-points generating harvestable content.

So it really does seem that we need to move ultimately to federated, paid-for services for communication at least, like POTS but for email and chat and whatever.

derefr• 13 years ago

They care about privacy... but they care about staying in business more.† They are in the business of providing web services (i.e., things you ask their servers to do to your data.) If they can't do anything with your files besides store them, they don't have a business.

† (To assume otherwise would be odd, wouldn't it? It's like taking someone saying "I like ice-cream" to mean "I would allow you to shoot me in exchange for some ice-cream." We assume people have an implicit preference for staying living. We should probably assume companies do too.)

ralfd• 13 years ago

Remember that Google is in the advertising business. If they can't scan users informations for showing context-sensitive ads, it would defeat their business model.

pippy• 13 years ago

Let's not forget Microsoft's ad campaign around Google's privacy:

http://www.scroogled.com/

shmerl2• 13 years ago

This campaign is highly hypocritical, since they don't care about users' privacy any more than Google does.

cobrausn• 13 years ago

I don't quite read it the same way - it means they, as a company, have little incentive to parse your email for choice bits and serve you advertising based on the results, because they don't make their money that way.

The people making this campaign probably knew nothing about PRISM anyhow.

scrrr• 13 years ago

The ones suffering are Microsoft. (IMHO) I don't think that many of their corporate customers are still considering investing in their software. This could be a huge turning point for them.

And unfortunate or not, I think they deserve to lose customers. Actually, I am surprised their stock is not plummeting right now.

RobAtticus• 13 years ago

Think your perspective is a bit off there if you think this should be causing a stock meltdown or a mass exodus. Most people, rightly or wrongly, probably aren't all that interested in Microsoft's involvement, but more concerned about where Snowden is and whether he's leaking our classified information to other nations. Yes, there are people upset at the tech companies and the NSA, but I don't think it's nearly as widespread as it is in the tech echo chamber.

EDIT: To clarify, maybe this SHOULD cause a mass exodus in an ideal world. But I don't think that matches up with reality, and therefore I don't think a mass exodus/stock meltdown is really an expected outcome.

gurkendoktor• 13 years ago

Most people, rightly or wrongly, probably aren't all that interested in Microsoft's involvement, but more concerned about where Snowden is

But what about the people in charge of buying software or services for their company? These are the people that Microsoft should worry about.

Sven7• 13 years ago

I know its fashionable to bash Microsoft but give me a break.

Why focus just on tech what about all those financial transactions flowing through Wall Street. Is everyone going to start banking in Antarctica now?

What has happened with American tech companies wrt the NSA can happen to any company anywhere in the world holding data. If the government walks in one day, and says give me the keys, lives are on the line, most people I know will hand over the keys.

InclinedPlane• 13 years ago

Are you serious?

Most big "enterprisey" customers who use MS servers or exchange or office etc. aren't even remotely contemplating about switching to anything else. That's a pretty safe business for MS at this moment. That will likely change, but it's hard to predict when.

ladzoppelin• 13 years ago

So they should invest in Google apps or Apple? The first leak from Snowden showed every top company is helping NSA and by law ordered to lie. The whole thing sucks for US tech ..

shmerl2• 13 years ago

Purely a PR move, after the recent revelations. MS for years collaborated with various governments, often providing information before being asked. And now we are supposed to believe that they are concerned about it?

barista• 13 years ago

I am surprised that Microsoft took as much flak for it as it did when pretty much every other online property including Google and Facebook has complied with these demand (as they are legally supposed to do). Besides it is also interesting to note that providers such as Google and Facebook probably have a lot more interesting data that the government is likely interested in. It is more likely that data from the likes of Google and Facebook that can be used to track an individual or can be detrimental to them as compared to the data that Microsoft has.

znowi• 13 years ago

Yes, they suddenly care about "constitutional principles" one month after the revelations.

brymaster• 13 years ago

Agree with you. This is the same as facebook now pretending to care about offering you a way to 'permanently delete' your data despite a 9-year history of completely the opposite.

The actions always speak louder than the words.

mortdeus• 13 years ago

Microsoft needs to quit acting like a lil bitch.

spoiledtechie• 13 years ago

Took them long enough to come out with a letter. Only after other companies stepped out.

Unfortunate for MSoft as I used to be a fanboy, but no more.

o0-0o• 13 years ago

Fuck yeah, MicroSoft. Fuck. Yeah!

mrmondo• 13 years ago

Can anyone say 'Damage Control'?

Microsoft: U.S. Constitution is 'suffering' from NSA secrecy

Related Stories