Microsoft Says: Come Back with a Warrant, Unless You’re Microsoft

https://www.eff.org/deeplinks/2014/03/microsoft-says-come-back-warrant-unless-youre-microsoft

by rdl • 12 years ago

142 81 12 years ago

Locke16892• 12 years ago

If the EFF wants to continue pretending that they're still primarily a legal outfit, I want one of their lawyers to prepare an actual brief or at least a citation on this matter of law on which they have deigned to hold court.

I am of course not a lawyer, but the inability of what is ostensibly a legal advocacy group to fail to attempt a prima facie case on violation of a law is just too pathetic for me to care.

rdl2• 12 years ago

Stuff like "HTTPSEverywhere" isn't entirely a legal advocacy matter, either. I don't think EFF needs to constrain itself to legal advocacy to be an effective organization. Making technical and policy recommendations to private companies and individuals (as producers and consumers) seems fine.

Locke16892• 12 years ago

The article explicitly states a legal opinion -- that Microsoft violated the EPCA. The author is a lawyer. Come on.

josephlord• 12 years ago

The point isn't that Microsoft have done anything illegal[0] it is what they have done is crappy and privacy invading. If Microsoft's actions are legal (regardless of whether they should be) any legal case would be bogus and almost certainly lose; achieving nothing.

[0] They haven't as far as I am aware.

pyre• 12 years ago

The EFF doesn't constrain themselves to just writing briefs in an effort to make sure that only the current laws on the books are interpreted in a sane fashion. Have you not seen them advocate for policy changes or against poor policy changes (e.g. SOPA)?

duaneb3• 12 years ago

primarily a legal outfit

I think I would prefer an ethical one. Most interesting problems are not legal—the law simply reflects the solution. I think the EFF correctly identified this as a problem, even if they aren't going to be fined by the government.

sytelus3• 12 years ago

Go back and read Microsoft's privacy policy [1]. Microsoft has inserted following in it:

We may access information about you, including the content of your communications to protect the rights or property of Microsoft.

In short, you agreed that they can search any of your shit without warrant or permission if they deem that you are a risk to Microsoft in anyway.

[1] http://privacy.microsoft.com/en-us/fullnotice.mspx

lawnchair_larry2• 12 years ago

An activists organization that only defends existing laws would be pretty useless. You're being shortsighted in your expectations here.

cheeze• 12 years ago

Which is exactly what you agreed to when you signed up for their service. Privacy and Microsoft are mutually exclusive.

sliverstorm3• 12 years ago

Kind of the way it is with every service, unless you take extra measures to protect yourself. E.g., PGP, careful selection of data you upload, or just not using any cloud services in the first place.

PythonicAlpha12• 12 years ago

No, normal online providers will have terms that they don't infringe into your privacy rights.

pktgen2• 12 years ago

Not defending MS at all but what is the alternative for them? What people want is the judicial oversight. But can Microsoft really go to a court and say "hey judge, we're Microsoft, we want a warrant for Microsoft to provide this"?

sliverstorm3• 12 years ago

Alright Microsoft, your days on the run are over. We, Microsoft, have gotten a subpoena against you. Now cough up that data, us. I mean you.

glimcat• 12 years ago

Ideally, I'd like to see a situation where you (1) have a contract protecting user data which is reasonably enforceable given the power dynamics which exist between the two parties, and (2) it's required for a judge to arbitrate whether a given situation provides justification to breach that contract.

Where "judge" is proxy for a nominally impartial third party who nominally has the experience to make an informed decision which reasonably protects the interests of both parties, the public interest, and our stated commitments to civil liberties. And we already make routine use of judges for this function in cases where the data or other artifacts are not possessed by the party who wants extraordinary permission to access them.

crygin• 12 years ago

Agreed -- based on MS's statement they went through a fairly rigorous internal procedure (of course, they could be lying, but it seems fairly unlikely particularly given the regulatory attention MS generally has on it). I don't fully understand what people think they "should" have done to access the emails -- waste a court's time on a meaningless judgement?

PythonicAlpha12• 12 years ago

No, not waste!

When you act rightfully, it is never wasting time of the legal system!

Because I can do something (without asking anybody else) it needs not to be right!

chris_mahan3• 12 years ago

They should have called the FBI, the FBI would have requested a warrant, the Judge would have approved the warrant, and the FBI would have accessed the information in the user's account.

That would have been the correct way to do it.

mcintyre1994• 12 years ago

It's far too idealist to be realistic, but they shouldn't be able to use that information for their own civil inquiry. If gmail or pgp were used they wouldn't have access to it, it being a Microsoft account shouldn't make its contents available to them for a private investigation. Of course it does and probably always will because they have lots of lawyers and terms of service, but I just disagree with them being able to.

I agree that if they have to do this investigation (and really they're the ones that will ultimately decide that) they shouldn't get anyone else involved - especially the criminal justice system.

I think what I'm trying to get at is that the conversation is turning here toward just how should Microsoft access the data they want, when it should be whether they should be able to at all. I don't like the idea that it's a given that they can take that information, and that's what should change here.

PythonicAlpha12• 12 years ago

A bank also has no right to search a locker that you have rented from them. The bank has to have a warrant against you to search it.

cookingrobot• 12 years ago

And a landlord has no right to come into your apartment without warning, even if they think you stole something from them.

duaneb3• 12 years ago

But can Microsoft really go to a court and say "hey judge, we're Microsoft, we want a warrant for Microsoft to provide this"?

Yes. They want people to use their products, don't they? I'm not going to spend money on a product that gives me zero assurance that I have control of my information.

kvb3• 12 years ago

Can you cite any precedent where a court has agreed to hear such an argument? This is not a rhetorical question - I'm genuinely curious whether civil procedure allows it. As a non-lawyer (and MSFT employee) who is interested in the law, the closest thing I can think of is a motion for declaratory judgment, but even there I think you need an actual case or controversy before the judge will hear arguments.

sytelus3• 12 years ago

You can't be serious. Microsoft could have filed complaint against employee with law enforcement agency who then would have received warrant to search any properties that law enforcement agency deemed as required.

Key here is that Microsoft is not searching itself. Content of the email account does not belong to Microsoft, it belongs to the user. To search it Microsoft needs explicit permission of user or law enforcement agency.

e12e• 12 years ago

Indeed. Consider this: you are a budding new software engineer, and you've used gmail since it came out. Now you start work at google. And now, google is entitled to search through your email? (Replace outlook.com/hotmail and microsoft, or y! mail and yahoo! etc)

mindslight• 12 years ago

Microsoft's actions in this case are pretty predictable, and the fact that this is a "story" at all just highlights the lowest common denominator news cycle (or alternatively the out of touch entitlement of webmail users).

But just think if they had filed a civil suit and gone to court for discovery of information that they had possession of but conceivably not the right to - they could have created a nice legal precedent and ended up being lauded by the EFF!

lawnchair_larry2• 12 years ago

I think they should just leave their users property alone, and act like a dumb conduit without the ability to inspect. Find other ways to solve the problem. Do what they would do if they were not in the convenient position of being the email host.

andrewfong3• 12 years ago

You missed that "what they would do if they were not in the convenient position of being the email host" is subpoena the email host. Unfortunately, you can't really subpoena yourself. Nor is it clear that they could subpoena the user here and compel the user to give information to Microsoft that Microsoft already has.

The EFF suggests getting the FBI involved and having them serve a court-approved warrant, but that doesn't work if you want to keep this a purely civil process and not involve the police (and given recent abuse of police powers for relatively minor crimes, getting the FBI involved is probably not something to be categorically encouraged).

sergers• 12 years ago

I would have to agree with MS.

Someone sharing proprietary info using your email platform, and its completely in their right as per eua to look at it, then damn right they should have reviewed the leakers account.

The guy knowingly received proprietary info.

Eff is almost like a troll sometimes

For one summer between semesters I worked for a MS call center who handled hotmail which we could read peoples mail if wanted. We didn't as MS has great auditing

duaneb3• 12 years ago

Eff is almost like a troll sometimes

It's almost like they're trying to free email from being a corporate black hole.

PythonicAlpha12• 12 years ago

As for me: MS has discredited itself with this behavior.

How can I know, that MS will not open my Word or Excel documents that I have in the Online-Office system, because it may contain information of value to its business -- or it may infringe on patents MS holds?

So, neither MS online mail products, nor online office systems can be trusted any more! Any business owner should know this and withdraw from usage of any MS owned online systems.

higherpurpose2• 12 years ago

Completely agreed. Also, I think starting with Windows 8.1, if you're logged in to Windows with a Microsoft account, your documents get saved automatically to Microsoft's cloud. I would watch out for that, especially if you have sensitive documents.

RexRollman• 12 years ago

You should what out for that with any cloud service.

kvb3• 12 years ago

Are you doing things that would enable Microsoft to get a court order against you? What parallels do you see with the actual facts of this case?

PythonicAlpha12• 12 years ago

If they could get a court order, why did they not do so?

I am really amused about the law feeling in the US. It seems to me, that in the US it is enough that a big company thinks that it can get a court order -- in that case nothing else is needed -- don't waste the time of the courts just go on.

Why not allow MS to also do the punishment -- don't waste any court-time!

Really cute!

To come to your question: There are cases, where you can get warrants because you infringe patents. So, when MS thinks, that I could infringe one -- why not search my office documents first??

Is this enough example? I would say, there could be thousands ... just imagine a world where the lawyers of the big companies make the court decisions ... <sarcastic>would be OK, they are making the laws anyway!</sarcastic>

rando289• 12 years ago

Maybe, maybe not. Perhaps I am an employee with a big technology company like google and my company has a wide array of partnerships, contracts, and ongoing lawsuits with various microsoft business units. Some court may give a court order to disclose some email from some employees of my company, but Microsoft might just decide to search every hotmail account of every employee of my company for whatever reason they want, and only reveal extremely limited subset as required by specific litigation.

amaks• 12 years ago

Completely agree. As a convicted monopolist Microsoft at the very least needs this kind of behavior, especially conducting search on its own without any law enforcement order.

thenewbtg• 12 years ago

"So, neither MS online mail products, nor online office systems can be trusted any more! Any business owner should know this and withdraw from usage of any MS owned online systems"

FYI: Google and Yahoo have similar policies and similar histories of abuse.

If you feel this way about Microsoft, you should feel this way about Google products, sites and services too.

http://www.theguardian.com/technology/2014/mar/21/yahoo-goog...

http://uncrunched.com/2014/03/21/google-spied-gmail/

stinos• 12 years ago

So, neither MS online mail products, nor online office systems can be trusted any more!

can you back this up with proper evidence? If I get it correctly, the hotmail EULA sort of allowed to do MS what they did. So does the Online-Office system (is that the same as Skydrive actually?) have a similar EULA? If so, then your statement seems valid. Else you are comparing apples with, erm, something that still comes close to apples: legally MS can't do that - which is no guarantee that they won't. Apart from that, like with probably any cloud service, there is always the risk a thir party like the NSA does whatever they want with your data anyway.

PythonicAlpha12• 12 years ago

I ask myself, why the rights of the (big) owners of "Intellectual Property" are strengthened all the time, but the rights of the small owners of Private information are reduced and reduced.

Something I just can't comprehend.

josteink• 12 years ago

Had you hosted your own email service on your own servers, your rights would be perfectly protected. Nobody is stopping you from doing this.

However, this guy used a company's email-service to try to leak proprietary business info about the same company.

You can't seriously expect to get away with that.

FD3SA• 12 years ago

This is equivalent to USPS opening your mail because they were tipped off of wrongdoing against their company, with no evidence whatsoever. Do you have a problem with that? Well too bad, its "their" mail.

Randian utopia at its finest.

mahyarm2• 12 years ago

What does this have to do with ayn rand or libertarians?

chc• 12 years ago

Many Randians believe that a free and unregulated capitalist market is the best solution to most problems. This is being put forth as an example of a problem with allowing private corporations such a central role in society without any oversight beyond the "invisible hand" of the market.

mbreese• 12 years ago

For Microsoft, this is very much a win the battle, lose the war situation. While they were perfectly within their legal rights to access the Hotmail account, it was horribly bad optics. It just looks bad. And it's stuff like this that makes cloud services a hard sell to a large demographic.

So while this may blow over, people will be more paranoid that Microsoft will decide that they have the right to look at your data, just because it exists on their servers.

Google isn't much better in this regard. Amazon so far is better positioned because they don't offer any other private "consumer" services that they'd want to review. But really unless you have the hardware in your physical possession, you will always be subject to these problems.

droopybuns• 12 years ago

Honestly, this whole thing has been such a glorious example of the absolute stupidity and tone-deafness of M.S.

It is mind-boggling that they could have shared the kinds of details they did with the press about their behavior.

"We busted a criminal. Along the way, we shat in the corner. We got the criminal really good."

How in the world could they have missed that second sentence? It's just incredible. My mouth is agape.

higherpurpose2• 12 years ago

What worries me is that FBI or NSA could've established a sort of relationship with Microsoft, where they don't even need to get court orders or warrants, because they can get them from "Microsoft" voluntarily, and Microsoft can just take the data from the users without any other judicial step, and give it to them. Wouldn't this type of loophole work in theory? I wonder if this is what the Snowden documents meant about Microsoft and NSA's "team sport":

http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...

myrandomcomment• 12 years ago

What MS did is in there terms of service. If you do not like it use do not use Hotmail. It is really that simple.

PhantomGremlin• 12 years ago

Everyone who uses Hotmail, Gmail, Google Drive, OneDrive, Google Docs, Dropbox, Evernote, and countless other similar services needs to keep in mind the following quip (which I stole from somewhere on the Internet):

   Today's word: The cloud.
   Explanation: Someone else's computer.

I'm a user of various cloud services, but I'm not naive enough to have any expectation of privacy, from either that company or from the NSA. Period. Full stop.

joseba286• 12 years ago

Good point, they can say whatever they want but we should just assume that our data could fall into someone else hands at any moment..

sytelus3• 12 years ago

http://www.scroogled.com/mail

Cough... cough...

briantakita• 12 years ago

"with intent to convert trade secrets belonging to Microsoft, specifically Microsoft's Activation Server Software Development Kit, to the economic benefit of someone other than Microsoft" "All in violation of Title 18, United States Code, Section 1832(a)(2), (a)(4), and 2."

http://www.law.cornell.edu/uscode/text/18/1832

So had Alex Kibkalo simply published this in the public domain, there would be no criminal case?

otterley• 12 years ago

Unlikely. I don't think a reasonable court would conclude that one has to have a specific beneficiary in mind to satisfy the prong of intent to benefit a third party.

Microsoft Says: Come Back with a Warrant, Unless You’re Microsoft

Related Stories