Microsoft responds to NSA allegations

[wraith808]

I've been trying to keep these together, but this is directly tech and such a holy crap moment, that I felt it deserved its own thread.

Microsoft responds to NSA allegations: "We believe the U.S. Constitution guarantees our freedom to share more information with the public, yet the Government is stopping us"

I just don't have the words.  And from Microsoft?

At least it's become a competitive liability to be associated with the NSA.  Maybe capitalism will win out where logic hasn't?  But then again, they'll probably choose a different name for the initiative, hide it off the books, and keep going like they are.

(from comments on reddit...)
"Introducing Altria. It's just like altruism only the opposite."

Altria Group, Inc. (previously named Philip Morris Companies Inc.) is a corporate business based in Henrico County, Virginia, United States of America and is the parent company of Philip Morris USA, John Middleton, Inc., U.S. Smokeless Tobacco Company, Inc., Philip Morris Capital Corporation, and Chateau Ste. Michelle Wine Estates.

[Renegade]

Skimmed through it. Seems like it's just misleading damage control.

[wraith808]

Skimmed through it. Seems like it's just misleading damage control.

-Renegade (July 16, 2013, 10:43 PM)

The big thing is the fact that Microsoft is doing it.  Yes, it's damage control.  Not so sure about the misleading, but it could be.  But Microsoft is unapologetic about most things, so for them to actually blog this is the part that was amazing to me.

[Renegade]

Not so sure about the misleading, but it could be.

-wraith808 (July 16, 2013, 11:08 PM)

Stuff like this:

Deny:
We do not provide any government with direct access to emails or instant messages.
Full stop.

Then completely recant what you just said:
Like all providers of communications services, we are sometimes obligated to comply with lawful demands from governments to turn over content for specific accounts, pursuant to a search warrant or court order.

Specific? As in specifically everyone?

That's in there a lot. "We comply with..." Well, WTF do you call giving information to governments? Either you do or you don't. There is no inbetween. Saying that you don't BUT... is still a bit BUT, with the inevitable "yes we do" following behind it.

It's just more BS lies.

The thing is that it is no longer possible to give anything the benefit of the doubt anymore. If there is even the slightest possible interpretation for doubt there, then it's likely true.

One only need to look at James Clapper to see that is true. "...least untruthful..." Yeah. Right. How many times did he lie or switch his story? Running out of fingers?

[Stoic Joker]

Superficially, this sounds good ... But, it also clarifies just how exposed cloud data really is, as providers have no vested interest in your personal privacy. Hence you can be easily subjected to intense scrutiny, having all of you correspondences spun out of context...with no forum for rebuttal...until it's too late.

Once you're in the 'system' you've already lost.

[wraith808]

Deny:
We do not provide any government with direct access to emails or instant messages.
Full stop.

Then completely recant what you just said:
Like all providers of communications services, we are sometimes obligated to comply with lawful demands from governments to turn over content for specific accounts, pursuant to a search warrant or court order.

-Renegade (July 16, 2013, 11:25 PM)

In that specific case, I think they were referring to the fact that they comply with the rule of law towards such things, i.e. you need a specific warrant, but they don't just let the government have direct access to all e-mails.  At least, that's what I took it as.

[Renegade]

In that specific case, I think they were referring to the fact that they comply with the rule of law towards such things, i.e. you need a specific warrant, but they don't just let the government have direct access to all e-mails.  At least, that's what I took it as.

-wraith808 (July 17, 2013, 07:56 AM)

There are more examples in there. That was just the first one.

I'm simply unwilling to show the slightest bit of leniency for any of these people anymore. No more charitable reads. They must be absolutely explicit and unequivocal. If there's any wiggle room, I'm assuming the worst. That's the safest bet as far as I can see. But even then, just how many unequivocal lies have we been told? I think I'm being far, far more than reasonable.

[40hz]

I think they were referring to the fact that they comply with the rule of law towards such things

-wraith808 (July 17, 2013, 07:56 AM)

Yet another attempt at spin control...

Translation: We were constrained - by law - to knowingly break the law.

Hmm...problem!

They could have gone public over that with small fear of any legal reprisals sticking. But they didn't. They instead chose to hide behind the excuses that were being spoon fed to them.

And besides, who wants to disrupt the cozy relationship that Microsoft has with the US government? There's legislation Microsoft wants enacted. And court cases surrounding IP issues Microsoft wants resolved in a manner congenial to Microsoft's own business interests. To say nothing of all the licenses for Microsoft products and services our government purchases from them each year...

Nope! That's too good a boat to rock on mere principle or respect for the Constitution. Far better to roll with Obama's administration on this one. Besides, Washington has already promised to indemnify all the corporate participants should the shit ever really hit the fan. So no worries!

Two things to remember and think about:

• The old saying that goes: "Truth and justice dies wherever greed and self-interest rules."
• A little bit of history. Because back in 1945, 23 government and corporate employees were put on trial for certain heinous actions on their part. Actions which the defendants characterized and as merely "following orders." That defense argument didn't wash with the tribunal hearing their cases. And it isn't going to wash for Microsoft either. Because the the rule that emerged from that tribunal was that crimes are committed by men, not abstract entities.

Now we all know it's extremely doubtful to the point of certainty that anybody in Microsoft (or the US government) will ever face criminal charges for any of this. But that's not the same thing as accepting their assertions they are entirely innocent of any wrongdoing.

[wraith808]

I'm simply unwilling to show the slightest bit of leniency for any of these people anymore. No more charitable reads. They must be absolutely explicit and unequivocal. If there's any wiggle room, I'm assuming the worst. That's the safest bet as far as I can see. But even then, just how many unequivocal lies have we been told? I think I'm being far, far more than reasonable.

-Renegade (July 17, 2013, 08:58 AM)

Yeah... you've got me there.  But the fact that MS was willing to call out the NSA and DOJ in a public forum is what was telling for me.  Other than if it's a smokescreen for changes to the relationship that aren't really changes.  *sigh*

[Renegade]

@40hz - Well put.

Because the the rule that emerged from that tribunal was that crimes are committed by men, not abstract entities.

This is a very real problem - "abstract entities" have been granted "human rights". They are not human, and have no legitimate claim there. Incorporation is effectively an abdication of responsibility for any wrong-doing, and has been abused in horrific ways. We are seeing a lot of that now. The entire information abuse aspect is merely one side of the die.

But the fact that MS was willing to call out the NSA and DOJ in a public forum is what was telling for me.

-wraith808 (July 17, 2013, 10:39 AM)

You've got a good point there. But my gut just tells me that they're only trying to shift blame, i.e. CYA (cover your ass). The US is a litigious society, so that shouldn't be very controversial there.

[wraith808]

Now we all know it's extremely doubtful to the point of certainty that anybody in Microsoft (or the US government) will ever face criminal charges for any of this.

-40hz (July 17, 2013, 10:35 AM)

Depends on how deep the well goes.  See... 'scapegoat' and 'disavowed'.  The government walks a line between business as usual and assuaging (majority) public opinion.  The wall street scandals are a good look at that...

Bread and Circuses is what it all comes down to in the end.  Whatever they have to do to get the spotlight somewhere else...

[Vurbal]

I posted this already at TechDirt but since I don't like sending people to another site in mid-conversation I'll just repost it here. Over the past few years I've had to cover a lot of businesses, lobbyists, politicians and lawyers for my job. There is a fine art to parsing a statement released by any of them because they pretty much never actually say what they're trying to convince you to believe.

Mad Magazine used to occasionally run a feature called, "When They Say... They Mean." With apologies to the late Bill Gaines I present my interpretation of Microsoft's non-denial denial.

When they say... Today we have asked the Attorney General of the United States to personally take action to permit Microsoft and other companies to share publicly more complete information about how we handle national security requests for customer information. We believe the U.S. Constitution guarantees our freedom to share more information with the public, yet the Government is stopping us. For example, Government lawyers have yet to respond to the petition we filed in court on June 19, seeking permission to publish the volume of national security requests we have received. We hope the Attorney General can step in to change this situation.

They mean... As long as this is so embarassing to high ranking government officials we will have plausible deniability. Once they figure out how to spin this we'll coordinate together to make sure we keep our stories straight. We remain confident in the ability of career bureacrats to cover their own asses which they can't do without covering ours as well.

When they say... Until that happens, we want to share as much information as we currently can. There are significant inaccuracies in the interpretations of leaked government documents reported in the media last week.

They mean... We're really embarrased that people found out what we were up to. We can't actually refute a single fact from the leaked documents because they're all true. Also, we don't know what else that rat bastard Snowden leaked. Since the government is giving us lots of cover right now we can at least try to control the debate.

When they say... We have asked the Government again for permission to discuss the issues raised by these new documents, and our request was denied by government lawyers.

They mean... We're victims here just like you. It's us against them.

When they say... In the meantime, we have summarized below the information that we are in a position to share, in response to the allegations in the reporting:

They mean... Our crack team of professional liars in Public Relations has come up with a 100% substance-free defense. It strongly implies a complete denial of our complicity in NSA surveillance without actually commiting to a single relevant fact. The meaning is subject to change over time to match any additional revelations. We're confident major media outlets will simply regurgitate it without any critical analysis and the public will follow along like the sheep they are. That's why we're running Microsoft and you're asking us if we want fries with that.

When they say... Outlook.com (formerly Hotmail): We do not provide any government with direct access to emails or instant messages. Full stop.

They mean... Technically no human has direct access to anything stored on a computer but it sure sounds like we're keeping the government away from your data doesn't it?

When they say... Like all providers of communications services, we are sometimes obligated to comply with lawful demands from governments to turn over content for specific accounts, pursuant to a search warrant or court order.

They mean... Let's change the subject.

When they say... This is true in the United States and other countries where we store data. When we receive such a demand, we review it and, if obligated to we comply.

They mean... We were just following orders.

When they say... We do not provide any government with the technical capability to access user content directly or by itself.

They mean... Government agents get your information remotely and access is controlled by Microsoft servers. That's how cloud services work.

When they say... Instead, governments must continue to rely on legal process to seek from us specified information about identified accounts.

They mean... The NSA just happened to specify "All Information from Every Account."

When they say... Not surprisingly, we remain subject to these types of legal obligations when we update our products and even when we strengthen encryption and security measures to better protect content as it travels across the Web.

They mean... This is not about your data. It's about our business. Government contracts account for a significant percentage of our profits and we intend to keep it that way. You don't shit where you eat.

When they say... Recent leaked government documents have focused on the addition of HTTPS encryption to Outlook.com instant messaging, which is designed to make this content more secure as it travels across the Internet.

They mean... See, we're doing everything we can to protect you. We really do care.

When they say... To be clear, we do not provide any government with the ability to break the encryption,

They mean... Seriously, let's change the subject. We are not doing what nobody accused us of doing.

When they say... nor do we provide the government with the encryption keys.

They mean... While we're at it, though, let's address that story about how the NSA has their own backdoor built into Windows. We didn't provide them with that. They provided it themselves. We just put it on your computer.

When they say... When we are legally obligated to comply with demands,

They mean... As long as they have a court order signed by a judge we have enough plausible deniability to give them whatever they ask for. Fighting for your basic Constitutional rights is a high risk, low reward proposition and it's not our job.

When they say... we pull the specified content from our servers where it sits in an unencrypted state, and then we provide it to the government agency.

They mean... We don't let the NSA tell our servers to give them all your data. We tell our servers to give the NSA all your data.

When they say... Cutting through the technical details, all of the information in the recent leaked government documents adds up to two things.

They mean... Seriously, though, that's all over your head anyway. Here's a dumbed down version even you can understand.

When they say... First, while we did discuss legal compliance requirements with the government as reported last week, in none of these discussions did Microsoft provide or agree to provide any government with direct access to user content or the ability to break our encryption. Second, these discussions were instead about how Microsoft would meet its continuing obligation to comply with the law by providing specific information in response to lawful government orders.

They mean... If we repeat these talking points enough most of you will convince yourselves we did nothing wrong because we're pushing the right psychological buttons. We don't need no stinking facts. We just need to give the part of your brain that wants to believe us an excuse to shout down all your reason and logic. One way to do that is repeat the same thing over and over.

When they say... SkyDrive: We respond to legal government demands for data stored in SkyDrive in the same way. All providers of these types of storage services have always been under legal obligations to provide stored content when they receive proper legal demands. In 2013 we made changes to our processes to be able to continue to comply with an increasing number of legal demands of governments worldwide. None of these changes provided any government with direct access to SkyDrive. Nor did any of them change the fact that we still require governments to follow legal processes when requesting customer data.

They mean... Rinse, lather, repeat.

When they say... The process used for producing SkyDrive files is the same whether it is for a criminal search warrant or in response to a national security order, in the United States or elsewhere.

They mean... Every government has the power to compel us to hand over information. What the US government is doing is nothing out of the ordinary if you look at it on a completely abstract and theoretical level. Of course on that level vanilla and chocolate are exactly the same because they're both flavors.

When they say... Skype Calls: As with other services, we only respond to legal government demands, and we only comply with orders for requests about specific accounts or identifiers. The reporting last week made allegations about a specific change in 2012. We continue to enhance and evolve the Skype offerings and have made a number of improvements to the technical back-end for Skype, such as the 2012 move to in-house hosting of “supernodes” and the migration of much Skype IM traffic to servers in our data centers. These changes were not made to facilitate greater government access to audio, video, messaging or other customer data.

They mean... How could a company that cares so much about you be colluding to violate your rights? We're not saying we didn't do exactly that, but we're hurt that you would believe it.

When they say... Looking forward, as Internet-based voice and video communications increase, it is clear that governments will have an interest in using (or establishing) legal powers to secure access to this kind of content to investigate crimes or tackle terrorism. We therefore assume that all calls, whether over the Internet or by fixed line or mobile phone, will offer similar levels of privacy and security.

They mean... Don't be naive. All your communications have been subject to secret surveillance since 9/11. All we're doing is complying with government policy. If you don't like it blame them.

When they say... Even in these circumstances Microsoft remains committed to responding only to valid legal demands for specific user account information. We will not provide governments with direct or unfettered access to customer data or encryption keys.

They mean... Pay no attention to the man behind the curtain.

When they say... Enterprise Email and Document Storage: If we receive a government demand for data held by a business customer, we take steps to redirect the government to the customer directly, and we notify the customer unless we are legally prohibited from doing so. We have never provided any government with customer data from any of our business or government customers for national security purposes.

They mean... If you're an enterprise customer rest assured you are still a special little snowflake. Your willingness to pay premium prices for our software and services year in and year out is the lifeblood of our company. Fighting for your rights is the fiscally responsible thing to do, and by fighting we mean sending the government to you. After that you're on your own.

When they say... In terms of criminal law enforcement requests, we made clear in our Law Enforcement Requests Report that throughout 2012 we only complied with four requests related to business or government customers. In three instances, we notified the customer of the demand and they asked us to produce the data. In the fourth case, the customer received the demand directly and asked Microsoft to produce the data.

They mean... After all you're going to be just as receptive to government demands as we are anyway. You know better than to argue principle or due process with agencies that can crush you on a whim.

When they say... We do not provide any government with the ability to break the encryption used between our business customers and their data in the cloud, nor do we provide the government with the encryption keys.

They mean... We didn't do that thing nobody accused us of to you either.

When they say... In short, when governments seek information from Microsoft relating to customers, we strive to be principled, limited in what we disclose, and committed to transparency. Put together, all of this adds up to the following across all of our software and services:

They mean... Now let's make sure the last thing you read is our talking points. This will probably be all you remember anyway.

When they say... Microsoft does not provide any government with direct and unfettered access to our customer’s data. Microsoft only pulls and then provides the specific data mandated by the relevant legal demand.

If a government wants customer data – including for national security purposes – it needs to follow applicable legal process, meaning it must serve us with a court order for content or subpoena for account information.

We only respond to requests for specific accounts and identifiers. There is no blanket or indiscriminate access to Microsoft’s customer data. The aggregate data we have been able to publish shows clearly that only a tiny fraction – fractions of a percent – of our customers have ever been subject to a government demand related to criminal law or national security.

All of these requests are explicitly reviewed by Microsoft’s compliance team, who ensure the requests are valid, reject those that are not, and make sure we only provide the data specified in the order. While we are obligated to comply, we continue to manage the compliance process by keeping track of the orders received, ensuring they are valid, and disclosing only the data covered by the order.

Microsoft is obligated to comply with the applicable laws that governments around the world – not just the United States – pass, and this includes responding to legal demands for customer data. All of us now live in a world in which companies and government agencies are using big data, and it would be a mistake to assume this somehow is confined to the United States. Agencies likely obtain this information from a variety of sources and in a variety of ways, but if they seek customer data from Microsoft they must follow legal processes.

The world needs a more open and public discussion of these practices. While the debate should focus on the practices of all governments, it should start with practices in the United States. In part, this is an obvious reflection of the most recent stories in the news. It’s also a reflection of something more timeless. The United States has been a role model by guaranteeing a Constitutional right to free speech. We want to exercise that right. With U.S. Government lawyers stopping us from sharing more information with the public, we need the Attorney General to uphold the Constitution.

If we do receive approval to share more information, we’ll publish it immediately.

They mean... All hail the hypnotoad. All hail the hypnotoad. All hail...

To be fair I took a few creative liberties with my translation, though in my defense I've found Microsoft to be the easiest company in the tech world to read. In any case my larger, and entirely serious point is that Microsoft didn't deny anything. While its true they couldn't provide details about what did happen they were entirely free to deny specific allegations from the leaks but what they did instead was put on a gladiatorial match against their own straw man. Bread and circuses is right.

[tomos]

^thanks for the translation Vurbal
that helped a lot

[40hz]

@Vurbal - easily one of the best analyses ever posted here. Hope you do it some more.

[Renegade]

@Vurbal - easily one of the best analyses ever posted here. Hope you do it some more.

-40hz (July 18, 2013, 07:26 AM)

+1 - That was excellent!

Now... MOAR~!  

[wraith808]

Maybe we were more cynical than we should have been?  Especially since they're putting their money where their mouth is:
Microsoft and Google Sue U.S. Government

[Renegade]

Maybe we were more cynical than we should have been?  Especially since they're putting their money where their mouth is:
Microsoft and Google Sue U.S. Government

-wraith808 (September 02, 2013, 07:58 AM)

Pfft! I'm still cynical. I don't see this as anything more than them simply trying some damage control. If they actually gave a rat's pitootie, they would have done that long ago. If they had any balls, they'd simply blow the whistle and claim 4th Amendment violations were going on, i.e. the government is overstepping its power.

They've probably had number crunchers run through how much the negative publicity will hurt them, and decided that spending the money on lawyers will give them a net better position.

Crocodile tears.

[wraith808]

Well, no matter the reasons behind it, it's still something that could turn out well for the people as this is in open court.  It might not pan out, but I'm cautiously optimistic.

[Renegade]

Well, no matter the reasons behind it, it's still something that could turn out well for the people as this is in open court.  It might not pan out, but I'm cautiously optimistic.

-wraith808 (September 02, 2013, 09:06 PM)

I hope it turns out well. I'm just not holding my breath. My hopefulness is already somewhat overextended elsewhere, and I've just plain run out of it.