Tech Companies Increasingly Telling Users When Law Enforcement Comes Asking For Data

from the good-for-them dept

In the past, we've noted that Twitter, alone among major tech companies, had made it a corporate policy to not just roll over when law enforcement came asking for user data, even alerting users that law enforcement was seeking their data, and giving them the chance to try to block the requests. Apparently, now a bunch of other big tech companies have started doing the same thing:

Google already routinely notified users of government data requests but adopted an updated policy this week detailing the few situations in which notification is withheld, such as when there is imminent risk of physical harm to a potential crime victim. “We notify users about legal demands when appropriate, unless prohibited by law or court order,” the company said in a statement.

Lawyers at Apple, Facebook and Microsoft are working on their own revisions, company officials said, although the details have not been released. All are moving toward more routinely notifying users, said the companies, which had not previously disclosed these changes.

“Later this month, Apple will update its policies so that in most cases when law enforcement requests personal information about a customer, the customer will receive a notification from Apple,” company spokeswoman Kristin Huguet said.

If you're looking for who to thank about this turn of events, there are two places to point. First: the good folks at EFF. For the past few years, it's been publishing its Who Has Your Back? chart looking at how companies respond to government requests for data. Each year, this list has convinced more and more companies to improve how they protect their users, and how they push back on government requests. And, the reason why so many companies are rushing to change their policies is because the EFF is about to release its latest version. Yet another reason to be happy the EFF exists.

Second, of course, is Ed Snowden. While not entirely directly at issue here -- since things like FISA Court Orders and National Security Letters are subject to gag orders barring companies from telling their users -- the generally heightened interest in government access to information provided to internet services has certainly created a culture where these companies can't get away with just rolling over for the government any more.

Of course, you could argue that it's taken these companies too long to get here -- and that's absolutely true -- but better late than never.

Oh yeah. Guess who's really upset about all of this:

The Justice Department disagrees, saying in a statement that new industry policies threaten investigations and put potential crime victims in greater peril.

“These risks of endangering life, risking destruction of evidence, or allowing suspects to flee or intimidate witnesses are not merely hypothetical, but unfortunately routine,” department spokesman Peter Carr said, citing a case in which early disclosure put at risk a cooperative witness in a case. He declined to offer details because the case was under seal.

Once again, it seems like the DOJ and others think that anything that makes their job harder is somehow wrong. But that's incorrect. The whole point of protecting freedom is that it's supposed to be hard for law enforcement to spy on people and arrest them. That's how it's supposed to work.

Filed Under: doj, law enforcement, privacy, protecting users, subpoenas, tech companies, warrants
Companies: apple, eff, facebook, google, microsoft, twitter, yahoo

US Judge Says Prosecutors Can Use A Warrant To Go Fishing For Information Held Overseas

from the jurisdiction:-the-whole-world dept

We've had some discussion concerning the NSA and its defenders arguing that the 4th Amendment doesn't apply outside of the US, but it seems they also believe that the US jurisdiction applies basically anywhere when they want it to. While we recently wrote about magistrate judges pushing back on overly broad requests for information, that clearly is not absolute. Magistrate judge James Francis recently ruled that Microsoft needs to turn over data held on servers in Dublin, even though a US warrant isn't supposed to apply outside the US. Microsoft, quite reasonably, sees this as a problem:

"A U.S. prosecutor cannot obtain a U.S. warrant to search someone's home located in another country, just as another country's prosecutor cannot obtain a court order in her home country to conduct a search in the United States," the company said. "We think the same rules should apply in the online world, but the government disagrees."

As does the judge. The judge's own explanation is basically that he's pretending the warrant is not a warrant, but a subpoena.

Francis agreed that this is true for "traditional" search warrants but not warrants seeking digital content, which are governed by a federal law called the Stored Communications Act.

A search warrant for email information, he said, is a "hybrid" order: obtained like a search warrant but executed like a subpoena for documents. Longstanding U.S. law holds that the recipient of a subpoena must provide the information sought, no matter where it is held, he said.

If the Stored Communications Act sounds familiar, that's because it's a part of ECPA, the horribly outdated law that we've been discussing for years concerning its need for reform. If this ruling stands (and Microsoft is already challenging it), it'll be just one more thing that ECPA reform needs to tackle.

Filed Under: 4th amendment, international, james francis, privacy, prosecutors, warrants
Companies: microsoft

Microsoft And Sony Double Down On Patent Trolling; Dump More Cash Into Intellectual Ventures

from the because-innovation-is-for-suckers dept

Last fall, we noted that the world's largest patent troll, Intellectual Ventures, was running out of cash, which is somewhat incredible, given that it had previously claimed to have raised $6 billion in investments (though many of its earliest deals with tech companies were categorized as "investments" when they were really promises not to sue, combined with access to the patent bank) and a further $3 billion in licenses. It should take a long time to spend $9 billion when your company produces nothing that has ever been brought to market, but that's IV for you. As we noted in that story last fall, many of the tech companies that initially "invested" in Intellectual Ventures had no interest at all in re-upping, as they felt that the whole thing had been a bait-and-switch. They were initially told it was a "patent defense fund," not a giant patent troll itself.

However, while many of the companies have indeed avoided giving IV any more money, it appears that Microsoft and Sony were quite happy to dump a lot more cash into IV, which has now ramped up its patent buying efforts again (as well as its lobbying and political contributions in an effort to kill off patent reform). Microsoft, of course, has always been close to IV, seeing as it was started by the company's former CTO, Nathan Myhrvold, who is also a close friend of Bill Gates (who has directly helped IV get some patents). Similarly, Microsoft has become one of the most aggressive patent abusers over the last decade, increasingly relying on its stock of patents to make money from other people's innovations, rather than innovating on its own.

It is similarly no wonder that the company somewhat famous for having nearly all of its major success based on copying the work of others, is now trying to stop anyone else from doing the same without paying a massive tax. There was a time when Bill Gates said:

"If people had understood how patents would be granted when most of today's ideas were invented and had taken out patents, the industry would be at a complete standstill today... A future start-up with no patents of its own will be forced to pay whatever price the giants choose to impose."

And, now, via Intellectual Ventures and its own patent holdings, Microsoft seems to be trying to make sure Gates' prediction is a reality. It all fits in to the same paradigm we've observed for years. When you're young, you innovate. When you're old, you litigate. Microsoft appears to have given up on innovation, but is ramping up on litigation, and re-investing in patent trolling via Intellectual Ventures is merely the latest step.

Filed Under: innovation, patent trolling, patents
Companies: intellectual ventures, microsoft, sony

5 Year Old Hacks Xbox Live; Thankfully DOJ Apparently Uninterested In Prosecuting Cute Kid Under CFAA

from the cfaa-is-broken dept

There have been a bunch of stories going around about how 5-year-old Kristoffer Von Hassel figured out a way to hack the Xbox Live password system. Kristoffer's parents noticed that their son was logging into his father's account and playing games he wasn't supposed to be playing. They asked him how he was doing it and he showed them:

Just after Christmas, Kristoffer's parents noticed he was logging into his father's Xbox Live account and playing games he wasn't supposed to be.

“I got nervous. I thought he was going to find out,” said Kristoffer.

In video shot soon after, his father, Robert Davies, is heard asking Kristoffer how he was doing it.

A suddenly excited Kristoffer showed Dad that when he typed in a wrong password for his father’s account, it clicked to a password verification screen. By typing in space keys, then hitting enter, Kristoffer was able to get in through a back door.

Kristoffer's father, Robert Davies, works in computer security (which, frankly, makes me a little skeptical that Kristoffer really made this discovery), and submitted the bug to Microsoft, who not only quickly fixed it, but also listed Kristoffer on their March "acknowledgements" for security researchers who helped them find bugs and vulnerabilities. Of course, the flip side to this story is how we've seen the CFAA used in the past to go after people discovering similar flaws. Compare the story of Kristoffer to the story of Andrew "weev" Auernheimer. Kristoffer clearly exceeded authorized access to the Xbox Live system in order to obtain something of value (perhaps he gets off because the "something" is not worth more than $5,000, but still...). Of course, weev is an obnoxious internet troll, and Kristoffer is a cute 5-year-old. I guess that's what's meant by "prosecutorial discretion."

Filed Under: cfaa, doj, kristoffer von hassel, security, vulnerabilities, xbox, xbox live
Companies: microsoft

Microsoft-Sponsored Study Says Problems Caused By Using Windows Software Will Cost Businesses $500 Billion In 2014

from the awkward dept

The copyright industries' obsession with trying to shoot down piracy at all costs can sometimes cause them to end up shooting themselves in the foot. Here, for example, is a great example from Microsoft, which has recently been fulminating against the dangers of software piracy:

A new study released Tuesday reaffirms what we in Microsoft’s Digital Crimes Unit have seen for some time now -- cybercrime is a booming business for organized crime groups all over the world. The study, conducted by IDC and the National University of Singapore (NUS), reveals that businesses worldwide will spend nearly $500 billion in 2014 to deal with the problems caused by malware on pirated software. Individual consumers, meanwhile, are expected to spend $25 billion and waste 1.2 billion hours this year because of security threats and costly computer fixes.

The study fills out the picture with some details of the methodology (pdf):

In 2013 IDC tested pirated software from more than 550 Web and P2P sites or CDs bought in street markets to determine the prevalence of malware in pirated software. In January and February of 2014, the Department of Electrical and Computer Engineering at National University of Singapore conducted a forensic analysis of 203 PCs that were purchased from PC resellers, specialty shops, and PC markets in typical buying situations in 11 countries. Together, this research found the chances of encountering malware in a pirated copy of software is one in three. The chance of encountering malware in a PC purchased with pirated software is more than 60%.

Although the report doesn't say so explicitly, we are clearly dealing with Windows systems here -- computers are referred to throughout as "PCs," never as Macs, and some of the malware is named as "Win32/Enosch.A, Win32/Sality.AT, Win32/Pramro.F," which attack Windows systems exclusively. We can also be pretty sure that none of the infected programs was open source. Why? Because pirating software that is already freely available makes no sense -- and is certainly unlikely to be as profitable as offering black market versions of costly closed-source programs.

Putting this information together -- in order to "Get The Facts" as Microsoft always liked to say -- we arrive at the interesting conclusion that the use of commercial closed-source programs running on Microsoft Windows will cost businesses around $500 billion in 2014 alone because of the wasted time, lost data and reputational damage that will result from associated malware infections.

Assuming the research results are representative of what's happening -- and there's no reason to suppose they aren't -- the obvious conclusion to draw from them for PC users is not just to stop using pirated software (a good idea), but to stop using Windows-based programs too, and to switch to open source applications running on an open source operating system like GNU/Linux. After all, free software is even cheaper than pirated software, and yet rarely has any of the problems identified in the new report.

That's a really useful message for those facing the unwelcome prospect of paying their share of $500 billion to deal with the multiple problems associated with the Windows platform, but probably not the one Microsoft had in mind when it sponsored the research.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: copyright, infringement, malware, open source, piracy, software
Companies: microsoft

Kudos: Microsoft Changes Policy, Promises Not To Inspect Customers' Content

from the good-move dept

Last week, we wrote about Microsoft's ridiculous decision to search through a reporter's Hotmail email account after realizing that reporter had an unauthorized copy of Windows 8. The whole thing seemed like a huge overreaction by the company -- in trying to track down an almost meaningless leak that was unlikely to have any real impact on anything, the company effectively alerted the world that you had no real privacy in your email. The move was even more ridiculous since Microsoft has more or less bet its email farm on a marketing campaign about how it respects your privacy more than others. Microsoft's first response to this was exceptionally weak. While it announced a "change" in policies, it was still the same basic policy, that effectively (and misleadingly) claimed that it could and would continue to search anyone's email if the company had evidence that you might reveal a leaker.

Apparently -- and somewhat surprisingly -- it appears that Microsoft and its legal team took the criticism seriously. Microsoft's General Counsel Brad Smith has now put out a new blog post announcing a complete change in policy, promising that it will not unilaterally look through any Microsoft user's content in search of "stolen" intellectual property:

Effective immediately, if we receive information indicating that someone is using our services to traffic in stolen intellectual or physical property from Microsoft, we will not inspect a customer’s private content ourselves. Instead, we will refer the matter to law enforcement if further action is required.

Furthermore, the company will officially change its terms of service to reflect that change in policy. On top of that, it is starting a (somewhat undefined) project with EFF and CDT to work on "best practices" concerning privacy. Smith's apology is quite heartfelt, which is also rare from a big company:

It’s always uncomfortable to listen to criticism. But if one can step back a bit, it’s often thought-provoking and even helpful. That was definitely the case for us over the past week. Although our terms of service, like those of others in our industry, allowed us to access lawfully the account in this case, the circumstances raised legitimate questions about the privacy interests of our customers.

In part we have thought more about this in the context of other privacy issues that have been so topical during the past year. We’ve entered a “post-Snowden era” in which people rightly focus on the ways others use their personal information. As a company we’ve participated actively in the public discussions about the proper balance between the privacy rights of citizens and the powers of government. We’ve advocated that governments should rely on formal legal processes and the rule of law for surveillance activities.

While our own search was clearly within our legal rights, it seems apparent that we should apply a similar principle and rely on formal legal processes for our own investigations involving people who we suspect are stealing from us. Therefore, rather than inspect the private content of customers ourselves in these instances, we should turn to law enforcement and their legal procedures.

Personally, I wish the announcement and policy change went a bit further -- beyond just "intellectual or physical property," but making it clear across the board that, absent a reasonable warrant signed by a judge, Microsoft will not allow anyone to access anyone's content. But, perhaps we'll get there some day. In the meantime, Microsoft does deserve some kudos for changing positions. Most large companies would try to just let this issue fade away rather than proactively address it.

Filed Under: brad smith, email, policies, privacy
Companies: microsoft

To Catch A Meaningless Leaker, Microsoft Made It Clear It Has No Concern For Your Privacy

from the cost-benefit dept

Yesterday, we wrote about the bizarre decision by Microsoft to search through a reporter's Microsoft Hotmail email account, in an attempt to catch the Microsoft employee who had leaked that reporter a copy of Windows 8. While most of the initial stories about this had focused on the arrest of the employee, Alex Kibkalo, and had pushed the email snooping issue to the bottom of the story, it appears that the email snooping is quickly becoming the story. After all, the leak itself was basically meaningless. Some early screenshots of Windows 8 were never a big deal, and Microsoft has struggled to get adoption of Windows 8 not because of any leak, but because a variety of other issues. So capturing the leaker does little of benefit for Microsoft.

However, at the same time, revealing that the company has no problem snooping through users' email accounts if it feels it is beneficial to Microsoft is hugely damaging to the company. People need to trust their email providers. A well-known venture capitalist I know has spoken repeatedly about how so many people use Gmail, even when doing things like negotiating deals with Google (or competitors!) because they actually trust Google not to abuse their privacy and snoop on those emails. In part, they do this because they know if Google was exposed for snooping on emails that way there would be a mass exodus from Gmail to alternative providers. Yet, Microsoft doesn't seem to have considered just how astoundingly damaging it is to violate its own users privacy -- whether permitted by Microsoft's terms of service or not.

On a basic cost-benefit analysis it's difficult to see how anyone at Microsoft thought this was a wise move. Absolutely wipe out any possible trust and privacy for all email users to track down one meaningless leaker? Instead, what this shows is how "piracy obsession" blinds companies. They seem to forget all about cost-benefit analysis and assume that "something must be done" at all costs, even if it basically destroys an entire business line for the company.

Microsoft is now desperately trying to minimize the damage as it's realizing just how it's wiped out all of its bogus talk about protecting your privacy. They've announced new policies concerning how and when they'll violate your privacy, but this seems quite clearly to be a case of too little, too late.

Filed Under: copyright, cost benefit, email, leaks, overreaction, privacy, trust
Companies: microsoft

Microsoft Looked Through Reporter's Hotmail And MSN Chat Accounts To Identify Windows 8 Leaker

from the scroogled? dept

Apparently, Microsoft's desire to track down someone who leaked screenshots of Windows 8 is so strong that it's willing to violate its own privacy guidelines and promises to the public -- even if it means undermining Microsoft's main promotional campaign for email services.

A few weeks ago, Microsoft promoted Mark Penn to chief strategy officer. Penn is most famous as a PR man and political pollster who was the driving force behind Hillary Clinton's failed campaign for President in 2008. He's known for his negative attack ads and his claims to do everything based on data -- though, people who have explored some of his techniques say it's a lot more flimflam than actual statistical analysis. His main contribution to Microsoft over the past few years seems to be its ridiculous "Scroogled" campaign, in which Microsoft -- a company not at all known for its privacy protections -- attempts to portray Google as being bad on privacy. The campaign has been a colossal and expensive flop according to most.

Either way, you'd think that for a company who's main marketing strategy these days is all about how it protects the privacy of your email account wouldn't then break into a user's email account. But that's exactly what Microsoft apparently did in tracking down the guy who leaked Windows 8 to a reporter. Alex Kibkalo, a software architect for Microsoft, sent a French blogger some Windows 8 code and the way to get around its anti-piracy measures. The French blogger posted screenshots and also emailed Microsoft for comment -- and that's when Microsoft apparently decided to throw its privacy promises out the window:

The engineer was caught after the blogger emailed Microsoft to confirm the authenticity of the leaked Windows 8 code. Investigators at the firm then reportedly looked through the blogger’s hotmail account and instant messenger chats to identify the source of the leak, and found an email from Kibaklo.

Of course, Hotmail today has morphed into Outlook.com, and the current ad campaign about it states: "Outlook.com prioritizes your privacy!" and "Your email is nobody else's business." Oh really? I guess Microsoft considers it their business. It's kind of astounding, first, that Microsoft did this, and second that they appear to openly admit that you have no privacy at all in your email if Microsoft suddenly decides it wants to dig through and dig up something.

Update: And, from the criminal complaint we see, indeed, that Microsoft figured it was fine to violate this journalist's privacy:

Filed Under: alex kibkalo, email, hotmail, leaker, mark penn, privacy, scroogled, windows 8
Companies: microsoft

Microsoft Enlisting Clueless States Attorneys General To Shake Down Foreign Companies For 'Piracy'

from the not-this-again dept

Almost exactly three years ago, we wrote about an effort by Microsoft to try to get various states to pass laws that would make it illegal to buy from a foreign company that uses unauthorized software. The goal was, basically, an incredibly cynical way for Microsoft to abuse overeager, grandstanding Attorneys General who want to pretend they're "helping local businesses" by blocking every other company from doing business with whoever might be the best supplier... unless they suddenly became licensed Microsoft customers. There were all sorts of problems with that idea, but over the past three years, Microsoft has apparently continued to push forward with variations on that concept -- and are now successfully getting states Attorneys' General (who have no authority over copyright issues) to shake down foreign companies with claims that they're "pirates."

In short, states Attorneys General are suing foreign companies, claiming that they're using infringing software, and claiming that this unfairly "harms" local competitors. Often, the "local" competitors have absolutely no clue this is being done in their name, or that they've even been "harmed" by a competitor they've never heard of:

The Oklahoma suit, filed in a state district court, alleges that Neway Valve Co. and affiliates, based in China, where they make valves and other equipment for oil companies, illegally obtained "copyrighted software that is crucial to the production and sale of their products," gaining an advantage over Oklahoma-based rivals.

[....]

Valve manufacturer Balon Corp., of Oklahoma City, was named by the attorney general as an injured party. That came as news to Phil Scaramucci, co-president of Balon, who said that he didn't know much about Neway and wasn't aware of the suit until he read about it in the newspaper.

In other words, this has absolutely nothing to do with protecting those local companies. They're being named in lawsuits that they don't even know about it and don't feel harmed by competitors they've never even heard of. This is all about Microsoft, yet again, abusing the legal system for its own benefit. It makes you wonder how much taxpayer money is being used to support these lawsuits.

Filed Under: copyright, infringement, states, states attorneys general
Companies: microsoft

No, Government Computers Won't Suddenly Be Vulnerable To Hackers On April 8; They Already Are

from the this-is-reporting? dept

The Washington Post has an article about how, even though it's long been known that Microsoft is sunsetting support for Windows XP on April 8th of this year, about 10% of US government computers still run XP. Because of this, the article declares that government computers running Windows XP will be vulnerable to hackers after April 8. While technically true (they will be vulnerable after April 8th) what would be a hell of a lot more true is to actually note that they're extremely vulnerable to hackers today and have been just as vulnerable for years. Microsoft sunsetting its support doesn't change that one way or the other.

What's incredible, is that for all the FUD being spread around by government officials about "cyberwar," "cyberattacks" and "cybersecurity," you'd think that getting the government's own house in order would be more of a priority. Outgoing NSA boss General Keith Alexander keeps claiming that he needs more access to private networks to protect them from foreign hackers (yeah, right), and yet this report notes that all sorts of classified government material is sitting on Windows XP computers.

That includes thousands of computers on classified military and diplomatic networks, U.S. officials said. Such networks have stronger defenses generally but hold more sensitive material, raising the stakes for breaches if they occur.

Given how sophisticated the NSA's abilities are to infiltrate just about any computer out there, as revealed by multiple documents leaked by Ed Snowden, you'd think that the NSA would be a bit more proactive in helping to shore up our own defenses by doing things like no longer using Windows XP.

Filed Under: cybersecurity, security, sunsetting, support, us government, windows xp
Companies: microsoft