Microsoft Fires Off Rebuttal To Latest Leak; Angry Letter To Eric Holder

from the at-this-point,-I'm-pretty-sure-no-one's-telling-the-complete-truth dept

The recent leak detailing Microsoft's extremely close work with US intelligence agencies seemed to contradict pre-leak statements made by the company concerning responses to data requests. Microsoft claimed it only did the minimum required by law, but the leaked documents portrayed the software giant as working in concert with the NSA and FBI to provide them with pre-encryption access to several services, including Outlook, SkyDrive and Skype.

Microsoft has responded to this leak via a blog post and a letter to Eric Holder. The blog post is a long refutation of every claim made in the leaked documents. Rather than give the agencies direct, pre-encryption access, as was stated in the leak, Microsoft claims it only provides metadata and content as requested -- and then only if Microsoft deems the request valid.

Microsoft does not provide any government with direct and unfettered access to our customer’s data. Microsoft only pulls and then provides the specific data mandated by the relevant legal demand.

If a government wants customer data – including for national security purposes – it needs to follow applicable legal process, meaning it must serve us with a court order for content or subpoena for account information.

We only respond to requests for specific accounts and identifiers. There is no blanket or indiscriminate access to Microsoft’s customer data. The aggregate data we have been able to publish shows clearly that only a tiny fraction – fractions of a percent – of our customers have ever been subject to a government demand related to criminal law or national security.

All of these requests are explicitly reviewed by Microsoft’s compliance team, who ensure the request are valid, reject those that are not, and make sure we only provide the data specified in the order. While we are obligated to comply, we continue to manage the compliance process by keeping track of the orders received, ensuring they are valid, and disclosing only the data covered by the order.

With this across the board denial of the leaked documents' contents, we're left with only a few possibilities. Either the document isn't accurate and Microsoft's statement is truthful or the statement is false and the document is the truth. Or, somewhere in between, there's a way both can be accurate (or "least untruthful"), which boils down to subjective definitions of certain words, most notably "access." Microsoft could have provided near real-time access while still only complying with court orders. Everything stored and turned over to the NSA and FBI was technically "pre-encryption," in the fact that Microsoft had unencrypted access to the data. As we haven't actually seen a court order or national security letter directed at Microsoft, it's tough to say how direct and how close to real time this access is.

Microsoft's rebuttal doesn't entirely refute the documents, however. There's no doubt it worked closely with these agencies to provide the access, content and data they were seeking, even if it was all strictly "by request." In terms of Skype, Microsoft doesn't even bother refuting the government had access to audio and video via its Prism connection. All it addresses is the statement that claimed video production had tripled "since a new capability was added" in July of 2012.

The reporting last week made allegations about a specific change in 2012. We continue to enhance and evolve the Skype offerings and have made a number of improvements to the technical back-end for Skype, such as the 2012 move to in-house hosting of “supernodes” and the migration of much Skype IM traffic to servers in our data centers. These changes were not made to facilitate greater government access to audio, video, messaging or other customer data.

These changes may not have been made to "facilitate greater government access," but that's not what the document claims. All it says is that this new capability tripled video production. Moving to in-house hosting and migrating traffic to Microsoft data centers could certainly aid in the "production" (read: harvesting) of Skype video calls. Whatever the intent, the end result was the same -- easier, faster access to Skpe data and content for intelligence agencies.

This back-and-forth is unlikely to result in establishing definitive guilt or innocence on the part of Microsoft. Either way, it's of negligible importance. The fact is that intelligence agencies are, by way of court orders and security letters, inserting themselves deeper and deeper into the underlying fabric of online communications, something that stretches much further than Microsoft.

Microsoft itself is hoping to address the larger, more problematic issue of our growing surveillance state. In addition to its blog post, the company sent a rather irate letter to Attorney General Eric Holder [pdf]. It dispenses with most of the usual diplomatic niceties and confronts the government with the damage it's doing to American citizens and American companies with its surveillance activities.

Since the initial leak of NSA documents, Microsoft has engaged constructively with the Department of Justice, the FBI, and other members of the Intelligence Community on the ground rules governing our ability to address these issues and the leaked documents publicly. We have appreciated the good faith in which the Government has dealt with us during this challenging period. But we’re not making adequate progress. When the Department and FBI denied our requests to share more information, we went to the Foreign Intelligence Surveillance Court (FISC) on June 19 to seek relief. Almost a month later, the Government is still considering its response to our motion.

Last week we requested official permission to publicly explain practices that are the subject of newly-leaked documents that refer to Microsoft and have now been misinterpreted in news stories around the world. This request was rejected. While we understand that various government agencies are trying to reach a decision on these issues, this has been the response for weeks.

This is no surprise to anyone who's attempted to obtain information or official responses from our intelligence agencies. The standard m.o. is to wait it out while chanting "grave damage to national security." But what Microsoft adds next serves as a slap in the face to those parties attempting to wait it out.

As I know you appreciate, the Constitution guarantees the fundamental freedom to engage in free expression unless silence is required by a narrowly tailored, compelling Government interest. It’s time to face some obvious facts. Numerous documents are now in the public domain. As a result, there is no longer a compelling Government interest in stopping those of us with knowledge from sharing more information, especially when this information is likely to help allay public concerns.

In other words, "Your secrets aren't secret anymore. Get over yourselves."

At this point, only government employees who dutifully ignore what their employer tells them to ignore aren't aware of these leaked documents and their contents. If our "national security" was suffering "exceptionally grave damage" from these leaks, you'd think at least some of that damage would be noticeable. Instead, what we have is the large scale embarrassment of government officials who are now forced to explain actions that contradict the very principles they claim this country stands for -- that they say they stand for. Refusing to allow companies to discuss activities already outed by leaks is simply the most self-serving form of damage control. The threat to officials' reputations easily exceeds the threat to the security of the American public, and continuing to deny these companies an opportunity to explain their involvement does them, and the public, a disservice.

Filed Under: eric holder, fisa rulings, free speech, nsa, nsa surveillance, skype, surveillance, warrants, wiretapping
Companies: microsoft