Hacker News Reader

Comment by autoexec | Hacker News Reader

It's crazy to think about the amount on insight outlook's data collection must provide on the inner workings of so many companies across so many different industries, even their own competitors. There's no way Microsoft isn't at least trying to use that data for their own benefit, yet somehow the company is still such a mess.

Companies just blindly trust MS with their data and even force their employees to hand their personal data over in the process. I've pushed for my company to stop leaking so much company/employee/customer data to MS, but as long as the corporation doesn't personally experience how that data is being used/abused and they aren't being fined or hauled into court over it I doubt much will change.

View on HN

Companies structure their relationships with Microsoft in detailed contracts, which specify what data Microsoft’s corporate staff can access, and why, and what the penalties are for violating the contract.

These contracts are extremely lucrative and extremely detailed. Microsoft applies a business analysis to each one of them. If they determine it’s more financially beneficial to abide by the contract, they will.

There is zero “blind trust” involved, on either side. Where there is trust, it has been earned. And it can be burned.

Contracts are great, and may even provide for some type of compensation or remedy if you know and you could prove that Microsoft was using the data they collect against their own customers, but good luck knowing/proving that.

If Microsoft uses the data they have to come up with competing products, or to time the release of their competing products, or to decide which stocks to buy or short, or to decide which companies to partner with or avoid, or which of your employees they should try to attract, or even to sell or leak privileged information to your competitors you'd never know about any of that without a whistleblower at Microsoft saying something, and that person's income and very comfortable lifestyle depends on them keeping their mouth shut. A whistleblower may also risk legal consequences themself if they ever come forward. Risking themselves, their future, and their family is asking a lot which is why whistleblowers are extremely rare.

That's part of the problem with surveillance capitalism. All the spying being done is to collect massive amounts of extremely valuable data, but very little of that data is used transparently. You simply can never know how the data being collected about you will be used against you, you can just be sure that it will be.

The reason companies are investing huge amounts of resources into collecting, storing, and analyzing every single scrap of data they can get their hands on is because doing so is making them money hand over fist. I doesn't matter if it's your data, or your company's data, they'll be using it in any and every way possible if they even suspect that doing so will give them an advantage or make them more money and their gains will almost always be at your expense.

Let's say Boeing is a Microsoft customer. What is Microsoft going to do, read all of Boeing's emails and then start manufacturing airliners and spacecraft? I think for most companies it would not be that hard to tell if Microsoft stole their data and set up a directly competing line of business.

If you can see Boeing's emails to Slack / Salesforce / AWS / ..., you know exactly what new features to build into Teams / Azure / etc., and exactly when they might be most receptive to a sales pitch. MS may not be in the aeroplane business but they're in a lot of businesses.

So the idea is that MS would violate all their largest existing contracts, potentially committing criminal fraud along the way, in order to gain some marginal advantage in securing a few additional contracts later on? Does that sound like a sustainable business strategy?

Companies routinely break laws when they think they'll increase their profits. Companies will even knowingly and willingly kill people, commit mass poisonings, pollute the Earth, work with terrorists, or exploit children. Microsoft isn't any different when it comes to having a willingness to break the law whenever they think they will profit from it.

Just last year Microsoft was fined for illegally collecting children's personal data. Microsoft has also broken the law to sell software in violation of US sanctions. They've illegally bribed government officials. They've committed a number of anti-trust violations. In these cases breaking the law was probably still worth it for them even after the fines they were forced to pay and other slaps on the wrist they received. We have no idea how many other laws they've been breaking without being caught.

For a company willing to break laws in the US and around the globe, violating a contract with Boeing is nothing, especially when the risk that Microsoft would be discovered taking advantage of the data Boeing gave them is basically zero.

You could even argue that Microsoft owes it to their shareholders to exploit every possible advantage they have at their disposal to maximize profits, laws and contracts be damned. That seems to be the position many corporations take at least, and even the companies that have been caught committing the worst kinds of acts like Purdue Pharma, DuPont, or Philip Morris still exist today and seem to have no problems with sustainability. MS could even use the data they collect to help ensure that they maintain their relationship with Boeing for as long as it benefits them to.

Right, if they have the chance to utilize information they've already collected to their benefit in any way, it would be seen as a "dumb move" by many to not capitalize on it

You’re writing down things that everyone already knows. But you’re seeming to not take the next mental step, which is:

Given that I understand all the bad things that a business can do, how do I structure a relationship with a service provider such that I get the benefit of their service, and avoid the bad stuff? What tools can I use to ensure our interests remain aligned?

You’re writing like it’s not possible to do that. Even though we live in a highly specialized society that is chock full of examples.

Can you give one of those examples?

A large enterprise may have the resources (time and money for corporate counsel) AND leverage (# licenses needed across many products) to negotiate privacy terms that align with their needs, or even pick another product.

A smaller firm is effectively stuck: they don’t have the resources or leverage, and sometimes must use the same products as large enterprises to do business with them.

In the case of Outlook specifically, if you do business with enterprises that use it, your meeting calendaring needs to work flawlessly with theirs. A missed or broken reschedule or repeating event can mean your teams sometimes don’t show up when expected. This really happens.

> Given that I understand all the bad things that a business can do, how do I structure a relationship with a service provider such that I get the benefit of their service, and avoid the bad stuff? What tools can I use to ensure our interests remain aligned?

Has any business really succeeded in keeping business information confidential while outsourcing operation of that information? It seems like at a minimum you'd need a PCI-DSS/HIPAA-style audit regime, which I haven't seen the likes of MS granting access for (why would they?); even then those schemes aren't great at protecting confidentiality. Core business trade secrets get leaked all the time; the idea that a company would manage to protect stuff that's proprietary but peripheral, like how they use their workflow tools, seems like wishful thinking.

I'm not suggesting it's a way to go but there might have been some reasons companies hosted their own infrastructure (even at the cost).

They controlled the upgrades, and Microsoft for a long time couldn't even count how many copies of office, etc were being used because the software didn't phone home. That software is probably still running until it's updated to have telemetry added.

What they can exploit depends on what's in Boeing's emails, and their existing relationship with MS. They might have seen internal communications about the problems Boeing had recently and used that information to guide investment decisions.

Maybe Microsoft used the information found in outlook to tailor their product offering and craft their sales pitch when convincing Boeing to buy into their cloud services and AI tech (https://news.microsoft.com/2022/04/06/boeing-and-microsoft-d...). Perhaps Microsoft found and leveraged detailed information on Boeing's finances and IT budget which allowed them to set a price much higher than they would have for those services. The more you know about a company and their situation the more leverage you'll have in a negotiation.

Just because MS isn't making airlines doesn't mean that they aren't able to abuse the data they collect for their own profit at Boeing's expense.

> Companies structure their relationships with Microsoft in detailed contracts

That might be so for big companies. Most smaller shops more likely just accept the (still extremely detailed) T&C's outright. That certainly structures the relationship, but I doubt there's much balancing involved.

I'm thinking of e.g. the medical lab next door, the girlfriend's gynecologist, most smaller businesses really, of which there are a ton which deal with relatively sensitive customer data.

Yeah, Microsoft seems to have all the power when it comes to small customers.

And yet their standard contracts don't say "if you give us all your data, we'll do whatever we want with it, tough shit." In fact they say pretty much the opposite of that. Isn't that interesting?

Big companies like MS will apply the same business analysis to their small customer contracts as they do their big contracts--but at scale. If they decide they'll make more money by honoring all the little contracts, they will honor them.

So even small customers need to understand the incentives that help that analysis come out in their favor. They tend to rely more on external incentives like criminal penalties under statutes governing fraud, personal data, medical data, etc., and the potential for negative press coverage.

I would imagine you have to be large enough for Microsoft to even entertain neogotiating with you.

If the majority of businesses (and employment, and communications) are small businesses.. where does that land?

We don't have access to that data internally. We can't access customer data outside performance metrics about the service. At least for the normal dev there is no real way to get access to what the customer does.

They can access your whole tenant and everything in it. Have had some pretty wild support calls where MSFT has had to crawl through a tenants data specifically the schedule system. It was ultra broken. They can literally just give themselves permission and roll in. If you can't your just not high enough up in a support team.

Their use of 3rd party and external tools for adjusting registry during licensing problems is wild.

You can get access with customer permission for a limited time window which is audited. In the normal course of business no.

The reality here is that no one will trust a pinky promise. Especially not from Microsoft. You’re fighting a good fight but it’s a losing battle no matter how locked down it feels from your POV.

“Can we have access to X, but don’t worry, we don’t let anyone look at X unless Y happens” is a bit suspicious when “grant X permission when Y happens” isn’t an option.

Even worse when the access to X is only disclosed to users living in a jurisdiction requiring it.

Microsoft’s many brand and marketing folks have a big uphill battle if they want to convince me otherwise. Or they can just stop collecting data.

Like telemetry? We have to collect customer data that's what we get paid for. As for pinky promises we are SOC compliant and externlly audited. https://learn.microsoft.com/en-us/compliance/regulatory/offe...

> We have to collect customer data that's what we get paid for.

Which is one of the many reasons why I will not allow Microsoft products on my machines.

If you write a document and store it in sharepoint online we have to keep that data as does any online offering.

Is that what you were referring to? The phrase "we have to collect customer data" implies a different thing entirely, so I misunderstood.

My objection to Microsoft's methods in this regard isn't the data that customers voluntarily and knowingly store on Microsoft servers, it's the collection of data about customers, their machines, and the use of their machines that happens behind the scenes.

We collect telemetry about user actions and the successes of our service. All the data we collect is about how the service runs and we only look at it via aggregation. Internally we have training every year about what you can and can't collect and under which scenarios. It gets stricter every year.

I would imagine it gets stricter every year due to this generally common opinion of Microsoft among these circles.

Wish you all the best though, a Microsoft people trust would do good for the world.

What are you using instead? Open source offerings generally work for me, it's when I have to share the results with others that formatting etc problems appear.

Welcome to my local bakery! We have to collect your credit card number before you enter. No one can access your credit card number though. I write it on a piece of paper and put it in a safe. Here, look at this list of people that have seen me put credit card numbers into a safe!

I’m sure you understand, we need to collect your credit card number because that’s how we make money at this bakery. No I will not explicitly explain how. Don’t you feel like I’ve improved your experience?

The document I linked explains how why and when. It also explains how we verify that and who does the verification. Also O365 customers have access to audit logs and the rest. At some level everything is about trust there is no way you can verify any large organizations activities.

That’s a big document with lots of acronyms and references to specific standards for compliance that law professionals might be familiar with, but is otherwise completely meaningless.

You also mentioned that collecting user data is how Microsoft is paid in the GP comment. That’s pretty clear to me. I thought when I paid Microsoft, that was the main revenue stream.

The document provided in theory communicates what you said so succinctly before, but with more legal and confusing language.

If it says the opposite, then just asking me to assume that this document that’s extremely difficult to read explains why outlook should ingest information I wasn’t told about, since I live in a jurisdiction where Microsoft doesn’t need to, and why that’s actually a neutral or possibly “good” thing for me, is a bit silly.

—

Edit: if I’m misunderstanding what you said earlier by:

> We have to collect customer data that's what we get paid for.

Then I’m sorry. I don’t mean to frame you as saying something you don’t mean to.

I should have been more specific. We have lots a data classifications we maintain and we have different rules for different classifications. Customer content we can't access without customer consent. We are paid to store customer content. Customer content is like your work doc stored in one drive. Some classification are only accessed in aggregate. Some are easier to access but cleared after a short period ect. We all have to go though a large training every year about the different classifications and that's not easy to communicate in a short comment.

We store data everywhere to meet european GDPR standards regardless of where you live. We have logs but they can only contain sanitized information.

Any document which attempts to describe how a large origination handles data is going to large and complex. As sometimes different standards conflict. For example we have to keep records of anyone who changes the system for some period of but we also have to delete data that has end user identifiers. When stuff like that happens we have to go to lawyers and have language that describes how we handle thoes conflicts. That doesn't lead to a small doc.

>>At some level everything is about trust there is no way you can verify any large organizations activities.

This is a major problem, actually, and exactly why people can't and won't trust you.

but its true for all organizations and people.

Which is why you should only trust things with E2E encryption.

How do you know they really run end to end encryption and are not lying.

Because that’s auditable on the client end. No need for trust.

You can trust open source, because it is transparent. You can verify, so you can trust. Perhaps it's time to start rolling back the layers of secrecy. Sunshine is and always will be the best disinfectant.

Unless you run it yourself you don't know. They could run a modified version ect. You can't know and at some level you have to trust that they do what they say.

Are these external audits just SOC checklists where they're basically just looking at policies and processes for employees or are teams of auditors routinely coming into each office and data center to physically examine servers and trace network cables while taking an independent inventory of all the hardware that sensitive data touches and the software running on that hardware?

SOC compliance and external audits can help keep things reasonably secure and prevent the totally careless/incompetent handling of data, but I'm skeptical that they would typically be robust enough to detect Microsoft's own equivalent of Room 641A let alone the actual hardware installed by the feds which MS itself isn't allowed to touch.

I don't know if I can say what we have to turn over to the auditors that isn't in the public document. As to verifying the hardware we buy our hardware from other companies who have their own controls. If you dig far enough down everything ultimately comes to trust as no one can verify everything.

All the more reason to only ever trust a corporation to do what is in the interest of their bottom line, including lie to your face, collect and sell your data, and violate the law whenever the financial disincentive is less than the profit potential.

>The reality here is that no one will trust a pinky promise. Especially not from Microsoft.

I'll just chime in to say that, while I appreciate the sentiment the user is conveying, I certainly don't trust a Microsoft pinky promise.

> You can get access with customer permission for a limited time window which is audited. In the normal course of business no.

Right but no one is saying your department is violating our privacy. I'm not sure why you feel a need to defend it.

I think we can safely say that MS's methods of violating our privacy are all automated and that you + coworkers aren't eyeballing our personal data. So we can move on from that.

If you'd like to speak to the privacy violations that are referenced in the article, we're all ears. Education guesses about methods or who some of the 3rd parties are would be terrific.

> They can literally just give themselves permission and roll in. If you can't your just not high enough up in a support team.

That is what a support team is for.

And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data.

This isn't some super duper secret, when shit breaks there needs to be a, well secured, escape hatch for the people who fix things to crawl in and make repairs.

Prior to cloud hosting, Microsoft could get permissions to remote in to your servers, or prior to those days, send someone physically out with a laptop and a debugger.

> And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data.

But surely you can see that saying this is still the same as just saying "trust us". It's very, very hard to trust Microsoft.

Not having those protections in place would be a company ending event for Microsoft. The legal system would crush them, and customers would leave in droves.

And the number of markets Microsoft completes in now is tiny. This isn't the 90s where Microsoft competed in slews of consumer and business markets. The potential upside from the Cloud team slurping up secrets from competitors in literally ANY other business segment, is dwarfed by the losses that would hit MS.

Now of course that doesn't mean some corrupt fool in sales won't risk destroying the company so he can make his yearly bonus (that very thing has brought down companies before!), but Microsoft internally has a lot of motivations to ensure that doesn't happen.

So, don't trust Microsoft saying "trust us". Trust Microsoft being greedy and wanting to keep growing the cash cow that is Azure Cloud.

I wasn't talking about Azure. I was talking about Microsoft's software products such as Outlook, Windows, etc.

Rergardless, my point is that Microsoft saying that they have audits and controls in place is exactly the same as them saying "trust us". They're just saying "trust that we have effective controls in place".

What exactly can an org do. We hire outside verifiers and then meet their standards.

Sure, I understand. The thing is that a company has to already have a measure of trust in order for the verification to be of reassurance to people. Hiring outside verifiers is absolutely better than nothing, but it's not a thing that inherently instills a high degree of confidence.

What an organization can (and should) do is to behave in a way that earns people's trust over time. Microsoft actually had a window of opportunity to do this. They even made a very public campaign proclaiming how they weren't like the Microsoft of old and were more trustworthy than they used to be. And for a while, I even thought that perhaps a real culture change really did happen. But their behavior (especially around Windows and Office) is uncannily similar to that of other companies of questionable trustworthiness.

Suppose I'm using services provided by JohnFen's employer. What does it do better than Microsoft that I can trust it with my data? What should Microsoft do to be a trusted partner?

You don't have to take their word for it. See the SOC audit reports for yourself:

https://servicetrust.microsoft.com/DocumentPage/6ee23fc7-20d...

That document doesn't seem to want to load for me, so I can't really comment on it one way or another.

https://learn.microsoft.com/en-us/compliance/regulatory/offe...

https://servicetrust.microsoft.com/ViewPage/AllDocuments

I got to the PDF download link, but I have to have a Microsoft account to actually download it, so that's a bit of a showstopper.

In any case, it doesn't much matter. The threads I'm in here are pretty much just me saying I don't trust Microsoft and others saying that I should, so I'll just bow out and leave it at that: we have different opinions.

> It's very, very hard to trust Microsoft.

The utterly massive enterprise market that values security and privacy and also pays Microsoft oodles of money says otherwise.

Well, I think most enterprises are more concerned with liability than anything, and as long as they can blame any breaches/security issues on Microsoft, that addresses most of their concern.

Also, people aren't enterprises. Microsoft doesn't treat people like they treat enterprises.

If you don't know that millions of people spending money can't be fools, you're probably one of them

And frankly given the monopolistic nature of the business, there are a lot of enterprises that pay for microsoft's services because they don't have the power to make the decision not to

Enterprises have more leverage and different agreements, often custom agreements, with vendors. Small businesses and consumers get click-wrap agreements - nobody reads them; nobody has time and Microsoft wouldn't change them regardless.

Oh I don't treat it like a secret. It's more that it's not known or understood by many users in how it actually affects the security posture of your organization.

It's one of those commonly overlooked things.

I use an older version of "Windows Firewall Control". Regarding Outlook, I block ALL, except the server(s) that Outlook needs to contact in order to collect emails (i.e. you may have a couple of gmail accounts, etc.)

The pros: Outlook doesn't get to speak to MS The cons: When an email has linked images, they don't load, which for the past 20+ years hasn't been a problem.

MSFT employee here.

Cannot say for the entire Microsoft, but in Azure the only way to access customer data is through support flow for cases where customer explicitly gave permissions. Otherwise support portal will not allow access. And there is no other way of accessing customer data. Access is revoked after a case is closed.

The incentive for customers to give this access is simple - with this my team can answer questions right away without very lengthy back and forth (especially if customer is in different time zone). Which results in (way) faster support and problem resolution.

What about executives and other higher-ups? If they want to know about my internal business operations - for example, if we are competitors, they are looking to invest, etc.

Is there technical protection? Is it encrypted in a way that's only accessible to me?

> MSFT employee here.

> Cannot say for the entire Microsoft, but in Azure the only way to access customer data is through support flow for cases where customer explicitly gave permissions.

That article notes that Microsoft says Microsoft accesses our data and make it available to 7xx 3rd parties. It is safe to assume that Microsoft has automated process to violate our privacy and not eyeballs and fingers.

So you don't really need to defend Azure tech support because no one is accusing Azure tech support.

On one hand we have:

sabarn01> We don't have access to that data internally. We can't access customer data outside performance metrics about the service. At least for the normal dev there is no real way to get access to what the customer does.

On the other hand we have:

Microsoft> We and 7xx Third Parties access Outlook data on user devices.

Taking both you and Microsoft at face value, we seem to have two fairly different assertions.

Customer concerns could be allayed if their shared data was fully auditable at any time by the customer. This would include what buyers of this data can see.

Outlook (the app) is not the same as outlook.com (the email service) or Exchange Online (what most companies use). Data from one product/service could be used in different ways than others.

Of course. Microsoft has different email products and services that they skim customer data from.

Fortunately, Microsoft has infrastructure so robust they can share a customer's data with 733 3rd parties.

I think we can safely send one more copy to the customer (who's data it is) without overtaxing anything.

> yet somehow the company is still such a mess

https://www.reuters.com/technology/microsoft-overtakes-apple...

Some mess.

Companies that use GMail/Google Workspace also weak a ton of private employee information to Google, without giving said employees much choice.

I mean, I don't think that's unreasonable. You are being paid by your employer after all, and part of the deal is that you agree, to a large extent, to do things the way your employer wants.

If you think it is a big issue you can of course talk to your employer about it and see if they will change, but they're also free to disagree with you.

Wouldn't surprise me. After all, Microsoft has always been built on a process of reimplementing/porting/integrating what others have made/invented before them, then doing a bunch of shady/clever business moves to corner the market.

>> blindly trust MS

We were sold on (in my mid biz) Microsoft being all-the-things compliant: HIPAA, GDPR, etc.. and this is why we put all our data there. As long as they keep touting this, businesses will keep on feeding them data.

We have to certify every O365 service for all of these. We also have to certify all of our dependencies.

Reply on news.ycombinator.com