Microsoft defends its right to read your email
money.cnn.com
money.cnn.com
Can we stop with the hyperboles and actually be realistic?
Quitting the use of Microsoft services won't really solve anything since, as has been made clear in other HN threads, the policies of other big players allow for the same (e.g. Gmail).
Arguing that "oh but Gmail hasn't actually proven they'll use this tactic" is absolutely absurd. They're saying they can, so nothing stops them from doing it tomorrow. If they really wouldn't ever do so then that clause would not be on any terms that users agree to. Ditto for all other major email providers.
Okay, so next we can say "aha! I'll just stand up my own email service!". Two reality checks...
--First: if you email anyone using a major email provider then you haven't really made much progress. Same even if they email you and you ignore them.
--Second: it seems completely unrealistic that this solution would scale to the entire world. NSA fiasco has proven to me that people value convenience more than privacy. Otherwise this "stand up your own email/cloud" trend would have started last summer. None of my friends (even tech friends) have switched away from gmail or whatever major provider they use.
This situation obviously sucks, but I don't see many reasonable responses to this. We're smart people here. Let's act like it.
While I agree that the Scroogled campaign does tread slightly into the hyperbole, I can't agree that this the double-standard that most are making it out to be.
Hyperbole doesnt make your case stronger. In light of every other privacy issue happening in the world, this is a non story. I think it would be useful to prioritize outrage, and direct it to a spy agency or some other countries military.
I'm not saying that Outlook / Hotmail is better or worse than competitors in terms of privacy. I'm saying that an MS Marketing campaign has helped create an unrealistic perception of MS email services for the public, which after this PR debacle has created yet another unrealistic perception of MS email services.
I don't care if some algorithm scans my email for keywords, but I don't want Bob to read my emails.
It did! Understandably, since it's not absolutely-zero-effort, there hasn't been 100% uptake, but Alex Payne started up a project that lets you run you own private cloud with surprisingly little configuration:
https://github.com/al3x/sovereign
I've been using it for a few months now and have been quite happy with it. I'm in agreement with you, though, that it won't scale to the entire world, but I don't think that it needs to.
Fastmail is a pretty major mail provider, I've read their TOS and Privacy Policy, and don't seen any clauses that allow them to read my mail the way Microsoft and Gmail claim to.
So they're saying "the end justifies the means".
I'm saying: no, stop and don't.
Stop using any Microsoft services (don't forget skype) and better yet any of their products.
So they shouldn't simply stop doing this (we don't really know how many times they did of course), they should start by getting rid of terms of service allowing such constructs - cause technically, they didn't do anything wrong and their defense seems justified (ianal)
But "Just because you can doesn't mean you should" is another perspective some folks take on matters like this.
https://en.wikipedia.org/wiki/Excite.com#Excite.40Home
EDIT: *I had hotmail & excite accounts before the mergers and I retained them for years after for online catch-all accounts. My 17yo hotmail locked me out when I refused to give MS my phone number awhile back. meh.
The current company I'm working for are a little pissed off with this whole Microsoft reading their email thing and have started to plan moving their exchange installation on-site from Office 365.
Microsoft still win due to lock in...
Use the internet as it was a public place. Remeber you can't even trust ssl connections (see Apple by mistake, NSA by purpose).
how is that different from gmails privacy policy? do we know anything about googles behavior with law enforcement wrt gmail? even if gmails eula technically allows them to "read"/index all you have in your inbox, does that really legally allow searching for a specific thing? what if there are nlp based triggers?
also while the article deems this ironic:
> In a move that might be deemed ironic, Microsoft will now add its own internal searches to its biannual transparency reports on government surveillance. To top of page
i actually think it's a good idea. does google have anything like this? the real irony is that it reminds me of chinas quarterly human rights report on the united states.
that said i use gmail in spite of hotmail.
by the way, if you want a simple to setup email server, you can use atmail in a kvm. there's a whole host of free solutions, but for those who don't want to fiddle with mail configurations it's worth the 20 bucks
Google's ad mechanism reads all emails sent and received by all gmail users, even in many cases people using paid Google Apps mail unless the administrator has opted out (I've encountered companies that left gmail ads enabled). This means that to a degree, the privacy and security of all your emails is compromised - though we would all hope that Google firewalls that stuff off carefully and ensures that no traces of the mails remain after they're scanned for ad keywords.
To say that Microsoft accessing one account based on evidence in order to gather more evidence for a civil suit - with explicit permission granted by the user during signup - is equivalent to Google's behavior is just blatantly wrong.
Both behaviors may be undesirable, but they are very, very different.
When it comes to this discussion, for me it's a matter of principles. The principles are being equally violated here, it doesn't matter if one does it more frequently than the other.
In this particular case human beings at Microsoft actually did paw through this individual's e-mail, to his detriment, as was their intent.
At the same time, it seems unlikely that anyone believes that Microsoft was actually advancing a principled criticism in an ad campaign as opposed to merely saying an expedient thing. I doubt that accusations of "hypocrisy" will hurt them, other than making coverage of "scroogled" in the press marginally more disdainful.
There is a fundamental difference. If you promise not to do content-based targeted advertising (as Microsoft claims), you have no interest to collect as much data from a user as possible. If you do content-based advertising, it's in your interest to collect data from as many sources as possible (from e-mails, to locations, to search queries) and combine them.
The latter may not be acceptable to some people.
At the same time, the adoption rates for, say, Facebook show that "nearly everyone" are not actually concerned about such things in practice. There are those who might argue that people should be more concerned. I believe you may find that such conversations have occurred.
Regardless, it seems silly to pretend that Microsoft is making a principled claim, as opposed to mouthing what they hope are scary words.
Similarly, Microsoft isn't actually worried about the plight of young women who may be under the impression that they can pawn their chromebooks to fund a trip to LA.
False. Microsoft is still hoovering up every scrap of data they can get. They'd be stupid not to, as data is insanely powerful. You don't need much data at all to do targetted advertising, by the way. Seriously, Google uses at most 1% of the data it gets from you for ad-related reasons, if that. No, Google's obsession with data is because data is tremendously powerful at building better products. Microsoft is just shooting themselves in the foot if they aren't doing the exact same thing.
Besides, if you don't want targetted advertising just go turn it off: https://www.google.com/settings/ads/
Even when the administrator has switched off ads, e-mails are still mined to show ads in Google services that are not covered under Google Apps:
http://safegov.org/2014/1/31/google-admits-data-mining-stude...
Since Google Apps for Business uses the same privacy policy, there is little reason to believe that anything is different when you are paying $5 per user per month. The privacy policy clearly states that Google can mine your data for ads. Ads can just be turned off for the services covered by Google Apps (but not Google+, Google Maps, Youtube, Google Search, etc.).
In any case, the article is wrong, on a number of fronts, actually. e.g. the DoubleClick and Google account cookies are never mixed (Google agreed to this in the wake of concerns over the merger, and it's called out explicitly in the Google privacy policy), the statement on Enterprise privacy policies and that testimony about the University of Hawaii don't contradict each other at all, and it's ridiculous to base a whole article on an entry on the University of Alaska's email FAQ. The entry is wrong anyway. Check out the "Data Processing Amendment"[1] that comes with Enterprise/Education accounts, which prohibits processing data in ways that aren't explicitly enumerated in that document. Advertising profiling is not included.
[1] https://www.google.com/intx/en/enterprise/apps/terms/dpa_ter...
Exactly like Microsoft, Apple or Yahoo! does.
I don't know where has started that urban legend that only Google scan the emails, every email provider that does anti spam, auto categorizes or does full text search read all the emails.
You are correct that the comparison is blatantly wrong. What Microsoft did is evil and a massive, massive violation of privacy and trust. What Google does can't even be classified as evil. Arguably it's creepy, but that's about the extent of it, and they have been clear about it from the start.
And bullshit on the "explicit permission" part. No where did anybody get a clear "you grant Microsoft the right to read your email whenever they bloody well want to if it suits an internal investigation with zero oversight" checkbox.
> Google's ad mechanism reads all emails sent and received by all gmail users
This is incorrect, as the word "read" requires some amount of comprehension. The automatic indexing algorithm has no comprehension of what it is scanning, ergo there is no "reading" going on.
Yes, quite a bit: https://www.google.com/transparencyreport/
But the problem in this scenario is law enforcement wasn't involved. I'm unaware of any other email hosting company doing this so far. Not to say they haven't, just it hasn't surfaced.
I'm sure people will object to this opinion, but I don't think it's reasonable to send your messages to a third party's server in a totally open, unobscured format and consider those messages private. I just can't really see the situation any other way. If you're going to do that, your only reasonable expectation of "privacy" is hoping that the server's admins aren't sufficiently interested in your messages to pay any attention to them.
It's not icky and wrong, it's part and parcel of the ethics of managing user's data. I've had access to corporate user's e-mail at various companies for decades, access to my entire family's e-mail (my wife, parents, siblings -- I host it for them), access to corporate instant messaging logs, and a whole slew of other data ...
... and I can definitively state that I've never read any of it without prior permission, and I've never been remotely tempted.
It's no different than having access to someone's mail, being handed the keys to a friend's house to house-sit their cats, or having someone hand you their mobile phone and then step away. As a matter of ethics, courtesy, and decorum, you simply don't look where you shouldn't.
Even for corporate e-mail, where we have an absolute legal right to look at e-mail, it's simply not something you do without a legal justification that outweighs the right to personal privacy -- which is why hosting your personal e-mail with a third-party corporation is a bad idea if you don't want them digging through it.
> I'm sure people will object to this opinion, but I don't think it's reasonable to send your messages to a third party's server in a totally open, unobscured format and consider those messages private.
The difference is that a third-party corporation like Microsoft or Google have very different ideas of ethics, courtesy, and decorum than your friends or even your employer.
In short, given the ability and even the legal right to engage in privacy-snooping behavior, everyone is not created equal, and not all relationships have the sort of constraints that we would (and I posit, should) expect.
I find it hard to believe the commercial value of the IP allegedly being sold exceeds that of the commercial value of the "cloud" enterprise deals Microsoft is jeopardising here...
Then again, an article in the sidebar points out that the other big players also reserve the right to do this: http://tech.fortune.cnn.com/2014/03/23/apple-icloud-email-ki...
Maybe there should be some kind of more normal procedure such as a court order rather than merely the "approval of Microsoft's lawyers", but either way they had justification. The blogger had obtained keys to a new server release and potentially he or his customers could use it to create highly insecure or spoofed installations, could they not?
Methinks the world is a safer place now that the leaker was caught.
By the way what's Microsoft doing employing some Russian guy living in Lebanon, anyway? The whole situation sounds a bit iffy.
If it's too widespread, it undermines others' online services. I'm already thinking I need to consider moving off Google Apps...
After a story like this, how on earth could any corporation blindly trust a cloud provider with their data?
I know many people simply do not care about their rights and freedoms, but I find this latest development incredibly disturbing.
However, I see this as a great opportunity for a company of good character to make a name for itself by promoting services with the assurance that their databases are encrypted in such a way that even they can't access our data.
By using an e-mail service that does not have such clauses in their terms of service, or even better, guarantee that they won't read your e-mail. Because if they do, it makes it a lot easier to sue them.
Of course, e-mail is inherently insecure. Even with PGP encryption, the metadata is visible by every SMTP server on a message's route. So, don't expect privacy when using e-mail.
http://www.theguardian.com/technology/2014/mar/21/yahoo-goog...
IANAL but I suspect that if MS had gone to a court seeking an order against itself, or if MS had set up some other legal entity to sue MS on MS' own behalf, they'd have been thrown out of court for timewasting.
So for my Hotmail account to be opened and read by Microsoft's personnel without a warrant, all I need to be is the willing or unwilling recipient of an email from a person whose activities Microsoft deem to be illegal/bad?
What happens if some well known internet pirate sends me an email with an attachment? Will an justified Microsoft go on a fishing trip in my inbox to find any juicy illegal activities?
One could say that this is what I get for using Hotmail, but no way in hell can Microsoft maintain that "we are the good guys in privacy" that they have in their campaign against Google.
Seriously, what the fuck? Why can't Microsoft, or any company, employ Russian expats in Lebanon? It's foreign (to you) so it's "iffy"?
When I worked for BT if say some one in marketing had done that our internal security department would have fucking crucified them - read Bruces resignation letter and note how carefull he is to make nice with SD.
You have a reasonable expectation of privacy, or at least you would if you hadn't explicitly waived it by agreeing to the ToS.
The phone company is a special case, because the regulations for wire communications were written in an era when people cared about this sort of thing, and the zeitgeist wasn't manipulated by the spectre of terror.
I'm not defending Microsoft here. But you'll get no redress from government (the theoretical defenders of natural rights in a democratic society) in this case. Obviously.
People who care deeply about privacy could make the case that this is unjust because there the legal system ought to recognize this as a natural human right.
Others, of a more philosophical bent, might note that the whole concept of "rights" is rather silly.
This has been true ever since email was invented.
It doesn't matter what the TOS /AUP is - that doesn't stop rogue employees creeping trough email. It doesn't matter if they advertise it as a secure sevice or if they use their competitor's advert serving in ads.
We can use words like "wrong", "unethical", "illegal" but that does nothing to make email more secure.
Stop giving your secrets to a 3rd party and being surprised when they know your secrets.
They had explicit permission to do exactly what they did (you grant that permission when you sign up for the service). It may be gross that they dug through someone's email, but they didn't violate any laws or ethical guidelines. If the people involved didn't want their emails read by Microsoft, they shouldn't have granted Microsoft permission to read their emails.
It does appear that the U.S. has no such provisions.
You send a letter to a friend with sensible information. The letter is transported by the post office from door to door. While in transit, the post office recognizes, from a 3rd party, that a letter exists, that contains sensible information about the post-office's business. Therefore the CEO of that company demands a internal investigation, which searches for a letter with the given senders/recipients address and then opens it.
IANAL, but at least where I come from, there exist laws that acknowledge the intimacy and privacy of these letters and would sentence this behavior.
So why on earth is everyone talking about policy, terms of service, the lack of alternatives a.s.o? Nobody sees the desperate need of legislation here?
Why do you feel the need to resort to using legislation to eliminate freedoms and rights I currently have?
Legislation in this case does not eliminate your freedom, but protects it, forcing companies to obey to privacy and data protection.
The only freedom that would be eliminated here is the freedom of a company to abuse data they do not own.
I understand exactly what you mean. You don't, however.
> The only freedom that would be eliminated here is the freedom of a company to abuse data they do not own.
You would also eliminate my ability to agree to the status quo. These are rights I have now. Legislation as you suggest would eliminate that freedom that I have.
You aren't enforcing privacy. You are removing choice and freedom. If anything, your legislation goes so far as to say I'm not allowed to trade my data for a service.
So, why do you feel it's okay to legislate away freedoms I have now?
If you allow a bomb to be placed in your house its not surprising that once in a while its going to go off.
To be harsh, I haven't learnt anything either. I use the ms live crap (only because of office 365) and gmail too.
That said, their stated justifications probably suffice to get this categorized as a "forgivable error".