Slashdot Mirror
Microsoft Says It Never Meant To Knock Cryptome Offline
CWmike writes "Microsoft withdrew on Thursday its demand that Cryptome.org yank the 'Microsoft Global Criminal Spy Guide' document from the site, and said it had never intended for the whistleblower's domain to be knocked off the Web. 'In this case, we did not ask that this site be taken down, only that Microsoft copyrighted content be removed,' said a Microsoft spokeswoman. 'We are requesting to have the site restored and are no longer seeking the document's removal.' The document, a 17-page guide to law enforcement on how to obtain information about users of Microsoft's online services, including its Windows Live Hotmail, the Xbox Live gaming network and its Windows Live SkyDrive storage service, was published by John Young, who runs Cryptome.org, on Feb. 20. Earlier this week, Microsoft demanded that Young remove the document from his site, citing the Digital Millennium Copyright Act. When Young refused, his Internet provider shut down the site, and Network Solutions, the registrar of Young's domain, put a 'legal lock' on the domain name. The last prevented him from transferring the URL to another ISP. Computerworld blogger Preston Gralla dug into the document today in his 'Leaked Microsoft intelligence document: Here's what Microsoft will reveal to police about you' post."
While I completely agree that using DMCA to pull of the site is an asshole move, the documents also gave reassurance about privacy policies used in those services, mainly that MS isn't logging chat between people in Messenger and that when you move the email from their servers to your local computer email box, it isn't kept on MS servers. While in contrast, in my understating, for example Google keeps even deleted email somewhere in their networked file system for many many months.
I actually like to see more of these from different companies. Most interestingly, Facebook has a lot personal data. And what about Google? Yahoo?
If anything, such openness is good for MS in this case (even while they don't seem to agree to it, until now that it's leaked).
One thing thats implied is that if the police say "this X-Box, SN#ABC, was stolen on this date", Microsoft will return the subsequent connection history for that xbox!
Speaking as someone who had my house broken into and my Wii stolen (I had no xbox at the time), this would have been very cool to have, since Nintendo would do F-all when asked.
Test your net with Netalyzr
That Network Solutions, Inc. placed a "legal lock" on his domain name strikes me as NSI appointing themselves sheriff.
We don't need totalitarian internet authorities who "enforce the law" for Microsoft's civil complaints.
I suggest we all boycott Network Solutions, Inc. over their treatment of cryptome.org. I will do so.
I'm no fan of Microsoft, but I think they've handled this whole situation correctly.
There's no indication that the document in question was *not* copyright by Microsoft. In this case, the correct legal action is a DMCA, same as if you had a movie up on your site. NetSol is just being a dick, as usual - it's not their responsibility to screw with the domain over the dispute between 2 third-parties unless legally required to (I don't think that's the case here).
In any case, when Microsoft saw how this was about to go all Streisand on them, they decided correctly that it wasn't worth the fight.
I believe them when they said they didn't intend to take Cryptome down. Looks like it was just NetSol being... proactive. So really the only thing they'd be at fault for was sending a DMCA, which is clearly within their rights. They probably have underlings scouring the web and sending DMCAs - so they were probably not delibrately targeted. When it had unintended consequences, they withdrew it.
I don't think MS is at fault here. I actually think they acted quite exemplary.
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
DMCA takedowns follow a very clear an explicit process on what providers have
to do and how... as I understand it, "locking out" the domain at the registrar
level is far beyond both the spirit and the letter of the law.
Okay wtf is going on lately. MS actually admitting mistakes left and right, trying to play nice. Did I miss the memo?
The chain of events is nothing newsworthy. 1. Microsoft claims copyright on its internal guide. 2. Microsoft sends DMCA takedown letter... site refuses. 3. Microsoft sends DMCA takedown to server provider, server provider must take on the liability or take down the whole server, server provider decides to down site. What's newsworthy is that Microsoft is now saying "sorry" and letting the document stay up now. If you didn't know there was a law enforcement back door in everything Microsoft does, well, here's your proof.
This stuff shouldn't be shocking to anyone: By law, they will reveal certain things about online services when requested. The problem should be that they don't want you to know what they are forced to give up which seems to be the wrong stance. These services should be function like a bank safety deposit box: Although private, it isn't legally sacrosanct and will be opened by third parties for inspection in certain circumstances.
If nothing else, all of these online services to have a general policy about this as well. If I suddenly croak, who gets access to stuff I stored out there online? Putting the password and other access information in a vault somewhere isn't reliable or sane. I may even state it in my will that I want my immediate family to take ownership of all of my online information but I have no idea how to compel Microsoft or Google or whatever to release these accounts to someone else. This seems like one of those areas all service providers should be better at defining instead of hiding the detail from us in the legalese of the EULA.
by the data that they can gather? Heck, the users give the data to them. All of it is data that would be gathered by any provider of similar services.
The only surprise is that they got worked up by the document getting out, and invoked the Streisand Effect.
Best Slashdot Co
I think you're on the wrong site. I mean that was a well-reasoned, even-keeled reply in a Microsoft article. Are you sure you're supposed to be on slashdot?
In any event, I agree. I don't approve of the DMCA as it currently exists, but it certainly wasn't being abused in this instance, and Microsoft withdrew it quickly after Cryptome was knocked off. *shrug* Story's pretty much over.
Canada: The US's more awesome sibling.
I suppose network solutions does not need customers. I've ready to move all my domains away from them... The question is where to move them to?
I do not know if the posting document would be covered by fair use or not. But copyright law does not protect facts or ideas, only the particular expression of ideas. It seems to me that a paraphrased version would be perfectly legal. This makes copyright law a poor vehicle to enforce secrecy.
On another news, Microsoft never intended to make an OS that made their users miserable. A spokesman from Microsoft said: "Ah, that did happen, we are sorry and maybe will will fix that in the next release."
"'In this case, we did not ask that this site be taken down, only that Microsoft copyrighted content be removed,' said a Microsoft spokeswoman."
This is total, exquisite bullshit. The fact is, a DMCA request in this case triggers a site takedown if the owner disagrees with taking down the material.
Did MS verbally utter the request, "Will you please take down the site?" No, they didn't.
Did they press a bright green legal button labelled, "Push here to initiate site takedown process"? Yes, they did.
We know where leadership by an anti-intellectual "strongman" who scapegoats minorities and likes boisterous rallies goes
Microsoft got caught taking unwarranted action against a well known website. Now they're claiming that they never intended to do that and that the information in question isn't really protected.
Anyone who believes that this means Microsoft has turned over a new leaf needs to go back to the school of hard knocks and learn about "spin", "doublespeak" and "marketing". If you think that they would back off like this if the general public DID NOT know what transpired then don your pointy hat and go sit in the corner. The history of Microsoft should be well known in these parts and years of bad behavior by that company should provide more than sufficient reason to doubt them now.
The way it was done - by the domain registrar re-directing their domain name to NULL was not a mistake - it was because a MS "enforcer" decided to teach Cryptome a lesson and used Microsoft's influence with NetSol to make it happen. You don't think NetSol makes a regular practice of this kind of stuff, do you? What's really interesting this time is they got caught with dirty hands - and decided a "whoops, my bad" would make it OK. That wouldn't work if there weren't so many who are ready to argue for the bad guy just because it gives them a soap box to speak from.
Sure, there's a few Microsoft shills who monitor this site and post / mod accordingly. Their behavior is bad but expected - but the rest of you... Really, read TFA and think about it for a few minutes before you hit that "reply" button. It's not only a good idea, it'll also make you a better Slashdotter.
The DMCA requires that if an alleged copyright owner alleges that specific material on a site infringes their copyright, the web hosting provider needs to disable access to that specific material, unless notified by the user that he disputes the allegations of the alleged copyright owner, and there are some detailed timelines for the actions. It doesn't require that the web hosting provider disable the whole website, or that the domain name registrar prevent the domain owner from changing the IP addresses for the website, or that either the web hosting provider or domain name registrar erase all backups, destroy the hardware with thermite, shoot the user's dog, or nuke the city from orbit.
Unless I'm misreading the correspondence that was posted on Cryptome's backup site, Microsoft asked Young's web hosting provider, Network Solutions, to disable access to one specific file under the DMCA, and Network Solutions, as the hosting provider, decided on their own to disable the entire cryptome website, and their evil twin, Network Solutions the DNS Registrar, decided on their own to place a lock on the domain name. I don't know if Netsol-the-registrar's contract with ICANN lets them do that, but I'd be surprised -this isn't a trademark dispute about the name cryptome, it's a copyright dispute about material on the site.
The DMCA deadlines haven't expired yet, so Network Solution's Other Evil Twin, Cthulhu Inc, have not yet completed the aforementioned other activities and slunk back in to the ocean, but it's possible they'll do it anyway just for fun.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
MS only asserted copyright over one file, and didn't request taking down the whole site. Netsol-the-hoster overreacted.
And as you say, Netsol-the-registrar way overstepped their boundaries.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
MS wants to suppress one file, JY refuses, MS sends DMCA letter to Netsol requesting taking down the one file. That's mildly newsworthy because it's cryptome and MS, but that's not the big event. Netsol took down the whole site, not just the one file, which is especially newsworthy because of the importance of cryptome and because it exceeds their requirements, and then Netsol the Registrar locked the domain name, which isn't at all required, and is newsworthy because they're locking domain names for non-domain-related reasons.
And MS is saying "sorry" not only because JY asserted his rights to dispute the DMCA takedown and thousands of people yelled at MS, but because MS is getting blamed for Netsol's overkill overreaction.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
tin_hat_mode_on
Hmmm this is too convenient... maybe MS wanted the document to "leak", giving false assurances to the masses? In actuality, they are logging every single bit that passes through!
tin_hat_mode_off
nah... couldn't happen... or could it?
How could a document like this "leak" out? By whom? A law enforcement agency employee? A Microsoft employee? The document is actually pretty benign - it basically states that the data logged is that which is also logged by every web server in existence, nothing more serious than that. Pretty good-natured from MS.
Anyways... stay crunchy!
-- Sig down
When we were shooting bullets, we didn't want anyone to get hurt. Blame the pistol!
Haven't we just established that Computerworld and Infoworld are a bunch of trolls who will do anything for pageviews? Why is Slashdot linking to them again?
This space for rent.
About 10 years ago a colleague of mine found a reproducible way to run commands as administrator on any windows machine that enabled shares or IIS. He provided Microsoft with full details on how to do it. Then he was raided by the Feds 2 days later, as he was apparently a "dangerous hacker". He didn't even let us know how he did it though - just Microsoft. Fortunately his Dad was a senior policeman, and knew the right people (lawyers) to get some sense in the situation. Microsoft is not to be trusted in it's dealings with the law.
a National Security Letter ?
Although private, it isn't legally sacrosanct and will be opened by third parties for inspection in certain circumstances.
Stop using big words correctly. You're setting a bad precedent for slashdot.
My blog. Good stuff (when I remember to update it). Read it.
And in other news, the tooth fairy gave me a blowjob last night....
The document had already gotten out into the wild. That it was restricted only made it more popular and there were plenty of places to get it besides Cryptome. All MS was doing was generating more bad publicity for itself.
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach
Okay wtf is going on lately. MS actually admitting mistakes left and right, trying to play nice. Did I miss the memo?
Yes you did. be careful; it's a cookbook!
But it would appear to me that some of Microsoft's policies, as stated, are potential violations of data retention laws, specifically the timeframe in which they are keeping their records.
Please correct me if I'm wrong.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Honestly, I read through the leaked document. I can't figure out why this wasn't just published on Microsoft's site. There isn't anything shocking in the document, just an overview of what US law (under the 9th circuit's interpretation) requires and what information is retained by Microsoft. If you look at page 22 of the document, they basically say "here's what the law says you have to do before we can turn this information over to you."
The document seems relatively tame and sane. I am not Microsoft's biggest friend here, and it seems they overreacted a great deal. It would be nice of other companies actually published such policies willingly instead of having them leaked.
LedgerSMB: Open source Accounting/ERP
So, Microsoft has prepared a document which details how they will comply with American Law when requested to do so by the appropriate Authorities. I think you will find this is not a Microsoft issue but a legal compliance issue that affects all businesses.
Now that you're back up it sounds like a good time to move your domain to a more reasonable registrar and hosting company. You have been warned!
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Microsofts anal retention coupled with the Streisand Effect (tm) has ensured that there are more than a million places on the internet where their evil intentions can be viewed, reviewed and picked apart. I even have a copy right here on my computer. Its a bit of a dry read, but I saw that all user information for all of their worldwide services --xbox, email, online services, everything -- is stored in the US, and with the US Patriot Act, all instantly available and in databases owned, operated and archived for full use by the US government (read NSA, CIA, everyone else). Now every Microsoft user doesn't just have their names sold to whichever retailer is offering the most cash, but the US government has open files on every Microsoft user who ever got online, and also some information about anyone who sent them information, along with the content of the message. No special request required. Microsot offers all of the information, and the guide provides a quickie guide for government boffins so that there is no confusion about what Microsoft is offering up. Instead of just handing everything over, microsoft is handing all of their users private information on a silver plate.