They're Reading Your Mail: Microsoft's ToS, Windows 8 Leak, and Snooping

After the recent Windows 8 leak by recently arrrested then-Microsoft employee Alex Kibkalo, Microsoft has tweaked its privacy policies, but also defended reading the email of the French blogger to whom Kibkalo sent the software. "The blogger in question, who remains unidentified, happened to use Hotmail—the investigation began in 2012 before Hotmail's Outlook.com transition—as his primary email account. So as part of its investigation, Microsoft peeked into the blogger's email account to read that person's correspondence with Kibkalo. ... Microsoft says it was justified in searching the blogger's email account, because it had probable cause to believe Kibkalo was funneling trade secrets to the blogger.The company also pointed out that even with its justification for searching the account, it would have been impossible to gain a court order." "The legal system wouldn't have let us" seems a strange argument to defend any act of snooping.

Comments

According to Arrington, Google reads it too

[mTor]

Here's what Michael Arrington, former editor of TechCrunch, says:

I have first hand knowledge of this. A few years ago, Iâ(TM)m nearly certain that Google accessed my Gmail account after I broke a major story about Google.

A couple of weeks after the story broke my source, a Google employee, approached me at a party in person in a very inebriated state and said that they (Iâ(TM)m being gender neutral here) had been asked by Google if they were the source. The source denied it, but was then shown an email that proved that they were the source.

The source had corresponded with me from a non Google email account, so the only way Google saw it was by accessing my Gmail account.

A little while after that my source was no longer employed by Google.

ABOUT THAT TIME GOOGLE SPIED ON MY GMAIL

Re:According to Arrington, Google reads it too

[K. S. Kyosuke]

Wow, you suck at reading comprehension.

Re:According to Arrington, Google reads it too

[stoploss]

All I'm hearing is that these bloggers are incompetent at protecting their sources.

I mean, WTF? Who the hell would imagine it's safe to use a company's services when collecting insider information? I mean the data is on the company's servers, FFS. I bet real spies don't need to be told not to set up a dead drop inside, say, the Capitol rotunda or the FBI headquarters, either.

Protip for any planning to publish dirt on Yahoo: don't use Yahoo mail to collect the information. Not that anyone still uses Yahoo mail anymore...

Bad summary

[whoever57]

Much as I hate to defend Microsoft, the summary mischaracterises Microsoft's statement. Microsoft is saying that it already had the right to search the mailbox, so a court would not have issued an order. It's like asking a court for permission to search your own house. The court won't issue an order, but that doesn't mean that it would be illegal to do the search.

I don't know if Microsoft is right in its claim that it would not have been able to get a court order, but let's get the facts straight when criticising Microsoft.

Re: Bad summary

[Anonymous Coward]

That is not a universal law. In Europe your landlord can not enter the flat without the tenants permission. It is expressly forbidden.

Re: Bad summary

[sribe]

A landlord can go into your apartment without your permission also.

Wrong. Except in cases of emergency, he needs your permission. Unlike what some people think, you do get a few rights when you pay for the use of the apartment...

Re: Bad summary

[sjames]

But he absolutely cannot open your mailbox or paw through your personal papers. Generally, landlords who enter without permission are limited to actions necessary to protect the property from damage (fire, leaking pipe, etc).

Re: Bad summary

[Zontar The Mindless]

Intruder is saying he already had the right to break into the house. No need to ask for permission.

That's right. He owns the house. And guess what. A landlord can go into your apartment without your permission also.

That's not quite how it has worked in in my experience as a renter in the US, Australia, and Sweden.

Don't store unencrypted email online

[gwstuff]

While this story is crazy, and MS should be spitballed for it... I don't buy that other companies that let your store your data online don't give access to your data to their employee, if only for "debugging and administrative purposes." If you want to store your data online encrypt it.

Scroogled by Microsoft!

[hsmith]

Here is to Microsofts shit ad campaign "Scroogled" - first they snoop on all Skype communication and now they admit to reading emails LOOKING for things.

I fully expect the daft ad men at Microsoft to continue their pathetic ad campaign.

Glass houses and all that.

Re:I want to be shocked, but honestly I'm not

[pushing-robot]

Not to defend Microsoft's actions, but this does seem like exceptionally poor judgement on the part of the leaker, on par with robbing a bank and having them put the money in your safe deposit box.

Personal criminal liability applies

[gweihir]

I suspect that certain MS managers and system administrators should now refrain from traveling to the EU for the next few years. Under EU law, you may not even look at email of your employees without having gotten a signed waiver on paper or a court order.

Re:They checked without a warrant

[tgv]

> It's not a legal question at all. If you use the service you have accepted their terms and so have given them permission to do this.
That *is* a legal question. If the EULA says: we own your first born, is that so just because you checked a box on a web site? Nope. There are laws governing the reading of email, and Microsoft has to obey those rules like everyone else.

Remember kids...

[mwvdlee]

Remember kids...
Do not store incriminating evidence on the servers of the company you're trying to screw.