reading on microsoft subpoena compliance details

Ever wonder what Microsoft stores in their services about you, or how that might be used to aid criminal investigation? Seems an internal document has been floating around that discusses Microsoft’s lobal Criminal Compliance Handbook. Some thoughts…

First, if you live in the US (or China, and others) don’t be naive and think businesses can keep what you do secret, even in the face of a subpoena or government influence. Many of these services and tools (like Skype, AIM, GMail, your cell phone provider, landline phones, ISP, etc) wouldn’t be allowed if there were not ways to intercept or request stored information from them to track down criminals. Simply because of that, you know they have to have some method of easy records requesting or eavesdropping capabilities (like the guy in that secret closet at AT&T!). Don’t get me wrong, I’m not necessarily saying this is a bad thing; I actually do favor having that capability to use for authorized purposes. It’s just really difficult to maintain that ethical level of “authorized.” Lots of people were shocked to hear that Google has a web site to request subpeona materials. I wasn’t shocked they have that capability, although I was a bit shocked that it was just a web portal that was apparently poorly protected.

Second, even if it’s not true in practice, it’s nice to read that Microsoft internally does not want to do things like record IM conversations or store your email after you’ve opted to delete it (or at least they don’t want to provide such to authorities, but I bet that lines up with what THEY want as well). Honestly, I really wouldn’t expect Google to be quite as satisfactory in this regard. It is my impression that they want to record, keep, index, and correlate as much as possible, even things you’ve marked or thought were deleted or not recorded.

Third, transparency should not be scary. Is this doc scary to read? Actually, no it is not. The only thing this leaves is whether all of this really is done in practice, but seeing the doc does nothing to challenge that, in and of itself. A doc that says all this, but in practice they do the opposite and save much of this information in personally-identifiable/correlatable form would be a bad thing. But otherwise, I think everything in this doc is actually somewhat reasonable.

Fourth, just to reiterate, I’d be shocked if Google could even begin to do this same thing.

Picked up from the infosecnews mailing list.