Microsoft: We don't give NSA direct access to email

The company does not help government agencies defeat its email encryption, says Microsoft's general counsel
  • Grant Gross (IDG News Service)
  • — 16 July, 2013 20:06

Microsoft does not give the U.S. National Security agency direct access to its customers' email or instant messages, contrary to previous news reports, a company executive said.

News reports last week suggested that Microsoft has helped the NSA circumvent the company's own encryption in order to conduct surveillance on email accounts through Outlook.com, but company General Counsel Brad Smith said Tuesday that's not true.

"We do not provide any government with direct access to emails or instant messages," Smith wrote in a blog post. "Full stop."

The company does not help government agencies circumvent its encryption, he added. "To be clear, we do not provide any government with the ability to break the encryption, nor do we provide the government with the encryption keys," he wrote. "When we are legally obligated to comply with [government] demands, we pull the specified content from our servers where it sits in an unencrypted state, and then we provide it to the government agency."

Microsoft on Tuesday asked U.S. Attorney General Eric Holder to permit Microsoft and other communications providers to share "more complete information" about how they handle national security requests for customer information, Smith added.

"We believe the U.S. Constitution guarantees our freedom to share more information with the public, yet the government is stopping us," he said. The U.S. government has not responded to a June 19 request Microsoft made to publish the number of national security requests it receives, and the company hopes Holder will step in, Smith said.

Microsoft provides government access to data stored in its SkyDrive service and to Skype calls when presented with a legal order to do so, such as a search warrant or national security letter, Smith said. If asked for customer data in enterprise email or document storage, Microsoft attempts to redirect the requesting government agency back to the customer, he said, "and we notify the customer unless we are legally prohibited from doing so."

Microsoft has never provided any government with customer data from any business or government customers for national security purposes, he said. In 2012, the company complied with four law enforcement requests related to business or government customers, he added.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Tags: Internet-based applications and services, security, Microsoft, Eric Holder, U.S. National Security Agency, Mail, Brad Smith, internet, government, privacy

Reverse Heartbleed puts your PC and devices at risk of OpenSSL attack

READ THIS ARTICLE
MORE IN Malware / Cybercrime
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

ZENworks® Endpoint Security Management

Protect against bugs in USB Storage devices

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.