Microsoft: We don't give NSA direct access to email

The company does not help government agencies defeat its email encryption, says Microsoft's general counsel

Microsoft does not give the U.S. National Security agency direct access to its customers' email or instant messages, contrary to previous news reports, a company executive said.

News reports last week suggested that Microsoft has helped the NSA circumvent the company's own encryption in order to conduct surveillance on email accounts through Outlook.com, but company General Counsel Brad Smith said Tuesday that's not true.

"We do not provide any government with direct access to emails or instant messages," Smith wrote in a blog post. "Full stop."

The company does not help government agencies circumvent its encryption, he added. "To be clear, we do not provide any government with the ability to break the encryption, nor do we provide the government with the encryption keys," he wrote. "When we are legally obligated to comply with [government] demands, we pull the specified content from our servers where it sits in an unencrypted state, and then we provide it to the government agency."

Microsoft on Tuesday asked U.S. Attorney General Eric Holder to permit Microsoft and other communications providers to share "more complete information" about how they handle national security requests for customer information, Smith added.

"We believe the U.S. Constitution guarantees our freedom to share more information with the public, yet the government is stopping us," he said. The U.S. government has not responded to a June 19 request Microsoft made to publish the number of national security requests it receives, and the company hopes Holder will step in, Smith said.

Microsoft provides government access to data stored in its SkyDrive service and to Skype calls when presented with a legal order to do so, such as a search warrant or national security letter, Smith said. If asked for customer data in enterprise email or document storage, Microsoft attempts to redirect the requesting government agency back to the customer, he said, "and we notify the customer unless we are legally prohibited from doing so."

Microsoft has never provided any government with customer data from any business or government customers for national security purposes, he said. In 2012, the company complied with four law enforcement requests related to business or government customers, he added.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Tags Internet-based applications and servicessecurityMicrosoftEric HolderU.S. National Security AgencyMailBrad Smithinternetgovernmentprivacy

Comments

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

AVG Internet Security 2011 Business Edition

Ultimate protection for your small or medium-sized business

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.