Microsoft's Spy Guide: What You Need to Know

Since 1996, the whistleblower site Cryptome has been posting sensitive government and corporate documents. Now Cryptome has been stricken from the Web after releasing the Microsoft Online Services Global Criminal Compliance Handbook , a "spy guide" for law enforcement detailing what data Microsoft has, keeps, and can relinquish. Since most of you are Microsoft users, there are a few tidbits of information you'll need to know before purchasing Xbox Live points, logging onto Office Live, or sending an e-mail through Hotmail.

By Brennon Slattery
Thu, February 25, 2010

PC World — Since 1996, the whistleblower site Cryptome has been posting sensitive government and corporate documents. Now Cryptome has been stricken from the Web after releasing the Microsoft Online Services Global Criminal Compliance Handbook , a "spy guide" for law enforcement detailing what data Microsoft (MSFT) has, keeps, and can relinquish. Since most of you are Microsoft users, there are a few tidbits of information you'll need to know before purchasing Xbox Live points, logging onto Office Live, or sending an e-mail through Hotmail.

Enterprise Data Security: Definition and Solutions

What is the "Spy Guide"?

The Global Criminal Compliance Handbook is a quasi-comprehensive explanatory document meant for law enforcement officials seeking access to Microsoft's stored user information. It also provides sample language for subpoenas and diagrams on how to understand server logs.

I call it "quasi-comprehensive" because, at a mere 22 pages, it doesn't explore the nitty-gritty of Microsoft's systems; it's more like a data-hunting guide for dummies.

Which of My Microsoft Services are Affected?

All sorts. Microsoft keeps user information related to its online services. The data ranges from past e-mails to credit card numbers. The information is kept for a designated period of time, sometimes forever.

The sites referenced are:

Windows Live
Windows Live ID
Microsoft Office Live
Xbox Live
MSN
Windows Live Spaces
Windows Live Messenger
Hotmail
MSN Groups

Some of these Microsoft services may not apply to a whole lot of people. Who uses MSN Groups, for instance? But accessing personal information from Xbox Live accounts, for example, could be a big problem for 23 million subscribers; especially since Xbox Live keeps more data than many of Microsoft's other services.

What Information Does Microsoft Have?

It depends on the service. We'll deal with the big dogs here:

Windows Live ID

Windows Live ID is a one-stop shop for user info retention and is used on a multitude of sites to limit scattered user names and passwords. Due to its wide reach, Windows Live ID could allow law enforcement agencies to access tons your personal Web surfing information. Microsoft keeps "the last 10 Microsoft site and IP connection record combinations (not the last 10, consecutive IP connection records)."

All things considered, that's not bad. It gets worse.

Hotmail

"E-mail account registration records are retained for the life of the account. Internet Protocol connection history records are retained for 60 days," according to the document. But if you, like many, switched over to Gmail and let your Hotmail account lapse, all e-mail content is "typically deleted after 60 days of inactivity. Then if the user does not reactivate their account, the free MSN Hotmail and free Windows Live Hotmail account will become inactive after a period of time."

1 2 next page »

Originally published on www.pcworld.com. Click here to read the original story.

You are here: Technology Topics » Operating Systems » News

Most Recent Windows 7 Stories

White Papers »

Microsoft Open Value Program Guide

In this overview, see how Microsoft Open Value provides a flexible, affordable way for small to midsize organizations (i.e. those with five or more desktop PCs) to use and manage all their Microsoft licensed products under a single agreement.

Microsoft Volume Licensing Comparison - Small/Med. Business

This quick-reference document lets small and medium organizations (i.e. those with five or more devices) to easily compare the available Microsoft Volume Licensing programs to create a simple, cost-effective and flexible way to benefit from volume licensing.

Microsoft Enterprise Agreement Program Overview

Discover how flexible the Microsoft Enterprise Agreement Program is to help you build the right software solution agreement for your business. This paper highlights all the available options-from on-premise software and cloud service solutions, to payment options and enrollment programs, and more.

Microsoft Volume Licensing Comparison - Enterprise

With this quick-reference document, you can easily compare the available Microsoft Volume Licensing programs for enterprise organizations with 250+ devices, and tailor a program to help save costs, manage multiple licenses, and keep software up-to-date.

Microsoft Volume Licensing Reference Guide

This guide provides an overview of the key features of Microsoft Volume Licensing programs. The information is presented by organizational type and size-two of the most important keys to determining your best Volume Licensing option.

Watson - A System Designed for Answers. The future of workload optimized systems design

Watson is a workload optimized system designed for complex analytics, made possible by integrating massively parallel POWER7 processors and DeepQA technology. Read the white paper about Watson's workload optimized system design.

Webcasts »

Virtualization Success is a Team Effort

As greater numbers of datacenter servers transition from the physical to the virtual world, the components of virtualization success come to the fore. What scores of organizations have discovered is that success is derived from an optimal pairing of the right software platform with the right hardware platform.

Customer Spotlight: How IPC The Hospitalist Company Implemented Oracle on VMware

Have you been looking to hear about customer's experiences with the new VMware vCenter Site Recovery Manager product? View this webcast to learn about VMware customer, Navicure, and their experiences testing and evaluating the recovery manager, their progress in implementing it in their environment and their advice other customers considering using vCenter.

Quantifying the Business Value of VMware View - Webcast

Many enterprises have discovered that the use of virtualization to support desktop workloads creates a range of significant benefits. These benefits include price efficiencies, improved IT management and greater agility and choice for end users.

This VMware sponsored webcast with IDC will provide both quantitative measurement of the business value -- defined as the expected ROI -- and qualitative analysis associated with the use of VMware View™. IDC will also provide an analysis of the View Composer and ThinApp™ features of VMware View, including the business value of these solutions and an overview of how they work.

Attend this webcast to learn about:
- Challenges and barriers that might impede the adoption of desktop virtualization
- Navigating roadblocks to facilitate a strategic implementation
- Optimizing qualitative and quantitative benefits to IT and your business

Deliver Private Cloud Database as a Service with VMware vFabric Data Director

VMware recently announced VMware vFabric™ Data Director, a new database deployment and operations platform that enables enterprise IT organizations to offer database as a private cloud service. Built on top of VMware vSphere 5, vFabric Data Director enables IT organizations to ontrol database sprawl through automation and consistent policy enforcement and accelerate application development cycles with self-service database management. Attend this webcast to learn how vFabric Data Director can help you build database-as-a-service in your datacenter.

Reliable Disaster Protection with VMware vCenter Site Recovery Manager

A simple, cost-effective disaster-recovery solution for virtual environments is high on the agenda for IT organizations as they virtualize more business-critical applications with VMware. VMware vCenter™ Site Recovery Manager-the market-leading disaster-recovery product-ensures the simplest and most reliable disaster protection for all virtualized applications. VMware vCenter Site Recovery Manager provides centralized management of recovery plans, enables nondisruptive testing and automates site-failover processes.

Introduction to VMware vCenter Site Recovery Manager 5

Traditional disaster recovery solutions are often too expensive, complex and unreliable to meet business requirements. As a result, IT departments are hesitant to expand disaster protection beyond their most critical applications, largely because they are uncertain whether the quality of the protection is really worth its cost. VMware vCenter™ Site Recovery Manager 5 is the market-leading disaster recovery product that addresses this situation for organizations of all kinds. It complements VMware vSphere to ensure the simplest and most reliable disaster protection for all virtualized applications.

Newsletter Sign-Up »

Receive the latest news test, reviews and trends on your favorite technology topics

Choose a newsletter