Microsoft Says: Come Back with a Warrant, Unless You’re Microsoft

EFF has long argued that law enforcement agencies must get a warrant when they ask Internet companies for the content of their users’ communications. In 2013, as part of our annual Who Has Your Back report, we started awarding stars to companies that require warrants for content. It is now unclear whether Microsoft, one of our inaugural “gold star” companies in that category, is willing to live by its own maxim.

This controversy was brought to light by the arrest of an ex-Microsoft employee named Alex Kibkalo. According to a criminal complaint sworn in a Seattle federal court, Kibkalo stole proprietary information from Microsoft, including its Activation Server Software Development Kit (SDK), and passed the code to a French blogger.

violation of the Electronic Communications Privacy Act, ECPA

Courts do not issue orders authorizing someone to search themselves, since obviously no such order is needed.  So even when we believe we have probable cause, it’s not feasible to ask a court to order us to search ourselves. 

And according to Section 3.5, one of the ways users can violate the agreement and thus give Microsoft “permission” to access their content is to email content that violates the company’s Code of Conduct. Spoiler alert: the Code of Conduct is ridiculously broad.