Microsoft does not give the National Security Agency direct access to its customers’ email or instant messages, contrary to previous news reports, a company executive said.
News reports last week suggested that Microsoft has helped the NSA circumvent the company’s own encryption in order to conduct surveillance on email accounts through Outlook.com, but company General Counsel Brad Smith said Tuesday that’s not true.
“We do not provide any government with direct access to emails or instant messages,” Smith wrote in a blog post. “Full stop.”
The company does not help government agencies circumvent its encryption, he added. “To be clear, we do not provide any government with the ability to break the encryption, nor do we provide the government with the encryption keys,” he wrote. “When we are legally obligated to comply with [government] demands, we pull the specified content from our servers where it sits in an unencrypted state, and then we provide it to the government agency.”
Microsoft on Tuesday asked U.S. Attorney General Eric Holder to permit Microsoft and other communications providers to share “more complete information” about how they handle national security requests for customer information, Smith added.
“We believe the U.S. Constitution guarantees our freedom to share more information with the public, yet the government is stopping us,” he said. The U.S. government has not responded to a June 19 request Microsoft made to publish the number of national security requests it receives, and the company hopes Holder will step in, Smith said.
Microsoft provides government access to data stored in its SkyDrive service and to Skype calls when presented with a legal order to do so, such as a search warrant or national security letter, Smith said. If asked for customer data in enterprise email or document storage, Microsoft attempts to redirect the requesting government agency back to the customer, he said, “and we notify the customer unless we are legally prohibited from doing so.”
Microsoft has never provided any government with customer data from any business or government customers for national security purposes, he said. In 2012, the company complied with four law enforcement requests related to business or government customers, he added.