Another topic explored in depth at Microsoft’s Underground Tour, held in Redmond, Washington was the cloud. Ryan Noik delves into the legalities surrounding a cloud that balances privacy with responsibility.  

While it was a departure from the innovation theme, another focus that vied for attention was no less fascinating, attention shifting to how technology in general and cloud in particular could be used for good.

This, however, had less to do with Microsoft’s community service initiatives, and more with the legal side of the business.

Neal Suggs, the vice president and deputy general counsel for Microsoft, explained that ensuring cloud served the best possible outcome, entailed a few core concerns, namely trust and transparency, reliability, or how cloud could be made available, and “doing the right thing” for the environment. Considering that at this time of writing, the fates of the Environmental Protection Agency and global treaties to protect the environment are uncertain, the latter seems to be more critical moving forward.

Making a change

Suggs explained that Microsoft has moved from being a provider of technologies that companies use, to providing an environment it builds.

“There’s been an enormous technological shift, and with the breadth of our ambitions in where we are focusing, we can’t bring customers on board unless they believe they are protected when they make use of our products,” he elaborated.

Suggs elaborated that as Microsoft started making inroads into the cloud about seven years ago, it faced difficulty convincing customers to put their trust in the company. It was various leaks, including Target, JP Morgan, and the Panama papers, that tipped the scales.  It shifted the conversation with customers to one where Microsoft addressed their misconceptions, including its capability to afford them better protection than they would have had on their own.

“In fact, the US CIO sees us assisting to provide security and protection to customers in the same way that banks do. The banking system works, as people trust that they can provide a more efficient and reliable service. When banking started, people were concealing their money in safes, holes in the yard, and mattresses, as they thought they could control it better. It was only after a while that we realised that was backward thinking,” he continued.

Seeking the balance

Coming as little surprise, it was Edward Snowden’s shocking revelations that altered the security landscape a couple of years ago.  “The idea that the US government was actively collecting information in bulk and not doing it lawfully was bad, but on the other side, this is a dangerous world and thus governments need to have an ability to protect all peace loving citizens,” he continued.

With this in mind, Suggs urged a balanced approach, where governments are able to protect citizens from legitimate threats, while cloud customers have their privacy, and can be assured of the integrity of their data.

Admittedly, the concern is always that a government will have too far reaching powers, and abuse these without being held to account. However, in the US at least, Suggs continued that Microsoft has in fact sued its government four times, challenging its interpretation of the law. Interestingly, contrary to the belief that suing the state rarely works, Microsoft either won or settled the majority of these  cases.

Fighting the good fight

The first instance was in 2013, when Microsoft along with Google, sued the government for forbidding it from disclosing customers as to how many requests they were receiving for information.  “After Snowden, people believed we were getting millions of these requests, but it was actually quite a small number. We reached a settlement and the government allowed us to expose that information,” elaborated Suggs.

“Another national security letter a year later told us that a request for a customer’s data was accompanied by a gag order – which was contrary to our customer policy. We challenged that in court and the FBI eventually rescinded the request,” he continued.

In 2014, the US government requested customer data in servers held outside of the US. Most recently, the New York Court of Appeals agreed that a search warrant has no extraterritorial reach and Microsoft didn't have to deliver the data. The final case, which is currently underway, has Microsoft challenging gag orders, arguing that it should be allowed to inform their customers two to five years after the order had been issued.

Working together, when needed

Referencing the balanced approach he earlier encouraged, Suggs stressed that it is not just an adversarial approach, and that governments and companies can work together when it is in the best interest of public safety. “The case of Charlie Hebdo is a great example of how the system can work – while the attack was going on, French authorities reached out to the FBI. Microsoft received the request through the FBI and it took just 45 minutes to get confirmation that the request was lawful. Microsoft had the information and delivered it. That is the way this needs to work,” he elaborated.

One of the questions that arises though, particularly when the government requests customer information from Microsoft, is how it knows that the ‘person of interest’ in question has their data stored on Microsoft’s cloud. “Sometimes the authorities can tell, because the customer has referred them to us.  Other times, they do not know but they ask us anyway to see if we do have information on a particular subject,” he elaborated.

All of this culminates in one of the most important issues touched upon with regards to cloud – trust, (explored further in part 2).

Need to catch up? Navigate to the links below to read all the previous articles in the coverage so far.

Overview

Cultural Shift

Microsoft Research

Research projects

The next era of computing

Welcome to Area 51

The Engines of Innovation