In the wake of a controversy surrounding the methods it used to obtain evidence in a Windows 8 leak case, Microsoft on Friday pledged not to snoop in a user's email but to refer the account to law enforcement if it suspects foul play.
"Effective immediately, if we receive information indicating that someone is using our services to traffic in stolen intellectual or physical property from Microsoft, we will not inspect a customer's private content ourselves," Microsoft general counsel Brad Smith wrote in a blog post. "Instead, we will refer the matter to law enforcement if further action is required."
The change will soon be reflected in Microsoft's customer terms of service "so that it's clear to consumers and binding on Microsoft," Smith said.
At issue is the recent arrest of Alex Kibkalo, a former Microsoft employee who stole Windows 8 documentation prior to the operating system's release and gave it to a French blogger. One of the more startling bits of the case details, however, was the fact that Redmond went through the French blogger's Hotmail account in order to uncover Kibkalo's identity.
Microsoft defended the move, arguing that its terms of service gave it the right to go through customer accounts when safety or the security of intellectual property was at risk. Indeed, that policy says Redmond "may access or disclose information about you, including the content of your communications" in order to "protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the Service," among other reasons.
Still, Smith said today, "the circumstances [of the case] raised legitimate questions about the privacy interests of our customers."
"We've advocated that governments should rely on formal legal processes and the rule of law for surveillance activities," Smith continued, and in a "post-Snowden era," Redmond decided to "apply a similar principle and rely on formal legal processes for our own investigations involving people who we suspect are stealing from us."
Smith said Microsoft has also reached out to privacy advocates like the Center for Democracy and Technology (CDT) and Electronic Frontier Foundation (EFF) to flesh out the best way to strike the balance between consumer privacy interests and protecting people and the security of Internet services they use.