“We all want to live in a world that is safe and secure, but we also want to live in a country that is protected by the Constitution.” – Brad Smith, Microsoft
Microsoft, concerned over recent allegations of governments attempting to circumvent online security measures in order to monitor users, has vowed to take action in order to protect its customers from prying eyes and increase transparency.
To start, the software giant said it would “pursue a comprehensive engineering effort to strengthen the encryption of customer data” across its networks and services.
“For many years, we’ve used encryption in our products and services to protect our customers from online criminals and hackers,” Brad Smith, General Counsel & Executive Vice President, Legal & Corporate Affairs, Microsoft wrote in a blog post late Wednesday. “While we have no direct evidence that customer data has been breached by unauthorized government access, we don’t want to take any chances and are addressing this issue head on.”
Microsoft’s anti-surveillance and security efforts will include “major communications”, productivity and developer services such as Outlook.com, Office 365, SkyDrive and Windows Azure.
Overall, Microsoft said it would provide protection across the “full lifecycle of customer-created content”, including:
· Customer content moving between customers and Microsoft will be encrypted by default.
· All of Microsoft’s key platform, productivity and communications services will encrypt customer content as it moves between Microsoft data centers.
· Strong cryptography to protect these channels, including Perfect Forward Secrecy and 2048-bit key lengths.
Microsoft also said it would encrypt customer content that it stores.
For applications and services developed to run on Windows Azure, Microsoft will give developers the choice, but will offer tools help them easily protect data.
Code Transparency
In addition, Microsoft said it would enhance the transparency of its software code, helping to convince customers its products do not contain back doors. The company said it would go as far as opening a network of “transparency centers” designed to provide customers with greater ability to assure themselves of the integrity of Microsoft’s products. The centers will be opened across Europe, the Americas and Asia, Microsoft said.
The company also said it would make an effort to protect data traveling between service providers, such as from one email provider to another.
All of these initiatives will be in place by the end of 2014, Microsoft said, with much of it is effective already.
“Although this is a significant engineering effort given the large number of services we offer and the hundreds of millions of customers we serve, we’re committed to moving quickly,” Smith added. “In fact, many of our services already benefit from strong encryption in all or part of the lifecycle. For example, Office 365 and Outlook.com customer content is already encrypted when traveling between customers and Microsoft, and most Office 365 workloads as well as Windows Azure storage are now encrypted in transit between our data centers. In other areas we’re accelerating plans to provide encryption.”
“Ultimately, we’re sensitive to the balances that must be struck when it comes to technology, security and the law,” Smith concluded. “We all want to live in a world that is safe and secure, but we also want to live in a country that is protected by the Constitution.”
Related: Twitter Boosts Web Encryption with ‘Forward Secrecy’
