Ex-Microsoft employee arrested for leaking company secrets | Hacker News Reader

Ex-Microsoft employee arrested for leaking company secrets

engadget.com

44 pointsABS47 comments

No one picking up on this snippet?

"When Redmond determined its authenticity, investigators looked through the blogger's Hotmail account and instant messenger, where they found incriminating emails and chat logs."

Yes that's insane. But the blogger is also to blame here, he should not have used a Hotmail account to share such sensitive information.

he might have been naive, stupid even, but definitely not to blame: they effectively broke the law.

IANAL and I'm not based in US but I would guess the only way to do this legally would be for MS to go to a law-enforcement agency, the agency would need to get a warrant and then the agency would be able to look into it, not MS itself.

What law would deter them from doing so? They are microsoft's computers. I'm sure the EULA has them covered legally, and I bet they asked their legal team before going in.

there are constitutional guarantees on the secrecy of correspondence and email is considered (by the law) the same as letters therefore legally protected from all forms of eavesdropping.

contracts are not above the law, if a contracts stipulates something illegal it doesn't matter that both parties agreed to it

https://en.wikipedia.org/wiki/Secrecy_of_correspondence

This seems to disagree with you, seems you are required to litigate to get your rights. The blogger was french also, so that probably has a bearing on what rights he has.

not so simple: http://en.wikipedia.org/wiki/Electronic_Communications_Priva...

That's for federal agencies and a third party's server. Considering microsoft are not a third party, not a federal agency and it's their own server, I don't think that law is relevant.

Him being from Europe makes this worse to me. Why isn't this reason enough to void Microsoft's safe harbor guarantees for the Data Protection Act? I'm sure they're all rubbish, but Microsoft are provably not protecting European rights here and I wish somebody forced these companies to take it seriously.

Microsoft's Online Services agreement (covers Hotmail)[0]:

Does Microsoft disclose my personal information outside of Microsoft? You consent and agree that Microsoft may access, disclose, or preserve information associated with your use of the services, including (without limitation) your personal information and content, or information that Microsoft acquires about you through your use of the services (such as IP address or other third-party information) when Microsoft forms a good faith belief that doing so is necessary (a) to comply with applicable law or to respond to legal process from competent authorities; (b) to enforce this agreement or protect the rights or property of Microsoft or our customers; or (c) to help prevent a loss of life or serious physical injury to anyone.

Notice the bit about "protect the rights or property of Microsoft or our customers".

[0] http://windows.microsoft.com/en-us/windows-live/microsoft-se...

See, indoctrinating employees to dogfood your products has upsides. Even when the products are crap.

but the blogger was not an employee and they accessed the blogger accounts

The word here is investigators, I assumed that this was some legal entity (FBI?) doing it with court orders.

that's what I thought too initially but re-reading they say "corporate investigators" and, unless they are being very liberal with names, a corporate investigators is not someone who works for some public agency

Yeah. Outrageous. IN the post snowden era, it is hard to understand how they could be public with such a detail.

If the truth were more worrying?

"Select id from attachments where introspective_function(part) contains 'LPCSTR'" as a scheduled task?

Re-read it again. It mentions corporate investigators but there is nothing that suggests that they were the ones who looked through his hotmail account - that information provided by an FBI agent.

It's possible the events went like this:

1) MS get suspicious and investigate, (legally) find things which point to the suspect.

2) They confront the suspect who confesses.

3) They take it to the authorities who as part of their investigation get court orders to access his hotmail accounts.

But based on what is here there is nothing that says MS did anything illegal. That's not to say they didn't, just that that's not what these posts say.

that was my assumption too but the charging papers disclosed, as reported by the Seattle PI, make very clear that that's not the case:

- "prompting corporate investigators to dredge the Hotmail account the blogger"

- "While searching the blogger’s account, Microsoft investigators found an email"

OK, that's more worrying.

Obviously the guy was massively stupid using an e-mail service run by the people he was screwing over but it'll be interesting to see how this plays out (whether his employment contract covers it, whether that's legal and so on).

but that's another point: this was the blogger account and the blogger was not a MS employee

It's just not written very clearly.

The blogger approached MS, so once they determined the code was authentic they could have easily got the FBI involved who then requested the information from the blogger's account.

But it doesn't read that way, it suggests that MS looked into it because it just says "investigators" and it's up to the reader to surmise what that means. My first thought it meant MS did the looking into the account mainly because there's no mention of a timeline of the actions taken. If it said something like "after MS authenticated the code the FBI was contacted who then requested a warrant to search through the blogger's account" then it would far more clear as to what was going on.

Makes me wonder if anyone bothered to ask the blogger if he would cooperate, as he did approach MS first, or if they just start looking through the person's account?

Later in the article they mention investigators again after the mention of criminal charges and then you can likely assume they mean criminal investigators.

I did not know that there was an internal team at MSFT that was empowered to read messages in third parties' Hotmail accounts. That seems a bit scary.

The blog post's source here is this Seattle P-I article : http://www.seattlepi.com/local/article/Ex-Microsoft-employee...

This article provides more color::

"""" The code was later confirmed to be authentic, prompting corporate investigators to dredge the Hotmail account the blogger used to contact the Microsoft worker. While the blogger took pains to protect his identity – he claimed falsely to be in Quebec and used an assumed name online – a Microsoft team dubbed Trustworthy Computing Investigations attempted to track the blogger down.

While searching the blogger’s account, Microsoft investigators found an email from Kibkalo in which he shared Windows 8 “hot fixes” through an online hosting system, the FBI agent continued. Windows 8 had not been released to the public at the time, and was the subject of much speculation in the industry.

Investigators claim to have recovered instant messages Kibkalo exchanged with the blogger showing Kibkalo was sharing trade secrets illegally.

“I would leak enterprise today probably,” Kibkalo told the blogger during an Aug. 2, 2012 exchange, according to charging papers.

“Hmm,” the blogger replied. “Are you sure you want to do that? Lol.”

Told the leak would be “pretty illegal,” Kibkalo is alleged to have responded “I know :)” """"

Hmm. So there are "charging papers" that provide an FBI statement which is the primary source here, but the P-I has not posted a link to those papers; I guess someone could dig up the complaint/affidavits if they want to see the full original text unfiltered by the P-I.

Here's a LinkedIn description of this group at Microsoft: http://www.linkedin.com/jobs2/view/10230290

"""" Job Category: Legal & Corporate Affairs Location: Redmond, WA, US Job ID: 852070-123363 Division: Advanced Strategy and Research

The Trustworthy Computing Investigations & Forensics team is a core unit within Microsoft’s Trustworthy Computing organization and is responsible for investigating escalated compliance violations, employee misconduct, and threats to the company and the corporate network. We provide technical expertise and investigative services to a variety of groups including: Legal and Corporate Affairs, Human Resources, Physical Security Investigations, the Financial Integrity Unit, and many others. In addition, the group provides more traditional subject matter and design expertise in a number of areas related to network security matters, investigative process, and digital evidence. This position is based at Microsoft headquarters in Redmond, Washington.

Travel: Periodic short notice/emergency travel may be required, primarily within North and South America.

Primary Responsibilities: - Conduct global IT-oriented security compliance investigations regarding breaches of policy, violations of standards of business conduct, hacks, leaks, and other escalated information security cases. - Provide expert technical guidance to other Microsoft groups and senior management regarding the technical and forensic aspects of major incidents and sensitive cases. Provide feedback and recommendations for remediation and policy changes - Develop, implement and refine industry leading procedures and methodologies for the conducting of forensic review of Microsoft platforms, applications, and information technology infrastructures - Perform forensic media acquisition and analysis - Communicate complex technical or evidentiary information and findings with internal customers and law enforcement agencies, if necessary - Maintain detailed and extensive documentation on all work performed. - Develop investigative plans, derive root causes from case facts and prepare executive level briefings - Proactively research new forensic technologies applicable across the enterprise, as well as the latest malicious technologies. Research includes the continuous assessment of the forensic implications of evolving and new Microsoft technologies, platforms, applications and data structures - Devise and drive remediation steps for affected internal clients after an incident has occurred - Keep abreast of developments in the areas of privacy and legal issues affecting corporate investigations and employee privacy.

Desired Background & Skillsets: - Strong familiarity with applicable local region domestic and international laws and regulations pertaining to information asset protection - Solid understanding of forensic methodologies, including in-depth knowledge of computer incident response processes, Microsoft file internals, as well as 'live' incident response techniques - Extensive host forensic analysis skills including strong hardware knowledge and skills, particularly with media and data storage, forensic imaging, and detailed file system level analysis - Strong experience with common forensic tools such as Encase, FTK, Winhex, etc. - Strong experience with electronic discovery tooling and indexing/keyword searching technology - Demonstrable knowledge of monitoring mechanisms, remote control services - Excellent written and verbal skills, including the ability to effectively communicate complex technical information to non-technical audiences. Must be able to lead presentations to senior management, and maintain detailed technical and investigative documentation. - Prior corporate, private, or law enforcement investigative experience preferred - Minimum of 5 years of demonstrated, relevant Information Security or related technical experience - Must be able to obtain necessary work permits and travel visas where applicable - Ability to be available “on call” on a 24 / 7 basis

Successful applicants will be subject to a satisfactory background check. """"

I read that too. I wonder if you waive that privacy as part of your employment agreement?

The blogger wasn't employed by Microsoft.

Did I misread? I interpreted it as the employees email. It can't possibly legal for them to go after a blogger's email without a lawsuit, no?

Criminal investigations don't need a lawsuit. They mentioned the FBI was involved. The search was probably stamped by a judge.

Sounds like no warrant.

http://arstechnica.com/tech-policy/2014/03/arrest-of-secret-...

The policy for Outlook.com, formerly Hotmail, states that, "We may access information about you, including the content of your communications...to protect the rights or property of Microsoft."

I was surprised trade secrets theft was a criminal rather than civil matter but it seems that is the case in the US:

http://www.tms.org/pubs/journals/JOM/matters/matters-9711.ht...

But I don't think it is in the UK:

http://richardpoynder.co.uk/Keep%20your%20secrets%20safe%20f...

Comedian Joe Rogan has a great bit about Wesley Snipes' tax-evasion jail term and how if you owe a friend money there's nothing he can do but if you owe the government money they lock you up and put you in a cage.

Snipes was jailed for failure to file.

The US generally does not believe in debtors prisons and even has legal routes like bankruptcy to discharge debt.

*except in cases where you borrowed that money to pay for your education

Internal builds at Microsoft get stamped with unique IDs by the download server (special kernel running on those servers knows to GUID-stamp and log certain files when they are copied, I understand). So binaries are pretty traceable.

Always assume that everything you type or view in a company is logged, especially in a place like MS where they basically control your computational oxygen down to the metal.

Presumably that's why he broke into that building to get a copy - stamped with other peoples' GUIDs.

This is a slippery slope. On the one hand, companies don't want their secrets being leaked. On the other hand, they need employees that can trust them.

If I were Microsoft I'd tighten internal controls rather than try to make an example of a former employee. They're legally in the right, but the question is: is that good for their reputation and their recruiting efforts?

I don't have any problems with their handling of their own employee. My problem, considering the facts as reported by the Seattle PI, is with their own "dredging" into a non-employee hotmail account and chat logs

Source:

http://m.seattlepi.com/local/article/Ex-Microsoft-employee-c...

He's getting to jail for ... screenshots ?

he sent more than screenshots, code as well

Sounds like the criminal offense was breaking and entering. The suspect admitted (to the blogger?) to illegally entering MS facilities to obtain the stolen software.

The charges should be dropped.

This was back in the time of stack ranking. The performance review he got wasn't just emotionally hurtful or annoying. It actually fucked with his reputation. In a typical stack-ranking regime, performance reviews are part of the transfer packet, actively making it hard to impossible for the employee to fix the situation on his own. While this action was probably overreach, some retaliation is to be expected under such regimes. If a company can't handle that sort of thing, it needs to ditch stack ranking (which Microsoft, admirably, has apparently done).

This doesn't 100% absolve him of responsibility (he still deserves to lose his job over the leak) but it absolves him enough that criminal charges are just inappropriate and wrong for the situation.

Uhh, what? Stack ranking is terrible and I'm glad MS got rid of it, but how does it justify leaking code in retaliation?

How does it 'absolve him enough'? That's a crazy moral framework.

Misread. I was confusing this with another case where no actual code was leaked.

If he broke federal laws I'm sure the FBI could care less about the performance review.

Except that it nicely ties up that 'motive' part of probable cause.

The challenge will be for the prosecution to suppress the stack rank system from any trial as it could prejudice a jury.

If they have him dead to rights on the breach, they probably wouldn't need motive for probable cause to investigate. If you walked out of a bank carrying a big bag of money while wearing a ski mask I'm sure the police won't bother over why you want the money so badly before investigating.

I would think a prosecutor could still use it in the trial if planned properly. Might as well prepare because I would guess the defense would try to use the old "they deserved it!" defense.

So what'd you leak from Google since, by your account, you got fucked on perf? Or are the wild accusations about a Grand Political Conspiracy, Target: mchurch, your idea of retaliation for bad perf?

I'm just extrapolating from you leaving this hilarious comment.

Reply on news.ycombinator.com