A few years ago, Microsoft experts concluded that the Chinese authorities had hacked into more than a thousand Hotmail accounts, including those belonging to the leaders of China's Tibetan and Uyghur minorities. However, according to former employees of the company, Microsoft chose not to notify the victims for fear of angering the Chinese government, even though this may have put lives at risk.
An article by Reuters explains that Microsoft's investigation found that "interception had begun in July 2009 and had compromised the emails of top Uighur and Tibetan leaders in multiple countries, as well as Japanese and African diplomats, human rights lawyers and others in sensitive positions inside China."
Both Tibet and the Uyghurs' homeland of Xinjiang are considered highly sensitive areas by China, which has responded to calls for greater local independence with harsh repressive measures. This makes the hacking by the Chinese authorities of e-mail accounts of Tibetan and Uyghur leaders an extremely serious matter: confidential information gathered in this way may have exposed local activists to the risk of arrest or worse.
After "a vigorous internal debate in 2011," Microsoft decided to force the affected users to pick new passwords, but without telling them why. As sources within the company noted: "it was likely the hackers by then had footholds in some of the victims' machines and therefore saw those new passwords being entered."
Reuters sought out five victims of the Hotmail hack: two Uyghur leaders, a senior Tibetan figure and two people in the media dealing with "matters of interest to Chinese officials." Although they recalled the password resets, none took it as a warning that their account had been compromised, or that they should be cautious in terms of what they wrote in e-mails thereafter.
Yesterday, the same day the Reuters story broke, Microsoft announced that it had changed its policy, and that "we will now notify you if we believe your account has been targeted or compromised by an individual or group working on behalf of a nation state." Until then, unlike Facebook, Google, Twitter, and Yahoo, Microsoft had rejected the idea of warning explicitly about hacking carried out by governments or their proxies.
The Microsoft announcement also explained the reasoning behind the shift: "We’re taking this additional step of specifically letting you know if we have evidence that the attacker may be 'state-sponsored' because it is likely that the attack could be more sophisticated or more sustained than attacks from cybercriminals and others." In such cases, Microsoft says, "it’s very important you take additional measures to keep your account secure."
It's a pity those whose Hotmail accounts were hacked by the Chinese authorities all those years ago weren't given that option.
Listing image by Antoine Taveneaux
reader comments
8