Microsoft® Online Services - Global Criminal Compliance Handbook.ppt
Microsoft Online ServicesGlobal Criminal ComplianceHandbookU.S.Domestic VersionMarch 20082007-2008 Copyright Microsoft Corporation.All rights reserved.Microsoft,MSN,Hotmail,Xbox and Xbox 360 are trademarks of the Microsoft group of companies.Nopart of this handout may be reproduced or transmitted in any form or by any means,electronic or mechanical,without the written permission of Microsoft Corporation.M i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 2MICROSOFT ONLINE SERVICESLaw Enforcement Hotline:(425)722-1299Where to Serve Legal Process in Criminal MattersWindows Live TM,Windows Live ID(Passport),MSN,Xbox&Other Online Services:FAX:(425)708-0096Microsoft CorporationAttn:Online Services Custodian of RecordsOne Microsoft WayRedmond,WA 98052-6399EMERGENCY REQUESTSMicrosoft Online Services will respond to emergency requests outside of normal business hours if theemergency involves“the danger of death or physical injury to any person”as permitted in 18 U.S.C.2702(b)(8)and(c)(4).Emergencies are limited to situations like kidnapping,murder threats,bombthreats,terrorism threats,etc.If you have an emergency request,please call the law enforcementhotline at(425)722-1299.NON-U.S.LAW ENFORCEMENTMicrosoft has established local contacts within your country or region to handle legal process relatedto Microsoft Online Services.If you are not already familiar with your local contact,please e-mail theGlobal Criminal Compliance team at ,and you will be directed to the localcontact handling requests from your country.All legal process for criminal matters from non-U.S.law enforcement,prosecutors and courts mustbe directed to Microsoft Corporation,One Microsoft Way,Redmond,WA 98052 and not toMicrosofts local subsidiary as all Microsoft Online Services customer data is stored in the U.S.Yourlocal contact will be able to educate you as to what local process must be followed in order to obtainonline services customer account records from Microsoft.M i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 3What are Microsoft Online Services?.E-mail ServicesAuthentication Service:Windows Live IDInstant Messaging:Windows Live MessengerSocial Networking Services:Windows Live Spaces&MSN GroupsCustom Domains:Windows Live Admin Center&Office Live Small BusinessOnline File Storage:Office Live Workspace&Windows Live SkyDriveGaming:Xbox LiveM i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 4E-mail ServicesWhat are the Various E-mail Services Microsoft Provides?.Several different domains:Microsoft also provides some country specific domains such as.co.uk,.fr,.it,.de,.es,.th,.tk,.co.jp.Currently all e-mail service customer data is stored in the U.S.even if the accountname contains a country specific domain.E-mail accounts may be either free or associated with a paid service.Accounts that start out as paid accounts may later become free OR accounts thatstart out as free may later be associated with a paid service.Therefore,the records available in response to law enforcement requests will varydepending on the type of e-mail service.Below are several examples of the paid e-mail services Microsoft offers:M i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 5What E-mail Services Records are Retained and for How Long?E-mail account registration records are retained for the life of the account.Internet Protocol(“IP”)connectionhistory records are retained for 60 days.How Do I Read E-Mail Account Results?Sample E-mail Account Registration Records:M i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 6.All registration data is provided by the user EXCEPT for the Registered from IP Address.Occasionally the“Registered from IP Address”field may blank for some accounts.In thissituation the users IP address was not captured by Microsofts systems during theregistration process.Microsoft retains e-mail account registration records for the life of the account.For free MSN Hotmail and free Windows Live Hotmail accounts,the e-mail content is typicallydeleted after 60 days of inactivity.Then if the user does not reactivate their account,the freeMSN Hotmail and free Windows Live Hotmail account will become inactive after a period oftime.Sample E-mail Account IP Connection Records:M i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 7.Occasionally the“Pass/Fail”column will include an entry entitled“mymsn”.When thisindication is present,it means the user logged in from the homepage.Stored E-mail Records for MSN Premium Customers:.Microsofts systems only store the e-mails a user haselected to maintain in the account.Therefore,theonly e-mails provided in response to legal processseeking stored e-mail content will be the e-mailsstored in the“Folders on MSN”section of a usersaccount.Be aware that users may also store e-mail contenton their computers hard drive.Microsoft will notbe able to disclose e-mail content stored on a userscomputer only e-mail content stored onMicrosofts e-mail servers.Additional Tips:.Within the available IP records,an entry could exist that belongs to Microsoft services due tointernal configurations.Registered From IP addresses or other IP addresses in the IP historythat are in the blocks of 65.54.xx.xx(MSN Hotmail)or 207.68.174.xx,207.46.237.xx,65.54.198,xx,64.4.55.xx(MSN Mobile)are from Microsoft-owned servers,but they do notprovide any further information which relates to the user.If there is an entry of 1.1.1.1 or 2.2.2.2 in the History Info the entry is a Microsoft systemgenerated line item.The 1.1.1.1 and 2.2.2.2 entries are not generated by user activity.Specific questions can be directed to the Global Criminal Compliance Team.FREE E-MAIL ACCOUNT AGE OUT TIMELINEIf account ownerdoes not sign inafter 120 days ofinactivity,all e-mail is deletedand the accountbecomes aIf the associatedWLID is not usedfor 365 days fromthe first day ofthe 120 dayAccount willbecome inactiveafter 30 days ofinactivity.No e-mail content isdeleted but theaccount will notreceive e-mail.After 365 days ofinactivity,theaccount name isrecycled and isavailable forcreation byAccountCreationUser must sign inwithin the first 10days to keepinactivity period,then theanotheraccount activeWindows Live IDonly account.associated WLIDis deleted.customer.Users may self delete an account at any point along this process.The 30 day inactivity periodis canceled if someone tries to create the same account name or attempts to access it.Between 120 and 365 days,users can recreate an e-mail mailbox.M i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 8Authentication Service:Windows Live IDWhat is the Service?The Windows Live ID authentication service,formerly known as“Passport”,helps simplify your sign in:Createyour sign in credentials e-mail and password once,and then use them everywhere on the Windows LiveNetwork.There are three different ways you may obtain a Windows Live ID:.Use a live,hotmail or msn e-mail accountEasy ID:Use an e-mail address you already have other_email_.You can use any existing e-mail address from any e-mail provider when you createyour credentials for Windows Live ID.Then you can use those credentials to sign in toany Windows Live ID site.Sign up for a limited account .Create credentials only Log on using e-mail address and password only.Accountcannot send or receive e-mail.Windows Live ID/Passport accounts:.Works with MSN,Office Live,and Microsoft Passport sitesHave an MSN Hotmail,MSN Messenger,or Passport account?Its your Windows Live ID.M i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 9What Windows Live ID(Passport)Records are Retained and for How Long?Microsoft retains the following:.Windows Live ID retains registration records as long as the account exists in our systems.Allregistration data is provided by the user.The last 10 Microsoft site and IP connection record combinations(not the last 10,consecutive IPconnection records.)How Do I Read Windows Live ID(Passport)Account Results?Sample Sign-in SummaryLastModifiedEntry Created ActionValueSiteNameSite IP AddressID2006/11/30 2006/08/1210:22:35 10:24:42LoginSuccess00192.192.240.1922006/11/30 2006/11/0610:22:35 10:12:55Site/IP/Time Hotmail|192.192.240.192|Nov 30 2006 10:22AM;History192.192.240.192Hotmail|192.226.141.89|Nov 29 2006 8:16PM;Hotmail|192.140.179.82|Nov 28 2006 8:22AM;Hotmail|192.192.150.140|Nov 24 2006 4:57PM;Hotmail|192.192.140.151|Nov 24 2006 3:40PM;Hotmail|192.192.132.144|Nov 18 2006 12:57PM;Hotmail|192.71.148.10|Nov 18 2006 9:19AM;Hotmail|192.192.156.23|Nov 17 2006 3:56PM;Hotmail|192.226.137.230|Nov 16 2006 4:22PM;Hotmail|192.214.138.210|Nov 16 2006 1:37PM;2006/11/02 2006/08/1217:50:38 10:24:42IP AddressHistory192.209.154.235;192.212.1.52;62.20.2.45;192.209.154.66;192.192.45.86;00192.209.154.235192.209.154.2352006/11/02 2006/08/1217:50:38 10:24:42Date/TimeHistory02 Nov 2006 17:50:38:770;01 Nov 2006 06:06:00:310;30Oct 2006 14:24:45:397;27 Oct 2006 10:30:21:143;25 Oct2006 19:36:14:570;2006/09/28 2006/08/1217:02:08 10:24:42Current State(login0192.192.45.86succeeded)2006/09/28 2006/08/1217:02:08 10:25:39Login Failure002192.192.45.86192.192.45.862006/08/12 2006/08/1210:24:42 10:24:42CreateCredential1 JMDCE6AMHotmailCreate Credential Row2006/08/12 2006/08/1210:24:42 10:24:42CreateCredential1 JMDCE6AMHotmail2192.192.45.86The IP address fromwhere the accountwas createdIgnore this valueThe Microsoft sitewhere the accountwas createdThe time when theaccount was createdM i cC o n f i d e n t i a l F owM i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 10Login Failure Row2006/09/2817:02:082006/08/1210:25:39Login Failure00192.192.45.86The IP address fromwhere the user tried tologin but failedThe last time the user failed to login.(If the current state is“Login Failed”ignore this value.)The number of times the user has failed to login.This value is reset to zero once the user issuccessful in logging in.Login Successful Row2006/11/30 10:22:352006/08/12 10:24:42Login Success0192.192.240.192The IP address fromwhere the user lastlogged inThe last time the usersuccessfully logged in.(Ifthe current state is“LoginFailed”else ignore thisvalue.)The first time ever the usersuccessfully logged in-typically the same as thecreation date.Current State Row2006/09/28 17:02:082006/08/12 10:24:42Current State(login succeeded)0192.192.45.86The timestamp of the lastlogin attemptPlease ignore this IP Address.Refer to IP address in“FailureRow”or“Success Row”.Site IP/Time/History Row2006/11/30 2006/11/0610:22:35 10:12:55Site/IP/Time Hotmail|192.192.240.192|Nov 30 2006 10:22AM;0192.192.240.192HistoryHotmail|192.226.141.89|Nov 29 2006 8:16PM;Hotmail|192.140.179.82|Nov 28 2006 8:22AM;Hotmail|192.192.150.140|Nov 24 2006 4:57PM;Hotmail|192.192.140.151|Nov 24 2006 3:40PM;Hotmail|192.192.132.144|Nov 18 2006 12:57PM;Hotmail|192.71.148.10|Nov 18 2006 9:19AM;Hotmail|192.192.156.23|Nov 17 2006 3:56PM;Hotmail|192.226.137.230|Nov 16 2006 4:22PM;Hotmail|192.214.138.210|Nov 16 2006 1:37PM;Shows the FIRST time of the LAST days successfullogins to a new Microsoft site or from a new clientmachine.The last time theuser successfullylogged inPlease ignore this IPAddress.Refer to IPaddress in“Failure Row”or“Success Row”.M i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 11Additional Tips:1.In Create credential Row2.In the Current State Rowa.The IP address DOES NOT denote the IP address of the machine of the last attempt.If the last login was a failure,thenthe IP address is present in the“IP address”column of the Login Failure Row while if it was success then the IP address ispresent in Site/IP/Time history row.b.If the state is“Login failed”,then refer the“Last Modified”timestamp in the“Login Failure Row”to find the last time theuser tried to login and failed.If the state is“Login Successful”,then refer to the“Last Modified”timestamp in the“LoginSuccess Row”to find the last time the user signed in successfully.3.In Login Failure Rowa.The value(number of failure tries)is cleared once the user is able to successfully login.Hence,if a user failed to login onseveral tries,but eventually logs in successfully,there is no record of the previous failures.4.In Site IP/Time/History Rowa.The Site IP/Time/History table is not updated if the user logs in again from the SAME IP address to the SAME Microsoftsite.It only shows the FIRST login of the LAST day for the user,from the same IP and to the same machine.b.There are many cases where end user IP address is hidden by ISP proxy server.SIS shows the IP address of ISP proxyserver,instead of real end user IP address.So for the individual user information you can approach the ISP.c.The table is limited to only the last 10 MS SITE and IP combinations.5.Sign-In Summary records are restricted to initial authentication so subsequent authentication to other Microsoft sites are notlogged.6.All times are UTC and the time-stamps come from Windows Live ID(Passport)servers and not the users computer.7.Ignore rows“IP Address History”and“Date/Time History”.These are present for some older accounts and have now beenreplaced by“Site IP/Time/History”row.One way to understand the table is to draw the timeline and plot the individual events in it.It gives a quickview of the activities in that account.Here is the timeline for the Sign-In Summary Table provided above:8/12/20069/28/200611/30/2006Account created in HotmailLast failure attemptLast Successful login9/1/200610/1/200611/1/20068/12/200611/30/200611/16/2006-11/30/20068/12/2006Last 10 entries in HotmailLogin failed for the first timeM i c r o s o f t C o n f i d e n t i a l F o r L a w E n f o r c e m e n t U s e O n l yPage 12Instant Messaging:Windows Live MessengerWhat is the Service?Windows Live Messenger is the“Next generation of MSN Messenger”.Free serviceCustomers use Windows Live ID/Passport account to sign-inMicrosoft retains:.Windows Live ID/Passport account registration data.Some Windows Live ID/Passport account IP connection recordsWindows Live Messenger program is downloaded onto clientMicrosoft servers authenticate users,but Microsoft does not log the content ofcommunications between usersWindows Live Messenger customers talk to Yahoo!contactsIf a Windows Live Messenger customer adds a Yahoo!contact to his or her contact list,.Microsoft will have the name of the Yahoo!contact.What records are retained and for how long?Since the Windows Live ID service is used to authenticate Windows Live Messenger or MSN Messenger users,Windows Live ID records are retained.Please refer to the“Authentication Services:Windows Live ID”sectionabove.Please note that Microsoft needs a full account name with domain(, or )in order to identify a Windows Live ID(Passport)account.An ac
