HR - Microsoft Online Services - Global Criminal Compliance Handbook

!
!
"#$%&'&()*!+,-#,.!/.%0#$.'!

1-&23-!4%#5#,3-!4&56-#3,$.!
73,82&&9!

U.S. Domest|c Vers|on
March 2008

M l c r o s o f L C o n f l d e n L l a l l o r L a w L n f o r c e m e n L u s e C n l y


age 2

2007-2008 CopyrlghL MlcrosofL CorporaLlon. All rlghLs reserved. MlcrosofL, MSn,
PoLmall, xbox and xbox 360 are Lrademarks of Lhe MlcrosofL group of companles. no
parL of Lhls handouL may be reproduced or LransmlLLed ln any form or by any means,
elecLronlc or mechanlcal, wlLhouL Lhe wrlLLen permlsslon of MlcrosofL CorporaLlon.


age 3
":4;+/+<=!+>?:>@!/@;A:4@/!
?3B!@,(&%$.5.,)!7&)-#,.C!!DEFGH!IFFJKFLL!

Where to Serve Lega| rocess |n Cr|m|na| Matters

W|ndows L|ve 1M,, W|ndows L|ve ID (assport),
MSN, kbox & Cther Cn||ne Serv|ces:

lAx: (423) 708-0096
MlcrosofL CorporaLlon
ALLn: Cnllne Servlces CusLodlan of 8ecords
Cne MlcrosofL Way
8edmond, WA 98032-6399

LMLkGLNC kLULS1S
MlcrosofL Cnllne Servlces wlll respond Lo emergency requesLs ouLslde of normal buslness hours lf Lhe
emergency lnvolves Lhe danger of deaLh or physlcal ln[ury Lo any person." as permlLLed ln 18 u.S.C.
2702(b)(8) and (c)(4). Lmergencles are llmlLed Lo slLuaLlons llke kldnapplng, murder LhreaLs, bomb
LhreaLs, Lerrorlsm LhreaLs, eLc. lf you have an emergency requesL, please call Lhe law enforcemenL
hoLllne aL (42S) 722-1299.
NCN-U.S. LAW LNICkCLMLN1
MlcrosofL has esLabllshed local conLacLs wlLhln your counLry or reglon Lo handle legal process relaLed
Lo MlcrosofL Cnllne Servlces. lf you are noL already famlllar wlLh your local conLacL, please e-mall Lhe
Clobal Crlmlnal Compllance Leam aL globalcc[mlcrosofL.com, and you wlll be dlrecLed Lo Lhe local
conLacL handllng requesLs from your counLry.
All legal process for crlmlnal maLLers from non-u.S. law enforcemenL, prosecuLors and courLs musL
be dlrecLed Lo M|crosoft Corporat|on, Cne M|crosoft Way, kedmond, WA 980S2 and noL Lo
MlcrosofL's local subsldlary as all MlcrosofL Cnllne Servlces cusLomer daLa ls sLored ln Lhe u.S. ?our
local conLacL wlll be able Lo educaLe you as Lo whaL local process musL be followed ln order Lo obLaln
onllne servlces cusLomer accounL records from MlcrosofL.!


age 4
MN3)!3%.!"#$%&'&()!+,-#,.!/.%0#$.'O!

! L-mall Servlces
! AuLhenLlcaLlon Servlce: Wlndows Llve lu
! lnsLanL Messaglng: Wlndows Llve Messenger
! Soclal neLworklng Servlces: Wlndows Llve Spaces & MSn Croups
! CusLom uomalns: Wlndows Llve Admln CenLer & Cfflce Llve Small 8uslness
! Cnllne llle SLorage: Cfflce Llve Workspace & Wlndows Llve Skyurlve
! Camlng: xbox Llve



age 3
@J53#-!/.%0#$.'!

What are the Var|ous L-ma|| Serv|ces M|crosoft rov|des?
! Several dlfferenL domalns:
! [hoLmall.com
! [msn.com
! [llve.com
! MlcrosofL also provldes some counLry speclflc domalns such as .co.uk, .fr, .lL, .de, .es, .Lh, .Lk,
.co.[p
! CurrenLly all e-mall servlce cusLomer daLa ls sLored ln Lhe u.S. even lf Lhe accounL
name conLalns a counLry speclflc domaln.
! L-mall accounLs may be elLher free or assoclaLed wlLh a pald servlce
! AccounLs LhaL sLarL ouL as pald accounLs may laLer become free ~C8~ accounLs LhaL
sLarL ouL as free may laLer be assoclaLed wlLh a pald servlce.
! 1herefore, Lhe records avallable ln response Lo law enforcemenL requesLs wlll vary
dependlng on Lhe Lype of e-mall servlce.

8elow are several examples of Lhe pald e-mall servlces MlcrosofL offers:



age 6

What L-ma|| Serv|ces kecords are keta|ned and for now Long?
L-mall accounL reglsLraLlon records are reLalned for Lhe llfe of Lhe accounL. lnLerneL roLocol (l") connecLlon
hlsLory records are reLalned for 60 days.
now Do I kead L-Ma|| Account kesu|ts?
Samp|e L-ma|| Account keg|strat|on kecords:



age 7

! All reglsLraLlon daLa ls provlded by Lhe user LxCL1 for Lhe 8eglsLered from l Address.
! Cccaslonally Lhe 8eglsLered from l Address" fleld may blank for some accounLs. ln Lhls
slLuaLlon Lhe user's l address was noL capLured by MlcrosofL's sysLems durlng Lhe
reglsLraLlon process.
! MlcrosofL reLalns e-mall accounL reglsLraLlon records for Lhe llfe of Lhe accounL.
! lor free MSn PoLmall and free Wlndows Llve PoLmall accounLs, Lhe e-mall conLenL ls Lyplcally
deleLed afLer 60 days of lnacLlvlLy. 1hen lf Lhe user does noL reacLlvaLe Lhelr accounL, Lhe free
MSn PoLmall and free Wlndows Llve PoLmall accounL wlll become lnacLlve afLer a perlod of
Llme.

Samp|e L-ma|| Account I Connect|on kecords:



age 8
! Cccaslonally Lhe ass/lall" column wlll lnclude an enLry enLlLled mymsn". When Lhls
lndlcaLlon ls presenL, lL means Lhe user logged ln from Lhe www.msn.com homepage.

Stored L-ma|| kecords for MSN rem|um Customers:

! MlcrosofL's sysLems only sLore Lhe e-malls a user has
elecLed Lo malnLaln ln Lhe accounL. 1herefore, Lhe
only e-malls provlded ln response Lo legal process
seeklng sLored e-mall conLenL wlll be Lhe e-malls
sLored ln Lhe lolders on MSn" secLlon of a user's
accounL.
! 8e aware LhaL users may also sLore e-mall conLenL
on Lhelr compuLer's hard drlve. MlcrosofL wlll noL
be able Lo dlsclose e-mall conLenL sLored on a user's
compuLer - only e-mall conLenL sLored on
MlcrosofL's e-mall servers.

P88#)#&,3-!=#6'C!

! WlLhln Lhe avallable l records, an enLry could exlsL LhaL belongs Lo MlcrosofL servlces due Lo
lnLernal conflguraLlons. '8eglsLered lrom l' addresses or oLher l addresses ln Lhe l hlsLory
LhaL are ln Lhe blocks of 63.34.xx.xx (MSn PoLmall) or 207.68.174.xx, 207.46.237.xx,
63.34.198,xx, 64.4.33.xx (MSn Moblle) are from MlcrosofL-owned servers, buL Lhey do noL
provlde any furLher lnformaLlon whlch relaLes Lo Lhe user.
! lf Lhere ls an enLry of 1.1.1.1 or 2.2.2.2 ln Lhe 'PlsLory lnfo' Lhe enLry ls a MlcrosofL sysLem
generaLed llne lLem. 1he 1.1.1.1 and 2.2.2.2 enLrles are noL generaLed by user acLlvlLy.
Speclflc quesLlons can be dlrecLed Lo Lhe Clobal Crlmlnal Compllance 1eam.

IkLL L-MAIL ACCCUN1 AGL CU1 1IMLLINL

! users may self deleLe an accounL aL any polnL along Lhls process. 1he 30 day lnacLlvlLy perlod
ls canceled lf someone Lrles Lo creaLe Lhe same accounL name ~or~ aLLempLs Lo access lL.
8eLween 120 and 363 days, users can recreaLe an e-mall mallbox.
AccounL
CreaLlon
user musL slgn ln
wlLhln Lhe flrsL 10
days Lo keep
accounL acLlve
AccounL wlll
become lnacLlve
afLer 30 days of
lnacLlvlLy. no e-
mall conLenL ls
deleLed buL Lhe
accounL wlll noL
recelve e-mall.
lf accounL owner
does noL slgn ln
afLer 120 days of
lnacLlvlLy, all e-
mall ls deleLed
and Lhe accounL
becomes a
Wlndows Llve lu
only accounL.
lf Lhe assoclaLed
WLlu ls noL used
for 363 days from
Lhe flrsL day of
Lhe 120 day
lnacLlvlLy perlod,
Lhen Lhe
assoclaLed WLlu
ls deleLed.
AfLer 363 days of
lnacLlvlLy, Lhe
accounL name ls
recycled and ls
avallable for
creaLlon by
anoLher
cusLomer.


age 9
PQ)N.,)#$3)#&,!/.%0#$.C!!M#,8&B'!?#0.!:R!

What |s the Serv|ce?
1he Wlndows Llve lu auLhenLlcaLlon servlce, formerly known as assporL", helps slmpllfy your slgn ln: CreaLe
your slgn ln credenLlals - !"#$%&'$()'*$++,-.) - once, and Lhen use Lhem everywhere on Lhe Wlndows Llve
neLwork. 1here are Lhree dlfferenL ways you may obLaln a Wlndows Llve lu:
! Use a Q||ve, Qhotma|| or Qmsn e-ma|| account
! Lasy ID: Use an e-ma|| address you a|ready have ! Qother_ema||_prov|der.com.
! ?ou can use any exlsLlng e-mall address from any e-mall provlder when you creaLe
your credenLlals for Wlndows Llve lu. 1hen you can use Lhose credenLlals Lo slgn ln Lo
any Wlndows Llve lu slLe.
! S|gn up for a ||m|ted account ! Qpassport.com
! CreaLe credenLlals only - Log on uslng e-mall address and password only. AccounL
cannoL send or recelve e-mall.

W|ndows L|ve ID ] assport accounts:
! Works wlLh MSn, Cfflce Llve, and MlcrosofL assporL slLes
! Pave an MSN notma||, MSN Messenger, or assport accounL? lL's your W|ndows L|ve ID.



age 10
What W|ndows L|ve ID (assport) kecords are keta|ned and for now Long?
MlcrosofL reLalns Lhe followlng:
! Wlndows Llve lu reLalns reglsLraLlon records as long as Lhe accounL exlsLs ln our sysLems. All
reglsLraLlon daLa ls provlded by Lhe user.
! 1he lasL 10 MlcrosofL slLe and l connecLlon record comblnaLlons (noL Lhe lasL 10, consecuLlve l
connecLlon records.)

now Do I kead W|ndows L|ve ID (assport) Account kesu|ts?
/356-.!/#S,J#,!/Q553%T!
Last
Modified
Entry Created Action Value Site
Name
Site
ID
IP Address
2006/11/30
10:22:35
2006/08/12
10:24:42
Login
Success
0 192.192.240.192
2006/11/30
10:22:35
2006/11/06
10:12:55
Site/IP/Time
History
Hotmail|192.192.240.192|Nov 30 2006 10:22AM;
Hotmail|192.226.141.89|Nov 29 2006 8:16PM;
Hotmail|192.140.179.82|Nov 28 2006 8:22AM;
Hotmail|192.192.150.140|Nov 24 2006 4:57PM;
Hotmail|192.192.140.151|Nov 24 2006 3:40PM;
Hotmail|192.192.132.144|Nov 18 2006 12:57PM;
Hotmail|192.71.148.10|Nov 18 2006 9:19AM;
Hotmail|192.192.156.23|Nov 17 2006 3:56PM;
Hotmail|192.226.137.230|Nov 16 2006 4:22PM;
Hotmail|192.214.138.210|Nov 16 2006 1:37PM;
0 192.192.240.192
2006/11/02
17:50:38
2006/08/12
10:24:42
IP Address
History
192.209.154.235;192.212.1.52;62.20.2.45;192.209.154.6
6;192.192.45.86;
0 192.209.154.235
2006/11/02
17:50:38
2006/08/12
10:24:42
Date/Time
History
02 Nov 2006 17:50:38:770;01 Nov 2006 06:06:00:310;30
Oct 2006 14:24:45:397;27 Oct 2006 10:30:21:143;25 Oct
2006 19:36:14:570;
0 192.209.154.235
2006/09/28
17:02:08
2006/08/12
10:24:42
Current State
(login
succeeded)
0 192.192.45.86
2006/09/28
17:02:08
2006/08/12
10:25:39
Login Failure 0 0 192.192.45.86
2006/08/12
10:24:42
2006/08/12
10:24:42
Create
Credential
1 JMDCE6AM Hotmail 2 192.192.45.86
!
4%.3).!4%.8.,)#3-!;&B!
2006/08/12
10:24:42
2006/08/12
10:24:42
Create
Credential
1 JMDCE6AM Hotmail 2 192.192.45.86

The IP address from
where the account
was created
The Microsoft site
where the account
was created
The time when the
account was created
Ignore this value


age 11
?&S#,!<3#-Q%.!;&B!
2006/09/28
17:02:08
2006/08/12
10:25:39
Login Failure 0 0 192.192.45.86

?&S#,!/Q$$.''(Q-!;&B!
2006/11/30 10:22:35 2006/08/12 10:24:42 Login Success 0 192.192.240.192

4Q%%.,)!/)3).!;&B!
2006/09/28 17:02:08 2006/08/12 10:24:42 Current State (login succeeded) 0 192.192.45.86

/#).!:UV=#5.V7#')&%T!;&B!
2006/11/30
10:22:35
2006/11/06
10:12:55
Site/IP/Time
History
Hotmail|192.192.240.192|Nov 30 2006 10:22AM;
Hotmail|192.226.141.89|Nov 29 2006 8:16PM;
Hotmail|192.140.179.82|Nov 28 2006 8:22AM;
Hotmail|192.192.150.140|Nov 24 2006 4:57PM;
Hotmail|192.192.140.151|Nov 24 2006 3:40PM;
Hotmail|192.192.132.144|Nov 18 2006 12:57PM;
Hotmail|192.71.148.10|Nov 18 2006 9:19AM;
Hotmail|192.192.156.23|Nov 17 2006 3:56PM;
Hotmail|192.226.137.230|Nov 16 2006 4:22PM;
Hotmail|192.214.138.210|Nov 16 2006 1:37PM;
0 192.192.240.192

!

The last time the user failed to login.
(If the current state is "Login Failed
ignore this value.)
The first time ever the user
successfully logged in -
typically the same as the
creation date.
The IP address from
where the user tried to
login but failed
The timestamp of the last
login attempt
Please ignore this IP Address.
Refer to P address in "Failure
Row or "Success Row.
The last time the user
successfully logged in. (If
the current state is "Login
Failed else ignore this
value.)
The IP address from
where the user last
logged in
Shows the FRST time of the LAST day's successful
logins to a new Microsoft site or from a new client
machine.
The number of times the user has failed to login.
This value is reset to zero once the user is
successful in logging in.
The last time the
user successfully
logged in
Please ignore this IP
Address. Refer to IP
address in "Failure Row or
"Success Row.


age 12
P88#)#&,3-!=#6'C!
1. ln Create credent|a| kow
2. ln Lhe Current State kow
a. 1he l address uCLS nC1 denoLe Lhe l address of Lhe machlne of Lhe lasL aLLempL. lf Lhe lasL logln was a fallure, Lhen
Lhe l address ls presenL ln Lhe l address" column of Lhe Logln lallure 8ow whlle lf lL was success Lhen Lhe l address ls
presenL ln SlLe/l/1lme hlsLory row.
b. lf Lhe sLaLe ls Logln falled", Lhen refer Lhe LasL Modlfled" LlmesLamp ln Lhe Logln lallure 8ow" Lo flnd Lhe lasL Llme Lhe
user Lrled Lo logln and falled. lf Lhe sLaLe ls Logln Successful", Lhen refer Lo Lhe LasL Modlfled" LlmesLamp ln Lhe Logln
Success 8ow" Lo flnd Lhe lasL Llme Lhe user slgned ln successfully.
3. ln Log|n Ia||ure kow
a. 1he value (number of fallure Lrles) ls cleared once Lhe user ls able Lo successfully logln. Pence, lf a user falled Lo logln on
several Lrles, buL evenLually logs ln successfully, Lhere ls no record of Lhe prevlous fallures.
4. ln S|te I]1|me]n|story kow
a. 1he SlLe l/1lme/PlsLory Lable ls noL updaLed lf Lhe user logs ln agaln from Lhe SAML l address Lo Lhe SAML MlcrosofL
slLe. lL only shows Lhe ll8S1 logln of Lhe LAS1 day for Lhe user, from Lhe same l and Lo Lhe same machlne.
b. 1here are many cases where end user l address ls hldden by lS proxy server. SlS shows Lhe l address of lS proxy
server, lnsLead of real end user l address. So for Lhe lndlvldual user lnformaLlon you can approach Lhe lS.
c. 1he Lable ls llmlLed Lo only Lhe lasL 10 MS Sl1L and l comblnaLlons.
3. Slgn-ln Summary records are resLrlcLed Lo lnlLlal auLhenLlcaLlon so subsequenL auLhenLlcaLlon Lo oLher MlcrosofL slLes are noL
logged.
6. All Llmes are u1C and Lhe Llme-sLamps come from Wlndows Llve lu (assporL) servers and noL Lhe user's compuLer.
7. lgnore rows l Address PlsLory" and uaLe/1lme PlsLory". 1hese are presenL for some older accounLs and have now been
replaced by SlLe l/1lme/PlsLory" row.
!
Cne way to understand the tab|e |s to draw the t|me||ne and p|ot the |nd|v|dua| events |n |t. It g|ves a qu|ck
v|ew of the act|v|t|es |n that account. nere |s the t|me||ne for the S|gn-In Summary 1ab|e prov|ded above:!
8/12/2006 11/30/2006
9/1/2006 10/1/2006 11/1/2006
8/12/2006
Account created in Hotmail
8/12/2006
Login failed for the first time
9/28/2006
Last failure attempt
11/30/2006
Last Successful login
11/16/2006 - 11/30/2006
Last 10 entries in Hotmail



age 13
:,')3,)!".''3S#,SC!!M#,8&B'!?#0.!".''.,S.%!

"#$%&'()*#+,)-,((,$.,/)#()01,)23,40).,$,/50#&$)&6)-73)-,((,$.,/8
! lree servlce
! CusLomers use Wlndows Llve lu / assporL accounL Lo slgn-ln
! MlcrosofL reLalns:
! Wlndows Llve lu / assporL accounL reglsLraLlon daLa
! Some Wlndows Llve lu / assporL accounL l connecLlon records
W|ndows L|ve Messenger program |s down|oaded onto c||ent
! MlcrosofL servers auLhenLlcaLe users, buL MlcrosofL does noL log Lhe conLenL of
communlcaLlons beLween users
W|ndows L|ve Messenger customers ta|k to ahoo! contacts
! lf a Wlndows Llve Messenger cusLomer adds a ?ahoo! conLacL Lo hls or her conLacL llsL,
MlcrosofL wlll have Lhe name of Lhe ?ahoo! conLacL.

What records are reta|ned and for how |ong?
Slnce Lhe Wlndows Llve lu servlce ls used Lo auLhenLlcaLe Wlndows Llve Messenger or MSn Messenger users,
Wlndows Llve lu records are reLalned. lease refer Lo Lhe AuLhenLlcaLlon Servlces: Wlndows Llve lu" secLlon
above.
|ease note LhaL MlcrosofL needs a full accounL name wlLh domaln ([hoLmall.com, [msn.com or [llve.com)
ln order Lo ldenLlfy a Wlndows Llve lu (assporL) accounL. An accounL cannoL be ldenLlfled when only an allas
or screen name has been provlded.


age 14
/&$#3-!>.)B&%9#,S!/.%0#$.'C!!!
M#,8&B'!?#0.!/63$.'!W!"/>!1%&Q6'!

What are the Serv|ces?
W|ndows L|ve Spaces ls a free servlce where users may creaLe and cusLomlze Lhelr own blog, upload phoLos
and neLwork wlLh oLher users (frlends and frlends of frlends).

MSN Groups are free webslLes LhaL provlde feaLures such as message boards, chaL rooms and phoLo albums.

hLLp://spaces.llve.com hLLp://groups.msn.com

W|ndows L|ve Spaces MSN Groups
! Cne owner
! Cnly Lhe owner of Lhe space can upload
conLenL
! Spaces can be publlc or prlvaLe
! Space owner can lnvlLe you Lo a prlvaLe space
lf you belong Lo hls or her conLacL llsL and/or
e-mall you Lhe llnk Lo Lhe space
! Pas only one manager buL manager may have
asslsLanL managers
! Anyone who ls a member of Lhe group can
upload conLenL
! Croups can be publlc or prlvaLe
! Manager musL e-mall llnk ln lnvlLaLlon Lo a
prlvaLe group


age 13
What kecords are keta|ned and for now Long?
W|ndows L|ve Spaces: Cnly Lhe owner of a Wlndows Llve Space can upload conLenL (e.g. lmages, documenLs,
vldeos), and when Lhey do so, Lhe l address and daLe and Llme ls also capLured. ln addlLlon, lf someone posLs
a commenL Lo Lhe blog, MlcrosofL capLures Lhe LexL of Lhe commenLs as well as Lhe l address, daLe and Llme
of upload and Lhe nlckname. 1hese LransacLlonal records are reLalned for 90 days.
MSN Groups: When a manager or member of an MSn Croup uploads conLenL, MlcrosofL capLures Lhe l
address and daLe and Llme of conLenL upload. 1hese LransacLlonal records are reLalned for 60 days.
Samp|e Language

W|ndows L|ve Spaces: 1he Wlndows Llve Spaces onllne servlce enables cusLomers Lo reach ouL Lo oLhers by
publlshlng Lhelr LhoughLs, phoLos, and lnLeresLs ln an easy way. 1hey can be as lncluslve or excluslve as Lhey
wanL Lo be. 1hey can seL Lhree levels of permlsslons Lo vlew Lhelr Space: 1) publlc - allows anyone on Lhe
lnLerneL, 2)allows only Lhe group of people from Lhelr Wlndows Llve Messenger allow llsL, or 3) prlvaLe -
allows only each person speclfled lndlvldually from Lhelr MSn Address 8ook. lnformaLlon LhaL Lhey publlsh ln
Lhelr Space ls arranged ln unlLs called conLenL modules. ConLenL modules conLaln lnformaLlon and llnks Lo
Lhelr lLems such as phoLos, muslc, blogs, and llsLs. Powever, when you are looklng for lnformaLlon on a
speclflc lncldenL llke a phoLo posLlng or blog posLlng, please requesL a|| conLenL and logs for Lhe Space. We
cannoL reLrleve slngle lncldenL daLa.
When submlLLlng legal process for lnformaLlon on Wlndows Llve Spaces, please lnclude Lhe followlng lLem
descrlpLlons as needed (llsLed below ln bold):
! lor lnformaLlon requesLs on Spaces webslLe conLenL & logs: conLenL lncludlng phoLos, phoLo albums,
blogs, llsLs eLc., and llS (webslLe acLlvlLy) logs:
/(0'$()'$&&',!1+%2!'%(3-.#$2%-('3-.'24!'56*$7!'.!89!+2!):'%(7&9)%(;'7-(2!(2<'*4-2-+<'1&-;+<'&%+2+<'
$()'$&&'==6'&-;+>!
! lor lnformaLlon requesLs on Lhe creaLor (owner) of Lhe Space:
' /(0'$()'$&&'+91+7.%1!.'%(3-.#$2%-('3-.'24!'7.!$2-.'-3'24!'56*$7!:'%(7&9)%(;'#!$(+'$()'+-9.7!'-3'
*$0#!(2'-3'$(0'+974'*$%)'+91+7.%*2%!"#$%&!$'(#)((!&*)+%'#,*+-#+-%#!,"%$.(#%"#$%&'$77-9(2'$+'
,!&&'$+'$++-7%$2!)'=?'4%+2-.0''3-.'24!'$77-9(2>'
! lor lnformaLlon requesLs on oLher vlslLors of Lhe Space (e.g. by nlckname or emall address):
/(0'$()'$&&'+91+7.%1!.'%(3-.#$2%-('3-.'24!'@%+%2-.'5@%+%2-.'($#!:'-3'24!'6*$7!'56*$7!'($#!:'
%(7&9)%(;'#!$(+'$()'+-9.7!'-3'*$0#!(2'-3'$(0'+974'*$%)'$77-9(2'$()'$++-7%$2!)'=?'&-;+'3-.'
24!+!'$77-9(2+>''A-2!B'',!'4$@!'%(3-.#$2%-('-(&0'-('@%+%2-.+',4-'*-+2!)'7-##!(2+'*-+2!)'2-'24!'
6*$7!>'



age 16
MSN Groups: When submlLLlng legal process for lnformaLlon on MSn Croups, please lnclude Lhe followlng
lLems (ln bold):
! lor lnformaLlon requesLs on group webslLe conLenL/logs: conLenL, lncludlng lmages, member llsLs,
llS (acLlvlLy) logs:
/(0'$()'$&&',!1+%2!'%(3-.#$2%-('3-.'24!'5;.-9*'.!89!+2!):'%(7&9)%(;'7-(2!(2<'%#$;!+<'
#!#1!.'&%+2+<'$()'$&&'==6'&-;+>!
! lor lnformaLlon requesLs on Lhe manager of Lhe group:
/(0'$()'$&&'+91+7.%1!.'%(3-.#$2%-('3-.'24!'#$($;!.'-3'24!';.-9*'%(7&9)%(;'#!$(+'$()'+-9.7!'
-3'*$0#!(2'-3'$(0'+974'*$%)'$77-9(2'$()'$++-7%$2!)'=?'&-;+'3-.'24!+!'$77-9(2+>'
! lor lnformaLlon requesLs on oLher members of Lhe group (e.g. by nlckname or emall address):
/(0'$()'$&&'+91+7.%1!.'%(3-.#$2%-('3-.'24!'#!#1!.'5#!#1!.'($#!:'-3'24!';.-9*'5;.-9*'
($#!:'%(7&9)%(;'#!$(+'$()'+-9.7!'-3'*$0#!(2'-3'$(0'+974'*$%)'$77-9(2'$()'$++-7%$2!)'=?'
&-;+'3-.'24!+!'$77-9(2+>'
'
lease noLe LhaL Lhe followlng lLems cannoL ln any way be assoclaLed wlLh MSn Croups: 1elephone number(s)
and Local and long dlsLance Lelephonlc connecLlon records. ln addlLlon, when you are looklng for lnformaLlon
on a speclflc lncldenL llke a phoLo posLlng or message posLlng, please requesL all group conLenL and logs. We
cannoL reLrleve slngle lncldenL daLa.

!


age 17
4Q')&5!R&53#,'C!!!
M#,8&B'!?#0.!P85#,!4.,).%!

What |s the W|ndows L|ve Adm|n Center Serv|ce?
1he Wlndows Llve CusLom uomalns ls now W|ndows L|ve Adm|n Center, whlch lncludes Wlndows Llve CusLom
uomalns, Wlndows Llve [edu, Wlndows Llve [neL and Wlndows Llve CommunlLy 8ullder. ?ou may learn
more abouL all of Lhese servlces aL hLLp://domalns.llve.com.
W|ndows L|ve Custom Doma|ns provldes cusLomers wlLh Lhelr own domaln name and, lnlLlally, up Lo 100 e-
mall accounLs. lor example, !ohn uoe may creaLe a cusLom domaln www.[ohndoefamlly2.com and may
creaLe e-mall addresses such as [ohn[[ohndoefamlly2.com, mary[[ohndoefamlly2.com, eLc.
W|ndows L|veQedu dellvers sLudenL and alumnl e-mall as well as communlcaLlon and collaboraLlon servlces.
1he e-mall accounLs offer a 3 C8 ln box, unlverslLy domaln name, as well as oLher feaLures and sLudenLs may
keep Lhelr e-mall afLer Lhey graduaLe. AddlLlonal servlces may also be uLlllzed by Wlndows Llve[edu
cusLomers such as Cfflce Llve Workspace and Wlndows Llve Skyurlve. Learn more abouL Wlndows Llve[edu
aL hLLp://geL.llveaLedu.com/LducaLlon/ConnecL.
C$,'!(3-.7!#!(2'+4-9&)'D(-,'2-'+!()'24!%.'7.%#%($&'&!;$&'*.-7!++'2-'E%7.-+-32'%3'$')-#$%('($#!'&--D9*'
%()%7$2!+'$++-7%$2%-(',%24'E%7.-+-32>''



age 18
4Q')&5!R&53#,'C!!!
+((#$.!?#0.!/53--!XQ'#,.''!W!+((#$.!?#0.!M&%9'63$.!

What |s the Cff|ce L|ve Serv|ce?
Cfflce Llve Small 8uslness provldes cusLomers wlLh web slLes, cusLom domaln name and e-mall as well as e-
commerce and oLher Lools. Cfflce Llve Workspace provldes sLorage and access Lo MlcrosofL Cfflce documenLs
as well as space Lo share documenLs and pro[ecLs.
Law enforcemenL should know Lo send Lhelr crlmlnal legal process Lo MlcrosofL lf a domaln name lookup
lndlcaLes assoclaLlon wlLh MlcrosofL or Cfflce Llve". Learn more abouL Cfflce Llve aL: hLLp://offlcellve.com .



age 19
+,-#,.!<#-.!/)&%3S.C!!M#,8&B'!?#0.!/9TR%#0.!!

What |s the W|ndows L|ve SkyDr|ve Serv|ce?
Wlndows Llve Skyurlve provldes password-proLecLed onllne flle sLorage for yourself, Lo share wlLh oLhers or
share wlLh Lhe world. Learn more aL hLLp://skydrlve.llve.com.

!


age 20
135#,SC!!YX+Y!?:A@*!!

xbox LlvL ls Lhe premler onllne gamlng and enLerLalnmenL servlce LhaL enables cusLomers Lo connecL
Lhelr xbox Lo Lhe lnLerneL and play games onllne. 1he xbox LlvL servlce ls avallable on boLh orlglnal
xbox and new xbox 360 consoles.
Cr|g|na| kbox
! AccounLs resLrlcLed Lo ages 13 and up
! CredlL card requlred
! uaLa collecLed: uaLe of blrLh, name, e-mall address, physlcal address, Lelephone, credlL card
number, Lype of credlL card, credlL card explraLlon daLe
kbox 360 ! User under 13
! CredlL card requlred
! uaLa collecLed: uaLe of blrLh, name, e-mall address, physlcal address, Lelephone, credlL card
number, Lype of credlL card, credlL card explraLlon daLe, MlcrosofL assporL
kbox 360 ! User 13 and up ! No cred|t card requ|rement (but can be used)
! uaLa collecLed wlLhouL credlL card: uaLe of blrLh, name, e-mall address, physlcal address,
Lelephone, MlcrosofL assporL
! uaLa collecLed wlLh credlL card: uaLe of blrLh, name, e-mall address, physlcal address,
Lelephone, credlL card number, Lype of credlL card, credlL card explraLlon daLe, MlcrosofL
assporL
noLe: Ceneral subscrlber lnformaLlon ls unverlfled. ueLalled credlL card verlflcaLlon has been
lmplemenLed.
What records are reta|ned and for how |ong?
8oLh reglsLraLlon and l connecLlon hlsLory records are reLalned for Lhe llfe of Lhe gamerLag accounL. 8ecause
Lhe volume of l connecLlon hlsLory records may be large, when posslble please ask for Lhe speclflc daLe range
of records you are speclflcally lnLeresLed ln recelvlng. A full llsLlng of reLalned records ls below:
! CamerLag
! CredlL card number
! hone number
! llrsL/lasL name wlLh zlp code


age 21
! Serlal number buL only lf box has been reglsLered onllne. Console lu" ls beLLer.
! Servlce requesL number from xbox PoLllne (e.g. S8 103xx-xx-xx)
! L-mall accounL (e.g. [msn.com, [hoLmall.com or any oLher Wlndows Llve lu accounL name)
! l hlsLory for Lhe llfeLlme of Lhe gamerLag (only one gamerLag aL a Llme)
lf your lnvesLlgaLlon lnvolves a sLolen xbox console, lf Lhe console serlal number or xbox LlvL user gamerLag ls
provlded and Lhe console has been connecLed Lo Lhe lnLerneL, l connecLlon records may be avallable.
Samp|e kbox LIVL Account kesu|ts
!

!



age 22
?.S3-!U%&$.''!

Lega| rocess kequ|red for
Customer Account Informat|on and Content

1he LlecLronlc CommunlcaLlons rlvacy AcL (LCA) (18 u.S.C. 2701-2712) seLs forLh Lhe approprlaLe legal
process requlred Lo compel MlcrosofL's Cnllne Servlces 8ecords CusLodlans Lo dlsclose cusLomer records and
conLenLs:

Informat|on that may be d|sc|osed w|th a subpoena. 8aslc subscrlber lnformaLlon lncludes name,
address, lengLh of servlce (sLarL daLe), screen names, oLher emall accounLs, l address/l logs/usage
logs, bllllng lnformaLlon, conLenL (oLher Lhan e-mall, such as ln Wlndows Llve Spaces and MSn Croups)
and e-mall conLenL more Lhan 180 days old as long as Lhe governmenLal enLlLy follows Lhe cusLomer
noLlflcaLlon provlslons ln LCA (see 18 u.S.C. 2703(b), 2703.)
9&:/0)&/%,/()5/,)/,;:#/,%)6&/)01,)/,(0)&6)01,)<:(0&=,/>()?/&6#@,)ABC)DE7E9E) 2703(d)). A courL order
lssued pursuanL Lo 2702(d) wlll compel dlsclosure of all of Lhe baslc subscrlber lnformaLlon avallable
under a subpoena plus Lhe e-mall address book, Messenger conLacL llsLs, Lhe resL of a cusLomer's
proflle noL already llsLed above, lnLerneL usage logs (e.g. WL81v or MSn lnLerneL Access), and e-mall
header lnformaLlon (Lo/from) excludlng sub[ecL llne.
Search warrants are requ|red for contents. A search warranL wlll compel dlsclosure of all lnformaLlon
avallable wlLh a courL order lssued pursuanL Lo 2703(d) (as llsLed above), plus all conLenLs (lf prlor
noLlce ls noL provlded or an order for delayed noLlce ls noL obLalned), and ls Lhe only means Lo compel
Lhe dlsclosure of e-malls, lncludlng sub[ecL llne, ln elecLronlc sLorage 180 days or less**.
**A Note About Cpened L-ma|| Content |ess than 181 days: under LCA, e-mall ln elecLronlc
sLorage for 180 days or less may be dlsclosed pursuanL Lo a search warranL. Whlle some have
lnLerpreLed ln elecLronlc sLorage" Lo refer only Lo unopened mall, a nlnLh ClrculL declslon ln
1heofel eL al v. larey-!ones and kwansy, 341 l.3d 978 (9
Lh
Clr. 2003) held LhaL opened e-malls on
lS servers are also ln elecLronlc sLorage." 1herefore, as MlcrosofL recelves and processes legal
process for lLs onllne servlces ln Lhe nlnLh ClrculL, MlcrosofL dlscloses boLh opened and
unopened e-mall ln elecLronlc sLorage for 181 days or less only upon pursuanL Lo a search
warranL.
reservat|on kequests 18 U.S.C. 2703(f): upon Lhe requesL of a governmenLal enLlLy, MlcrosofL shall preserve
all lnformaLlon, lncludlng l logs and conLenLs for a perlod of 90 days from Lhe daLe of Lhe preservaLlon. A
preservaLlon creaLes a snapshoL of Lhe lnformaLlon ln or abouL Lhe accounL aL a parLlcular polnL ln Llme, buL Lhere
ls no updaLe of Lhe lnformaLlon LhroughouL Lhe preservaLlon perlod. er MlcrosofL pollcy, preservaLlons may be
exLended up Lo Lwo (2) Llmes. Lach exLenslon shall be for a perlod of 90 days from Lhe explraLlon of Lhe currenL
preservaLlon, resulLlng ln a maxlmum of 270 days on a glven preservaLlon. An exLenslon does noL creaLe a new
snapshoL, buL merely preserves Lhe lnformaLlon for Lhe addlLlonal perlod.

HR - Microsoft Online Services - Global Criminal Compliance Handbook

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

HR - Microsoft Online Services - Global Criminal Compliance Handbook

Uploaded by

Copyright:

Available Formats

!

You might also like