Now that the fuss and excitement from the Microsoft Exchange Conference (MEC) has settled down, let me take the opportunity to voice a caution to companies who have used the old Exchange Hosted Encryption (EHE) service offered by Microsoft as part of Office 365. If you are such a customer, I’m sure that you are delighted to move to the altogether more modern and more functional (support on mobile devices, for instance) Office 365 Message Encryption>. But as always, some devilment hides in the detail.
EHE uses technology licensed from Voltage. I assume that Microsoft elected to go with Voltage as a stop-gap way to provide message encryption before they could engineer their own solution. This is absolutely a reasonable approach, but it does come with a downside in that Microsoft has to pay Voltage for the software.
Now that Office 365 has its own message encryption capability, Microsoft has built code to migrate EHE customers over. You can find details of the process in the EHE Upgrade Center. The FAQ says that the migration should be complete in the first few months of 2014. Office 365 tenants don’t get to vote when the migration happens. Tenant administrators receive four weeks’ notice by email before their tenant is scheduled to be upgraded and are expected to do the necessary work on their side to prepare for the upgrade. As you’d expect in a service, Microsoft does a lot of the upgrade in the background, but they cannot handle issues such as user education.
As I understand it, Microsoft wants to have all of their Office 365 customers who use message encryption over to the new platform very soon. Their goal is to stop using the Voltage technology as quickly as possible because the contract between Microsoft and Voltage will eventually expire and won’t be renewed. At this point the exact date of that expiration is “still to be determined” and the natural question that hangs in the area is what access users will have to messages encrypted with Voltage after a contract is no longer in place.
People encrypt messages for a reason. They probably don’t bother encrypting messages to their grannies asking them around for tea and buns, but they do when the content is important and needs to be protected. It doesn’t sound like a good thing to be in a situation where access to all of those important encrypted messages might be guillotined at some time in the future. If you’re in this situation and are required to keep copies of messages to satisfy some regulatory requirements, you might have some work to do to ensure that you meet your obligations.
Microsoft would love Office 365 Message Encryption to be perceived as the natural choice for cloud-based email encyption, but it's not the only game in town. For example, AppRiver, a well-respected and longstanding supplier of hosted Exchange, offers a comprehensive email encryption service for Office 365 called Cipherpost Pro. This solution isn't integrated with Windows Azure Rights Management in the way that Message Encryption is, but it offers a big advantage in terms of the separation of encryption responsibilities away from the email supplier, which is attractive to those who worry about access to confidential information. The fact that AppRiver has a datacenter in Zurich to run Cipherpost is also comforting if you're concerned about the activities of three-letter-agencies in the U.S. All of which proves that some careful consideration is necessary before you select an encryption solution for Office 365. Personally speaking, the back-end encryption stuff is boring because it is taken care of by the cloud provider. What's more interesting are factors such as secure access to messages from multiple devices, ease of access for users (no complex gyrations to read email), and a guarantee that the company providing the service is there for the long haul.
Microsoft changing the technology platform for message encryption within Office 365 is entirely understandable from a cost and technology perspective. It is a reasonable step forward that will benefit Microsoft as they will have more control over the future direction of the technology. They have additional engineering costs to develop and support Office 365 Message Encryption, but will probably achieve a cost saving over what they pay Voltage for EHE. It is also reasonable that customers who pay Microsoft for an encryption service as part of their Office 365 subscription should be able to access their messages for as long as they need that access – or have the ability to retrieve the messages before Microsoft and Voltage part ways.
Looking forward, I see benefits for users, mostly in the better integration between Office 365 and hybrid on-premises Exchange. And of course, Office 365 Message Encryption allows users to send encrypted email to anyone, as long as the recipient is willing to log-on to the service using a Microsoft Live ID or an organizational account (belonging to an Office 365 tenant), because this is the identifier used to establish that a recipient is entitled to see the content. Some recipients might be less charmed with this scheme than others. I can quite imagine the upset of a Linux user who is asked to create a Microsoft Live ID just to be able to read a message. Still, into every life a little rain must fall.
The downside of the transition is obvious. Being forced to retrieve encrypted messages before an arbitrary date is a pain. Losing access to encrypted messages after that date is even worse. However, when you subscribe to a service, you accept that you lose the control over technology that you exert in an on-premises deployment. Those running the service make the best possible decisions they can for the benefit of the service and its users. Some of those decisions might be painful, but that’s part of the contract that you enter into when a decision is made to cede responsibility to the service.
The move from EHE to Office 365 Message Encryption is a bump in the road that will be painless for some, painful for others. We’ll get over it in time, just like we’ll recover from the ravages of the many parties that always seem to happen at MEC.
Follow Tony @12Knocksinna
