The transcripts of the official inquiry into the culture, practices and ethics of the press. More…

  • MR RONALD ZINK (affirmed).

  • If you could take a seat.

  • Just before you start, I have determined to admit the evidence offered by the National Union of Journalists. A full ruling will be available to all core participants and others immediately. Thank you.

  • Mr Zink, you are here today to give evidence about Bing and you're employed by Microsoft Corporation; is that right?

  • Although you are not the person who made the witness statement which has been provided to the Inquiry by Microsoft Limited, or indeed Microsoft Corporation, are you able to confirm that the contents of those documents are true and correct to the best of your knowledge and belief?

  • Could you tell me your position in this organisation?

  • Yes. I'm the chief operating officer for EU affairs. I'm based in Paris, where Europe, Middle East and Africa headquarters is for Microsoft and I'm also an associate general counsel. That means I work on policy and regulatory issues across Europe, Middle East and Africa.

  • So you've come from Paris for these purposes? Thank you very much indeed. I'm very grateful.

  • I'm usually much less aggressive.

  • You've told us what you're presently doing. Could you give us a very quick summary of your professional background before your present post?

  • Sure. I've been at Microsoft 16 years, so I've had a number of different positions within the company, and also before that I was a lawyer at a law firm in Seattle, focusing on intellectual property issues.

  • Thank you. Moving now just to very briefly get clear in our minds the corporate structure that we're dealing with, am I right to understand that Microsoft's corporate presence in the United Kingdom is in the form of Microsoft Limited, which is essentially a sales and marketing organisation?

  • But that the ultimate holding company is Microsoft Corporation, a United States company incorporated in Washington?

  • If I could now ask you a little bit about the Bing search engine. Is it right that, as we heard from Google last week, the way in which the search engine operates is by crawling the Internet to compile an index, which can then be readily accessed using a computer algorithm to respond to search requests?

  • Yeah, that sounds accurate.

  • What Bing then does, when a search is executed, is to display the results with snippets of information from the websites which are thrown up by the search?

  • So does it follow that Bing is not a publisher of information on the Internet; it is merely a mechanism for finding information which is already out there on the Internet?

  • Yes, that's accurate.

  • Would it also be fair to say that, given the amount of material which is now available on the World Wide Web, that what it does is effectively help the user to find a needle a hey stack?

  • I think you could say that.

  • Bing News. Again, is it right that that is a service which works through a search engine and is not an independent news organisation?

  • Yeah, that's accurate. Bing News is, if you will, a subset of the index because the way Microsoft does it at least, we choose different sources for that news. It's not the entirety of what we can find across the world; it's various sources that we've chosen, and then you do the indexing based on those sources alone.

  • It's right, isn't it, that there's no journalistic input at all by Microsoft; is that correct?

  • Yeah, that is correct.

  • And there's no editorial function either, other than setting the parameters of the search?

  • Right. There's no editorial function other than -- again, it's a subset of sources, so that's not necessarily editorial but does limit what you'll find in Bing News, based on those sources that have been specified in advance. After that, it's all the machine that's creating the index for that set of results.

  • Your servers, as I understand it, for Bing are predominantly in the United States?

  • Right. We have servers around the world. The Bing servers that do the bulk of gathering the information from the Internet and creating an index are based in the US, although we do have a server in Dublin that will cache some of that information, so if you are doing a search from, for example, the United Kingdom, it may go to Dublin to get the result from the work that's been done in the United States.

  • And the way it operates is you have a service tailored for a country or a region. In this country, you would encourage somebody to use Bing.co.uk to get a search result that was tailored for a British user; is that right?

  • Yes, we'd tailor it to what we think British citizens would want to see when they do a search. So it's tailored to that group.

  • But a user here could equal little access Bing.com, which is the American results?

  • I'd like to move now to the topic of the removal of problematic content. I understand that Microsoft deals with all sorts of problematic content. The sort of content that I would like to focus on for these questions is defamatory material or material which amounts to an unjustified invasion of a person's privacy.

  • You point out in your witness statement that you are, as a search engine, probably not the best target for remedial action, and you tell us about three courses of action which you would recommend in preference to seeking assistance from a search engine.

    First of all, you say the best target for a remedy is the webmaster, to try and get the material taken off the Internet altogether; is that right?

  • Yes. If you can remove the creator of the content, then that eliminates the problem across the entire web. So that, I think, is a first course of action.

  • There might, though, be difficulties with that in practice though, mightn't there? First of all, identifying the publisher of the information, that can be difficult, can't it?

  • Yes, I think it can, and that's why, if you look at the way the Internet law has developed over the years, it contemplated other avenues to try and remove things beyond just going to the person who was the original author or the original person putting it up onto the website.

  • Because it goes further than that. Even if you can identify the person concerned, he or she may well be in another jurisdiction altogether?

  • Yeah, that's correct.

  • The second route you identify for us is the hosting service provider. Could you perhaps help us a little bit to distinguish a hosting service provider from an Internet service provider so that we clearly understand the difference?

  • Sure. The hosting service provider is the entity or person who is actually putting the content on the website for everyone to see worldwide. The Internet service provider, we sometimes talk about -- in terms of "last mile" but that's how you connect to the Internet. Your ISP connects you to the Internet so you can see different things there. So the web hoster will be kind of a worldwide element. The ISP, Internet service provider, will be directed towards a particular group of people or individuals, maybe in a country, for example.

  • Focusing on the hosting service provider then for a moment, might there be problems for the individual victim in locating and identifying the hosting service provider?

  • There should be mechanisms to find the hosting service provider based on where the content is originating, so I think typically you should be able to find where that material is located.

  • So easier than identifying the individual who's posted the material, in many cases?

  • It depends on the case, but it can be.

  • That also could be anywhere in the world?

  • So that may prove to be an insuperable problem to that avenue. The third avenue of redress you identify for us is to go to the Internet service provider. Now, the ISP is the part of the system which connects the user to the specific website; is that right?

  • The ISPs, we think of them as connecting the user to the Internet from a global level, and then it's up to that particular user as to where they want to go and what they want to view on the Internet.

  • What limitations might there be on the ISP's ability to deliver a remedy to the victim?

  • There's a whole set of laws that were developed under the E-Commerce Directive that came out in 2000 and was formed into a regulation in the UK in 2002, that relate to how you think about the Internet and liability around the Internet and who has what obligations, and that gets you into a notice and takedown system where you can notify the ISP if there's something on the Internet that you'd prefer to have taken town, and based on those sets of rules and obligations, they'll go ahead and act accordingly.

  • So what is it, from a technical point of view, they are able to do if they have decided to to something about some offending content? They can prevent it being accessed, can they?

  • Right, for an ISP in particular, if they were to prevent access to that content, it would apply across all the consumers and businesses that use that ISP to connect to the Internet.

  • But if one ISP does something about the material, you could access it through another ISP; is that correct?

  • I think that's fair to say, yeah.

  • So if you are trying to seek a remedy against material which is still actually on the Internet, you would have to seek redress from every ISP through which the offending material might be viewed?

  • Yeah, which gets you back to things like the web host or creator of the content. That's a more elegant solution, a more comprehensive solution.

  • It's absolutely elegant if it works, in the sense that you find out who he is, where he it is and he's amenable to the jurisdiction.

  • Yes, sir, I think that's correct.

  • But your last example rather strikes me like a sledgehammer to crack a nut and there's lots of collateral damage with that as well, isn't there? In other words you're going to impact on perfectly legitimate material.

  • With the example the ISP? I think that would be narrowly tailored to precisely that content, so I don't think that would impact beyond the precise thing you're really trying to take down.

  • But would you not have to have a precise url so that if somebody had put the same material up with different urls or it's accessible in different ways, you'd have to identify each one, each variable?

  • Yes, that's generally correct.

  • So having explored the alternatives and the pros and cons of each of them in at least summary terms, can we move to what Bing might be able to do by way of removal of material from its index. I'd like to do this by looking at defamation and privacy separately, because they are dealt with separately in your policies. It might be useful to look at the policies at tab 6 of the bundle.

    Before we go to the defamation section, can I touch first on part of the very first paragraph, which is under the heading "How Bing delivers search results". I'm looking now at the last five lines of that section, which says:

    "We might remove particular resources from the index of available information. In each case, where we are required to do so by law, we try to limit our removal of search results to a narrow set of circumstances so as to comply with applicable law but not to overly restrict access of Bing users to relevant information."

    So can I take it that Bing's approach in principle to removals is to remove the minimum necessary in order to comply with the law?

  • Generally, I would say yes, but it does depend on the -- if you look at this tab, there are three different scenarios. There's child sexual abuse content, there's intellectual property and then there's defamation and invasion of privacy, and for some of those the standards are a little bit different. For example, in child sexual abuse content, there's been a worldwide view, through the Internet Watch Foundation, which is based in the UK, that this is such egregious material and there's agreement kind of on a worldwide basis that that should be taken down, that we have a higher methodology for removing that content from the Internet. So that isn't the minimum; that actually is a very robust mechanism for bringing things down.

    If you go to defamation, invasion of privacy, we do insist on a specific url for that content in order to remove it.

  • By "remove it", you don't actually mean remove it. All you mean is take it out of your index?

  • Yeah, that's precisely correct, sir. We actually -- to be real technical, we block that particular url from showing up in the jurisdiction in which we're talking about. In this case, it would be the UK.

  • Yes, but you can't take it out of the Internet because it's there, and the same problems that you've identified earlier on would hit you as well.

  • That's exactly right.

  • So let's look in a little bit more detail about the libel and defamation approach taken by Bing. It's at the bottom of the first page of the policy. It says it recognises that there are different laws in different countries and it says:

    "We do not remove resources containing allegedly defamatory content from our index without a court order indicating that a particular link has been found to be defamatory. When we do receive a valid court order, we remove those links from our index permanently."

    You're an American corporation in an American jurisdiction, so my first question is: does the system permit for a victim in the United Kingdom to obtain a British court order -- or to be very correct, an order of the court of England and Wales, if we're someone here in London -- and then to send that to Microsoft in Washington, USA? Is that enough or does it have to go through the American court system as well?

  • No, that would be enough. I mean, just from a mechanism standpoint, there's a couple of ways you can do that, or more. We're not prescriptive on how we get such a notice, but one way is there's a feedback section. If you go to Microsoft.co.uk, on the lower right you can click that and send a notice to Microsoft saying you'd like something taken down. You can also just contact either Microsoft Limited here in the UK or Microsoft Corporation in America with your issue and we'll take a look at that. So we're not prescriptive on how we would receive that information.

  • What I'd just like to explore there is: should we understand that answer as meaning you're still requiring a court order, or are you saying that Microsoft would consider a complaint by a private individual that something was defamatory and make its own judgment as to whether or not it was?

  • Yes, we would. This is a global statement, and maybe in some ways you might look at it as setting a minimum bar for how we were going to conduct such activities. If you think about the UK and how our practice is today, we have, in the past, looked at less than a court order on taking things down from a defamation standpoint.

    I was talking to a colleague about this in preparing for this testimony, and I was asking her about what sort of priority does this take, and I was relieved to hear it is a business priority. But beyond that, she said she drops everything and just deals with these when they come in.

  • Is there material available to the user in this country which would make that avenue clear to them? Because it's not clear, certainly, from the policy that we have here that that is an option available to an individual.

  • I'm not aware of material available in the UK that could soften the stance we have in this document.

  • The stance identified at the bottom of this page:

    "We do not remove resources containing allegedly defamatory content from our index without a court order indicating that a particular link has been found to be defamatory. When we do receive a valid court order, we remove those links to our index permanently."

    But do I gather that you're prepared to look even if you don't have a an order?

  • Yes, we are. In fact, in the memorandum we attached, we actually -- if you refer to that, we do go further than that statement to say that we'll look at things on a case-by-case basis.

  • But it's quite difficult to judge, because somebody may say, "This is defamatory", and then the person who wrote it may say, "No, it's not, it's entirely true", and you can't really set yourself up as the judge. Or maybe you do?

  • That's absolutely right, sir; we do not want to be the judge. What happens is -- of course you look at it on a case-by-case basis. Is it particular to what they're trying to accomplish? Is there a court order? If there is, you know, we would abide by that. If there isn't, we'll take a look and try and see what makes the most sense.

    Of course, I'm not a UK lawyer, I'm an American lawyer, but this would be for our team here based in London to take a look at this and give us what they think the appropriate remedy should be, and then that instruction would go to Microsoft Corporation based in Seattle for the technical aspects if we wanted to block that material.

  • So if there was a direction from some sort of regulatory body, even a self-regulatory body, to the effect that this was defamatory or in breach of privacy -- we'll deal with privacy in a moment -- then Microsoft would be prepared to look at that?

  • Yeah, we would be willing to consider that.

  • I think that does take us to privacy. If we follow your policy, we're now on page 2 of tab 6. The policy acknowledges that there might be sometimes occasions where material is posted which invades privacy. It gives examples. The examples are: inadvertent posting of public record, private phone numbers, identification numbers and the like, or intentional posting of email passwords, log-in credentials, credit card numbers or other data that is intended to be used for fraud or hacking.

    Then it goes on to say what is done or not done, as in fact the case is. It says:

    "Bing doesn't control the sites that publish this information or what they publish. Most of the time the website is in the best position to address any privacy concerns about the information it publishes. As long as a website continues to make the information available on the web, the information will be available to others. Once the website has removed the information and we have crawled the site again, it will no longer appear in our results. If the information has already been removed from that website but is still showing up in Bing's search results, you can request that we remove the information by using our content removal request form."

    So on the wording of that policy, it appears that Bing isn't offering to do anything about removing a link from or a result from a search if it invades privacy. The victim is left to go direct to the publisher and the only circumstance in which Bing intervenes is if the material has been removed from the website but remains in your index. You will, in those circumstances, remove it from the index; is that right?

  • From a question standpoint and from a reading of this, I think that's probably accurate, but if you look at page 3 of the memorandum that we submitted, we actually don't differentiate defamatory material from privacy-invading material. I can tell you our practice in the UK would be the same for invasions of privacy as it would be for defamation. We would take a look at those on a case-by-case basis.

  • Are you saying that if someone has a court order with a decision of the court saying that a publication has unlawfully violated someone's privacy, that you would accept that as sufficient to cause that material to be removed from your search results?

  • I think largely that would be the case. Certainly if Microsoft is a party to that court order, we would absolutely remove it. If Microsoft wasn't -- or is not a party to that court order, we would look at it and make sure the specificity is there and the information we need is there, but we would endeavour to remove it as well, based on that court order.

  • Are we talking about removal just from Bing.co.uk searches?

  • But still be available on a Bing.com search?

  • It would appear then that effectively the victim of an invasion of privacy has in fact very little redress, doesn't he, from an invasion of privacy which has gone viral on the Internet. If we could perhaps think through what happens if someone is the subject of an unlawful breach of privacy which then goes viral on the Internet. If it ends up being posted on several different web pages by different people in different jurisdictions, finding the individual publishers may become effectively impossible, mightn't it?

  • I think it's conflicted, and that does get back to the ecosystem and how you think about the various avenues by which you might try to remove this material. It would probably be the case that you would look at a number of different avenues, not just one and not just search engines and not just Microsoft's but --

  • You'd probably try them all. We've had evidence from one witness who was in just that position and has made very extensive international efforts to have material removed or made inaccessible, but it can still be found. Is the position this: that in the current state of affairs, someone who is the subject of an unlawful invasion of privacy which goes viral has, in practical terms, very little prospect of having it completely removed from the Internet?

  • That's probably a little beyond my knowledge of UK law and how I think about the -- my background, if you will. I think it's complicated.

  • If we stick to just from Bing, you're telling us what you'd require really is a court order or some very strong alternative evidence to get it removed simply from Bing.co.uk but it would remain available to Bing.com.

  • That's correct. We'd look at it from a case-by-case basis, so the standard -- I'm not sure I quite agree how strong it has to be. It has to be credible and particular. It doesn't have to be a court order, just to be completely clear, but it would come off of the Bing.co.uk. It would still be available to Bing.com.

  • In the light of the evidence you've given us, which goes further than your written policies, do you think there might be a case for Microsoft making clearer to UK users that there are avenues of redress which require less than a formal court order?

  • Yeah, I think we could take a closer look at our global statement that we're looking at and see if there might be some modifications for UK users.

  • The final area I want to ask you about -- I appreciate it's not about Bing, it's about another Microsoft product, and I readily accept that you may not be able to help us instantly, in which case if Microsoft can help us in writing afterwards, we would be very grateful. It's about your web browser, Internet Explorer.

    If offending content has been successfully removed from search engine results but somebody wants to access the material and still knows the url, you can type the url straight into the browser and it will find the web page for you, won't it?

  • Yeah. A browser really is just a mechanism to find a resource on the Internet. That's the primary function of a browser, is to find what you're looking for through a url.

  • The first question is: is it technically possible for the browser to be set by Microsoft so that if somebody types in the offending url, the browser will not connect them to the web page?

  • There you're getting beyond my technical background.

  • If that could be answered in writing, we would be very grateful.

  • The second question -- again, it may be that it has to be followed up in writing: does Microsoft have a policy as to privacy and protecting the sort of privacy invasions that I've been talking about in the use of Internet Explorer?

  • We actually do. We've put a lot of thought into privacy-enhancing features. In fact, we just celebrated our 10-year anniversary for Trustworthy Computing, which is the group that looks at: how do we build privacy and security into our products at the beginning so they make sense as you go forward instead of looking at it after it's all done. So I'm pretty proud that Microsoft's done that. I think it was very much a leader in this area.

    And a more recent thing, if you think about Internet Explorer, is around how do you figure out behavioural advertising and cookies on the Internet, if you're familiar with that, but the information that's collected about you, and we recently worked with Privacy International to create a tracking protection list where, if you subscribe to Privacy International's list, it has websites they consider to be maybe not the best sites for people to go to and have their information tracked, and so you can subscribe to that list and if you go to those websites, the cookies are shot off and it won't track your information on those sites. I think that's a pretty compelling technology and it's a way to think about privacy, where if you don't collect information in the first place then you don't have to worry about what you do with it afterwards.

  • So those are technologies for protecting your privacy when you are online. The sort of protection that I'm asking about is: once there is problematic material on the web, how do you prevent others from seeing it? Is that something that you would need to look into and get back to us in writing about it?

  • Yes. That would be my preference on that question.

  • Thank you very much.

  • That's entirely fair enough. I understand the position that Microsoft adopts, and it's not perhaps surprising that what might not be lawful in this country could be lawful somewhere else, and you're obviously not going to take steps which would not comply with the law in another place.

    If there is a solution to the problem -- and I'm not sure there is -- of replication of defamatory or breach of privacy material going viral, as Mr Barr described it, with different urls, I apprehend you'll say that whereas a search engine might pick up the general words and block them, going beyond that, you'd have to go to the original webmaster each time, each one, one by one?

  • I think that's right. We have the technology when it comes to images, like sexual abuse content or images, to go further, but there's -- and part of that is -- you might be familiar with photo DNA, which we put in Bing, we put in Hotmail, we put in our Skydrive product and also licence or work with Facebook on to try and remove that type of content. So that's available and is working well. Not 100 per cent but works well. To go further though when it comes to other things gets much more technically complicated, and not something that currently we can do.

  • I don't want to ask you in this public forum how you identify pornographic photographs, because I don't want to encourage those who might want to put that material online to think of ways of defeating what you're doing, but if those to whom you are speaking can see any way of using that approach to deal with material that is recognised by a court to be defamatory or in breach of privacy, I'd be very grateful if you'd let us know.

  • Thank you, sir. I'll take that back with me.

  • Thank you very much, and thank you for coming from Paris to give evidence.

  • You're welcome. Thanks.

  • Sir, might I ask that we have a few minutes to prepare for the next witness, because I think material has to be brought in.

  • Material has to be brought in?

  • I think Mr Jay has rather more bundles to deal with the next witness than I've had with Mr Zink.

  • (A short break)

  • Sir, the next witness is Baroness Buscombe, please.