An electronic Microsoft logo is seen at the Microsoft store in New York City, July 28, 2015. REUTERS/Mike Segar
Microsoft Corp (MSFT.O) experts concluded several years ago that Chinese authorities had hacked into more than a thousand Hotmail email accounts, targeting international leaders of China’s Tibetan and Uighur minorities in particular – but it decided not to tell the victims, allowing the hackers to continue their campaign, according to former employees of the company.
On Wednesday, after a series of requests for comment from Reuters, Microsoft said it would change its policy and in future tell its email customers when it suspects there has been a government hacking attempt. Microsoft spokesman Frank Shaw said the company was never certain of the origin of the Hotmail attacks.
The company also confirmed for the first time that it had not called, emailed or otherwise told the Hotmail users that their electronic correspondence had been collected. The company declined to say what role the exposure of the Hotmail campaign played in its decision to make the policy shift.
The first public signal of the attacks came in May 2011, though no direct link was immediately made with the Chinese authorities. That’s when security firm Trend Micro Inc (4704.T) announced it had found an email sent to someone in Taiwan that contained a miniature computer program.
The program took advantage of a previously undetected flaw in Microsoft’s own web pages to direct Hotmail and other free Microsoft email services to secretly forward copies of all of a recipient’s incoming mail to an account controlled by the attacker.
Trend Micro found more than a thousand victims, and Microsoft patched the vulnerability before the security company announced its findings publicly.
Microsoft also launched its own investigation that year, finding that some interception had begun in July 2009 and had compromised the emails of top Uighur and Tibetan leaders in multiple countries, as well as Japanese and African diplomats, human rights lawyers and others in sensitive positions inside China, two former Microsoft employees said. They spoke separately and on the condition that they not be identified.
Some of the attacks had come from a Chinese network known as AS4808, which has been associated with major spying campaigns, including a 2011 attack on EMC Corp’s security division RSA that U.S. intelligence officials publicly attributed to China. To see the report click here
Microsoft officials did not dispute that most of the attacks came from China, but said some came from elsewhere. They did not give further detail.
“We weighed several factors in responding to this incident, including the fact that neither Microsoft nor the U.S. government were able to identify the source of the attacks, which did not come from any single country,” the company said. “We also considered the potential impact on any subsequent investigation and ongoing measures we were taking to prevent potential future attacks.”
In announcing the new policy, Microsoft said: “As the threat landscape has evolved our approach has too, and we’ll now go beyond notification and guidance to specify if we reasonably believe the attacker is `state-sponsored.'”
The Chinese government “is a resolute defender of cyber security and strongly opposes any forms of cyber attacks”, Chinese Foreign Ministry spokesman Lu Kang said, adding that it punishes any offenders in accordance with the law.
“I must say that if the relevant party has some real and conclusive evidence, then it can carry out mutually beneficial cooperation with China in a constructive way in accordance with the existing channels,” Lu said at a daily news briefing.
“But if there’s the frequent spreading of unfounded rumors, it will, in fact, be of no benefit to solving the problem, enhancing mutual trust and promoting cyber security.”
The Cyberspace Administration of China did not respond to a request for comment.
INTERNAL DEBATE
After a vigorous internal debate in 2011 that reached Microsoft’s top security official, Scott Charney, and its then-general counsel and now president, Brad Smith, the company decided not to alert the users clearly that anything was amiss, the former employees said. Instead, it simply forced users to pick new passwords without disclosing the reason.
The employees said it was likely the hackers by then had footholds in some of the victims’ machines and therefore saw those new passwords being entered.
One of the reasons Microsoft executives gave internally in 2011 for not issuing explicit warnings was their fear of angering the Chinese government, two people familiar with the discussions said.
Microsoft’s statement did not address the specific positions advocated by Smith and Charney. A person familiar with the executives’ thinking said that fear of Chinese reprisals did play a role given the company’s concerns about the potential impact on customers.
Microsoft said the company had believed the password resets would be the fastest way to restore security to the accounts.
“Our primary concern was ensuring that our customers quickly took practical steps to secure their accounts, including by forcing a password reset,” the statement said.
It is unclear what happened to the email users and their correspondents as a result of Microsoft’s failure to alert them to the suspected government hacking. But some of those affected said they were now deeply worried about the risks, especially for those inside China.
“The Internet service providers and the email providers have an ethical and a moral responsibility to let the users know that they are being hacked,” said Seyit Tumturk, vice president of the World Uyghur Congress, whose account was among those compromised. “We are talking in people’s lives here.”
HUNDREDS OF LIVES
Unrest in Xinjiang, the Chinese region bordering Kazakhstan that is home to many Uighurs, has cost hundreds of lives in recent years. Beijing blames Islamist militants, while human rights groups say harsh controls on the religion and culture of the Uighurs have led to the violence.
Until Wednesday, Microsoft had rejected the idea of explicit warnings about state-sponsored hacking, such as those Google Inc (GOOGL.O) began in 2012, the former employees said. In the 2011 case, the company also opted not to send a more generic warning about hacking. Yahoo Inc (YHOO.O) and Facebook Inc (FB.O) have been issuing such warnings for several years, former employees of those companies told Reuters, including when the principal suspect was a government.
Both companies, along with Twitter Inc (TWTR.N), announced in recent months that they would follow Google’s lead and explicitly notify users about suspected state-sponsored hacking.
Google said on average it now issues tens of thousands of warnings about targeting every few months, and that recipients often move to improve their security with two-factor authentication and other steps.
Reuters interviewed five of the Hotmail hacking victims that were identified as part of Microsoft’s investigation: two Uighur leaders, a senior Tibetan figure and two people in the media dealing with matters of interest to Chinese officials.
Most recalled the password resets, but none took the procedure as an indication that anyone had read his or her email, let alone that it may have been accessed by the Chinese government.
“I thought it was normal, everybody gets it,” said one of the men, a Uighur émigré now living in Europe who asked not to be named because he left family behind in China.
Another victim identified by Microsoft’s internal team was Tseten Norbu of Nepal, a former president of the Tibetan Youth Congress, one of the more outspoken members of a community that has frequently clashed with Chinese officials. Another Microsoft-identified victim was Tumturk, the World Uyghur Congress vice president who lives in Turkey.
Microsoft investigators also saw that emails had been forwarded from the account of Peter Hickman, a former American diplomatic officer who arranged high-profile speeches by international figures at the National Press Club in Washington for many years.
Hickman said he used his Hotmail account on Press Club computers to correspond with people, including the staff for the Tibetan government in exile, whose leader Lobsang Sangay spoke at the club in 2011; Tumturk’s World Uyghur Congress, whose then-president Rebiya Kadeer spoke in 2009; and the president of Taiwan, who spoke by video link-up in 2007.
Hickman said he didn’t recall the password reset. He said he never suspected anything was wrong with the account, which he continues to use.
(Reporting by Joseph Menn; Additional reporting by Humeyra Pamuk in Istanbul and Sui-Lee Wee in Beijing; Editing by Jonathan Weber and Martin Howell)
From : Reuters SAN FRANCISCO| BY JOSEPH MENN / Thu Dec 31, 2015 9:38pm EST
Link : http://www.reuters.com/article/us-microsoft-china-insight-idUSKBN0UE01Z20160101
This mode enables people with epilepsy to use the website safely by eliminating the risk of seizures that result from flashing or blinking animations and risky color combinations.
Visually Impaired Mode
Improves website's visuals
This mode adjusts the website for the convenience of users with visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others.
Cognitive Disability Mode
Helps to focus on specific content
This mode provides different assistive options to help users with cognitive impairments such as Dyslexia, Autism, CVA, and others, to focus on the essential elements of the website more easily.
ADHD Friendly Mode
Reduces distractions and improve focus
This mode helps users with ADHD and Neurodevelopmental disorders to read, browse, and focus on the main website elements more easily while significantly reducing distractions.
Blindness Mode
Allows using the site with your screen-reader
This mode configures the website to be compatible with screen-readers such as JAWS, NVDA, VoiceOver, and TalkBack. A screen-reader is software for blind users that is installed on a computer and smartphone, and websites must be compatible with it.
Online Dictionary
Readable Experience
Content Scaling
Default
Text Magnifier
Readable Font
Dyslexia Friendly
Highlight Titles
Highlight Links
Font Sizing
Default
Line Height
Default
Letter Spacing
Default
Left Aligned
Center Aligned
Right Aligned
Visually Pleasing Experience
Dark Contrast
Light Contrast
Monochrome
High Contrast
High Saturation
Low Saturation
Adjust Text Colors
Adjust Title Colors
Adjust Background Colors
Easy Orientation
Mute Sounds
Hide Images
Hide Emoji
Reading Guide
Stop Animations
Reading Mask
Highlight Hover
Highlight Focus
Big Dark Cursor
Big Light Cursor
Cognitive Reading
Virtual Keyboard
Navigation Keys
Voice Navigation
Accessibility Statement
www.secnia.go.th
1 July 2025
Compliance status
We firmly believe that the internet should be available and accessible to anyone, and are committed to providing a website that is accessible to the widest possible audience,
regardless of circumstance and ability.
To fulfill this, we aim to adhere as strictly as possible to the World Wide Web Consortium’s (W3C) Web Content Accessibility Guidelines 2.1 (WCAG 2.1) at the AA level.
These guidelines explain how to make web content accessible to people with a wide array of disabilities. Complying with those guidelines helps us ensure that the website is accessible
to all people: blind people, people with motor impairments, visual impairment, cognitive disabilities, and more.
This website utilizes various technologies that are meant to make it as accessible as possible at all times. We utilize an accessibility interface that allows persons with specific
disabilities to adjust the website’s UI (user interface) and design it to their personal needs.
Additionally, the website utilizes an AI-based application that runs in the background and optimizes its accessibility level constantly. This application remediates the website’s HTML,
adapts Its functionality and behavior for screen-readers used by the blind users, and for keyboard functions used by individuals with motor impairments.
If you’ve found a malfunction or have ideas for improvement, we’ll be happy to hear from you. You can reach out to the website’s operators by using the following email
Screen-reader and keyboard navigation
Our website implements the ARIA attributes (Accessible Rich Internet Applications) technique, alongside various different behavioral changes, to ensure blind users visiting with
screen-readers are able to read, comprehend, and enjoy the website’s functions. As soon as a user with a screen-reader enters your site, they immediately receive
a prompt to enter the Screen-Reader Profile so they can browse and operate your site effectively. Here’s how our website covers some of the most important screen-reader requirements,
alongside console screenshots of code examples:
Screen-reader optimization: we run a background process that learns the website’s components from top to bottom, to ensure ongoing compliance even when updating the website.
In this process, we provide screen-readers with meaningful data using the ARIA set of attributes. For example, we provide accurate form labels;
descriptions for actionable icons (social media icons, search icons, cart icons, etc.); validation guidance for form inputs; element roles such as buttons, menus, modal dialogues (popups),
and others. Additionally, the background process scans all the website’s images and provides an accurate and meaningful image-object-recognition-based description as an ALT (alternate text) tag
for images that are not described. It will also extract texts that are embedded within the image, using an OCR (optical character recognition) technology.
To turn on screen-reader adjustments at any time, users need only to press the Alt+1 keyboard combination. Screen-reader users also get automatic announcements to turn the Screen-reader mode on
as soon as they enter the website.
These adjustments are compatible with all popular screen readers, including JAWS and NVDA.
Keyboard navigation optimization: The background process also adjusts the website’s HTML, and adds various behaviors using JavaScript code to make the website operable by the keyboard. This includes the ability to navigate the website using the Tab and Shift+Tab keys, operate dropdowns with the arrow keys, close them with Esc, trigger buttons and links using the Enter key, navigate between radio and checkbox elements using the arrow keys, and fill them in with the Spacebar or Enter key.Additionally, keyboard users will find quick-navigation and content-skip menus, available at any time by clicking Alt+1, or as the first elements of the site while navigating with the keyboard. The background process also handles triggered popups by moving the keyboard focus towards them as soon as they appear, and not allow the focus drift outside it.
Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements.
Disability profiles supported in our website
Epilepsy Safe Mode: this profile enables people with epilepsy to use the website safely by eliminating the risk of seizures that result from flashing or blinking animations and risky color combinations.
Visually Impaired Mode: this mode adjusts the website for the convenience of users with visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others.
Cognitive Disability Mode: this mode provides different assistive options to help users with cognitive impairments such as Dyslexia, Autism, CVA, and others, to focus on the essential elements of the website more easily.
ADHD Friendly Mode: this mode helps users with ADHD and Neurodevelopmental disorders to read, browse, and focus on the main website elements more easily while significantly reducing distractions.
Blindness Mode: this mode configures the website to be compatible with screen-readers such as JAWS, NVDA, VoiceOver, and TalkBack. A screen-reader is software for blind users that is installed on a computer and smartphone, and websites must be compatible with it.
Keyboard Navigation Profile (Motor-Impaired): this profile enables motor-impaired persons to operate the website using the keyboard Tab, Shift+Tab, and the Enter keys. Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements.
Additional UI, design, and readability adjustments
Font adjustments – users, can increase and decrease its size, change its family (type), adjust the spacing, alignment, line height, and more.
Color adjustments – users can select various color contrast profiles such as light, dark, inverted, and monochrome. Additionally, users can swap color schemes of titles, texts, and backgrounds, with over seven different coloring options.
Animations – person with epilepsy can stop all running animations with the click of a button. Animations controlled by the interface include videos, GIFs, and CSS flashing transitions.
Content highlighting – users can choose to emphasize important elements such as links and titles. They can also choose to highlight focused or hovered elements only.
Audio muting – users with hearing devices may experience headaches or other issues due to automatic audio playing. This option lets users mute the entire website instantly.
Cognitive disorders – we utilize a search engine that is linked to Wikipedia and Wiktionary, allowing people with cognitive disorders to decipher meanings of phrases, initials, slang, and others.
Additional functions – we provide users the option to change cursor color and size, use a printing mode, enable a virtual keyboard, and many other functions.
Browser and assistive technology compatibility
We aim to support the widest array of browsers and assistive technologies as possible, so our users can choose the best fitting tools for them, with as few limitations as possible. Therefore, we have worked very hard to be able to support all major systems that comprise over 95% of the user market share including Google Chrome, Mozilla Firefox, Apple Safari, Opera and Microsoft Edge, JAWS and NVDA (screen readers).
Notes, comments, and feedback
Despite our very best efforts to allow anybody to adjust the website to their needs. There may still be pages or sections that are not fully accessible, are in the process of becoming accessible, or are lacking an adequate technological solution to make them accessible. Still, we are continually improving our accessibility, adding, updating and improving its options and features, and developing and adopting new technologies. All this is meant to reach the optimal level of accessibility, following technological advancements. For any assistance, please reach out to
