Launching the expanded AI Classroom Toolkit with Cyberlite during Global Media and Information Literacy Week 

AI is opening new pathways to information, giving people faster access to answers, ideas, and knowledge. At the same time, it’s making it harder to know whether the content we see is authentic. 

Companies that build AI have a responsibility to make it reliable and trustworthy, and that responsibility doesn’t shift to the people who use it. But AI is already shaping how people search, learn, and encounter information. Helping people navigate that reality means building media and AI literacy (MAIL): the judgment to decide whether and how to use AI and what information to trust. These skills are as foundational as AI safety, and educators are asking for help teaching them. 

That’s why, during Global Media and Information Literacy Week, we’re launching the expanded AI Classroom Toolkit: Unlocking Generative AI Safely and Responsibly, created with the online safety organization Cyberlite. It’s part of Microsoft’s broader commitment to make sure AI strengthens human thinking rather than replaces it. It also reflects Microsoft’s focus on education and empowerment, a core pillar of our Safe Participation Framework. 

What’s new in the AI Classroom Toolkit

The expanded toolkit adds a deeper focus on critical thinking, verification, and media and AI literacy, helping students judge AI outputs and make informed decisions about what to trust online. Together with the original modules, it’s now a single, classroom-ready resource that covers the core of AI safety and literacy. Realistic, scenario-based lessons and activities help students practice these skills in situations they may encounter online: 

• The Climate Campaign: Gina enters an online challenge to make a campaign for a cause she cares about and finds that some winning entries use AI to show events that never happened. Students sort a feed of real and AI-made posts and practice lateral reading. The lesson: whether a post was made with AI doesn’t decide whether it’s trustworthy. What it claims, and who is behind it, does. 

• The Helpful Bot: Alex creates an AI help bot inside his online game, then catches it inventing details and collecting players’ personal information. Students learn why AI can get things wrong, how to trace claims to reliable sources, and why they’re responsible for AI-generated content they act on or share. 

• What Kind of AI User Are You?: An interactive quiz, hosted by Cyberlite, helps students identify their AI habits, strengths, and potential blind spots, and gives them an AI Type to reflect on and discuss. 

“When we created the first Classroom Toolkit: Unlocking Generative AI Safely and Responsibly with Microsoft in 2023, most of the conversation was about using AI safely. Today, the questions young people ask about AI have grown sharper and more personal, like what to believe online or how far to trust a chatbot’s answer,” said Michelle Yao, cofounder of Cyberlite. 

The toolkit also reflects what young people in our co-design sessions with Cyberlite told us: they want to learn by doing, through games, real-life scenarios, and peer discussion. Teachers don’t need to be AI experts, and students don’t need an AI tool in hand to start. 

That approach builds on the reach and results of the original toolkit. Since 2023, the first version has reached educators in 10 countries and 11 languages, including through government and partner learning platforms. In South Korea, 93% of participating educators reported improved knowledge and understanding of ethical issues, privacy, and bias related to AI. 

“Our hope is that every student leaves a little surer of their own judgment, and that everyone feels more confident deciding how AI fits into their lives,” said Yao. 

Literacy works alongside product design and policy

Education is one part of the equation. Our commitment to media and AI literacy also shows up in how we design products and the policies we support.  

Last month, we set out five principles for AI in education, including “AI designed to support students’ learning, not replace their thinking.” We also committed to enforceable privacy, safety, and transparency protections for qualifying educational AI products in US school districts. These protections help schools and families understand how these tools work and the controls available to them. 

Media and AI literacy is now a global priority

The Organisation for Economic Co-operation and Development has released a framework for a MAIL assessment beginning in 2029. As part of its Programme for International Student Assessment (PISA), it will examine how students reflect on, analyze, and evaluate information, including AI-generated information. This week in New Delhi, UNESCO is also launching an AI extension of its “Think Critically, Click Wisely” global curriculum, which Microsoft advised on. 

This growing global focus makes the need for support urgent—educators want help, and many aren’t getting it. In Microsoft’s 2026 AI in Education report, 53% of educators and 77% of students say they haven’t had AI training.  

Closing this skills gap matters beyond the classroom. Healthy societies depend on a shared basis of facts, informed public debate, and confident civic participation. As authenticity gets harder to judge, there’s a risk that people start doubting everything, creating what the Digital Inquiry Group calls a “dangerous declaration of permanent uncertainty.” MAIL offers a way through. It builds the confidence to decide what to trust. 

Media and AI literacy for every age

Across Microsoft, we’re helping people build these skills wherever they learn and find information: 

• In classrooms: Students debate whether to accept, question, or rework an AI tool’s answers in an AI and Critical Thinking lesson from The Economist Educational Foundation, supported by Microsoft. Available alongside other media literacy lessons in Microsoft Learning Zone, the lesson has reached students in 116 countries. 

• Through play: Millions of players have checked sources, spotted bias, and cracked cases of AI misuse in Minecraft Education’s The Investigators and Reed Smart: AI Detective. 

• For content creators: UNESCO, with Microsoft’s support, is developing resources to help creator associations train their members in MAIL and is testing them with creators in Nairobi this week.  

• For voters: Check. Recheck. Vote. helps people apply AI literacy to election information. 

• In our products: Search Progress, built with input from the Digital Inquiry Group, turns research assignments into source-checking practice in Microsoft Teams for Education. 

What’s next 

Through Microsoft Elevate for Educators and local partners, we’ll bring the AI Classroom Toolkit to new audiences, with more languages and localized content rolling out through 2027. We’ll keep evolving it as technology and educators’ needs change. 

Explore the toolkit and supporting resources for educators today.  

AI will keep changing how people find information and the content they encounter. Our goal is to help people meet that change with confident, informed judgment about the AI they use and the information they trust so they can fully take part in civic and democratic life. 

The post In an age of AI, deciding what to trust is a foundational skill. Here’s how we’re helping educators teach it. appeared first on Microsoft On the Issues.

The rapid diffusion of AI globally and the pace at which AI is developing put us at a societal crossroads. The choices we’re making now will determine who has access to AI and the opportunity it affords. There is perhaps no more important tool than our education systems for addressing the uneven diffusion of AI we’re seeing currently: national adoption runs above 70% in countries such as the United Arab Emirates and falls to low single digits across much of sub-Saharan Africa, close to a tenfold difference. 

The way we teach AI and learn with it will have long-lasting impacts on jobs, the workforce, and our broader economy. Learning Curves: Rethinking Education from Classrooms to Careers in an AI-Driven World is a collection of research-driven essays that can help guide those choices. This book brings together the body of work from the second cohort of Senior Fellows from the Microsoft AI Economy Institute (AIEI), a flagship think tank that produces research and convenes experts to generate insights into how AI is reshaping work, education, and the broader economy. 

In Learning Curves, researchers consider how AI is reshaping the earliest stages of learning and work, from K–12 classrooms and community and technical colleges to college‑to‑work transitions and entry‑level jobs, and what it will take for that transformation to widen opportunity rather than deepen divides across institutions, communities, and countries.  

Below, I share a few of my own reflections that informed my contributions to Learning Curves, a collaborative effort that wouldn’t have been possible without the truly talented, diverse cohort of researchers who contributed to this book.  

The good, the bad, and the ugly: Laying the foundation for AI in K–12 classrooms

Before delving into the specifics of how to incorporate AI in classrooms, we need to ask ourselves whether we’re teaching for knowledge, or for learning.  

The book, the calculator, the personal computer, the internet, the search engine, and the smartphone all arrived in classrooms carrying real promise alongside the worry that they would hollow out young minds. Usually the truth landed somewhere in between, and where it landed depended less on the tool than on the choices the adults made about how to use it. 

The fact is that the AI-native generation is already here, and its members are in classrooms around the world. More than half of US teenagers already use AI chatbots for schoolwork. I’ve personally seen the promise of AI as a force for good in education up close in my own classroom, where I teach a computer science class to elementary school students.  

But of course, the good is only part of the story. We can’t shy away from the downsides of incorporating AI into classrooms. While AI can help with accessibility and individualized learning, it can also create over–reliance, contribute to student cheating, or prevent students from recognizing when information may be false. 

The rapid deployment of AI in K–12 classrooms needs to come with a sober assessment of how that technology impacts all students. This assessment must go beyond the technology itself to encompass how students, teachers, parents, and society use AI.   

AI literacy is only part of the solution

If classrooms are where students learn how to think, teachers are the conduit through which this learning happens. In Learning Curves, Joseph Orero, Senior Researcher in AI at Strathmore University’s School of Computing and Engineering Science, posits that teachers aren’t resistant to AI in classrooms; they just need proper training to help them adequately adapt and teach their students critical skills. His research contribution explores game-based learning with AI-enabled African languages. 

AI usage and adoption worldwide are also dependent on accessibility. Another chapter of the book looks at barriers and opportunities in Arabic education and finds that the primary barrier teachers encountered when introducing AI writing assistants into classrooms was Arabic digital literacy, particularly students’ typing ability.  

Researchers often circled around a similar theme: there is no one-size-fits-all approach to developing AI competency; instead, such an approach must be sensitive to local knowledge and contextualized teaching and learning practices. This means that teachers, in turn, must have training that makes sense for the unique contexts in which their students are learning.  

Frank Nagle, now Microsoft’s Chief AI Economist, Sarah Rodriguez, Associate Professor of Engineering Education at Virginia Tech, and other researchers in Learning Curves make the case that, in many ways, nontraditional pathways such as apprenticeships and two-year-degree programs, particularly those that are virtual, are more nimble and thus better able to adapt their curricula to the rapidly changing field of AI.  

AI Is taught in the classroom, but then what?

Education has never been about simply preparing people for the future of work so they can thrive in the labor market. When considered holistically, it is about teaching students not what to think but how to think. In our AI era, education is one of the core institutions through which the future of work will be built, distributed, and made more (or less) equitable. Successful AI integration remains human-centered by focusing on organizational change, durable human skills like empathy and judgment, strong employer partnerships, and learner needs. 

As research from Laura Nuriski, Head of Program on the Future of Work at the Centre for European Policy Studies (CEPS), highlights, access to AI alone does not ensure successful integration. Technology transfer, data infrastructure, organizational readiness, and a human-centered approach to building and deploying AI are also key indicators of success.  

Whether we’re talking about the classroom or the boardroom, it’s worth keeping in mind that AI tends to do the most good when it strengthens human capability and the most harm when it substitutes for it. That holds as true in a fourth- grade reading lesson as in a software team or a hospital ward. 

The children in our schools deserve tools that serve their learning rather than stand in for it, and that is within our power to provide. Our most successful future with AI will be one that is human-centered, inclusive, and designed to help people thrive. 

The post Learning Curves: The future of education, from classrooms to careers, in an AI-driven world appeared first on Microsoft On the Issues.

The people and institutions closest to a community understand their needs best. Libraries, small businesses, nonprofits, and schools see firsthand where AI can create opportunity and where people need support to navigate change. At Microsoft, our role is to help these trusted institutions lead by providing practical resources, training, and clear safeguards that strengthen local capacity and put communities at the center of AI literacy and adoption. 

Public libraries have served as trusted centers of community learning across the United States for generations. Today, we are announcing a new initiative with the Public Library Association, a division of the American Library Association, to expand resources and no-cost AI literacy and skills training for public library workers and their patrons.  

This work delivers on the commitment we made earlier this year through our Community-First AI Infrastructure initiative: to expand access to AI learning and opportunity by investing directly in local training. We’re committed to neighborhood learning through libraries, free literacy training, and certification opportunities, age-appropriate learning in schools and colleges, and support for nonprofit and small-business workforces. This new library initiative is the latest example of our broader work to help trusted local institutions serve as entry points for AI learning, skills development, and opportunity. This program comes alongside small business accelerator programs in TechSpark, our new Elevate for Changemakers platform connecting nonprofits to resources, and our ongoing national and statewide work to bring safe and responsible AI to education. 

Local libraries lead AI learning in their communities 

The Public Library Association AI literacy initiative we are announcing today, Building AI Skills and Agency Through Libraries, is designed to build practical skills, critical awareness, and the judgment to use AI safely and appropriately. It will pair Microsoft’s AI skilling resources with PLA’s national network of expert practitioners to support library workers and community patrons as they navigate this rapidly evolving technology.  

The initiative will expand practical resources and training for library workers, create opportunities to learn from one another through a Community of Practice, and offer free webinars and guidance to support their work with patrons.  

Library workers help people navigate information, find learning resources, and make informed decisions for themselves and their families. Supporting those workers is a practical way to bring AI learning closer to people, while respecting the independence of the institutions they trust. 

The approach reflects a broader view of AI literacy: people need more than instructions for using AI tools; they also need the knowledge and judgment to decide whether, when and how those tools should be used. The training will help library workers and patrons understand how AI works and expand their skills, while also evaluating potential risks, protecting personal and confidential information, critically evaluating AI-generated claims and sources, and better understanding considerations related to safety and bias.   

Equipping trusted local institutions to lead responsible AI adoption 

Last July, we launched Microsoft Elevate, a company-wide initiative that brings together our work to help people and institutions build the skills and capacity to navigate AI responsibly. Under the Elevate charter, each year, Microsoft supports nearly one million nonprofit organizations and education systems worldwide with technology, training, grants and discounts. Microsoft Elevate for Educators, our global community of over 100,000 teachers and school leaders, recently recognized our inaugural group of 20 Beacon Schools and School Systems that are leading examples of AI transformation in education, bringing together effective AI practices while keeping educators and students first. They are powerful examples of what happens when you combine committed educators, AI-powered technology, and intentional, no-cost staff training.

In Washington, our Elevate commitment has included a $3 million, two-year investment supporting 10 school districts and 10 community and technical colleges with grants, coaching, and communities of practice. To date, the initiative has reached 29,375 educators, with early pilots in Kennewick and Everett helping teachers explore practical uses of AI while keeping professional judgment at the center. 

Skills and access must be matched by strong safeguards. In September, Microsoft joined the American Federation of Teachers to establish a national AI Safety & Privacy Standard for Schools, with enforceable protections for student and educator data, human oversight, and transparency for families. Beginning November 1, every US school district can request Microsoft to add these protections to a new or existing agreement, without waiting for renewal or renegotiation. 

That same commitment extends to nonprofit staff and leaders. The Elevate for Changemakers program has already supported over 18,000 learners, helping them build practical AI skills, connect with peers, and earn recognition for turning learning into tangible outcomes for their organizations. And today we are expanding the program and introducing a new, connected experience that brings training, resources, and community together.  

Together, these efforts reflect a simple principle: responsible adoption requires more than technology. Educators, nonprofit changemakers, and community leaders need time, training, trusted connections, practical support, and clear guardrails so they can decide when AI strengthens learning and, equally important, when it does not. 

Investing in locally led economic opportunity across all 50 states

For nearly a decade, Microsoft has partnered with local nonprofits and small businesses across the U.S. through our TechSpark program. 

Through Fellows grants, TechSpark pairs local expertise with Microsoft coaching and a national peer network to help nonprofits expand their impact in their local community and drive accelerated innovation for local small businesses. Today, Microsoft is announcing the new 2027 TechSpark Fellows across all 50 states and releasing the 2026 Fellows Impact Report showing what a locally led model can make possible.  

Over the last three years, the Fellows cumulatively report access to more than $298 million in community funding, 59,600 people trained and upskilled in AI literacy, and more than 1,500 nonprofit partners mobilized to advance their missions within their communities. These numbers tell an important story: no single organization can create lasting opportunity on its own, and local context matters.  

In Virginia, Rosie Riveters Executive Director Brittany Greer is showing what it looks like to build the human capabilities that innovation requires. Through hands-on STEM experiences, students build, test, and troubleshoot to develop the critical thinking, persistence, and independent judgment they will need to use AI thoughtfully. Her work is the kind of learning these partnerships are designed to strengthen.  

Community institutions know their neighbors, understand the barriers they face, and are best positioned to decide how new resources can serve them. 

An ongoing journey

The thread connecting a library worker, a job seeker, a TechSpark Fellow, and a teacher is not a particular product. It is the ability to make informed decisions with support from people and institutions they trust. Our responsibility is to make that support more useful, accessible, and human-centered, while being candid about what we have yet to learn. 

As we navigate the rapid pace of innovation in this AI era, our aim is not simply to bring AI into more places. It is to help people retain a stronger voice in what happens next, in their workplaces, their classrooms, and their communities. 

The post Expanding AI literacy with the Public Library Association and community-based programs appeared first on Microsoft On the Issues.

Most people have opened their messages to find a suspicious alert urgently telling them that a package cannot be delivered, a toll remains unpaid, a bank account needs attention, or a tax bill is overdue. The details may change, but the goal is the same: to get someone to click, share personal information, or pay. 

These messages are relentless. Delete and block one, and another takes its place. Ignore them, and more will follow. Fall for one, and the floodgates open. What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation. 

When Microsoft and Japan’s National Police Agency (NPA) followed a wave of fraud and scam activity targeting people and businesses in Japan, they expected to find individual campaigns. Instead, they found themselves inside a sprawling Chinese-language cybercrime marketplace where criminals could buy accounts, hosting services and tools used to create fake websites and online identities. The investigation expanded globally, involving the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs to uncover the businesses sustaining this criminal ecosystem. 

Today, Microsoft and Health-ISAC, a global non-profit that helps health sector organizations share cyber threat information and collaborate to improve operational resilience, are moving to dismantle three components of this criminal marketplace: YAM Store, CoGUI and Iron Man.  

Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone. These messages have been used to target consumers, healthcare organizations, financial institutions, and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.   

Tracing the businesses behind the scams

The investigation began in late 2025 after Japan’s NPA alerted Microsoft to malicious messaging campaigns targeting people in Japan. NPA continued providing intelligence and investigative support as the partners traced those campaigns back to the businesses supplying criminals around the world. 

The trail led investigators deep into a Chinese-language cybercrime ecosystem that was difficult for non-native-speaking investigators to penetrate. There, they gained access to CoGUI, which supplied criminals with ready-made websites and messages impersonating companies, financial institutions, government agencies, and other trusted organizations. Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.  

As Microsoft’s investigation expanded, intelligence from JC3 helped confirm the scale of the activity affecting Japanese organizations and their customers. Drawing on information collected across its network of more than 130 member organizations, JC3 connected what appeared to be separate incidents to a broader pattern of scams targeting Japanese companies and financial institutions, including efforts to defraud consumers and to steal credentials and other sensitive information.  

One name that kept appearing throughout the investigation was YAM Store. YAM Store operated much like an online shop. Customers could browse products, compare prices and purchase fraudulent Microsoft and Google accounts and other ready-made tools used to carry out scams, including credential theft. Controlled purchases conducted by Microsoft helped confirm how it worked. 

In some cases, operators acquired internet domains that legitimate organizations had allowed to expire, often targeting certain sectors, such as non-profits and education, with specialized product offerings. They then rebuilt the websites to make those organizations appear active, allowing them to fraudulently obtain Microsoft 365 accounts that could later be sold through YAM Store.  

Ready-made tools

YAM Store provided criminal infrastructure that was frequently paired with tools and services such as CoGUI. As investigators dug deeper, they found that the marketplace was already evolving. CoGUI had become one of the most widely used offerings in the ecosystem, particularly targeting victims in Japan and the United States but by mid-2026 it was increasingly being replaced by a newer offering known as Iron Man. 

Iron Man expanded the model by giving criminals access to thousands of ready-made templates designed to impersonate trusted organizations. Criminals could then quickly deploy email, text and web content tailored to specific brands, industries and countries.  

Through test purchases and work with Resecurity, investigators gained access to Iron Man and identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments, government agencies, and other organizations across more than 150 countries worldwide. Some were designed for government impersonation scams, using the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information. Others impersonated organizations across industries, countries, and languages, from banks and airlines to telecommunications companies, retailers, and parcel delivery services.  

Examples of these impersonation templates are below. Importantly, the presence of an organization or government entity in these templates does not indicate that its systems were compromised. 

A blog from Microsoft Threat Intelligence shares more details on the network, as well as steps customers can take to protect themselves.  

Putting the pieces together

No single organization saw the full picture. Japan’s NPA played a critical role throughout the investigation, providing intelligence, investigative support and collaboration that helped uncover how the operation worked. JC3 helped establish the scale of the activity affecting Japanese organizations and consumers. Health-ISAC provided insight into impacts affecting healthcare organizations, while Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs contributed intelligence and investigative support.  

Working together, and with the assistance of AI tools, we connected accounts, websites, and infrastructure that initially appeared unrelated, helping expose the broader criminal marketplace behind them. Microsoft also worked closely and shared intelligence with U.S. Secret Service and international law enforcement partners.

This investigation also reflects a broader trend highlighted in this year’s Microsoft Digital Defense Report: modern fraud increasingly relies on businesses and services that make it easier for criminals to reach more victims. It took two-way information sharing across industries and international borders to uncover how these deeply interconnected services worked together. 

Going after the suppliers

With an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that were part of the underlying infrastructure powering YAM Store, CoGUI and Iron Man. Microsoft has already disabled more than 20,000 accounts connected to YAM Store and continues to dismantle the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.   

What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world. YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on. 

The scam message is often the only part victims see. The businesses behind it are what make it possible. 

The post Disrupting the service economy behind transnational cybercrime operations appeared first on Microsoft On the Issues.

We believe in the strength and talent of the American workforce. That is why the vast majority of Microsoft employees in the United States are Americans.

We look forward to providing the Administration with additional information. For example, of the approximately 6,000 H-1B visa applications we submitted in the last fiscal year, 80% were to extend or change the status of existing Microsoft employees. These were not to hire new people. The remaining filings for new employees were for individuals already legally in the United States who decided to come work for us, and they equal only 1% of our U.S. workforce. They are not new arrivals to our country.

Microsoft only files H-1B petitions for those who meet the rigorous standards of this visa category. We pay our employees some of the highest compensation in the tech sector, and our wages are among the highest of all H-1B filings. We pay our H-1B employees the same as any other employees doing comparable work.

Microsoft succeeds as a global technology leader by developing the world’s best technology workforce. We do this by strengthening this country’s talent pipeline, hiring American workers, and attracting the best talent from around the world.

The post Microsoft Comment on Recent Immigration Questions appeared first on Microsoft On the Issues.

According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are also the most frequently targeted sectors for nation-state activity. They are attractive targets because they hold sensitive information, operate essential services, and sit at the center of networks of agencies, contractors, technology providers, and critical infrastructure operators.  

Dwell time, the period between when an attacker gains access and when defenders detect and stop them, also increased this year across multiple sectors. While organizations responded faster once an intrusion was identified, detecting threats early remains a challenge. Attackers increasingly gain access through techniques that mimic legitimate activity, making malicious behavior harder to spot. For example, phishing accounted for 23% of observed intrusions in 2026, up from 7% in 2025, highlighting the continued importance of compromised identities as an entry point for broader attacks. 

Taken together, the implication for governments is clear. Security in the AI era is no longer simply about preventing individual intrusions. It is about ensuring institutions can operate effectively in an environment where risks are interconnected, threats move faster, and attackers remain hidden longer. Public-private partnerships are also more important than ever for securing critical government infrastructure and developing the policies and regulations needed for emerging technologies.  

In this year’s report, which examines cyber threat trends observed between July 2025 and June 2026, Terrell Cox, Microsoft’s Corporate Vice President & Deputy Chief Information Security Officer, and I explore how these dynamics are reshaping cyber risk. In a companion blog, Terrell takes a closer look at what these findings mean for CISOs and security professionals.

 

To strengthen resilience, governments should focus on five priorities:

1. Prepare for a faster threat environment 

AI is compressing the window for action. Adversaries are moving faster. A vulnerability’s discovery in the wild to active weaponization can be well below 24 hours. While the number of publicly disclosed software vulnerabilities (commonly tracked as CVEs) is projected to reach a record 72,000 in 2026. 

Governments best prepared for the future will be those that can rapidly gather and assess information, make decisions, coordinate across institutions and industries, and communicate effectively during a crisis. This requires clearly defined responsibilities and trusted relationships established before an incident occurs, enabling swift and coordinated action when it matters most.  

2. Build security into the AI ecosystem  

AI is becoming part of the infrastructure that governments, businesses, and citizens rely on every day. As governments continue to adopt AI across public services and encourage its broader use, they should approach its security as a resilience challenge rather than a narrow technical issue. 

AI systems depend on interconnected infrastructure, data, models, applications, suppliers, and governance processes. Governments should promote security across this ecosystem through secure-by-design practices, testing and evaluation, stronger supply chain protections, transparency, accountability, and international cooperation on AI risk. 

The goal is not to create a separate AI security agenda. It is to integrate AI security into broader efforts to protect critical infrastructure and build national resilience. 

3. Plan for incidents to spread

Governments may not immediately know whether an intrusion is criminal, geopolitical, or something else. Cybercriminals and nation-state actors pursue different objectives, but increasingly rely on many of the same entry points, including compromised identities, exposed applications, social engineering, and legitimate administrative tools. 

Microsoft found that 52.2% of intrusions involving valid accounts resulted in additional credential theft, highlighting how quickly attackers can expand beyond an initial foothold. A seemingly isolated compromise can evolve into ransomware, espionage, data theft, or disruption of essential services. 

Governments should therefore assess incidents not only by how they begin, but by where they could lead. Response plans should account for the suppliers, partners, and service providers supporting critical functions. As attacks expand beyond their initial targets, they can also cross organizational, sectoral, and national boundaries, reinforcing the need for global collaboration. 

4. Enable timely, two-way public-private information sharing 

A compromised account at one organization may provide early warning of a broader campaign. Signals that appear inconclusive in isolation can reveal coordinated activity when combined across organizations and jurisdictions. Modern cybercrime operates through interconnected networks of actors, services, and infrastructure that no single institution can fully see or disrupt on its own. 

Information sharing must be timely, trusted, and two-way—also known as bidirectional. The goal is not simply for companies to report threats to government. Public agencies should also return actionable intelligence, guidance, and warnings that help organizations protect their networks, customers, and operations. Trusted channels can enable this exchange among government agencies, law enforcement, critical infrastructure operators, technology providers, and international partners while respecting legal and privacy requirements. 

Policymakers can support this cooperation through protections for good-faith information sharing, common anonymization standards, and investment in shared threat intelligence and detection capabilities. Information sharing should also lead to action, including investigations, disruption efforts, and accountability for those responsible for serious cyber intrusions. 

5. Prepare essential services to operate through disruption

The organizations governments depend on to deliver public services, including transportation systems, communications infrastructure, schools, universities, and critical infrastructure operators, are increasingly targeted by cyber threats. Resilience therefore requires understanding not only government systems, but the broader ecosystem that supports them.

Planning documents alone are not enough. Governments should regularly conduct tabletop exercises bringing together policymakers, operational leaders, law enforcement, critical infrastructure operators, and private-sector partners to test how they would respond to incidents disrupting essential services. These exercises can expose gaps in decision-making, information sharing, public communications, and cross-sector coordination before a real-world crisis. Microsoft’s work through initiatives such as the Advancing Regional Cybersecurity (ARC) program, most recently in Kenya, illustrates how scenario-based exercises and cross-sector collaboration can help strengthen preparedness and response capabilities across the broader ecosystem. 

Government leaders should also know which services are most critical, which identities, systems, suppliers, and infrastructure support them, and how incidents will be escalated. Shared-service approaches can help extend security and response capabilities to local governments and public institutions that cannot build them independently. 

As cyber incidents cross organizational and national boundaries, resilience depends not only on technical preparedness, but on whether institutions can coordinate effectively under pressure. 

In an era of AI-enabled and increasingly interconnected cyber threats, resilience is no longer simply about recovering from an attack. It is about preparing for a world in which cyber incidents move faster, spread further, and affect more organizations than ever before. Governments best prepared for the future will be those that can contain harm, adapt quickly, and continue delivering critical services when citizens need them the most.  

The post Preparing governments for an era of interconnected cyber risk appeared first on Microsoft On the Issues.

Microsoft has served the Middle East since it began operations in the region in 1991. Since then, we’ve steadily expanded our presence and investments, growing from a local technology provider into a long-term partner to governments, businesses, educational institutions, and civil society organizations. Today, Microsoft is reaffirming that commitment through a new framework focused initially on Kuwait, Qatar, Saudi Arabia, and the United Arab Emirates.  

We are expanding our investments in the Middle East with confidence in the region’s future as it pursues one of the world’s most ambitious AI transformations. We will add to our local partnerships across the region. We will build on the work we have done to stand by these countries’ governments and people through a period of significant challenges. As we look to the future, we will invest further in technology, digital resilience, and the people across the region.   

From now until 2030, we will pursue the following initiatives with our partners in the region:  

Technology

We will expand cloud and AI infrastructure across the Middle East 

Microsoft will continue to invest in cloud and AI infrastructure across the region, expanding capacity, launching new capabilities, and delivering long-term infrastructure commitments. We plan to invest more than $10 billion in capital and operating expenses between now and 2030 in the region.  

We will deepen our partnerships through national AI champions 

Microsoft will deepen strategic partnerships with governments and national AI champion organizations to translate AI ambition into economic growth, modern public services, and global competitiveness. This builds on work with organizations including HUMAIN, G42, QAI, and the Government of Kuwait, alongside digital-government initiatives such as TAMM in the UAE, SDAIA’s ALLaM in Saudi Arabia, TASMU in Qatar, and Microsoft 365 Copilot adoption across the Government of Kuwait. 

These partnerships will support responsible AI adoption, sovereign-ready cloud services, Arabic and multilingual AI, and the use of AI to improve services for citizens and businesses. They will be supported by capabilities including Microsoft Sovereign Public Cloud, Sovereign Private Cloud, and Project Digital Shield, where relevant and available. 

We will invest in subsea and terrestrial connectivity 

Digital resilience depends on strong and reliable networks. Protecting subsea and terrestrial connectivity requires sustained cooperation between governments and the private sector, but the foundation of continuity is redundancy.  A diverse network of high-capacity routes allows traffic to be rerouted around disruptions, minimizing latency and maintaining critical data flows.  

Microsoft has helped expand both the capacity and reliability of digital connectivity across regions through investments in major international subsea cable systems, including SeaMeWe-6, which has landings in Qatar, Saudi Arabia, and the United Arab Emirates, as well as operating a global network spanning more than 275,000 miles of terrestrial and subsea fiber. During network disruptions, Microsoft has demonstrated the value of redundancy by rerouting traffic through Middle East corridors and maintaining service continuity with minimal impact on customers.  

Building on this foundation, Microsoft plans to invest more than $400 million in subsea and terrestrial connectivity across the Middle East by 2030. This investment will expand capacity, strengthen regional data flows, and support Microsoft’s growing cloud and AI infrastructure footprint across the region.  

We will build AI infrastructure with the planet in mind

As we expand our cloud and AI infrastructure in Kuwait, Qatar, Saudi Arabia, and the UAE, we will do so with a focus on responsible growth. Guided by Microsoft’s global goals to address carbon, water, waste, and ecosystems, we will work with our lessor partners to ensure that the cloud infrastructure supporting our services advances Microsoft’s water-positive ambitions, including by prioritizing zero-water cooling technologies where feasible. 

Water resilience is particularly important across the Middle East. Building on Microsoft’s global experience advancing water stewardship through water reuse, replenishment, and innovative water management solutions, we will work with governments and local stakeholders to identify opportunities that advance responsible water stewardship across the region. 

As AI accelerates economic opportunity across the Middle East, expanding access to clean energy will be essential to ensuring this growth is sustainable. We will also collaborate with regulators, utilities, and our lessor partners to help create the market conditions needed to expand carbon-free electricity procurement and stimulate new clean energy investment. By combining infrastructure investment with local partnerships and innovation, we aim to support the region’s energy and water priorities while helping build the sustainable foundations needed for long-term AI-led economic growth. 

Digital resilience

We will launch a new Middle East digital resilience initiative 

Conflict in the Middle East has reinforced the connection between digital resilience and digital sovereignty. Microsoft has worked with customers to support business continuity through resilience options tailored to different operational and regulatory needs. Going forward, Microsoft will make digital resilience a cornerstone of its Middle East strategy, helping organizations strengthen continuity and recovery through digital resilience assessments, reference architectures, readiness guidance, continuity planning, and enablement programs that help identify vulnerabilities, protect critical data, and build tested recovery capabilities.  

We will strengthen data protection, privacy, and business continuity 

Microsoft will expand our existing commitments on data-protection sovereignty and business continuity to eligible governments and customers in Kuwait, Qatar, Saudi Arabia, and the UAE. These are designed to give organizations greater confidence in how their data, systems, and operations are protected while maintaining continuity in times of uncertainty. They will be complemented by Microsoft’s growing sovereign-cloud portfolio, including Sovereign Public Cloud and Sovereign Private Cloud capabilities, together with Project Digital Shield and other capabilities that support security, privacy, transparency, and operational resilience. 

 We will expand and strengthen cybersecurity cooperation 

As Kuwait, Qatar, Saudi Arabia, and the UAE accelerate their digital transformation, cybersecurity has become a core pillar of national and economic security. As governments, critical infrastructure, and economies become more connected, cyber threats and influence operations can have consequences that extend far beyond physical borders.  That’s why we are announcing that we are deepening our partnerships with the cybersecurity authorities in these countries.  

A network of dedicated Microsoft cybersecurity champions in Kuwait, Qatar, Saudi Arabia, and the UAE will help governments translate these resources into action and connect national priorities with expertise across Microsoft. Stronger cybersecurity benefits far more than individual networks. It helps build trust to ensure digital transformation will succeed.  

We will advance responsible AI through governance, assurance, and inclusion 

Microsoft will work with governments, businesses, researchers, and civil society organizations across the Middle East to help people and institutions benefit from new technology. As AI advances, realizing its full potential will require not only access to powerful technology, but the governance, assurance, and skills required to deploy it confidently and responsibly.  

We will help strengthen AI governance capabilities across the region and support practical approaches to testing, evaluating, and assurance systems. We will also expand collaboration with the Responsible AI Future Foundation (RAIFF), co-founded with G42 and the Mohamed bin Zayed University of Artificial Intelligence (MBZUAI), to support the development and sharing of responsible AI practices and evaluation tools that can be applied across high-impact AI use cases in the Middle East and beyond.  

By helping organizations align with emerging international practices, we aim to strengthen confidence in AI systems, support responsible innovation, enhance global competitiveness, and ensure that the Middle East plays an active role in shaping the future of AI. 

We will advance AI for Good research and innovation 

Microsoft’s AI for Good Lab will continue to support the region through research and partnerships focused on food security, low-resource language development, and climate and disaster resilience. This includes work through initiatives such as the LINGUA program, which supports the development of language technologies for underserved communities.  

In partnership with governments, NGOs, nonprofits, and research institutions, the AI for Good Lab will continue developing and scaling AI solutions that address real-world challenges across the Middle East and beyond.  

People

We will prepare the next generation for the AI economy 

We believe AI should enhance human ambition, strengthen human capability, and help prepare workers to thrive in a changing economy. That is why Microsoft will continue to invest in AI skills, workforce readiness, public-sector capability building, and inclusive talent development across Kuwait, Qatar, Saudi Arabia, and the UAE, building on existing commitments to help skill more than 4.2 million people by 2030.

This work includes training for public-sector leaders, students, and workers; initiatives focused on expanding opportunities for women; and partnerships with educational institutions across the region. This work builds on programs such as Saudi Arabia’s AI Global Leadership Program, AI Skills 4 Women programs in Saudi Arabia and Qatar, and the Women’s Datacenter Academy in Saudi Arabia. Microsoft will also engage with workforce coalitions that can support national talent strategies and policy recommendations. 

We will help education communities prepare learners for the AI era 

Microsoft is working with governments, educators, institutions, and partners across the Middle East to develop responsible AI principles across primary, secondary, and tertiary education. This includes supporting AI literacy, helping educators integrate AI into teaching and learning, and sharing practical guidance for responsible AI use in educational settings. Across Kuwait, Qatar, Saudi Arabia, and the UAE, we will work with local partners to ensure students and educators can benefit from AI safely, responsibly, and effectively and will engage educators, policymakers, industry leaders, and civil society to support practical approaches to AI implementation that reflect local priorities. 

We will help empower workers in the AI economy 

We will partner with governments, employers, workers, education providers, and other stakeholders to help people adapt to changing workplace demands. Our focus is on practical skills development, workforce readiness, and leadership development that helps countries build competitive economies and create new opportunities for workers in an AI-enabled future.  

We will support local and national AI talent priorities across the Middle East 

Microsoft is partnering with governments, academic institutions, and civil society organizations to support national talent priorities by advancing AI skills, leadership development, and workforce readiness programs for public-sector leaders, students, underrepresented talent, and people across the Middle East. The goal is to help countries build globally competitive workforces, accelerate innovation, and unlock new economic opportunities in the AI era.  

From ambition to impact

While no one can predict the future, one thing is certain: Microsoft has been part of this region’s journey for more than 35 years, and we are committed to being a partner for the long term. We look forward to continuing to work alongside governments, businesses, educators, and communities to help build that future together. 

The post Microsoft strengthens its commitment to the Middle East by investing in technology, digital resilience, and people appeared first on Microsoft On the Issues.

Microsoft has disrupted EvilTokens, a powerful cybercrime platform that used AI at every step of the attack chain—from compromising email accounts to designing intricate roadmaps for financial fraud and scams. While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed. The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action. 

In short, AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible.   

Within months of launching in February 2026, EvilTokens had been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, showing how quickly the service gained traction. Microsoft observed the highest concentrations of victim activity in the United States, Canada, the United Kingdom, Australia, India, and France. Affected organizations ranged from wholesale distribution and construction to financial services, real estate, higher education, and healthcare. Working with partners, Microsoft seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure. In the United Kingdom, the Metropolitan Police Service’s cybercrime team arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens.  

But the significance of EvilTokens extends beyond its rapid growth and global reach. It offers an early warning of what happens when cybercriminals combine stolen access with AI capable of understanding how an organization works. 

From account access to financial fraud

EvilTokens helped criminals gain access to email accounts by tricking victims into entering an authentication code on Microsoft’s legitimate sign-in page. By completing the normal authentication sign-in process, victims unknowingly gave criminals access to their email accounts without revealing their passwords. That access could persist even after a password reset if the associated sessions and tokens were not also revoked. Microsoft Threat Intelligence provides additional technical details about the operation, how device-code attacks work, and steps customers can take to protect themselves here. 

Once inside an account, criminals have traditionally needed time and experience to sift through thousands of messages, identify decision-makers, understand payment processes, and find opportunities for fraud. 

EvilTokens began automating that work. Its AI tools could summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets. Preset prompts offered to find wire-transfer discussions, identify the organization’s “money movers,” locate vendor invoices, and determine the best people to impersonate.

The post Disrupting EvilTokens: The AI Chatbot Built for Cybercrime appeared first on Microsoft On the Issues.

Today we published our latest Global AI Diffusion Report. Global AI diffusion continued to climb in the second quarter of 2026. In June, AI usage was 18.8% of the working-age population worldwide, an increase of about 1% from the first quarter of this year. Growth was broad-based: almost every economy saw increased usage.

Notably, the UAE (73.3%) and Singapore (64.3%) continue to top the leaderboard. South Korea again saw the largest absolute change, with an increase of 3.5 percentage points. Saudi Arabia climbed five places from 30th to 25th, the largest rise in the rankings. Japan recorded the largest relative change, growing by 2.2 percentage points, or roughly 10% relative to its Q1 usage of 22.5%. Worldwide, the quarter brought a continued widening of the AI gap between the Global North and South, with usage now at 28.8% in the North and 16.2% in the South.

To track all these trends, we continue to measure AI diffusion as the share of people worldwide ages of 15 and 64 who have used a generative AI product during the reported period. This measure is derived from aggregated and anonymized Microsoft telemetry data and is adjusted to reflect differences in operating system and device market share, internet penetration, and population. Additional details on the methodology are available in our AI Diffusion technical paper.

No single metric is perfect, and this one is no exception. Through the Microsoft AI Economy Institute, we continue to refine how we measure AI diffusion globally, including how adoption varies across countries in ways that best advance priorities such as scientific discovery and productivity gains. For this report, we rely on the strongest cross-country measure available today. Over the past year, there has been a significant rise in new AI tools and models. For our next report, we will expand our measure to include usage of these new tools and expect this update to increase AI user share across almost all economies, with larger projected increases in China.

In addition to our comparison of AI diffusion between the Global North and the Global South, we also find important differences in how AI is being used. Using consumer Microsoft Copilot usage insights, we examined these differences. The most notable difference is a higher share of education and learning use in the Global South.

This report also includes a substantive discussion of open-weight AI models. Open-weight AI model use is increasingly visible through application programming interface (API) usage of AI, where open models have captured a growing share of token volume. This shift could especially benefit the Global South by lowering access costs and enabling adaptation to local languages and needs, although barriers such as infrastructure, connectivity, and skills remain.

Download the latest Global AI Diffusion report and explore the data here.

The post The continued state of global AI diffusion in 2026 appeared first on Microsoft On the Issues.

Why LinkedIn is challenging an overbroad government demand—and why Congress must make secrecy the exception

Today, the U.S. Court of Appeals for the Fourth Circuit heard oral argument in LinkedIn’s (a Microsoft subsidiary) appeal challenging a government demand for user records and a related secrecy order that is preventing LinkedIn from notifying those users that the government is seeking their data. The appeal asks important, constitutional questions about whether service providers may challenge demands that sweep in records unrelated to an investigation, and when the government may prevent a provider from notifying the user of a request.  

This appeal continues Microsoft’s longstanding work to ensure that secrecy orders remain the exception, not the rule. LinkedIn’s appeal asks courts to enforce meaningful limits on both the scope of government demands and the secrecy that can accompany them. 

We recognize law enforcement’s important role in protecting public safety and investigating crime, and sometimes that does need to be done covertly. We respond to lawful legal requests. At the same time, customers and users deserve meaningful limits and independent oversight through an adversarial process. And, customers deserve to be notified when the government seeks their data, unless the government clearly establishes the need for secrecy under statutory and constitutional standards. 

Those safeguards fulfill basic constitutional rights. The Fourth Amendment protects the right to be free from unreasonable searches and seizures. That right applies to papers kept in a desk, and it also applies when personal and business records are stored online. Online service providers, like LinkedIn and Microsoft, also have a First Amendment right to speak to their customers when the government obtains an order to search their private information. Secrecy may sometimes be justified—but it should be tailored to demonstrated needs and subject to meaningful review.  

This particular case arose after LinkedIn received a court order seeking user records together with a secrecy order preventing LinkedIn from informing anyone about the order. The details remain under seal, including the nature of the information the government seeks and the people who own that information. But the Fourth Circuit partially unsealed LinkedIn’s opening brief in July, allowing the public to understand some of the core issues. LinkedIn argues that the demand is overbroad, the secrecy order is unconstitutional, and the government has violated LinkedIn’s due process by withholding evidence from LinkedIn. 

Three amicus briefs from a broad coalition support LinkedIn’s position. The American Civil Liberties Union and ACLU of Virginia argue that users’ privacy interests must inform whether a demand is reasonable and that providers may be the only practical means of challenging unlawful process because users often receive no notice. The Reporters Committee for Freedom of the Press warns that overbroad demands, delayed notice, and secret evidence can expose confidential sources and chill newsgathering. Amazon, Apple, Google, Meta, and X emphasize that cloud providers are uniquely positioned to identify irrelevant requests and that secrecy orders require case-specific evidence rather than boilerplate assertions. Together, these briefs show why cloud providers must be able to test both the scope of government demands and the need for secrecy. 

Microsoft has a long record of standing up for these principles. In 2014, Microsoft successfully challenged a secrecy order connected to a National Security Letter that prevented notice to an enterprise customer. In 2016, we filed a landmark challenge to the widespread use of indefinite secrecy orders. We’ve successfully challenged individual secrecy orders time and again over the years. Our efforts contributed to updated Justice Department policies, but executive-branch practices can change. Durable protections require the development of case law and legislation. 

The U.S. House of Representatives recently took an important step in that direction. On August 31, the House passed legislation to rein in secret surveillance and strengthen notice protections when the government seeks data held by technology providers. As we explained when the bill passed, the reforms would place clearer limits on secrecy orders, require greater accountability, and help ensure that secrecy is the exception – not the rule. The Senate should act promptly to send these historic reforms to the President. 

The House –passed legislation recognizes that privacy and public safety are not opposing values. Clear standards can give investigators the confidentiality they genuinely need while providing courts, providers, and customers with predictable rules. The pending legislation and LinkedIn’s appeal are the latest, complementary chapters in this broader effort. Legislation can establish durable, system-wide rules for notice and accountability. Courts must meanwhile enforce the limits already contained in existing statutes and the Constitution. Neither task requires obstructing legitimate investigations. Rather, both mean the government must seek only relevant information, justify secrecy with specific evidence, and infringe on speech to the least extent possible. 

That is why today’s argument matters beyond a single sealed investigation. People and organizations increasingly entrust their most sensitive information to online services. If providers cannot challenge demands they know are overbroad—or if courts may silence them without a rigorous, adversarial review—the safeguards the law requires will be weakened precisely when they are most needed.

Microsoft and LinkedIn will continue to support lawful investigations while standing up for customer privacy, transparency, and the rule of law. We have appealed to the Fourth Circuit to preserve providers’ ability to challenge overbroad demands and to require the government to meet its constitutional burden before imposing secrecy. And we urge the Senate to complete the work the House began by enacting durable non-disclosure order reform.

Further reading 

• House passes historic reforms to rein in secret surveillance 

• New success in protecting customer rights unsealed today 

• Keeping secrecy the exception, not the rule 

• DOJ acts to curb the overuse of secrecy orders. Now it’s Congress’ turn. 

• DOJ’s newly released recommended practices are a win for cloud and enterprise customers 

• Ensuring secrecy orders are the exception not the rule when the government seeks data owned by our customers 

• The need for legislative reform on secrecy orders 

• Freedom is built on the protection of privacy | Episode 2 

The post Protecting customer privacy means standing up for transparency appeared first on Microsoft On the Issues.

As Americans prepare to vote this November, artificial intelligence is changing how many people find and understand election information. 

Some voters are deliberately turning to AI tools with questions about candidates, ballot measures, election procedures, and issues that matter to their communities. Others are encountering AI-generated summaries at the top of search results. In either case, AI is increasingly becoming a front door to election information. 

This shift is happening quickly. More than 30% of the U.S. working-age population now uses AI (Microsoft AI Diffusion Index, Q1 2026; Microsoft, AI Adoption Across the United States). These tools can help people understand complicated topics, compare information, and explore unfamiliar issues. But election information can also present some challenges for AI. It is highly local, changes quickly, and can be incomplete, contested, or stripped of essential context. 

The answer is not to steer voters away from AI, it is to help people use it wisely, particularly when the information may influence aspects of their voting experience, such as how, when, and where they cast their ballot. 

That is why, on National Voter Registration Day, a day when our brands and products come together to encourage civic participation, we’re launching the next phase of our voter education initiative, Check. Recheck. Vote. This year, the campaign will equip voters with practical AI literacy skills for the 2026 election season.  

Check. Recheck. Vote.

We launched Check. Recheck. Vote. in 2024 to help voters recognize the risks posed by deceptive AI-generated content. Deepfakes and other deceptive media remain a serious concern. But in conversations with voters and election organizations, we are also hearing about a broader and more immediate challenge. Millions of people now encounter election information through AI-generated answers, and many are not sure how to determine whether those answers are current, complete, or reliable. 

The updated campaign gives voters three straightforward steps: 

• Check the sources and citations behind an AI-generated answer. Look for where the information came from, who published it, and when it was last updated. Be cautious when an answer provides no sources. 

• Recheck important details by visiting the original sources and comparing what other credible sources say. This is especially important for fast-changing or location-specific information. 

• Vote based on current information from your state or local election website, including official guidance on registration, voting options, deadlines, and polling locations. 

At the center of the campaign is a new 75-second video that shows how an AI-generated answer can appear during an ordinary election-related search, explains where these answers can fall short, and offers simple steps voters can take before relying on them. 

The campaign website pairs the video with practical guidance and links to authoritative election resources, including state-by-state voting information and tools for educators.  

We are working with the National Association of Secretaries of State (NASS) and the National Association of State Election Directors (NASED) to scale the reach of this campaign across all fifty states and the territories and to point voters to accurate information directly from state and local election officials so they can participate with confidence. 

We believe that civics and voter education start well before a citizen is old enough to vote. That’s why we are also investing in efforts to extend AI voter literacy education in the classroom. The campaign website includes a classroom activity to help students examine how AI may shape the election information they encounter, practice verifying claims, and keep their own judgment at the center of the process. We are also amplifying our impact on this important issue by supporting the News Literacy Project. 

We’re also proud to announce today that, in partnership with iCivics, we are launching Village Square – a new Minecraft Education civic learning experience that helps students explore how communities make decisions and solve shared challenges. The game brings concepts such as dialogue, participation, and collective decision-making to life through immersive gameplay. Village Square gives educators and families an engaging, nonpartisan way to help young people practice listening to different perspectives, weighing trade-offs and working together to build stronger communities. 

Finally, we know that credible local reporting remains essential to informed civic participation, and that reporting is under strain in many communities. 

In Washington state, Microsoft is partnering with the Associated Press Fund for Journalism to expand election coverage for 10 local newsrooms operating 14 news websites. Participating newsrooms receive access to AP election results and race calls, vote tabulations, state-specific maps and graphics, and resources that help local journalists connect national and statewide developments to the communities they serve. 

The newsrooms represent communities from Seattle to Spokane and the Wenatchee Valley. Their work complements the reporting of the Associated Press, helping trusted, fact-based election coverage and results reach communities that might otherwise lack access. 

This investment reflects a broader reality. Voters need more than information. They need reliable sources that can provide context, ask hard questions, correct mistakes, and explain what national developments mean at the local level. 

Microsoft’s Support for the 2026 Midterms

Voters aren’t the only ones navigating this AI moment, so are the people running campaigns and conducting elections, all while facing an increasingly complex cybersecurity landscape. Microsoft has long supported the security and resilience of campaigns and elections. In 2018, we launched AccountGuard to help political campaigns and democracy-focused organizations defend against cyberattacks, and during the 2024 election cycle we joined dozens of other technology companies in the Tech Accord to Combat Deceptive Use of AI in 2024 Elections. Here’s how that commitment continues today: 

Equipping election officials. With The Elections Group, International IDEA, Ready for Tuesday and Arizona State University’s Mechanics of Democracy Lab, we launched the free, open-source AI + Elections Skills Hub: prompts, sample AI agents, and draft policies for responsible adoption. It’s already reached 1,000+ officials across 45 states. 

Strengthening cybersecurity. We’ve deployed Microsoft Sentinel to several state and local election offices for stronger threat detection, and we’re also supporting select election and political stakeholders with MDASH to find and fix software vulnerabilities faster. 

Countering bomb hoaxes. More than 300 emailed bomb hoaxes disrupted polling places in 2024. In response, we’ve started a new Elections Bomb Threats Task Force alongside partners Social Scout, Nisos, and the Committee for Safe and Secure Elections (CSSE) to bring together digital intelligence and law enforcement expertise to track & share trends and reduce disruptions. An initial report on the hoaxes encountered in 2024 will shape our approach for 2026. 

Supporting campaigns. Built with Defending Digital Campaigns, our Secure AI Toolkit for Campaigns has reached 3,000+ campaigns and political stakeholders with practical AI guardrails. Our Campaign Technology team has also trained thousands of candidates, staff, and officials from both parties on responsible AI use and cybersecurity best practices. 

The technology continues to change, but our approach remains consistent: help voters find authoritative information and make informed judgments, help campaigns and election authorities defend against evolving threats, and help the election community adopt technology that strengthens security, accountability, and civic participation. This work is bipartisan by design, and it includes: 

• Azure for Elections – prioritized support and security for elections-critical cloud workloads 

• M365 for Campaigns – secure, cost-effective collaboration and email for candidates and campaigns 

• Deceptive AI in Elections Reporting – malicious deepfakes of candidates and election officials are disallowed on Microsoft platforms, and targeted individuals can report them directly 

• Content Provenance – Microsoft image generation products affix content provenance to images, with LinkedIn displaying that provenance to users 

• Civic engagement – continuing our long-standing work to promote civic engagement through our own products and partnerships 

The 2026 election will be the first U.S. federal election in which generative AI is part of the everyday environment for millions of voters as well as those who support the political process. That creates new risks, but it also gives us an opportunity to equip people with skills that will remain valuable well beyond a single election. 

The post 2026 midterm elections: Helping voters navigate election information in the age of AI appeared first on Microsoft On the Issues.

Today, Microsoft is sharing our Safe Participation Framework, which centers on designing and enabling safe, privacy-preserving, and age-appropriate experiences for young people online. Members of our AI Youth Futures Council have delivered a clear message: they want to learn, create, and prepare for a future with AI. Protecting their privacy, ensuring their safety, and preserving their opportunity to participate must go hand in hand.   

They are right. Children and families should not have to choose between the protections they need and the opportunities technology can provide. 

Technology companies have a responsibility both to protect young people from harm and to ensure they can benefit from technology through thoughtfully designed experiences, age-appropriate protections, and demonstrable safeguards. Microsoft’s Safe Participation Framework serves as a foundation for our work today, and we expect it to continue evolving as technology, research, and societal expectations change. We do not claim to have all the answers, but we believe it is important to share our approach and our learnings to help inform emerging regulatory frameworks and advance protection and opportunity together. 

Pillar one: Safety by design

Microsoft recognizes our responsibility to help create safer experiences for all users, particularly children and those more vulnerable to harm. Our safety-by-design approach seeks to embed protection from the outset: identifying foreseeable risks, examining the impact of product features and user experiences, and implementing proportionate safeguards. As risks evolve, we continue to learn from emerging research, science, andas well as from customers, governments, and other stakeholders. 

For more than a decade, Microsoft has invested in technologies designed to protect people online, beginning with PhotoDNA  in 2009 and continuing through our work to build safeguards for AI experiences and address emerging harms such as synthetic and non-consensual intimate imagery. We have also learned that families want tools that are simpler, intuitive, and easier to use. That is why, earlier this week, we announced new protections and defaults for children, teenagers, and families using Windows Family Safety. We view these changes as an important step forward, while recognizing that earning and maintaining trust requires continued investment, learning, and iteration. 

Bing has also strengthened protections against child sexually abusive material (CSAM) across its generative AI experiences. We have also expanded SafeSearch globally to cover additional categories of harmful content, helping reduce the risk of exposure to harmful material. We will continue to make progress, listen to our users and stakeholders, and learn by working with others to strengthen safety.  

Our goal is to help children and teenagers participate confidently in appropriate digital experiences that reinforce access to the meaningful educational, social, and economic opportunities technology can provide. Achieving that goal requires real protections that are proportionate to risk and implemented in ways that respect users’ privacy. Risks are not uniform across different technologies and services, and safeguards should reflect and address those differences.   

Pillar two: Age-differentiated experiences

We recognize that young people are not a single group. Their needs, capabilities, and expectations evolve with age, development, and context. For that reason, age-appropriate design is an important element of creating safer digital experiences and complements safety-by-design. Age-appropriate design ensures protections and experiences are responsive to the needs of users at different stages of development. This approach informs experiences across Microsoft’s consumer ecosystem.  

On XBOX, we leverage family safety and privacy tools designed specifically to help manage online interactions, content access, spending, screen time, and privacy settings. These features are intended to support safer experiences while giving families flexibility to make choices. We are applying many of these same learnings to Copilot. All users must now sign in to use Copilot, and access is restricted for children under 13 (or older where required by local law). We have also implemented measures to reduce exposure to harmful content, directing users to crisis support resources when self-harm risks are detected, and encouraging healthy use through transparency, break reminders, reporting tools, and guardrails to protect against delusional outputs.   

Microsoft has now also extended protections at the platform level. Through our new Windows Age application programming interface (API), expanded age assurance capabilities, and enhanced family safety tools, Microsoft is helping establish a more consistent and privacy-conscious foundation for age-appropriate experiences across the broader ecosystem. These capabilities are intended to provide developers with trusted age signals to support age-appropriate protections, making the experience ultimately easier for families to understand and navigate downstream. 

Reliable age signals play an important role in enabling age-appropriate experiences. Innovations such as the Windows Age API help provide privacy-preserving age signals while minimizing the collection and sharing of personal data. Young people share this expectation. Participants in Microsoft’s AI Youth Futures Council have consistently emphasized the importance of understanding how their information is collected, used, and protected. 

Pillar three: Education and empowerment

Technology alone cannot deliver safe participation. Young people and their families must have an opportunity to provide direct feedback, and they must have easy access to tools and resources that support and build their knowledge as they navigate digital experiences, evaluate what they encounter, and decide when to seek help. Digital literacy is, therefore, a core component of child safety. 

Microsoft has invested in digital literacy and safety education for years through resources and partnerships that reach communities around the world. Earlier this year, we launched Behind the Chat: A Human Guide to Safe AI Conversations, designed specifically to help young people understand the opportunities and risks associated with AI companionship. This toolkit is supported by classroom resources for educators and materials for parents and trusted adults, reflecting our belief that supporting young people requires an ecosystem approach. Beginning this fall, we will expand these resources throughout Europe, Asia, and the Americas. We will also continue working closely with educators to ensure safety and privacy. 

Over the coming year, we will deepen partnerships with researchers, AI Safety Institutes (AISIs), governments, and civil society to advance the research, evaluations, and benchmarks needed for safer digital and AI experiences. Working together, we will learn and help build the foundation for the next generation of trusted technology. 

A framework for the future

Our work is far from finished. As technology evolves, our understanding of how to support young people safely and responsibly must continue to evolve with it. This framework reflects our current approach, informed by evidence, shaped by young people and their families, and grounded in ongoing learning. We recognize that we do not have every answer, and that building safer digital experiences will require continued experimentation, humility, and collaboration. No single organization can do this alone. Progress will depend on deep partnerships across government, industry, civil society, educators, and families worldwide. Together, we can help build a future in which every young person has the opportunity to participate, create, learn, and thrive. 

The post Safe Participation Framework: Opportunity and Safety for the Next Generation in the Age of AI appeared first on Microsoft On the Issues.

Today, Microsoft published its 2026 Responsible AI Transparency Report. The report highlights the progress we’ve made in building and deploying AI responsibly, supporting our customers, and strengthening our responsible AI governance, tools, and practices. You can explore the report in its entirety here.

AI is moving fast, and so are societal expectations. The boundaries of what people can accomplish with AI are expanding, and communities are asking more questions about how AI systems are designed, built, and used. As AI becomes more integral to how we live and work, confidence that AI systems are operating reliably and securely is becoming an essential prerequisite to their broad and beneficial adoption.

At Microsoft, we have been building a responsible AI program for nearly a decade, rooted in two core beliefs: that trust is foundational to realizing the benefits of AI and that the empowerment of people and organizations must remain at the center of our strategy. As capabilities advance and adoption accelerates, that experience is helping us meet this moment and adapt for what comes next.

Our third annual Responsible AI Transparency Report shares how our program is evolving and the priorities that continue to shape our work. Over the last year, investing in three specific areas has enabled us to embed trust more deeply and at greater scale: adaptive governance and technical risk management, practical tools and capabilities, and shared practices and strong partnerships. These investments cut across five trends shaping the AI landscape, including the rapid expansion of agentic AI.

Taken together, these trends and investments underscore our view that model capability alone will not determine the impact of AI. That will depend on organizations that develop and deploy AI technologies that deliver real value—and govern them with the rigor and adaptability needed to earn and sustain trust.

Adaptive governance and technical risk management

As the frontiers of AI advance, we are making our governance more adaptive and more tightly integrated with engineering workflows. In practice, this means that we have updated our policies to better match the AI tech stack and AI value chain, evolved our risk management practices to address emerging AI capabilities and risks, and strengthened the readiness of our responsible AI community: the people who operationalize our program at enterprise scale.

This year, we re-engineered our Responsible AI Standard to make it more adaptive to evolving technical realities, uses, risks, and regulatory requirements. The new Standard is structured by reference to different components of the tech stack—models, platform services, and applications—and the role that Microsoft plays in developing or deploying those components. It combines core requirements that always apply with more targeted, scenario-specific requirements that can evolve as capabilities and risks change. For example, we apply some of our most rigorous risk management measures to AI systems with the most significant cyber capabilities, helping ensure that advances in AI favor the defenders responsible for securing critical digital infrastructure.

We are also evolving our technical risk management practices. Increasingly capable systems can retain memory, use tools, access data, and take actions on behalf of users. Governing these systems requires us to think beyond the behavior of an individual model or application to interactions among models, agents, applications, tools, data, and people. Our work increasingly focuses on controls such as agent identities, tool permissions, and monitoring of actions.

And governance only works when people can put it into practice. We have continued to build responsible AI capabilities across Microsoft, equipping thousands of engineers and product managers with training on topics such as agentic AI threat modeling and prompt injection defenses.

Together, these investments are helping us move toward a more continuous, lifecycle-based approach to AI governance. With agentic AI, risks can evolve as systems interact with their environments, users, and other systems. Our governance needs to evolve with these agentic capabilities—and incorporate what we learn from their testing and deployment.

Practical tools and capabilities

Effective governance depends on tools that help translate policy goals into action. As developers and organizations navigate a more complex technical and regulatory environment, they need practical ways to identify risks, evaluate systems, establish controls, and monitor how AI behaves in the real world.

We are applying what we learn from governing AI at Microsoft into tools, capabilities, and resources that help developers and organizations beyond Microsoft do just that—whether they build on our platforms or leverage open-source projects.

We have expanded tools to evaluate AI systems across the lifecycle. A new AI Red Teaming Agent helps accelerate the identification and evaluation of risks. Agent evaluators help developers measure the quality, safety, and performance of agentic applications. RAMPART turns red team findings into repeatable tests, enabling more continuous coverage as systems change.

We are also building greater visibility and control into agentic systems. With ASSERT and Agent Control Specification, developers can evaluate agents against their policies, place runtime controls at critical points in an agent’s workflow, and monitor behavior.

These tools and capabilities reflect a shift: as systems become more dynamic, governance needs to become more operational. Organizations need to be able to see what their systems are doing, test how they behave, and intervene when necessary—not just assess them before deployment.

Organizations also need confidence—and increasingly need to demonstrate—that responsible AI practices are being implemented consistently. Microsoft is one of the few companies certified against ISO 42001 across a broad portfolio, including Microsoft 365 Copilot, Foundry, and GitHub Copilot. Over the last year, we have simplified and strengthened our internal processes that support that certification.

Ultimately, responsible AI governance is a shared responsibility across the AI value chain. Our goal is to help make the practices and capabilities needed to meet that responsibility more accessible, practical, and scalable.

Shared practices and strong partnerships

The challenges of governing AI are bigger than any one company, and increasingly interconnected AI systems make collaboration even more essential.

As AI adoption expands across borders and sectors, we need shared expectations for how systems are evaluated, monitored, and governed, as well as interoperable standards that enable visibility into interactions across tools, data, and systems. We also need to keep advancing the underlying science and technical practices so that we can benefit from rigorous, applied insights into what effective governance looks like and where the remaining gaps are.

That starts with research. Over the past year, we advanced our work with the US Center for AI Standards and Innovation and AI Safety and Security Institutes in Australia, Singapore, and the UK to strengthen the science and practice of AI evaluation. We also launched an External Red Team Alliance with 18 universities across six continents to expand understanding of priority risks.

Common technical practices and standards are critical. Through the Frontier Model Forum, OpenTelemetry, and the Appia Foundation, we are helping develop approaches spanning frontier cyber benchmarks, end-to-end observability for increasingly agentic systems, and AI assurance across supply chains and sectors. We are also contributing to efforts that make transparency reporting more interoperable across organizations and jurisdictions, including through an OECD-led informal task force that developed the Hiroshima AI Process Reporting Framework version 2.0.

We also need shared ways to measure progress. We cannot meaningfully assess progress if every organization measures AI risks differently. Through our work with MLCommons, we are helping expand AILuminate into a broader suite of reliability benchmarks, creating common approaches for evaluating areas such as jailbreak resilience, multilingual performance, and psychosocial risk in conversational AI.

Shared learning, shared practices and standards, and shared measurement can help the entire ecosystem develop while raising shared expectations for trust.

Meeting the moment and investing for the future

Our experience over the past year has reinforced that responsible AI cannot be static. It has to be embedded in development processes, supported by practical tools, and continually informed by what we learn. That is why our responsible AI investments extend from the systems we build, to the tools we provide our customers, to the research, practices, and measurement approaches we help develop with the broader ecosystem.

Our 2026 Responsible AI Transparency Report explores this work in more depth—from how we re-engineered our Responsible AI Standard to how we are strengthening governance for agentic AI, advancing evaluation, and addressing AI misuse. We invite you to explore the report to see what we have learned, what we have changed, and how we are putting our priorities into practice.

As AI becomes more powerful and more present in people’s lives, our commitment is to keep listening and learning, to keep strengthening our safeguards, and to keep putting the empowerment of people and organizations at the center of our strategy.

The post Responsible AI in 2026: How we are adapting for what’s ahead appeared first on Microsoft On the Issues.

Today, the House of Representatives passed historic legislation that will protect our customers’ most fundamental privacy rights in the cloud. The bipartisan NDO Fairness Act (H.R.6048) would require that federal courts apply a rigorous standard when issuing non-disclosure orders (NDOs), or secrecy orders, that prevent technology providers from telling customers when law enforcement accesses their emails, texts, photos, and other personal information in the cloud. Microsoft has strongly supported these reforms, and they are consistent with our commitment to protect our customers and ensure trust in the digital services that are powering the global economy.  The House’s passage of the NDO Fairness Act marks a significant step forward. We now look forward to working with the Senate to advance these important reforms.

The NDO Fairness Act would finally correct the glaring disparity between covert searches in the physical and digital worlds. Law enforcement must meet a strict standard for secret physical searches, but these restrictions do not apply to secret searches for data stored by technology providers. Instead, law enforcement can obtain boilerplate secrecy orders under a 40-year-old law, the Electronic Communications Privacy Act (ECPA), enacted before the cloud even existed. This represents a fundamental shift from historical law  enforcement practices where secrecy was the exception, not the norm. Officers or agents would knock on your door with a warrant or serve your company with a subpoena. If you had an issue with that, you could go to court to object. But NDOs, often obtained without meaningful judicial review, allow law enforcement to skip going to you and instead go to your cloud provider for your data in secret.  

This is a problem with far-reaching consequences. The overuse of secrecy orders erodes trust in and discourages adoption of the cloud, stifles transparency and accountability, and threatens our fundamental freedoms. Notice is perhaps the most foundational protection against government overreach. It is necessary to give meaning to nearly every other right we enjoy. This is because it is a lot more difficult to assert your rights when you don’t know they are at risk to begin with.  

Two investigations, two administrations, one case for reform 

In recent years, Congress has learned this lesson firsthand. Microsoft first testified and began working with Congress in support of the NDO Fairness Act following reports in 2021 that the first Trump Justice Department used NDOs in a leak investigation that prevented notice of legal demands to Members of Congress, their staff, and the press. In a subsequent review, the Justice Department’s Inspector General found that the NDOs used boilerplate justifications that did not include case-specific information and did not even inform the court that some accounts belonged to Members of Congress. The NDOs were then renewed for years—some even after the investigation was public and individuals were no longer targets.  

This is despite the fact that, under our Constitution, Congress is a separate branch of government and has unique Speech or Debate privileges, and the press is entitled to heightened First Amendment protections. 

Separately, a recent Senate investigation revealed that the Biden Justice Department’s “Arctic Frost” probe of the 2020 presidential election sought telephone records from more than a dozen Members of Congress. As first disclosed by Senator Grassley and recently reported in the New York Times, the subpoenas were accompanied by NDOs that, again, did not inform the judge of the fact that the phone numbers belonged to Members of Congress. 

The NDOs in these two investigations illustrate a core problem with NDOs. And it’s a problem that spans administrations and extends well beyond investigations involving Members of Congress: Too often, courts are not aware of the most basic facts needed to evaluate whether total secrecy is necessary.  

Microsoft’s record: Standing up for our customers 

This is why Microsoft, for years, has fought to strengthen our customers’ rights and has challenged unlawful secret surveillance. We’ve stood up for our customers not just in the halls of Congress, but in courts across the country and in daily negotiations with law enforcement. We routinely challenge NDOs and convince the government to modify secrecy orders to permit notice to our customers. When we can’t reach a reasonable agreement with the government, we don’t hesitate to go to court. Microsoft is currently seeking to modify or vacate several NDOs in courts across the country. While the details of these challenges remain under seal, this includes a now-public appeal brought by LinkedIn, a Microsoft subsidiary, that is scheduled for oral argument before the US Court of Appeals for the Fourth Circuit on September 15. 

Our efforts over the years have led to policy changes at the Department of Justice, including guidance limiting the duration of NDOs after Microsoft filed a lawsuit against the US government in 2016 challenging indefinite NDOs as unconstitutional.  

Sometimes, challenges to secrecy orders are unsealed, and we’re able to share additional details; most often, we simply provide our customers with notice, allowing them to take steps to further protect their rights. But these efforts, no matter how successful, have not stopped the flow of overbroad NDOs.  

The NDO Fairness Act 

Challenges in court cannot do the work of Congress. We need the legislative reforms contained in the NDO Fairness Act. These would:  

• End boilerplate secrecy orders by requiring judges to consider the full facts and circumstances of each order.  

• Ensure that the NDO statute is consistent with the First Amendment by requiring courts to strictly scrutinize requests for secrecy.  

• Codify restrictions to prevent indefinite secrecy orders and limit the length of extensions by requiring time-limited orders.  

• Recognize technology providers’ statutory right to challenge an order to ensure providers can stand up for their rights and their customers’ rights.  

• Increase transparency reporting around the government’s use of secrecy orders.  

The NDO Fairness Act would not eliminate NDOs. Nor should it. Temporary secrecy is appropriate in some cases—particularly those involving child exploitation, terrorism or other violent crimes, nation-state cyberattacks, or cases where there is clear evidence that notice would jeopardize a sensitive investigation. Microsoft is a strong partner with law enforcement in its efforts to protect our nation and the most vulnerable members of society. But these reforms would ensure that NDOs are consistent with our most fundamental rights and freedoms.  

The Senate must now seize the moment 

Congress has made significant progress advancing these reforms. I want to thank Speaker Johnson and Majority Leader Scalise as well as Representatives Fitzgerald and Nadler for scheduling a vote and sponsoring this legislation. House Judiciary Committee Chairman Jordan and Ranking Member Raskin also deserve our appreciation for championing this legislation through the House committee process. As consideration moves to the Senate, we look forward to working with Senators Lee and Coons and supporting their leadership and efforts to enact this bill into law.  

Microsoft has fought for the NDO Fairness Act because we stand up for our customers and will fight for their rights. I am thrilled to see bipartisan support for these reforms culminate in today’s House passage of this legislation. But the work is not yet finished. The Senate now has an opportunity to build on this momentum and help enact these critical reforms into law. 

 

 

The post House passes historic reforms to rein in secret surveillance appeared first on Microsoft On the Issues.

Today, Microsoft published its 2026 Environmental Sustainability Report. This report covers our fiscal year 2025, and measures progress against our 2020 baseline. You can read the foreword below and explore the report in its entirety here. 

As we enter a new era for AI, Microsoft’s environmental sustainability work is entering a new phase—defined not only by ambition, but by how we deliver in a period of rapid technological change. In our pursuit of becoming a carbon negative, water positive, and zero waste company that protects ecosystems, the context has evolved, and so must our approach. 

The global shift toward AI is reshaping economies, accelerating innovation, and becoming foundational to how technology is built and used. It is also increasing demand for the energy, water, land, and materials required to support that growth. As a company at the forefront of this transition, Microsoft has a responsibility to help ensure that technology strengthens, rather than strains, the systems and communities on which it depends. This imperative is reshaping the context for our work. 

We are approaching this moment with clarity and conviction. We believe AI can deliver broad societal, economic, and environmental benefits, but innovation at this scale must be matched by responsibility at the same scale. For Microsoft, this means designing, building, and operating infrastructure that is more efficient, more resilient, and more grounded in the realities of the communities where we operate. 

We do not see these dynamics as a reason to step back. We see them as a mandate to lead differently. That requires greater operational rigor, stronger integration across our sustainability priorities, and a sharper focus on durable outcomes for the local communities where we work and the global value chains that make our work possible. It also requires being transparent about where progress is advancing, where it is more difficult, and where new approaches are needed. 

The path forward will not be defined by simple tradeoffs or single solutions. It will depend on how effectively we align innovation with stewardship. The systems we build to support the future must also support the long-term health of the planet and the communities we serve. Our experience makes clear that this is possible, but only with even greater discipline, partnership, and a willingness to learn and adapt as conditions evolve. 

What this moment requires 

Our aim is to build technology that gives more than it uses. Lasting progress depends on how we build it and whether that growth strengthens the places where it takes root.  

This thinking is reflected in our Community First AI Infrastructure approach, which is helping shape a more integrated model for community partnership, responsible operations, and environmental performance as we grow. In this way, sustainability is not separate from growth; it is part of how responsible growth is defined. 

While AI infrastructure is driving demand for energy, water, land, and materials, sustainability solutions are not scaling fast enough to meet demand. This tension is real, and it is also productive. 

It is forcing sharper questions: Where do we need to move faster, invest differently, or rethink our approach? Which assumptions still hold, which ones need to evolve? Five years into this work, we have more operational data, more direct experience, and a clearer view of what measurable planetary progress actually requires. That perspective helps keep us focused on outcomes rather than attached to any single pathway. 

We want to be clear about what this means—and what it does not. It means being more precise about what sustainability requires for Microsoft, and more willing to refine our strategies as conditions change, data improves, and tradeoffs become clearer. It does not mean we are lowering our ambition. 

Progress amid growth 

Our results reflect both progress and pressure. As we scale the physical infrastructure required to power the AI economy, our emissions are shaped by the impact of that growth and the actions we are taking to manage it. 

The visual that follows illustrates this dynamic by comparing our reported emissions with a modeled view of where emissions may have been in the absence of four specific interventions: carbon free electricity, sustainable fuels, XBOX console efficiency, and Surface device decarbonization. While these examples represent only a portion of our emissions reduction efforts, they highlight an important lesson from our work to date: that well-designed, targeted interventions can deliver measurable progress even as demand for infrastructure continues to rise.

In FY25, we matched 100% of our annual global electricity consumption with renewable energy^[2]. Microsoft will continue to push for an expansive focus on adding all forms of carbon-free electricity (CFE) ^[3] to the grids where we operate, complementing and building on our portfolio of renewable energy resources. We recognize that the world’s rising electricity needs require a balanced, all-of-the-above decarbonization strategy to meet global economic growth and environmental goals, and we will continue to support this approach moving forward.

Our total emissions (Scopes 1, 2, and 3) increased 25% year over year, driven primarily by the expansion of our datacenter infrastructure and pausing our use of non-additional, unbundled renewable energy certificates as we prioritize investments that bring net new power to grids. While this decision increases our reported emissions in the near term, it enables us to increase the development of new CFE rather than relying on certificates alone. We believe this change will create more long-term sustainability benefits. Growth-related emissions pressure was expected. The more important signal is where that pressure is concentrated. 

Scope 3 remains the largest share of our footprint overall, but one of the clearest changes this year was the growing contribution of Scope 2, which represents 13% of our total emissions—up from nearly 2% last year. This development highlights how important the energy systems across our supply chain are in shaping environmental outcomes. 

This year’s results also made clear that progress now depends on adapting how we work. 

Water is one of the clearest examples. In FY25, we replenished for the first time more water globally than we withdrew—more than 14 million cubic meters—marking a major milestone on our journey to become water positive. Reaching this point reflects years of work to improve water efficiency, expand replenishment efforts, and scale partnerships around the world. 

We are proud of this achievement but also know that replenishing global volumes is not enough. The next phase of our work is increasingly local. As we move forward, we are placing greater focus on helping restore more water to the watersheds where we operate than we withdraw while strengthening long-term water resilience. We prioritize projects in water-stressed regions that are locally relevant and designed in partnership with communities, delivering benefits not only for water availability, but also for ecosystems, economies, and people. Through this approach, we aim to ensure our growth supports and helps sustain the communities and environments where we operate. 

Transparency remains central to how we work and how we report. Microsoft has eliminated nearly all single-use plastics in our primary product packaging, reducing the share that remained to just 0.07% at the end of calendar year 2025.^[4] But we are not rounding down. We are staying accountable to the work required to eliminate them entirely. 

Across our cloud operations, we achieved 92% reuse and recycling of decommissioned servers and components for the second consecutive year, diverted 90.5% of construction and demolition waste from landfills and incinerators, and expanded our Circular Centers to seven facilities globally. These results also reflect a broader shift toward solutions that have co-benefits—reducing both emissions and resource demand over time. 

Throughout this journey, we have learned that progress in one area often depends on progress in another. Clean energy investments are essential to decarbonization. Water use is linked not only to our operations, but also to the energy systems that power them. And extending hardware life through circular approaches can reduce both emissions and material demand across the value chain. 

That is why our priorities extend beyond tracking progress against individual commitments on water, carbon, waste, and ecosystems as though they move independently. Our experience has made clear that progress does not happen pillar by pillar. Some of the most consequential work ahead will be measured in whether we address system challenges and help build the conditions for long-term progress: more resilient grids, stronger markets for lower-carbon materials, more effective water stewardship, and infrastructure designed and operated with local realities and community priorities in mind. 

For that reason, this year’s report takes a more integrated approach—placing progress against our commitments in the broader context of how those commitments are operationalized across our infrastructure and products. 

What’s next 

We are proud of what we have accomplished, and we remain humbled by the scale of the challenge ahead. Responsibly building the AI future requires clear accountability for what AI demands, candor about real constraints and tradeoffs, and sustained focus on outcomes that are durable and broadly shared. The chapters that follow show how we translate that intent into execution across our physical infrastructure, products, and value chain—where our sustainability commitments become operational reality.

Read the full report: https://aka.ms/SustainabilityReport2026 

[1] The solid line represents Microsoft’s reported greenhouse gas emissions (Scopes 1, 2, and 3) for FY20–FY25, prepared in accordance with GHG Protocol and management’s criteria, and uses a market-based emissions approach. The dotted line represents an illustrative counterfactual scenario of estimated emissions had select, discrete carbon reduction initiatives not been undertaken. These initiatives include energy efficiency improvements for XBOX consoles, renewable energy purchases, sustainable aviation fuel (SAF) and sustainable marine fuel (SMF) certificates, and supply chain decarbonization of Surface devices. The difference
between the two lines is an estimate of emissions avoided through these specific initiatives relative to a scenario without those initiatives occurring. This estimate is directional in nature, does not represent the full scope of Microsoft’s decarbonization efforts, and is not part of our reported greenhouse gas inventory. It should not be interpreted as a comprehensive measure of total emissions reductions or as additive to other carbon reduction or removal claims.

[2] Microsoft defines renewable energy as electricity that comes from sources that are replenished at a rate greater than or equal to their rate of depletion, such as geothermal, wind, solar, hydro, and biomass. To date, Microsoft’s renewable energy target includes two primary categories: renewable energy from contracted projects and grid mix. The first is renewable energy delivered under PPAs or similar long-term contracting mechanisms, generally for new projects where our financial involvement in the project’s development is critical for its success. This category represents more than 90% of the renewable energy applied to achieve our 2025 target. The second category is “grid mix” – renewable energy supported via our standard utility relationships and rates, inclusive of policy programs such as renewable portfolio standards and state and utility decarbonization goals. Our 2025 100% renewable target does not include purchases from short-term, so-called “spot market” renewable energy credits (RECs) sourced from operational clean energy projects.

[3] Microsoft defines carbon-free electricity (CFE) technologies as technologies with zero direct emissions and biogenic technologies with lifecycle emissions equivalent to renewables. CFE technologies include wind; solar; geothermal; sustainable biomass; hydropower; nuclear; fossil fuels with complete carbon capture, utilization, and sequestration; and storage charged with CFE generation.

[4] By weight, as designed, portfolio average. More details can be found in our Environmental Data Fact Sheet.

The post Responsibly building the AI future appeared first on Microsoft On the Issues.

In armed conflict, a simple symbol can save lives. The Red Cross, Red Crescent, and Red Crystal emblems signal that those providing medical care and humanitarian assistance must be protected. 

In cyberspace, there is not yet a widely adopted equivalent, even as hospitals, humanitarian organizations, and relief operations increasingly rely on digital systems to deliver care, coordinate assistance, protect sensitive data, and reach people in crisis. 

Today, the digital systems that support hospitals and humanitarian operations—including communications tools, logistics platforms, patient care systems, cloud services, and the data center infrastructure which underpins them—can be difficult to distinguish from surrounding digital infrastructure. In conflict, that raises the risk of misidentification, spillover, and cascading disruption from cyber operations. As cybersecurity operations become more automated and machine-driven, clear, trustworthy, machine-readable signals become even more important.

That is why Microsoft supports the International Committee of the Red Cross as it launches the next phase of the Digital Emblem initiative today in Geneva. The Digital Emblem is intended to provide a machine-readable way to help identify digital assets that support protected medical and humanitarian functions, so they can be recognized, verified, and avoided in conflict settings.

From principles to operational practice

The Digital Emblem does not create new legal protections, and it does not replace cybersecurity. Instead, it helps to make existing protections under international humanitarian law more actionable in cyberspace. 

For many years, governments, humanitarian actors, civil society, technical experts, and industry have worked to clarify how international law applies in cyberspace. These efforts have reinforced a core principle that civilians, medical services, and humanitarian operations must be respected and protected in armed conflict. But translating that principle into operational reality remains difficult when protected digital assets are not easily identifiable. 

The Digital Emblem can help bridge that gap. If implemented responsibly, a clearer, more consistent, and technically usable signal can support recognition, verification, and respect for protected medical and humanitarian functions in cyberspace. 

This next phase marks an important transition for the Digital Emblem: from concept development toward operationalization, testing, standards, and implementation. 

Over the past several years, the ICRC has worked with states, the Red Cross and Red Crescent Movement, technical experts, standards bodies, academia, and industry to explore whether the protective function of the physical emblems can be translated meaningfully into cyberspace. That work has helped move the Digital Emblem from an important idea to a project with growing legal, technical, and operational foundations. 

The work now is to test how the Digital Emblem can be deployed, discovered, authenticated, and verified in real-world conditions. It also means advancing standards work through bodies such as the Internet Engineering Task Force and the International Telecommunication Union, developing guidance for those who operate protected digital infrastructure, and engaging the actors who will need to recognize and respect the Digital Emblem in practice.

Building on Microsoft’s work to protect civilians in cyberspace

Across our cybersecurity work, we have consistently argued that protecting civilians and critical services in cyberspace requires more than statements of principle. It requires practical standards, technical implementation, trusted partnerships, and cooperation among governments, humanitarian actors, civil society, standards bodies, and industry. 

From our early calls for stronger norms of responsible state behavior in cyberspace, to the launch of the Cybersecurity Tech Accord, Microsoft has advocated for the application of international law and the protection of civilians online. 

Every day, Microsoft works alongside governments and partners to detect, disrupt, and defend against cyberattacks that target critical infrastructure, healthcare, and humanitarian operations. Together, we have seen the importance of real-time visibility, trusted signals, and coordinated defense across public and private actors. This work has underscored a central reality: as civilian and humanitarian services become more digitally dependent, cybersecurity is increasingly connected to humanitarian resilience. 

Microsoft will continue supporting the ICRC with a focus on how our technologies enable this model at scale. That includes exploring how technology can support both sides: enabling humanitarian and medical organizations to signal protected systems and helping defenders recognize and verify those signals in real-world operations.

The role of industry

The ICRC’s leadership is essential to the credibility and neutrality of this effort. But for the Digital Emblem to succeed, it must also work across the broader technology ecosystem, which includes the cloud services and data centers, telecommunications networks, cybersecurity tools, identity systems, and other digital infrastructure on which humanitarian and medical organizations increasingly rely.

Industry, therefore, has an important role to play in helping ensure the Digital Emblem is technically sound, interoperable, and aligned with how defenders operate in practice. That includes supporting standards development, helping test implementation models, and ensuring that any approach reflects both sides of the model: enabling eligible humanitarian and medical organizations to express the signal for relevant assets and helping defenders recognize and verify that signal in operational workflows. 

In today’s fragmented and low-trust geopolitical environment, shared technical standards can reduce ambiguity even where political agreement is difficult. That is why standards-based implementation can help make the Digital Emblem consistent, verifiable, and usable across networks, platforms, and borders.

From launch to implementation 

The launch in Geneva marks an important milestone, but the Digital Emblem’s promise will depend on what happens next. 

The work ahead should focus on clear and concrete outcomes: continued technical testing, progress in standards development bodies, practical implementation guidance, and broader engagement from states, humanitarian actors, technology companies, telecommunications providers, cybersecurity professionals, and operational defenders. 

The call to action is straightforward. Governments should support the Digital Emblem as a mechanism for making protected humanitarian and medical functions more identifiable in cyberspace and promote respect for it in policy and practice. Humanitarian and medical organizations should help test and shape implementation so it reflects operational reality. Standards bodies should continue building the technical foundations for trusted adoption. And technology companies should help translate the Digital Emblem into the tools, systems, and workflows defenders already use. 

Physical emblems made humanitarian protection visible on the battlefield. The Digital Emblem can help make protected humanitarian and medical functions visible, verifiable, and actionable in cyberspace. Turning that promise into practice will require sustained cooperation so that those who care for the wounded, the sick, and civilians can be more easily recognized, respected, and protected in the digital age. 

 

 

The post Making humanitarian protection visible in cyberspace: The promise of the Digital Emblem appeared first on Microsoft On the Issues.

The AI Economy Institute (AIEI) is launching its third cohort of researchers, advancing our mission to understand the adoption of artificial intelligence across economies, industries, and communities. 

We launched the AI Economy Institute because AI’s economic impact is not predetermined. Though AI is being rapidly adopted, the evidence base for understanding its impact on work, jobs, education, productivity, and opportunity is still too thin. By increasing the scholarship around the AI economy and producing it in a timely and accessible way, we can help ensure that as AI transforms our world, we’re equipping people with the knowledge and tools they need to make decisions and succeed with AI.

Our 2026 AI Economy Institute Cohort

The AI Economy Institute convenes outside experts and researchers to share their perspectives and advance the body of knowledge on topics related to AI, work, and education. Our third global research call centered on understanding how frontier firms are reshaping work and the broader economic landscape.  

Representing a diverse group of institutions worldwide, our cohort brings together subject matter experts and researchers to explore how AI is reshaping the workforce, organizations, and the broader economy. The cohort consists of the following individuals, representing the following institutions:    

• Brian Jabarian, Carnegie Mellon University 
• Caspar David Peter, Erasmus University, Rotterdam, Netherlands 
• Christoph Siemroth, University of Essex, England 
• Daniel Yue, Georgia Institute of Technology 
• Edoardo Maria Acabbi, University of Mannheim, Germany 
• Frank Nagle, Massachusetts Institute of Technology (Advising Fellow and Cohort 2) 
• Friederike Mengel, University of Essex, England; Erasmus University Rotterdam, Germany 
• Gianmarco Ottaviano, Bocconi University, Italy 
• Ilan Strauss, AI Disclosures Project 
• Johannes Wachs, Corvinus University, Budapest, Hungary 
• Luca Henkel, Erasmus University, Rotterdam, Netherlands 
• Luca Mazzone, University of Montreal, Canada 
• Laura Nurski, Centre for European Policy Studies (CEPS), Belgium (Cohort 2) 
• Meeyoung (Mia) Cha, Korea Advanced Institute of Science and Technology (KAIST), South Korea 
• Mustafa Afacan, Mohamed bin Zayed University of Artificial Intelligence (MBZUAI), United Arab Emirates; Sabancı University, Turkey (World Bank Affiliated Senior Fellow) 
• Nataliya Wright, Columbia University 
• Nuriye Melisa Bilgin, Koç University, Turkey 
• Pëllumb Reshidi, Florida State University 
• Pierre-Alexandre Balland, Centre for European Policy Studies (CEPS), Belgium (Advising Fellow and Cohort 2) 
• Salman Khan, Mohamed bin Zayed University of Artificial Intelligence (MBZUAI), United Arab Emirates (World Bank Affiliated Senior Fellow) 
• Serena Booth, Brown University 
• Wesley Rosslyn-Smith, University of Pretoria, South Africa (Advising Fellow) 
• Yingfei Wang, Foster School of Business, University of Washington 

Cohort members will analyze frontier firms to examine both upstream, firm-level transformations and downstream, economy-wide impacts. Researchers will also explore how AI changes job design, skill demands, productivity, and regional economic development.  

AIEI’s first two cohorts explored how AI is reshaping the talent pipeline, from higher education and skills to K-12, community colleges, and early-career pathways, so that we could understand and inform the early changes to the labor market. What we learned from that point of inquiry shifted the focus; this year’s cohort moves further into the economy itself, focusing on frontier firms and how leading organizations are adopting AI, redesigning work, and creating the conditions for productivity, diffusion, and human agency at scale.

Interpreting the frontier: What this means for policy and strategy  

Since its launch, the AI Economy Institute has fielded more than 800 responses to our calls for research proposals. The gap between what AI systems can do and what organizations can actually deploy will shape the pace of adoption. Gains in productivity may come alongside organizational shifts as firms adapt their workflows, teams, and decision-making processes.

At the same time, the expansion of automation raises a parallel question of whether systems are enhancing human learning or displacing it. Underlying all of this is a broader uncertainty about the extent to which AI will diffuse widely across economies or concentrate in a narrow set of firms and regions. 

Cohort 3 moves beyond identifying these tensions and toward generating the empirical evidence needed to navigate them, providing policymakers, firms, and institutions with a clearer basis for decision-making in a rapidly evolving AI economy. 

The post New cohort of AI Economy Institute Fellows to examine frontier AI firms and the transformation of work appeared first on Microsoft On the Issues.

Today we’re publishing our first “Public Country-by-Country Report” for our fiscal year 2025, disclosing our taxes in the period from July 1, 2024, to June 30, 2025. It covers the countries and regions included under European Union rules and shows, for each one, our revenue, profit, number of employees, and income tax accrued and paid during the year.  
 
We have provided this kind of information directly to tax authorities for several years under the Organization for Economic Cooperation and Development (OECD) framework. It is now published to support transparency commitments, and we believe it is important to proactively address any questions these disclosures may raise, recognizing that numbers on a spreadsheet rarely tell the full story.
 
Microsoft pays the taxes we owe in every country where we operate. We know there are strong views about whether companies are paying enough, and we believe providing this context leads to a more informed conversation.

Understanding country-by-country reporting

Country-by-country reporting is not widely understood outside tax and accounting circles. Some figures may look surprising at first, but a number that appears low or high in one country does not, on its own, tell the full story. Tax law differs from country to country, and there are two important things to keep in mind when reading the report.  

First, the numbers are prepared using rules that differ from United States or country-specific financial accounting and tax rules, so they may not match other Microsoft information people have seen. For example, this report combines all Microsoft legal entities in a country and follows the reporting rules required by EU regulations. By contrast, local statutory accounts usually cover just one legal entity, follow local accounting rules, and may use a different fiscal year from Microsoft’s.  

Second, accrued tax is what you owe for the year. Tax paid is the amount actually paid during the year. The two can differ because the timing of owing tax and paying tax doesn’t match exactly. 

France is a good example of why a single line can look unusual without context. In FY25, cash tax paid in France reflects a one-time refund of tax overpaid in an earlier year. That makes this year an outlier. In this specific case, accrued tax may be a better reflection of the taxes borne for the fiscal year. Microsoft paid $374 million in tax in France over the prior three years. 

Variations like these are a normal part of how large companies, both domestic and multinational, are taxed across borders, and they reflect an evolving tax landscape as well as a business that continues to change. We comply with every local rule that applies to us, and as those rules change, our reporting will change with them. Microsoft is committed to a tax structure that reflects where our people work, where we invest, and where functions, assets, and risks occur, and this has been a guiding principle. 

How our investments support local economies

We understand that this discussion is not only about what the law requires or what a single tax line shows in a given year. For many people, it is also about a broader question of contribution: how companies support the countries where they do business. That contribution includes the taxes we pay, the capital we invest, the local jobs and infrastructure we support, and the economic activity created through customers and partners. In the S&P, Microsoft ranks second globally in corporate income taxes paid in the last year, with a total of $28.7 billion. In fiscal year 2025, we paid $6.3 billion in income tax in the EU. Importantly, this does not include payroll, VAT, property, and other taxes paid in addition. 

Taken together, our tax payments, capital investments, and partner ecosystem reflect a long-term commitment to the countries where we operate. We opened our first European office in the UK in 1982, followed by France and Germany in 1983, and then expanded into Denmark, Ireland (our largest hub in the region), Italy, Norway, Spain, and Sweden in 1985. Microsoft is now present in all 27 EU Member States and across the broader region. We have worked in these and many other communities for decades, and thousands of our employees call them home.  

From research and development to digital infrastructure and partnerships with local organizations, we are investing in ways that support these economies beyond our direct commercial activity. At our core, we are building tools that help large enterprises, small and medium-sized businesses, institutions, and individuals become more productive and competitive, which strengthens their business and benefits the people they serve. We only do well when our customers do well. In practice, that means helping customers design and manufacture cars better, helping patients get their next appointment sooner, or making it simpler for someone to find that dream job. 

Our investments in digital infrastructure are not only supporting the local digital economy, they are also contributing meaningfully through both taxation and capital expenditure. Across markets, we continue to invest at scale in datacenters and supporting infrastructure, creating value that extends well beyond the technology sector. In the three years to June 30, 2025, our total capital expenditure amounted to $176 billion, and we spent $89.2 billion on research and  development in the markets where we operate. 

Our customers require local industry- and country-specific expertise, and this is where our partner ecosystem plays an important role. Many of these partners are local businesses themselves. A 2024 IDC study on partner profitability showed that for every $1 of Microsoft revenue, partners that provide services generate $8.45, and partners that develop software generate $10.93. While this varies by country and partner segment, it offers another useful lens on how Microsoft’s business contributes to local economic activity. 

Investments in digital infrastructure are not only investments in technology ecosystems, but in national and local economies as well. They support jobs, strengthen supply chains, create opportunities for companies across many sectors, and help build the foundation for growth and economic competitiveness beyond the digital economy. 

That is the broader context for this report. Tax is one important measure of contribution, but it is not the only one. Our investments, partnerships, infrastructure, and long-term presence in countries around the world also reflect a commitment to helping strengthen the economies and communities where we operate, today and for the future.

 

The post Context on our country-by-country tax footprint appeared first on Microsoft On the Issues.

At Microsoft, we are committed to our customers’ fundamental right to privacy. In a world defined by rapid technological change and geopolitical volatility, this commitment has remained constant. It’s rooted in decades of experience building trusted technologies that our customers rely on every day to manage their data. Many of these organizations depend on the ability to move data across the Atlantic, from the EU to the U.S., in a way that protects their privacy. That’s why we support the European Commission in its defense of the EU-U.S. Data Privacy Framework. And that’s why we have formally intervened in the Latombe v. Commission case before the Court of Justice of the European Union. This case puts at stake two principles that are important for Microsoft – the protection of our customers’ privacy and their ability to do business on both sides of the Atlantic.

To intervene in a case before the Court of Justice, a company must apply for permission. In this case, the Court granted our application, finding that Microsoft has a direct and existing interest in its result. Put simply, the outcome of this case will determine whether Microsoft and its enterprise customers may continue to use the EU-U.S. Data Privacy Framework to transfer data to participating U.S. companies, including vital customers and suppliers. This critical legal bridge promotes stability, beneficial trans-Atlantic ties, economic growth, and prosperity, while upholding strong privacy safeguards. The Latombe case seeks to dismantle it. As an intervener, we can now file legal briefs in support of the European Commission, participate in oral hearings, and share our perspective on the importance of upholding a framework that directly benefits the European economy.

Supporting the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework before the Court of Justice of the European Union

Companies across the globe rely on data flows to manage their people, produce their goods and services, and distribute products to their customers. We understand that data flows trigger questions about differences in legal traditions. They should. And for that reason, the European Commission and the U.S. administration worked diligently, in the decade since the Safe Harbour ruling, to harmonize EU and U.S. law. As a result of that hard work, and as required under the European General Data Protection Regulation (GDPR), the U.S. has now created an independent review court for any complaints regarding U.S. surveillance and implemented other required measures to provide an “adequate” level of data protection that is essentially equivalent to that in the EU.

This equivalence is a key point. The law entitles our customers to privacy on both sides of the Atlantic. This is the principle on which the Data Privacy Framework rests. And our intervention in the Latombe case is just one part of a long history in which we have stood up for that principle in Europe, as well as in the U.S. As far back as 2014, Microsoft challenged the FBI’s secret attempt to use its national security authorities to obtain information about an account that belonged to one of our enterprise customers. After we filed the case, the FBI withdrew its request. In 2016, we sued the U.S. government to challenge its practice of seeking indefinite secrecy orders—i.e., orders that prevented Microsoft from ever notifying its enterprise customers when the government sought their data. As a result of that case, the U.S. Department of Justice changed its policy to place strict limits on the duration of secrecy orders. In the decade since that first constitutional challenge, we’ve launched a series of successful court challenges to ensure that secrecy orders, of any duration, are the exception, not the rule. As a result of our litigation, numerous secrecy orders have been vacated or modified to allow notification to our customers.

We don’t confine our advocacy to courts. We are a steadfast proponent of strong privacy regulation on both sides of the Atlantic. That’s why we are specifically pushing Congress to update the U.S. Electronic Communications Privacy Act to place stricter limits on the use of secrecy orders and ensuring they are subject to meaningful judicial review. This legislative reform is gaining momentum in Congress and will greatly enhance our continued ability to protect our customers’ data.

Stable and trusted data transfers are not an end in themselves. They are a means to enable innovation, economic opportunity, and public services—while upholding the fundamental rights that are at the core of EU and U.S. law. Our intervention in the Latombe case reflects that principled balance and follows a long line of legal actions we have taken to protect our customers.

Looking ahead

At Microsoft, we have long recognized that trust is not a given—it is earned through sustained action, thoughtful design, and a willingness to engage openly with governments, customers, and individuals. Microsoft has consistently advocated for strong, clear, and globally interoperable privacy frameworks, recognizing that trust in technology depends on the strength of the rules that govern it.

Our customers in Europe can rely on us to continuously improve and update our privacy practices as technology and legal standards evolve. In 2018, we were the first major technology company to extend GDPR subject matter rights to all our customers around the world. And recent positive assessments of our privacy compliance by the European Data Protection Supervisor and the Hessian DPA in Germany underscore our continuous commitment to our customers’ fundamental right to privacy.

In support of this work, we’ve updated the Microsoft Privacy Statement to use clearer structure, simplified language, and more precise explanations of our data practices—making it easier to understand what data we collect and how it’s used, without changing our underlying privacy protections or commitments.

The future of technology will be shaped not only by what we build, but by the principles that guide us. By grounding innovation in respect for people and organizations, and strong legal protections, we can help ensure that technology continues to be a force for good.

The post Protecting privacy as a fundamental right while supporting transatlantic data flows appeared first on Microsoft On the Issues.

Microsoft is taking a new approach to fighting cybercrime, targeting the cyberattack supply chain, not just individual services. In a case unsealed today, we are simultaneously targeting two widely used cybercrime tools, Amadey and StealC, after AI-assisted analysis revealed they rely on the same infrastructure.

This action goes after the cybercrime “assembly line,” where coordinated tools drive ransomware, financial fraud, and disruptions to public services. Amadey and StealC are often used alongside each other: Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information. Together, they form a critical link in the chain. In the first two weeks of May alone, Amadey and StealC were linked to more than 140,000 infected computers globally, highlighting how widely they are used.

Working with Europol and industry partners, we targeted both tools at once. The goal: break the chain. Since the start of the operation, Microsoft has identified more than 18,000 victim computers, severed criminal control of those devices, and is working with telecommunications providers to help protect affected customers globally.

When multiple parts of an operation are disrupted together, attacks are harder to launch, scale, and recover from. The result: fewer disrupted services, fewer opportunities for cybercriminals to profit, and more friction when they try to rebuild.

It’s no longer enough to go after threats one by one. We need to interrupt how the attacks are put together. 

What’s different about this action   

Microsoft has long used civil legal action to disrupt cybercriminal infrastructure and pioneered the innovative use of existing laws, including the Racketeer Influenced and Corrupt Organizations Act (RICO), a US law designed to target organized crime.

What’s new is how we’re combining AI analysis with an expanded use of that law.

Amadey and StealC were developed by separate cybercriminals, but they relied on the same infrastructure. To understand how they worked, investigators used AI, including Copilot, to quickly analyze the malware, asking questions in plain English instead of manually combing through complex code. That helped surface key details, uncover hidden data, and test findings in a fraction of the time, turning what would have taken hours or days into minutes and enabling the team to spot connections faster.

Those insights allowed the legal team to treat both malware families as part of a single conspiracy. Instead of going after each tool separately, as we have done in the past, we used RICO to charge multiple complicit enablers involved across the operation. In total, Microsoft’s Digital Crimes Unit disrupted over 200 command-and-control servers—the systems criminals use to control infected devices, steal data, and keep attacks running.

By targeting tools together, we can disrupt the cybercrime chain more efficiently and more effectively, in a way that better reflects how these networks actually operate today.

Cybercrime now runs like an assembly line 

Cybercrime is no longer a series of isolated attacks—it’s a coordinated system.

Specialized tools handle each step: one gains access, another steals credentials, and others sell or exploit that access for fraud, ransomware, espionage, or other nefarious purposes. Different actors may be involved at each stage, but together they turn access into profit, quickly and at scale.

That structure also creates a point of vulnerability. The people behind these cybercriminal tools may never interact directly, but their tools are designed to work together. If those connections can be identified, multiple stages of an attack can be disrupted at once.

How these attacks play out in the real world 

Most people will never hear the names Amadey or StealC, but they feel the effects. A hospital locked out of critical systems. A city unable to deliver essential services. A small business losing access to accounts overnight. A retiree who lost their life savings.

These attacks don’t happen all at once. They unfold step by step: attackers get in, passwords are stolen, access is reused or sold, and sometimes repurposed for more targeted operations. For example, Microsoft has observed Russian-affiliated actor Secret Blizzard leveraging Amadey infections to deploy custom malware against targets in Ukraine.

By targeting multiple points in that chain at once, we reduce the chance that a single compromise turns into widespread harm. Put simply: fewer attacks succeed and fewer people feel the impact when they do.

No one organization can do this alone 

Actions like this underscore a fundamental reality: we’re successful when we collaborate. No single organization, whether government or industry, has full visibility into how cyber threats operate across borders and sectors. What makes this effort effective is the combination of perspectives and data.

Microsoft had been tracking Amadey due to its impact on customers, working with cybersecurity partners ESET, BitSight, Lumen, and Mitsui Bussan Secure Directions (MBSD) to better understand how it operated. At the same time, Europol’s European Cybercrime Centre (EC3), together with European law enforcement partners including Germany’s Federal Criminal Police Office and the Dutch and Danish National Police, was investigating StealC as part of Operation Endgame, alongside IBM X-Force and Proofpoint.

Bringing those efforts together expanded our collective datasets and made it possible to identify the connections between the two tools and act on them quickly. That shared understanding enabled a coordinated response that went further than any single organization could achieve alone.

 

This shows why partnerships matter. Industry shares technical insight, government brings visibility, and we need trusted ways to exchange that information. Only by working from the same picture can we stay ahead of attackers, disrupting not just individual tools but also the systems that make cybercrime possible.

Creating sustained pressure on cybercrime  

This work doesn’t end with a single action. Cybercriminals adapt quickly, which is why we continue tracking how these operations evolve and working with partners to disrupt them.

Microsoft’s court-authorized disruption in this case is paired with ongoing efforts to track how cybercriminals rebuild, identify new infrastructure, and work with partners to disrupt the services they rely on to operate. It also includes incorporating the findings from this disruption into initiatives like Microsoft’s Statutory Automated Disruption program, which helps accelerate the removal of malicious domains and infrastructure.

The goal is not just to stop one operation but to slow the system itself—making attacks harder to launch, scale, and recover from. By combining AI-driven insight, legal action, and strong partnerships, we can continue to raise the cost of cybercrime and reduce its impact.

For more than a decade, Microsoft’s Digital Crimes Unit (DCU) has worked to disrupt cybercrime and nation-state threats, filing around 40 cases since 2008 and partnering with law enforcement to take down criminal networks. Learn more about the team’s efforts here.

 

The post Scaling cybercrime disruption through innovation and AI appeared first on Microsoft On the Issues.