SurveillanceYahoo stealthily scanned customer e-mails on behalf of U.S. intelligence agencies

Published 4 October 2016

A report on Tuesday accuses Yahoo of secretly building a customized software program to search all of its customers’ incoming e-mails for specific information provided by the U.S. intelligence company. The company, complying with classified NSA and FBI directives, scanned hundreds of millions of Yahoo Mail accounts. Yahoo is the first U.S. Internet company to agree to such a blanket request.

Yahoo's home office // Source: theconversation.com

A report on Tuesday accuses Yahoo of secretly building a customized software program to search all of its customers’ incoming e-mails for specific information provided by the U.S. intelligence company.

The Streetreports that the company, complying with classified NSA and FBI directives, scanned hundreds of millions of Yahoo Mail accounts. Reuters quoted surveillance experts who said this is the first case to surface of a U.S. Internet company agreeing to a demand by an intelligence agency to search all arriving messages, rather than examining stored messages or scanning a small number of accounts in real time. 

Reuters notes that it is not clear what information the NSA and FBI were looking for, but they wanted Yahoo to look for a set of characters. This in all likelihood would be a phrase in an e-mail or an attachment.

The new service said it could not say for sure what data Yahoo had handed over to the NSA and the FBI, and whether intelligence officials had made similar demands of other e-mail providers in addition to Yahoo.

The Verge reports that two former employees said that Yahoo Chief Executive Marissa Mayer’s decision to comply with the directives was a cause of consternation among some senior executives, and that it led to the June 2015 resignation of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook.

“Yahoo is a law abiding company, and complies with the laws of the United States,” the company said in a brief statement. Stamos declined to comment, as did the NSA.

The demand to search Yahoo Mail accounts came in the form of a classified directive sent to the company’s legal team.

The Streetnotes that U.S. phone and Internet companies have handed over bulk customer data to intelligence agencies. Former government officials and private surveillance experts said, however, that they had not previously seen either such a broad directive for real-time Web collection or one that required the creation of a new computer program.

“I’ve never seen that, a wiretap in real time on a ‘selector’,” Albert Gidari, a lawyer who represented phone and Internet companies on surveillance, told Reuters. A selector refers to a type of search term used to zero in on specific information.

He added: “It would be really difficult for a provider to do that.”