Yahoo Secretly Scanned All Customer Emails for the NSA, FBI


Yahoo is having a bad month.

While the company is trying to sell itself to Verizon, it announced last month that state-sponsored hackers accessed 500 million accounts in 2014. (Better late than never, I guess?)

Now this week, it was discovered that Yahoo secretly built a program to search every Yahoo user email.

Reuters reported the exclusive:

Yahoo Inc last year secretly built a custom software program to search all of its customers’ incoming emails for specific information provided by U.S. intelligence officials, according to people familiar with the matter. The company complied with a classified U.S. government demand, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said three former employees and a fourth person apprised of the events.

Some surveillance experts said this represents the first case to surface of a U.S. Internet company agreeing to an intelligence agency’s request by searching all arriving messages, as opposed to examining stored messages or scanning a small number of accounts in real time. It is not known what information intelligence officials were looking for, only that they wanted Yahoo to search for a set of characters. That could mean a phrase in an email or an attachment, said the sources, who did not want to be identified.

Reuters was unable to determine what data Yahoo may have handed over, if any, and if intelligence officials had approached other email providers besides Yahoo with this kind of request. According to two of the former employees, Yahoo Chief Executive Marissa Mayer’s decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc.

Yahoo insists they are a “law abiding company, [that] complies with the laws of the United States.” Under vague, sweeping legislation like the Foreign Intelligence Surveillance Act, who knows, that might technically be true. But it doesn’t make it right.

That is why it’s so important to fight legislative battles early when it counts, to prevent our civil liberties from being taken away one small step at a time. A surveillance state isn’t created overnight. It’s created in small increments that sneak up on you when it’s too late to object to them. It’s floated into national consciousness through vague slogans like “nothing to hide, nothing to fear.”

Giving government the authority to order private companies to release personal information sets a dangerous legal precedent for future abuses of power. We need to fight this now.