Yahoo Inc. complied with a request last year from the U.S. government to search all users’ incoming email for specific terms. The company created a software program that would seek out specific characters within emails and attachments and store them so they could be delivered to either the National Security Agency of the FBI; it is unclear which agency made the request. Two former employees and a third source familiar with the decision confirmed the news to Reuters but spoke on a condition of anonymity. It is unclear what information the agencies were trying to obtain.
Since 2008, phone and Internet companies have provided the government with data to aid them with efforts to fight terrorism and gain intelligence under the Foreign Intelligence Surveillance Act, but this marked the first time a company was intercepting e-mail as they came in. Other efforts have found communications providers searching stored messages or scanning e-mail in small batches, according to Reuters.
“Yahoo is a law-abiding company and complies with the laws of the United States,” the company said in a statement. It did not elaborate further on the claims of its former employees, who claimed that its CEO Marissa Meyer decided to obey the request, which came via the company’s legal department. Reuters linked the decision to the departure of Chief Information Security Officer Alex Stamos, who left in June 2015 for Facebook. The sources claimed Meyer complied because she thought she would be unable to fight the request.
On Wednesday, the company called the Reuters report “misleading.”
“We narrowly interpret every government request for user data to minimize disclosure,” a rep said in a statement (via CNBC). “The mail scanning described in the article does not exist on our systems.”
“Based on this report, the order issued to Yahoo appears to be unprecedented and unconstitutional,” ACLU attorney Patrick Toomey said in a statement. “The government appears to have compelled Yahoo to conduct precisely the type of general, suspicionless search that the Fourth Amendment was intended to prohibit.
“It is deeply disappointing that Yahoo declined to challenge this sweeping surveillance order, because customers are counting on technology companies to stand up to novel spying demands in court,” he added. “If this surveillance was conducted under Section 702 of the Foreign Intelligence Surveillance Act, this story reinforces the urgent need for Congress to reform the law to prevent dragnet surveillance and require increased transparency.”
The company’s security team, which had not been briefed on the decision to create the software, discovered the program within a couple of weeks of its implementation in May 2015. It had thought the company had been hacked. (Recent news of a “state-sponsored” attack on Yahoo in 2014 is unrelated to today’s news.)
Stamos and the Office of the Director of National Intelligence both declined Reuters’ requests for comment. The news agency was also unable to confirm whether or not the government had approached other companies. In statements to the Intercept, a Google rep said, “We’ve never received such a request, but if we did, our response would be simple: ‘No way.’” A rep for Microsoft said, “We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo.”
Apple previously rebuffed a similar request when the FBI sought to gain access to an iPhone belonging to one of the terrorists who attacked San Bernardino last year.