News

Report: Yahoo Scanned User E-Mails Per Government Requests

• By Kurt Mackie
• October 05, 2016

Yahoo allegedly cooperated with U.S. intelligence officials to scan all incoming Yahoo e-mail traffic last year, according to a report by Reuters on Tuesday.

Yahoo performed the scans using a program built by Yahoo's engineers, which searched for a "set of characters." The information was stored for remote retrieval by the spy officials. Presumably, the scans were requested by the FBI or the U.S. National Security Agency (NSA), although that detail wasn't clarified in the story.

The scanning operation was approved by Yahoo's CEO Marissa Mayer, causing Yahoo's Chief Information Security Officer Alex Stamos to resign. The Reuters story cited "people familiar with the matter" as the source of the information.

Stamos, now chief security officer at Facebook, also was said to have exited Yahoo after he was unable to get basic security protections in place for Yahoo accounts, as reported in a New York Times story published last week. Yahoo admitted last week that it had been hacked in late 2014, which exposed the account information of more than 500 million Yahoo users.

In past public spying disclosures, initiated due to document leaks by former NSA contractor and whistleblower Edward Snowden, multiple Internet service providers (ISPs) were shown to have been participants in the NSA's PRISM program, which tapped Internet traffic in bulk. Participants in that program included Yahoo, as well as Microsoft, Google, Facebook, Apple and others. However, Yahoo's participation in directly scanning e-mail traffic seems to be a new twist. It's a more direct indication of ISP participation in such clandestine schemes.

In 2013, President Barack Obama had denied the practice bulk scanning of public e-mail traffic. Snowden noted that point in a Tweet on Wednesday.

Yahoo reportedly didn't contest the scanning request in the courts, according to the Reuters story. On Wednesday, Yahoo issued a statement to Reuters indicating it "complies with the laws of the United States." Yahoo currently is under consideration for acquisition by Verizon in a deal estimated at $4.8 billion.

The Reuters story obtained denials from both Microsoft and Google that those ISPs also conduct such bulk e-mail scanning for government authorities.

"We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo," a Microsoft spokesperson told Reuters.

A Google spokesperson stated, "We've never received such a request, but if we did, our response would be simple: 'No way.'"

(Update: As reported Wednesday by Bloomberg, Yahoo described the Reuters story as "misleading" and added that "the mail scanning described in the article does not exist on our systems.")