Verizon Wants A Yahoo Price Cut After Company Reveals Another, Massive Hack Attack

from the this-is-not-going-well dept

Earlier this year Verizon was understandably irritated when it learned (just two days before the public) that Yahoo had failed to disclose a massive hack of the company's systems during the companies' $4.8 billion merger negotiations. Reports suggested that Verizon, who is attempting to pivot from broadband to ads and content, wanted a $1 billion reduction in the asking price and another $1 billion set aside for the inevitable lawsuits. Given its NSA ties, Verizon was likely much less concerned about reports revealing that Yahoo also went out of its way to help the government sniff through subscriber e-mail accounts en masse.

Fast forward to this week, and things just got notably more complicated for both companies. While the first Yahoo hack revealed the personal data of roughly 500,000 Yahoo subscribers, Yahoo just confirmed a second attack by the same party that the company says revealed the personal data of 1 billion Yahoo users. Yahoo says this second attack was only revealed once law enforcement reached out to Yahoo with snippets of the compromised data in hand. But in a website post by Yahoo’s chief information security officer Bob Lord, the company effectively admits it still doesn't actually know how the hackers got this information:

"As we previously disclosed in November, law enforcement provided us with data files that a third party claimed was Yahoo user data. We analyzed this data with the assistance of outside forensic experts and found that it appears to be Yahoo user data. Based on further analysis of this data by the forensic experts, we believe an unauthorized third party, in August 2013, stole data associated with more than one billion user accounts. We have not been able to identify the intrusion associated with this theft. We believe this incident is likely distinct from the incident we disclosed on September 22, 2016."

Not too surprisingly, Verizon continues to be frustrated by the revelations, while simultaneously using them to drive down the Yahoo asking price:

"A legal team led by Verizon General Counsel Craig Silliman is assessing the damage from the breaches and is working toward either killing the deal or renegotiating the Yahoo purchase at a lower price, the person said. One of the major objectives for Verizon is negotiating a separation from any future legal fallout from the breaches. Verizon is seeking to have Yahoo assume any lasting responsibility for the hack damage, the person said."

While some outlets continue to suggest the deal could be killed entirely, Yahoo is critical to Verizon executives' beliefs they can transform Verizon from stodgy old telco into a Millennial-focused media and advertising juggernaut. The problem is that Verizon's attempt to become the next Google or Facebook isn't going particularly well. Being a pampered telecom monopoly for a generation doesn't imbue you with the kind of DNA required to make such a disruptive transition, resulting in the company's Millennial-focused streaming service Go90 being a "dud" in the words of Verizon's own partners.

Verizon will likely continue undaunted in its plan to magically become Google by gobbling up failed 90s internet brands. And while it's far from certain that Verizon has the chops to successfully make this transition work, the least we can hope is that the telco brings something vaguely resembling security standards along for the ride as the deal stumbles its way toward its inevitable conclusion.

Filed Under: cybersecurity, hack, merger, privacy
Companies: verizon, yahoo

Yahoo Asks James Clapper To Please Let It Talk About The Email Scanning It Did For The Government

from the 'it-already-sucks-enough-to-be-us' dept

After spending several days basking in the fiery glow of negative press (and seeing potential investors walk away from buying the company), Yahoo is asking the government to please please let it talk about the spying it apparently performed for the NSA or FBI.

Yahoo sent a letter to National Intelligence director James Clapper on Wednesday urging the U.S. government to provide clearer information to citizens on national security demands for user data.

Yahoo’s letter called for intelligence groups to confirm if future reported demands for data are real, and if they are, declassify them with context for the public.

Pots, kettles, and other analogous materials are rendered incomprehensible in its statement, which involves a media company implicitly criticizing other media companies.

In a letter today to James Clapper, Director of National Intelligence (DNI), Yahoo is formally urging that the U.S. government provide its citizens with clarification around national security orders they issue to internet companies to obtain user data.

While the letter makes specific reference to recent allegations against Yahoo, it is intended to set a stronger precedent of transparency for our users and all citizens who could be affected by government requests for user data. As we’ve said before, recent press reports have been misleading; the mail scanning described in the article does not exist on our systems.

"Does not exist" is not nearly the same thing as "did not exist." This means Yahoo is no longer scanning emails in this fashion, not that it never performed this scanning.

The letter does make a good point about transparency. Currently, Yahoo is unable to defend itself against any allegations because it is likely under a gag order. Yahoo would like Clapper's office to share in the public pain, especially since it had a problem sharing in the communications gathered on its behalf by the email provider.

Public embarrassment or not, Clapper's office is probably not rushing through a declassification review of this Section 702 FISA order. It could still be months or years before the government produces this document and/or allows Yahoo to speak openly about its email scanning program.

Perhaps recognizing that a displeased letter to the ODNI doesn't create much leverage, the company appears to be making this a global issue, rather than simply a domestic one. Marcy Wheeler points out that the letter mentions Yahoo's global reach and users several times and namechecks the EU's Privacy Shield agreement. This may be the key that loosens the Intelligence Community's Glomarred lips.

But there’s another reason why Clapper’s office — or rather ODNI General Counsel Bob Litt — may be so quiet.

Litt is the one who made many of the representations about US spying to authorities here [Wheeler is in Europe at the moment]. Someone — Litt, if he’s still around for a hearing that may take place under President Hillary — may also need to go testify under oath in an Irish court in conjunction with a lawsuit there. Whoever testifies will be asked about the kinds of surveillance implicating European users the government makes US companies do.

In other words, Bob Litt is the one who made certain representations to the European authorities. And now some of those same people are asking questions about how this scan complies with the terms Litt laid out.

Which makes his silence all the more instructive.

Someone's going to have to start talking about Yahoo's email scanning program soon. Yahoo obviously can't, which means the ODNI is going to have to address this on someone else's timetable. We already have US legislators demanding answers. European politicians are already unhappy about the apparent breach of the Privacy Shield Agreement. If the ODNI continues to avoid the issue, all it will be doing is letting a private company take the fall for its possible overreach.

Filed Under: email, gag order, james clapper, mass surveillance, nsa, scanning, surveillance
Companies: yahoo

Verizon Wants $1 Billion Discount After Yahoo Scandals, Still Fancies Itself The New Google

from the we're-innovative-if-we-say-we-are dept

With wireless and fixed-line broadband growth slowing, Verizon has been steadily expanding into new growth territories to try and please insatiable investors. So far, that apparently includes buying failed 90s internet brands like Yahoo and AOL in the belief that it can somehow become a Millennial advertising juggernaut. Except that hasn't been going particularly well, as the stodgy old telco realizes that it's kind of hard to innovate when you've spent the last thirty years bumbling about as a government-pampered telecom monopoly almost solely focused on turf protection.

And things have been going notably worse for Verizon over the last month, as the company has acknolwedged that Yahoo failed to reveal not only the 2014 hack of 500 million user accounts, but also its recently disclosed wholesale e-mail spying for the U.S. government during negotiations. That has prompted rumors that Verizon is looking for a billion-dollar discount off the original $4.8 billion Yahoo asking price:

"In the last day we’ve heard that [AOL boss] Tim [Armstong] is getting cold feet. He’s pretty upset about the lack of disclosure and he’s saying, ‘Can we get out of this or can we reduce the price?’” said a source familiar with Verizon’s thinking. That might just be tough talk to get Yahoo to roll back the price. Verizon had been planning to couple Yahoo with its AOL unit to give it enough scale to be a third force to compete with Google and Facebook for digital ad dollars.

Of course "scale" isn't enough to compete with Facebook and Google when you lack anything resembling disruptive or innovative DNA, though Verizon seems intent on learning this the hard way. Verizon CEO Lowell McAdam says the company has no intention of backing away from the deal, and continues to insist that despite Yahoo being a vicious shitshow, it's the missing link necessary to transform Verizon from stodgy old telco to innovative advertising juggernaut:

"I think, and we’ll see how AOL and Yahoo come together, but I think that entity can be easily one of the top three,” McAdam said at the conference. “I think we can provide the content and applications that will stand up with anything that goes up on the West Coast."

Right. But so far, there's absolutely zero indication that's going to be the case. One of the key cornerstones of Verizon's attack plan has been Go90, a new streaming video service tailored to Millennials. The problem? Those advertising and content partners McAdam claims are so excited about Verizon's entry into the market think the platform is a disaster of colossal proportions:

"Early on, we thought the platform had promise, but it was an absolute dud when it launched,” says one Go90 publishing partner. “We get the sense that unless you’re one of the premier folks they paid piles of money to [for original content], there isn’t much there from a traffic perspective,” said another. “Based on the plan they had originally laid out, it would have been a mid-tier platform for us — millions of views per month, at worst — but it’s turned out to be far, far worse than their projections,” says yet another."

Fancy! So not only did Verizon gobble up a number of underwhelming 90s internet brands in the hopes of striking it rich in content, its own foray into content has been painfully underwhelming (something that should have been apparent to anybody who remembers Verizon's first, brief attempt at original content, SugarString). Combine that with the money Verizon will have to dole out once the lawsuits over the Yahoo hack begin flooding in, and you've got the kind of pivot and metamorphosis that makes Jeff Goldblum's experience in The Fly look arguably pleasant.

Filed Under: hacking, mergers, security, surveillance
Companies: verizon, yahoo

Continued Disagreement And Confusion Over Yahoo Email Scanning

from the someone-needs-to-come-clean-for-real dept

The story behind Yahoo's apparently scanning over every email for the NSA continues to be... confusing. Earlier this week we noted some conflicting reports in the media on what was actually happening. The NY Times report said that it was via a FISA Court Order, which would be interesting, and would almost certainly require a declassification of the FISA opinion. However, Reuters insisted that it was actually under Section 702 of the FISA Amendments Act (which doesn't involve a FISA Court Order). So, confusion abounded.

And now it's getting worse. That same NY Times report said that the system was just a modification of Yahoo's malware scanners for a particular snippet of text or code:

To comply, Yahoo customized an existing scanning system for all incoming email traffic, which also looks for malware, according to one of the officials and to a third person familiar with Yahoo’s response, who also spoke on the condition of anonymity

Except, according to a new report from Motherboard, that's not actually true, and instead the NSA was asking Yahoo to install its own malware which was super buggy:

Anonymous sources told The Times that the tool was nothing more than a modified version of Yahoo’s existing scanning system, which searches all email for malware, spam and images of child pornography.

But two sources familiar with the matter told Motherboard that this description is wrong, and that the tool was actually more like a “rootkit,” a powerful type of malware that lives deep inside an infected system and gives hackers essentially unfettered access.

The rootkit-like tool was found by Yahoo’s internal security testing team during one of their checkups, according to a source.

That's more consistent with the original report in Reuters, which talked about the security team finding the code and believing it was malware. And, apparently the rootkit/malware code that the NSA gave Yahoo was super buggy and put everyone at risk:

“It definitely contained something that did not look like anything Yahoo mail would have installed,” the source added. “This backdoor was installed in a way that endangered all of Yahoo users.”

Another source, who also requested anonymity and was familiar with what happened, confirmed that describing the tool as a “buggy” “rootkit” is accurate.

A different article over at the Intercept has similar claims as well. It's possible that this is the same source going to multiple publications, or it could actually be different sources. Seeing as the language in the two articles is similar, it very likely is the same source though:

According to the Yahoo alum, a mere “modification to [existing] mail filters wouldn’t have raised a red flag … [the security team] wouldn’t have been able to detect it in the first place.” Rather, Yahoo’s security team had detected “something novel, like something a hacker would have installed.” The team believed it “was or looked like a root kit,” a piece of software installed on a computer system to give a third party complete, invisible control. In this case, according to the ex-Yahoo source, it was “a program that runs on your servers that has access to incoming data.”

And the buggy nature is also discussed as well:

“The program that was installed for interception was very carelessly implemented, in a way that if someone like an outside hacker got control of it, they could have basically read everyone’s Yahoo mail,” something the source attributed to “the fact that it was installed without any security review.”

I'm guessing this is the same source who went to both publications, but it continues to raise more questions about this. Forcing Yahoo to actually install code is a big, big deal and gets back to the questions raised by the DOJ trying to force Apple to do the same thing. And, once again, this is the kind of thing the government isn't supposed to be able to do in secret. Yes, individual orders and details about who or what is being searched can and should be kept secret, but requiring a company to install code that sniffs through every email... that's not how these things are supposed to work.

Filed Under: email, malware, mass surveillance, nsa, rootkit, scanning
Companies: yahoo

Senator Ron Wyden Says White House Is Required By Law To Reveal Details Behind Yahoo Scanning

from the where's-my-popcorn? dept

So, one of the things in the USA Freedom Act is a provision requiring that the White House declassify any "novel interpretations" of the law in ordering surveillance. This was to avoid the situations, such as under the Section 215 program, where the intelligence community reads words to mean things differently than anyone else would read them. Now, given what we've learned so far about the Yahoo email scanning case and the fact that it clearly goes beyond what people thought the law enabled, it seems clear that there's some interpretation somewhere that's "novel."

And that means that the White House should declassify the reasoning. Now Senator Ron Wyden is asking them to do exactly that:

“Recent reports of a mass-email scanning program have alleged that federal law is being interpreted in ways that many Americans would find surprising and troubling,” Wyden said. “The USA Freedom Act requires the executive branch to declassify Foreign Intelligence Surveillance Court opinions that involve novel interpretations of laws or the Constitution and I certainly expect the Executive Branch to follow this law.”

This is, obviously, something of a warning shot to the administration. Chances are they'll ignore this, but that could turn into a pretty serious strategic mistake. As we've been saying since it first came out, James Clapper should explain what's happening, because the longer they stay silent, the worse this looks.

Filed Under: fisa court, mass surveillance, nsa, odni, ron wyden, surveillance, usa freedom act
Companies: yahoo

Yahoo Email Scanning May Sink EU Privacy Shield Agreement

from the nsa-fucking-things-up-again dept

After the US/EU "safe harbor" on data protection was tossed out thanks to NSA spying being incompatible with EU rights, everyone had tried to patch things up with the so-called "Privacy Shield." As we noted at the time, as long as the NSA's mass surveillance remained in place, the Privacy Shield agreement would fail as well. This wasn't that difficult to predict.

And there are already some challenges to the Privacy Shield underway, including by Max Schrems, who brought the original challenge that invalidated the old safe harbor. But things may have accelerated a bit this week with the story of Yahoo scanning all emails. This news has woken up a bunch of EU politicians and data protection officials, leading to some serious questions about whether it violates the Privacy Shield agreement.

Johannes Kleis, a spokesman with BEUC, an umbrella group for European consumer organisations, called on other EU data protection authorities to investigate Yahoo.

Fabio de Masi, a German member of the European parliament with the leftist Die Linke party called on the EU high representative for external affairs Federica Mogherini to seek clarification from US authorities about the treatment of EU data.

And elsewhere as well:

"It goes far beyond what is acceptable," said Johannes Caspar, Commissioner for Data Protection and Freedom of Information in Hamburg, Germany.

Over in the European Parliament, Dutch MEP Sophie in 't Veld has asked the EU Commission to investigate: While some keep arguing that the whole idea of a safe harbor or privacy shield is a problem, that's not really true. Enabling more easy data flows between countries on a borderless internet is really important for keeping the internet really global. This is a serious issue. The problem is the NSA's surveillance activities undermining all of this, and continually (rightfully) freaking out people in other countries about what happens to data that flows into the US. The answer is not to dump agreements that enable the free flow of data, but to stop mass surveillance activities.

Once again, it appears that overly aggressive mass surveillance by the US intelligence community is creating massive headaches for American internet companies.

Filed Under: data flows, data protection, eu, mass surveillance, nsa, privacy shield, us
Companies: yahoo

NY Times And Reuters Claim Totally Different Explanations For Yahoo's Email Scanning

from the so-um-well,-this-is-awkward dept

On Wednesday afternoon the NY Times released a report that appeared to clarify some of the questions around Tuesday's Reuters report about Yahoo scanning all emails. According to the NY Times, unlike the original Reuters report that talked about a "directive" (which would imply an NSA surveillance program such as the one under Section 702 of the FISA Amendments Act), the scanning was actually the result of a more traditional FISA Court order.

Yahoo was ordered last year to search incoming emails for the digital “signature” of a communications method used by a state-sponsored, foreign terrorist organization, according to a government official familiar with the matter.

The Justice Department obtained the order from a judge of the Foreign Intelligence Surveillance Court.

To comply, Yahoo used a modified version of its existing systems that were scanning all incoming email traffic for spam, malware and images of child pornography. The system stored and made available to the Federal Bureau of Investigation a copy of any messages it found that contained the digital signature.

Some had speculated that this was what happened, but there was still some confusion over Reuters' original use of "directive." However, before the digital ink had even dried on the NY Times report, Reuters came out with a new report of its own that claimed the scanning was done under a Section 702 program:

Yahoo's request came under the Foreign Intelligence Surveillance Act, the sources said. The two sources said the request was issued under a provision of the law known as Section 702, which will expire on Dec. 31, 2017, unless lawmakers act to renew it.

But, the Reuters report also notes that there was a "FISA Court warrant" associated with the request:

The FISA Court warrant related specifically to Yahoo, but it is possible similar such orders have been issued to other telecom and internet companies, the sources said.

So it sounds like there may have been some sort of weird hybrid FISA Court order, which used Section 702 as the basis for the demand -- even though the coverage of it included items that previously had been considered off limits under the 702 PRISM program (i.e., "about" communications, rather than just to and from metadata).

Either way, this is putting renewed emphasis on the problems with Section 702 -- and the fact that it expires at the end of next year. If the NSA had been hoping that the PCLOB report, and other factors, would lead Congress to rubber stamp the renewal, the exposure of the Yahoo program may have just undermined that in a big way. The EFF is already pointing out how scanning all emails for a selector like this is a 4th Amendment violation. Of course, actually getting standing to prove that in court is going to be a challenge.

Filed Under: 702, email scanning, fisa court, fisc, mass surveillance, nsa
Companies: ny times, reuters, yahoo

Yahoo Issues Tone Deaf Non-Denial Denial Of Email Scanning Report

from the blink-twice-if-you're-being-forced-to-say-this dept

After basically all the big tech companies have come out with strong and clear denials, Yahoo this morning released a silly mealy mouthed non-denial denial, written by a PR firm, that took almost 24 hours to craft:

Good morning –

We are reaching out on behalf of Yahoo regarding yesterday’s Reuters article. Yahoo said in a statement:

“The article is misleading. We narrowly interpret every government request for user data to minimize disclosure. The mail scanning described in the article does not exist on our systems.”

Best,

The Joele Frank Team

Of course, people are parsing every word of that and noting some... remaining questions. The article is misleading? Okay, how? Which parts? What did it get wrong? You narrowly interpret every government request? Great. So explain what was found here, or explain the specifics of what Yahoo is doing. "Does not exist on our systems"? Did it ever? Does it exist on someone else's system? Does a different mail scanning system exist? Lots of people would like to know.

More importantly, note that they say they want to minimize disclosures. But that's not the key issue here, as Chris Soghoian points out. The Reuters report was on the searching of all emails, not the disclosure bit. Yes, sure, it seems clear that after searching everyone's email, Yahoo likely only "disclosed" a small number to the NSA, but that's not really the point, is it?

I mean, I guess this statement is better than Yahoo's original: "Yahoo is a law abiding company, and complies with the laws of the United States" statement. But, it's not very reassuring. Much more important is what Yahoo could have said, but didn't. But that's not happening. Yahoo has said that it "can't comment further" which either means it doesn't want to comment further or, potentially, that it feels it is legally barred from commenting any further -- which is certainly a possibility (though a disturbing one).

The NSA or the Director of National Intelligence could help clear this up, but so far they're going all Glomar on any questions: And that alone should be a giant warning sign to any tech company that decides not to fight these kinds of demands: when it inevitably leaks to the public (and it will), the intelligence community will let you hang out to dry all by yourself.

Filed Under: email, mass surveillance, non-denial denial, nsa, scanning, section 702
Companies: yahoo

Basically All Big Tech Companies Deny Scanning Communications For NSA Like Yahoo Is Doing

from the getting-more-interesting dept

So, the big story yesterday was clearly the report that Yahoo had secretly agreed to scan all email accounts for a certain character string as sent to them by the NSA (or possibly the FBI). There has been lots of parsing of the Reuters report (and every little word can make a difference), but there are still lots of really big questions about what is actually going on. One big one, of course, is whether or not other tech companies received and/or complied with similar demands. So it seems worth nothing that they've basically all issued pretty direct and strenuous denials to doing anything like what Yahoo has been accused of doing.

Twitter initially gave a "federal law prohibits us from answering your question" answer -- and a reference to Twitter's well documented lawsuit against the US government over its desire to reveal more details about government requests for info. However, it later clarified that it too was not doing what Yahoo was doing and had never received such a request. Microsoft's response was interesting in that it says it's not doing what Yahoo is, but refused to say if it had ever received a demand to do so. Google said it had never received such a request and would refuse to comply if it had. Facebook has also denied receiving such a request, and, like Google, says it would fight against complying. This still leaves lots of unanswered questions about why Yahoo gave in. Again, historically, Yahoo had been known to fight against these kinds of requests, which makes you wonder what exactly was going on here.

Former GCHQ infosecurity guy Matt Tait has one of the more more interesting threads about this news, arguing (in some ways) that it's both less and more than everyone is making it out to be. His basic argument is that this is an expansion of the PRISM program to include "about" targets. This has been discussed in the past, but under PRISM, the NSA could give tech companies "selectors" in the form of specific addresses and the companies were compelled to hand over emails "to" or "from" them -- but according to the PCLOB's report on the Section 702 program it did not include anyone emailing "about" the selector. Upstream collections (i.e., tapping the backbones from folks like AT&T) did include "about" selectors (and this information also flowed into other areas, enabling so called backdoor searches. And, as I speculated yesterday, Tait says that this latest news appears to be Yahoo now agreeing to use "about" selectors on its emails, which means that it's still part of PRISM, with a massive expansion.

Tait then notes that if James Clapper wants to clear this up, he should state publicly whether or not "about" collection is a part of PRISM. And if that's the case, he should also explain when and why PRISM was expanded to include this. But, of course, Clapper and the Intelligence Community tend not to want to explain very much of anything, leaving lots of people in the dark.

And, frankly, that's stupid. The Intelligence Community thinks that this keeps "bad guys" on edge, not knowing what's safe and what's not. But that's dumb. They mostly know to use more encrypted/secret means of communication when they need to. Instead, what you end up with is keeping the public on edge and not trusting services. I can almost guarantee that one of the early comments on this post will be some of you insisting that all the companies denying doing this are flat out lying. I don't agree with that, because the companies don't have a history of outright lying on things like this, but the way the NSA and other parts of the US government have repeatedly tried to pressure them and gag them, it's much tougher to take anything at face value any more. And that's not good for anyone.

Filed Under: about collection, about selectors, mass surveillance, nsa, prism, section 702, upstream
Companies: facebook, google, microsoft, twitter, yahoo

Yahoo Secretly Built Software To Scan All Emails Under Pressure From NSA Or FBI

from the uh-wait-a-second dept

So Reuters had a big exclusive report this morning about Yahoo creating "custom software to search all of its customers' incoming emails for specific information" at the behest of the NSA or FBI. This was built last year -- which came well after the Snowden disclosures, and after Yahoo had been revealed to have legally challenged earlier NSA dragnet attempts -- and after it had rolled out end-to-end encryption on email.

Apparently, this was a decision made at the top by Marissa Mayer, and pissed off the company's top security guy, Alex Stamos (who is awesome and a big supporter of end-to-end encryption) leading him to leave the company (and move to Facebook, where he is currently).

According to the two former employees, Yahoo Chief Executive Marissa Mayer's decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc."Yahoo is a law abiding company, and complies with the laws of the United States," the company said in a brief statement in response to Reuters questions about the demand. Yahoo declined any further comment.

Of course, this comes out less than a week after the NY Times had a big report on how Mayer de-prioritized security, despite having built up a great team of computer security experts called "The Paranoids." But, Mayer apparently downplayed or blocked their efforts, leading many to go elsewhere. And now we find out that Yahoo agreed to create this special software for scanning all emails for certain phrases or keywords. Bizarrely, this new report notes that Mayer gave the task of writing this software not to the security team, but to email engineers, leaving the security team in the dark, until they discovered it, thinking it was malware:

They were also upset that Mayer and Yahoo General Counsel Ron Bell did not involve the company's security team in the process, instead asking Yahoo's email engineers to write a program to siphon off messages containing the character string the spies sought and store them for remote retrieval, according to the sources.

The sources said the program was discovered by Yahoo's security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in.

When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users' security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails.

Now, there are still a number of open questions about this: chief among them if others, such as Google, Microsoft, Facebook, and Twitter were similarly compelled to create similar software. This may not be that meaningful, but the article does not say that it was a FISA Court "order" but rather a "directive" that compelled this:

The company complied with a classified U.S. government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said two former employees and a third person apprised of the events.

The question then is what secret "directive" does the government have that allows such broad scanning? The most likely (but certainly not the only) possibility is a stretched interpretation of Section 702 of the FISA Amendments Act. That Section is responsible for two known programs for the NSA to collect info: PRISM, which had big tech companies sharing specific information with the NSA, and "upstream" collection in which broadband providers like AT&T would scan all traffic for certain information. Without more detail, it's a little difficult to know what happened here, but it sounds like something in between PRISM and upstream -- in which online service providers were similarly asked to scan all content for certain information.

It seems clear that Yahoo either didn't think it could win a legal fight over this (certainly a possibility), or that it just didn't want to. At the very least, this seems like yet another example of totally secretive rulemaking by the US government on what surveillance capabilities are legal, without any public review or adversarial process designed to make sure that civil liberties are protected. I know that many of the more paranoid folks out there think that the NSA already had deals with the big companies to scan all content, but they weren't supposed to, and as far as we knew they did not as of a few years ago. But if that changed last year, that's a big, big deal, and much more information needs to become public on this.

Filed Under: alex stamos, bulk collection, email, marissa mayer, mass surveillance, nsa, privacy, scanning, section 702
Companies: yahoo