The tech world expressed alarm on Tuesday over a report that the National Security Agency ordered Yahoo to build custom software to search incoming email messages, a move that would represent a new extension of the agency’s controversial spying practices.
The details of the Yahoo email surveillance program, reportedly installed in 2015, are still emerging, but they immediately raise questions about whether other companies are participating as well. So far, four tech giants say they are not.
“We’ve never received such a request, but if we did, our response would be simple: ‘no way’,” said a spokesperson from Google in response to a query about whether the NSA asked the company to build similar custom software to scan Gmail.
While tech companies have for years been subject to surveillance requests by the NSA, the 2015 Yahoo initiative, first reported by Reuters, appears to be different in scope in two respects. First, the surveillance included a search for specific characters of all incoming messages in real time—as opposed to stored messages or a handful of email accounts in real time. Secondly, the program—unlike ones reported by Edward Snowden—required Yahoo to build new tools to facilitate it.
The report caused outrage among civil libertarians:
https://twitter.com/agcrocker/status/783357105730297856
Yahoo has not denied the information contained in the Reuters account, only saying it complies with all U.S. Laws.
As for Microsoft, which operates millions of Hotmail accounts, the company has denied being participating in a similar scanning program.
“We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo,” said the company in a statement.
Get Data Sheet,Coins2Day’s technology newsletter.
Microsoft did not elaborate as to whether the NSA has asked it to construct an email scanning system akin to the one allegedly in place at Yahoo. Meanwhile, a Twitter spokesperson told news site the Intercept that the company it is not carrying out a Yahoo-like program.
Facebook also told Coins2Day that it had not received such a request from the NSA, adding it would “fight” if it did. (The company’s current security chief previously worked at Yahoo, but reportedly left over the company’s decision to go along with the NSA request).
In general, it can be difficult to decipher the scope of the NSA’s activity in Silicon Valley, in part because the agency often obtains orders from a secret body, known as the FISA court, where all proceedings are subject to gag orders. As a result, it’s possible that companies like Microsoft are challenging requests to expand their email surveillance but are legally barred from saying they are doing so.
As for Yahoo, the Reuters report cites sources who say the company decided against challenging the NSA’s request in the belief it would lose at the FISA court.
The new controversy over Yahoo also has echoes over a high-profile security showdown earlier this year between the FBI and Apple. That case, which involved the agency demanding that Apple build custom software to break its iPhone encryption, likewise raised the question of how far the country’s spy agencies could go to force companies to comply with their orders.
Between Apple v FBI and the Yahoo/NSA news it's now clearer than ever that next surveillance fight frontier is the scope of assistance req'd
— Kevin Bankston (@KevinBankston) October 4, 2016
Finally, the contents of what the NSA was seeking at Yahoo are a mystery. The initial report cites sources saying law enforcement asked Yahoo to “search for a set of characters,” which could indicate a passcode used by terrorists in an email or an attachment — or something else entirely.