Tag Archives: yahoo

Yahoo built secret software to scan customer emails for U.S. intelligence

Yahoo Inc. last year secretly built a custom software program to search all of its customers’ incoming emails for specific information provided by U.S. intelligence officials.

The company complied with a classified U.S. government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said two former employees and a third person apprised of the events.

Some surveillance experts said this represents the first case to surface of a U.S. Internet company agreeing to a spy agency’s demand by searching all arriving messages, as opposed to examining stored messages or scanning a small number of accounts in real time.

It is not known what information intelligence officials were looking for, only that they wanted Yahoo to search for a set of characters. That could mean a phrase in an email or an attachment, said the sources, who did not want to be identified.

Reuters was unable to determine what data Yahoo may have handed over, if any, and if intelligence officials had approached other email providers besides Yahoo with this kind of request.

According to the two former employees, Yahoo Chief Executive Marissa Mayer’s decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc.

“Yahoo is a law abiding company, and complies with the laws of the United States,” the company said in a brief statement in response to Reuters questions about the demand.

Yahoo declined any further comment.

Through a Facebook spokesman, Stamos declined a request for an interview.

The NSA referred questions to the Office of the Director of National Intelligence, which declined to comment.

The demand to search Yahoo Mail accounts came in the form of a classified directive sent to the company’s legal team, according to the three people familiar with the matter.

U.S. phone and Internet companies are known to have handed over bulk customer data to intelligence agencies. But some former government officials and private surveillance experts said they had not previously seen either such a broad directive for real-time Web collection or one that required the creation of a new computer program.

“I’ve never seen that, a wiretap in real time on a ‘selector,'” said Albert Gidari, a lawyer who represented phone and Internet companies on surveillance issues for 20 years before moving to Stanford University this year. A selector refers to a type of search term used to zero in on specific information.

“It would be really difficult for a provider to do that,” he added.

Experts said it was likely that the NSA or FBI had approached other Internet companies with the same demand, since they evidently did not know what email accounts were being used by the target.

The NSA usually makes requests for domestic surveillance through the FBI, so it is hard to know which agency is seeking the information.

Reuters was unable to confirm whether the 2015 demand went to other companies, or if any complied.

Alphabet Inc’s Google and Microsoft Corp, two major U.S. email service providers, did not respond to requests for comment.

CHALLENGING THE NSA

Under laws including the 2008 amendments to the Foreign Intelligence Surveillance Act, intelligence agencies can ask U.S. phone and Internet companies to provide customer data to aid foreign intelligence-gathering efforts for a variety of reasons, including prevention of terrorist attacks.

Disclosures by former NSA contractor Edward Snowden and others have exposed the extent of electronic surveillance and led U.S. authorities to modestly scale back some of the programs, in part to protect privacy rights.

Companies including Yahoo have challenged some classified surveillance before the Foreign Intelligence Surveillance Court, a secret tribunal.

Some FISA experts said Yahoo could have tried to fight last year’s directive on at least two grounds: the breadth of the demand and the necessity of writing a special program to search all customers’ emails in transit.

Apple Inc made a similar argument earlier this year when it refused to create a special program to break into an encrypted iPhone used in the 2015 San Bernardino massacre. The FBI dropped the case after it unlocked the phone with the help of a third party, so no precedent was set.

Other FISA experts defended Yahoo’s decision to comply, saying nothing prohibited the surveillance court from ordering a search for a specific term instead of a specific account. So-called “upstream” bulk collection from phone carriers based on content was found to be legal, they said, and the same logic could apply to Web companies’ mail.

As tech companies become better at encrypting data, they are likely to face more such requests from spy agencies.

Former NSA General Counsel Stewart Baker said email providers “have the power to encrypt it all, and with that comes added responsibility to do some of the work that had been done by the intelligence agencies.”

SECRET SIPHONING PROGRAM

Mayer and other executives ultimately decided to comply with the directive last year rather than fight it, in part because they thought they would lose, said the people familiar with the matter.

Yahoo in 2007 had fought a FISA demand that it conduct searches on specific email accounts without a court-approved warrant. Details of the case remain sealed, but a partially redacted published opinion showed Yahoo’s challenge was unsuccessful.

Some Yahoo employees were upset about the decision not to contest the more recent directive and thought the company could have prevailed, the sources said.

They were also upset that Mayer and Yahoo General Counsel Ron Bell did not involve the company’s security team in the process, instead asking Yahoo’s email engineers to write a program to siphon off messages containing the character string the spies sought and store them for remote retrieval, according to the sources.

The sources said the program was discovered by Yahoo’s security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in.

When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users’ security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails.

Stamos’s announcement in June 2015 that he had joined Facebook did not mention any problems with Yahoo. (http://bit.ly/2dL003k)

In a separate incident, Yahoo last month said “state-sponsored” hackers had gained access to 500 million customer accounts in 2014. The revelations have brought new scrutiny to Yahoo’s security practices as the company tries to complete a deal to sell its core business to Verizon Communications Inc for $4.8 billion.

A man walks past a Yahoo logo during the Mobile World Congress in Barcelona, Spain in this February 24, 2016 file photo. REUTERS/Albert Gea/File Photo
A man walks past a Yahoo logo during the Mobile World Congress in Barcelona, Spain in this February 24, 2016 file photo. REUTERS/Albert Gea/File Photo

In tune online: Live Nation, Yahoo stream a concert a day

Live Nation’s partnership with Yahoo to stream one live concert every day is a rare win for music fans. The series, which began with the Dave Matthews Band in mid-July, offers free, high-quality concert footage in a way that helps the companies providing it, since selling ads is more profitable than concert promotion.

The deal opens up a new revenue stream for Live Nation, which reported second quarter earnings Thursday that fell short on profit but beat Wall Street’s revenue expectations. And for Yahoo, premium video ad prices could be a cure for its plunging display ad rates.

Concerts globally are having a down year as a larger number of big acts sacrifice their own tour dates to play at popular festivals like Coachella and Lollapalooza, according to an analysis by the trade magazine Pollstar. And while Live Nation’s events are doing better than the industry overall, the company takes a tiny slice of concert proceeds even as it invests in improvements to apps and websites to attract more people.

On the Yahoo Screen app featuring the new Live Nation channel, advertisers like Kraft, Kellogg’s, Citigroup and Sprint are running pre-roll advertising and in-stream overlays. Given robust demand for the commercial time, Live Nation CEO Michael Rapino told investors in May the streams would be “a positive revenue channel almost (from) day one.” He went further Thursday, saying he expects to expand programming with Yahoo and other distribution partners to help accelerate advertising revenue growth.

Another beneficial element of the deal: Live Nation isn’t paying for the rights to the content. Artists, whose incomes are hurting from a decline in digital downloads, are happy to allow their concerts to be streamed, mainly to promote future ticket sales and song downloads. Plus, the performers get to keep a copy of the show for re-use and DVD sales.

“We’re getting paid in promotion and the fact we don’t have to hire our own crew” to shoot the concert, said Brian Klein, manager of Los Angeles-based indie pop band Fitz & The Tantrums.

On August 20, John Legend will reprise Marvin Gaye’s album, “What’s Going On?” in concert at the Hollywood Bowl. Legend’s manager Ty Stiklorious believes it might cost $500,000 to shoot such a one-time-only event. But in exchange for Legend receiving a copy of the recording in about a year, Yahoo will cover venue fees, songwriting royalties, crew wages and pay for the 50-piece orchestra that will accompany the R&B singer.

“They said they would do it regardless of all the issues and complexities around filming it,” Stiklorious said. “We’re so excited and happy.”

Artist managers don’t fear a loss of ticket sales, either. Attending in person is far different from watching from a couch or on a mobile device, they say. And usually, the event is already sold out or in a far-off location -like Justin Timberlake’s upcoming Aug. 24 concert in Iceland.

Increasingly, Live Nation Entertainment Inc. is becoming an advertising business that uses concerts as its “content.” While the company loses money putting on the concerts themselves, advertising and third-party sponsorships at venues have become its most profitable segment.

“Concerts, on paper, are very low-margin and as a result they have to push margin into other areas of the business,” says Rick Tullo, an analyst with Albert Fried & Co. “Advertising is the big one.”

Last year, Live Nation lost nearly a penny for every dollar it made in concert promotion revenue, which rose 17 percent to $4.52 billion. But it kept two-thirds of every dollar made from advertising, which climbed 15 percent to $284.7 million. Profit from advertising was nearly twice as big as profit derived from ticket-selling, which makes it even more important to the company as it seeks its first year of positive net income since 2004.

On the concert deal, Live Nation will split ad revenue 50-50 with Yahoo after Yahoo recoups the costs of shooting and producing the concerts.

For Yahoo, the deal helps bolster multiple areas of weakness: by paying for exclusive content, Yahoo hopes it can boost the price of ads. Prices for display ads, once Yahoo’s mainstay, fell 24 percent last quarter, offset only by greater volume. Still, the result was an overall 4 percent drop in the company’s revenue to $1.14 billion.

“We’ve continued our focus on video with investments in unique premium content,” Yahoo CEO Marissa Mayer told analysts on a conference call this month. “Fundamentally, premium content draws premium advertisers.”

Now Yahoo just has to get concert lovers to tune in.

Online: Yahoo Screen’s Live Nation channel: http://yhoo.it/Ur8OQB

Google, Yahoo criticize Australian Internet filter

Internet giants Google and Yahoo have criticized Australia’s proposal for a mandatory Internet filter, calling it a heavy-handed measure that could restrict access to legal information.

Their statements, among 174 comments from the public submitted to the Australian Department of Communications on the filtering proposal, come amid a struggle between Google and China over censorship-free content.

Lucinda Barlow of Google Australia called the Internet blocking measures of Australia and China “apples and oranges,” but also said her company was deeply concerned about Australia’s proposal because of its mandatory and sweeping nature.

If adopted into law, the screening system would make Australia one of the strictest Internet regulators among the world’s democracies, and the proposal has put the country on the Reporters Without Borders annual “Enemies of the Internet” list.

Google’s Barlow told the Australian Broadcasting Corp. that the proposal raised the possibility of banning politically and socially controversial material and went beyond filters used in Germany and Canada, which block child pornography and, in Italy, gambling sites.

Yahoo made a similar contention, saying the filter would block many sites with controversial content, such as euthanasia discussion forums and gay and lesbian forums that discuss sexual experiences.

“There is enormous value in this content being available to encourage debate and inform opinion,” Yahoo said.