A new report claims that Yahoo last year scanned customers' incoming emails for the feds.
Reuters on Tuesday reported that Yahoo, at the request of US intelligence officials, built a custom software program to search its customers' incoming emails for specific information.
"The company complied with a classified US government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI," Reuters reports, citing two former employees and a third person apprised of the events.
Reuters' sources didn't say what intelligence officials were looking for or what data Yahoo handed over, if any. According to the report, the program was designed to "siphon off messages containing the character string the spies sought and store them for remote retrieval." It's possible that the government approached other email providers with the same request.
Yahoo did not confirm or deny the claims when contacted by PCMag. "Yahoo is a law abiding company, and complies with the laws of the United States," the company said in a statement.
According to Reuters, the issue led to the resignation of Yahoo's former Chief Information Security Officer Alex Stamos, who now works at Facebook. Yahoo CEO Marissa Mayer and General Counsel Ron Bell reportedly left Stamos and the security team in the dark about decision, instead asking the company's email engineers to write the program.
The security team reportedly discovered the program in May 2015, weeks after its deployment, and initially thought it was the work of hackers.
"When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users' security," Reuters reports. "Due to a programming flaw, he told them hackers could have accessed the stored emails."
It should be noted that US tech and Internet companies receive many law enforcement requests for user information. Complying with those requests usually involves handing over information stored on a server — like bulk customer data or the names, addresses, and the length of service for specific accounts in question. This is different. As Reuters points out, this may be the first known case of a US Internet company scanning messages en masse as they come in.
In a statement, the American Civil Liberties Union called the scanning effort "unprecedented and unconstitutional."
"The government appears to have compelled Yahoo to conduct precisely the type of general, suspicionless search that the Fourth Amendment was intended to prohibit," ACLU Staff Attorney Patrick Toomey said in a statement. "It is deeply disappointing that Yahoo declined to challenge this sweeping surveillance order, because customers are counting on technology companies to stand up to novel spying demands in court."
The news comes after Yahoo last month confirmed a massive data breach affecting 500 million user accounts.