Yahoo email surveillance: who approved the secret scanning program?

By what legal authority do the National Security Agency and the FBI ask Yahoo to search its users’ emails? Neither the government nor the tech company would say, after Reuters first reported on Tuesday that Yahoo “secretly built a custom software program” it used on behalf of the NSA and CIA to scan customer emails.

But technologists and legal experts say the source may have been a directive from the secret national security court authorized by the Foreign Intelligence Surveillance Act (Fisa), and not a wider digital dragnet.

The government appears to have undertaken the program under the law in 2015 even as Congress was attempting to roll back surveillance of American citizens.

It also appears very similar to programs the FBI uses to pursue child abusers.

No single court order can allow surveillance of millions of Americans

Further reporting from the New York Times on Wednesday said Yahoo was ordered to scan its emails “for the digital ‘signature’ of a communications method used by a state-sponsored, foreign terrorist organization”.

But scanning the entirety of its email service for a specific string would appear to be a major change in the way Fisa has operated, said Liza Goitein, co-director of the national security program at New York University’s Brennan Center for Justice.

“A regular Fisa order, you have a specific target who is a US person or resident and you have to go to the Fisa court to get authorization with probable cause that they’re foreign powers or agents of a foreign power,” Goitein said. “So it’s not meant for mass surveillance at all. If Fisa is being used for mass surveillance that creates a whole other problem.”

“It’s hard to see how the Fisc [foreign intelligence surveillance court] found that to be constitutional,” she added.

The other possible law in play is section 702 of Fisa, which the NSA used to justify its Prism program of dragnet surveillance. That law exclusively applies to persons located outside the United States, which would seem to preclude its use on all Yahoo subscribers, though it was used by the Bush administration to justify Prism.

Senator Ron Wyden of Oregon said the possibility of yet another domestic spying program under Section 702 was untenable. “It is a fact that collection under Section 702 of the Foreign Intelligence Surveillance Act has a significant impact on Americans’ privacy,” he wrote in a statement. “The NSA has said that it only targets individuals under Section 702 by searching for email addresses and similar identifiers. If that has changed, the executive branch has an obligation to notify the public.”

“The government should be coming forward about this surveillance and whether the Fisc authorized this surveillance and issued an opinion explaining its rationale,” said ACLU staff attorney Patrick Toomey. “I think the public should demand this kind of transparency from their representatives.”

A new use for an old method

But if the authority is new, the method is old. The FBI has for years demanded cooperation from email providers in its search for people who exploit children, and the system Yahoo uses to aid those investigations is effectively the same as the one described to the New York Times. In the case of Yahoo and child abuse images, software designed by Microsoft called PhotoDNA compares video and image files across Yahoo’s email system to a database of images.

If a match comes up, the user gets a knock on the door. Other companies, such as Facebook, use PhotoDNA to identify images that violate their terms of service, not always with success. A similar system appears to have searched Yahoo’s servers for messages from suspected terrorists.

There is tremendous legal pressure on tech companies to use PhotoDNA and similar systems to monitor user activity, ACLU technologist Chris Soghoian has often observed; a Bush-era law makes it a felony for tech companies to fail to report any “actual knowledge” of images of abuse. There is no such pressure to install systems that track digital signatures of suspected terrorists, but once any such system is in place, another is easier to install, Soghoian has said.

“Once the technical infrastructure for automatically intercepting and examining user communications has been designed and deployed, service providers are not in a position to limit the extent to which they can be compelled to use it,” Soghoian wrote in a section of his dissertation he posted on Twitter on Wednesday.

The government appears to see no harm in these sorts of intrusions. Robert S Litt, general counsel for the US Office of the Director of National Intelligence (ODNI), wrote in April that the fourth amendment was essentially outdated when it came to digital privacy. “If the government electronically scans electronic communications, even the content of those communications, to identify those that it is lawfully entitled to collect, and no one ever sees a non-responsive communication, or even knows that it exists, where is the actual harm?” Litt wrote in the Yale Law Journal.

It’s difficult to know what the digital signature of a foreign terrorist group would look like unless members of that group were somehow already known to the US government or that group’s networks were compromised. Terrorist operatives tend to try to work in as much anonymity as they can. The FBI has often used its knowledge of illegal communications to track the communicators.

But images of abuse are illegal to possess and distribute; it’s not illegal to talk to terrorists. “Individual Fisa orders are supposed to be narrowly targeted – the equivalent of search warrants – and this one required a scan of hundreds of millions of users’ emails,” said Goitein.

The ODNI, the House judiciary committee, the Senate select permanent committee on intelligence, and the Senate judiciary committee did not return requests for comment. A spokesman for the House select permanent committee on intelligence declined to comment; a spokeswoman for the Senate judiciary committee said she had no new information. Yahoo did not comment.