Welcome to the machine—Yahoo mail scanning exposes another US spy tool
Surveillance by machine "doesn't count as spying unless you’re guilty," right?
Imagine a futuristic society in which robots are deployed to everybody's house, fulfilling a mission to scan the inside of each and every residence. Does that mental image look far-off and futuristic? Well, this week's Yahoo e-mail surveillance revelations perhaps prove this intrusive robot scenario has already arrived in the digital world.
Days ago, Reuters cited anonymous sources and reported that Yahoo covertly built a secret "custom software program to search all of its customers' incoming e-mails for specific information." Yahoo, the report noted, "complied with a classified US government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI."
Reuters then followed up, saying Yahoo acted at the behest of the secret Foreign Intelligence Surveillance Court. Not to be outdone, The New York Times reported Yahoo used its system designed to scan for child pornography and spam to search for messages containing an undisclosed "signature." The Times said a FISA judge found probable cause to believe that this digital signature "was uniquely used by a foreign power." The scanning has ceased, the report noted, but neither of the news agencies said how long the search lasted and when it began.
Yahoo denies how the reports portrayed its assistance, saying they are "misleading." Other tech companies have denied participating in such surveillance as it was outlined in those reports.
At its most basic level, this newly surfaced tool exposes another US digital surveillance program. It differs from so-called "upstream" spying in which the authorities tap directly into the Internet backbone and scan for certain search terms—a spying program with diminishing returns as more and more data on the Internet has become encrypted. This Yahoo situation is also different from the Prism program, where the authorities acquire customer data from tech companies matching chosen search selectors.
In this latest bit of spying to come to light, it still hasn't been revealed whether the Yahoo e-mail scanning was of e-mail metadata—like the headers—or of a message's content. Many, including NSA whistleblower Edward Snowden, believe content was being scanned. And if it was content, that would make the latest program perhaps even more aggressive than the US bulk collection of telephone metadata Snowden exposed.
That metadata includes the phone numbers of both parties in a call, calling card numbers, the length and time of the calls, and the international mobile subscriber identity (IMSI) number for mobile callers. The NSA had kept a running database of this information, but now the telcos keep it and allow the government to query it in terror investigations on an as-needed basis. The Fourth Amendment does not apply to these searches. To be sure, a great deal of information can be gleaned from this metadata—but, obviously, scanning content of e-mail is an even greater privacy intrusion.
In the most extreme sense, the Yahoo revelation highlights a new tool in the quiver of US spies. When metadata queries and e-mail scanning combine, such tools provide enormous precedent for wanton, science-fiction-like spying by machines on humans, according to Jennifer Granick, the civil liberties director at the Center for Internet and Society at Stanford Law School.
"They're saying we can spy on everybody. It doesn't count as spying unless you’re guilty," she told Ars. The Yahoo disclosure, she added, "It's part of constellation of tools, each with its own intelligence benefits and each with its own privacy and security safeguards, and lack of safeguards."
Kurt Opsahl, the deputy executive director of the Electronic Frontier Foundation, said the Reuters and The New York Times stories underscore the vulnerability of our online communications to US spies.
"We know that the telephone metadata program was all the providers, for all the customers, for all of the time, local, long distance, and international call(s)," he said in an e-mail. "While the Yahoo program is broader, because it scans content, we have yet to find the scope of the Yahoo program—whether it is limited to Yahoo, whether it is time limited, etc. They are both egregious, but we don't know the full scope of Yahoo to assess."
Snowden took to Twitter and said if Yahoo "repurposed" its child-porn and spam scanning system as stated by The New York Times, the scan was likely "content." That would make it an unprecedented search, issued by a single search warrant, of content affecting millions of people's Yahoo accounts. While some (even Snowden) suggest the scanning could be a hunt for malware the government was seeking to capture, the search nevertheless raises substantial Fourth Amendment privacy questions in the digital age.
Elizabeth Goitein, co-director of the Liberty and National Security Program at the Brennan Center for Justice, suggested that the precedent set here has scary, real-world privacy implications outside the online world. If a judge can authorize a single probable cause warrant to allow a bot to scan hundreds of millions of e-mails, then a judge presumably could order the same surveillance by a non-human robot in the real world.
"It's sort of the equivalent of sending a robot to everyone’s home to look for a piece of evidence. You can say it’s not a person, but it's a computer. Would that be OK?" Goitein said to Ars. "In order to find a murder weapon, they sent a robot in every house in this country to look for it. That's kinda like what we're talking about here."
Robert S. Litt, the general counsel for the US Office of the Director of National Intelligence, explains the government's thinking when it comes to non-human spying on humans. In the April edition of the Yale Law Journal, he wrote that if scanning is not done by a human, then no harm, no foul:
Quote:
Similarly, in the hypothetical Internet case, if the government electronically scans electronic communications, even the content of those communications, to identify those that it is lawfully entitled to collect, and no one ever sees a non-responsive communication, or even knows that it exists, where is the actual harm? Indeed, while I am no expert, I believe that this scanning is similar to what private companies and government agencies already do on their networks for the purposes of identifying and stopping malware.
In both of these situations, while government computers may electronically touch information about you contained in a digital database, the government actually knows nothing more about you than it did before—unless and until it has a valid purpose for learning that information. Fourth Amendment analysis should be based on that reality, rather than on hypotheticals.
Richard Kolko, a spokesman for the Office of the Director of National Intelligence, would not address the Yahoo scanning. But in a statement, he said, "Under FISA, activity is narrowly focused on specific foreign intelligence targets and does not involve bulk collection or use generic keywords or phrases. The United States only uses signals intelligence for national security purposes, and not for the purpose of indiscriminately reviewing the e-mails or phone calls of ordinary people."
