One day after a report claimed that Yahoo scanned users’ emails on behalf of U.S. intelligence agencies, the head of the NSA argued that getting a blanket look at hundreds of millions of Americans’ emails “would be illegal.”
“I’ve read this real quickly, and I thought, well, this is a little speculative,” Adm. Michael Rogers said at the Cambridge Cyber Summit on Wednesday.
Yahoo called the report “misleading” in a short and vague denial to reporters.
“We narrowly interpret every government request for user data to minimize disclosure,” a Yahoo spokesperson wrote. “The mail scanning described in the article does not exist on our systems.”
There’s no telling what exactly that means, but, due to the lack of a strong denial, it’s reasonable to guess that some kind of scanning system does exist.
Since the report emerged a day ago, journalists and technologists have been hypothesizing about the specific nature of what’s been going on at Yahoo.
https://twitter.com/declanm/status/783477070831628289
https://twitter.com/declanm/status/783477236254973952
Robert Graham, at Errata Security, emphatically pointed out that the Reuters article lacked crucial details about how the scanning worked. Actually, he called the whole report garbage.
Well? Which is it? Did they “search incoming emails” or did they “scan mail accounts”? Whether we are dealing with emails in transmit, or stored on the servers, is a BFD (Big Fucking Detail) that you can’t gloss over and confuse in a story like this. Whether searches are done indiscriminately across all emails, or only for specific accounts, is another BFD.
Rogers, who heads both the NSA and U.S. Cyber Command, argued that the U.S. does not engage in blanket domestic surveillance such as scanning all Yahoo emails.
“We don’t do that, and no court would ever grant us the authority to do that,” he said. “We have to make a specific case. And what the court grants is specific authority for a specific period of time for a specific purpose. It’s not a blanket, just everything.”
As usual, the details here are scant. But what is clear is that there is a whole lot more left to learn about exactly how much data the U.S. government gets from America’s biggest tech firms. Vague denials and secret court orders do little to educate the public on that front.
