In 2015, Yahoo Inc. allegedly created secret custom software enabling it to search the entirety of customers' email inboxes for certain information requested by U.S. intelligence officials, according to a new report.
Anonymous individuals close to the incident reportedly told Reuters that the U.S. government -- either the FBI or National Security Agency (NSA) -- commanded the internet company to search its customers' incoming emails for a set of characters, such as a phrase in the email or attachment, though the specific words are not yet known, the Oct. 4 report said.
It is also not known what, if any, information Yahoo passed along to the government, or if other email providers were issued the same request.
"Yahoo is a law abiding company, and complies with the laws of the United States," the company told Reuters in a statement responding to inquiries regarding the incident.
Two former employees told the news agency that Yahoo's Chief Information Security Officer Alex Stamos, who now heads security for Facebook Inc., departed from the company directly in response to Chief Executive Marissa Mayer's decision to comply with the government request for information.
It is well known that phone and Internet companies have handed over large amounts of customer information in the past, but experts said that the incident with Yahoo went far beyond anything that they had ever seen before. They also said that the agency that requested the information likely sought similar data from other internet companies.
Both Google and Microsoft Corp. told Reuters that they had not conducted such searches, and a Facebook spokesperson told The Intercept that they had never received any similar request, and that they would "fight it" if they had.
Though the exact directive is unknown, attorney Andrew Crocker, who works with the Electronic Frontier Foundation and expressed concerns over the Fourth Amendment implications of the incident, told The Intercept that the FBI and/or NSA may have invoked Section 702 of the Foreign Intelligence Surveillance Act, which allows collecting communications in bulk in order to target a foreign individual.