Yahoo scanned customer emails for US intelligence • Hacker News Board

Re: Yahoo scanned customer emails for US intelligence

#201

Post by generj » Tue, Oct 04, 2016, 10:04 PM UTC

aab0 wrote: post #7

vermontdevil wrote: post #3

Now gotta wonder if Google has succumbed to government pressure to do the same. I'm really hoping and trusting they haven't.

I wouldn't bet a bent penny on it: "Experts said it was likely that the NSA or FBI had approached other Internet companies with the same demand, since they evidently did not know what email accounts were being used by the target. The NSA usually makes requests for domestic surveillance through the FBI, so it is hard to know which agency is seeking the information. Reuters was unable to confirm whether the 2015 demand…

They later responded. Quoting from Arstechnica's 5:11 ET update:

A spokeswoman for Microsoft, Kim Kurseman, e-mailed Ars this statement, and also declined further questions: “We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo.”

For its part, Google was the most unequivocal. Spokesman Aaron Stein e-mailed: "We've never received such a request, but if we did, our response would be simple: 'no way.'"

http://arstechnica.com/tech-policy/2016/10/fbi-demands-signa...

Re: Yahoo scanned customer emails for US intelligence

#202

Post by kuschku » Tue, Oct 04, 2016, 10:04 PM UTC

johansch wrote: post #64

zzzcpan wrote: post #56

Earlier quoted context omitted.

Google is definitely in cahoots with the government and probably way deeper than Yahoo. Why would you even assume otherwise, given how much ties to the government they expose to the public these days?

As a European I have to I assume all major US companies in this area are either infiltrated or willingly participating in pervasive surveillance. It's still interesting to know which companies have been actually exposed for this kind abuse of their customers' trust.

I’ve said the same a few times before, sadly, I usually get downvoted for it.

It’s impossible to trust Google (Search, Chrome, DNS, Fi, Voice, Android, etc) or other big US companies at all regarding this, so we need open source solutions.

The US government is openly hostile to citizen of other countries, on the internet and in the real world, so relying on them not sending an NSL to Google to fuck you over is quite dumb.

Personally, I built my own cloud for everything I need, and I run Firefox on Arch Linux.

Re: Yahoo scanned customer emails for US intelligence

#203

Post by chc » Tue, Oct 04, 2016, 10:07 PM UTC

duaneb wrote: post #185

chc wrote: post #79

Earlier quoted context omitted.

It is impossible to live functionally in society without trusting someone on some level.

Yea--I'm just saying this is a product of being a business, not Meyer. One can fight it and still give information over. You can't take the sign of struggle as a sign your data is safe.

It's not a sign that your data is safe, but I think the point here is the opposite: You can take easy capitulation as a sure sign that your data is compromised.

Similarly, the lock on my door doesn't make me safe against everyone who might want to commit any crime against me, but all else being equal, a locked door is still preferable from a security standpoint, and it's very preferable to keeping your valuables in an unlocked room with a known thief.

Re: Yahoo scanned customer emails for US intelligence

#204

Post by generj » Tue, Oct 04, 2016, 10:09 PM UTC

zzzcpan wrote: post #56

johansch wrote: post #39

So, is this correct, in this context? Pass: Apple, Google Fail: Microsoft, Yahoo Unknown: Facebook, Twitter

Google is definitely in cahoots with the government and probably way deeper than Yahoo. Why would you even assume otherwise, given how much ties to the government they expose to the public these days?

Google denied they have a similar program:

For its part, Google was the most unequivocal. Spokesman Aaron Stein e-mailed: "We've never received such a request, but if we did, our response would be simple: 'no way.'"[0]

I wonder if Google could even run a program like this while keeping it secret. Yahoo had their program discovered within weeks, and public within a year. Stamos could easily have immediately gone public in a way which would have prevented him from being prosecuted - say posting a blog post about how hypothetically Yahoo would implement such a system at the governments request, forwarding this on to Bruce Scheiner, and then refusing to comment if such a "hypothetical" program actually existed.

[0] http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-...

Re: Yahoo scanned customer emails for US intelligence

#205

Post by duaneb » Tue, Oct 04, 2016, 10:15 PM UTC

spdustin wrote: post #36

rodgerd wrote: post #13

Earlier quoted context omitted.

Microsoft and Apple have both been in court during the last 12 months to block US government over-reach. Yahoo joins Amazon in ethusiastically facilitating it. Your assertion isn't realistic, it's nonsense.

I must have missed something, can someone elaborate on how Amazon has enthusiastically facilitated government overreach into citizens' privacy?

I would have assumed it's referring to this: https://aws.amazon.com/message/65348/

I don't really see the point, though, I wouldn't want to host wikileaks either.

Re: Yahoo scanned customer emails for US intelligence

#206

Post by generj » Tue, Oct 04, 2016, 10:15 PM UTC

codedokode wrote: post #193

matt4077 wrote: post #143

Earlier quoted context omitted.

You may have missed the part where Yahoo engineers implemented this scheme, they are to blame as much as management here, possibly more because they could've walked away and gotten a different job without much trouble, but management had a responsibility to the whole organization. Contrast with the rumors that Apple engineers were prepared to refuse & resign if ordered to share the iPhone's encryption keys.

Why should they lose their job and salary to defend someone else? Yahoo users can go to court themselves if they feel that their rights were violated.

Yahoo users can't go to court if they can't prove their rights were violated. Even with this news story there is no court-admissible evidence of collusion with the government.

Also, from the perspective of a civil suit against Yahoo, this program is likely somewhat legal unless it was specifically against their privacy policy and terms of use.

That doesn't mean the engineers knew they were performing unethical behavior. A better question is: why should anyone hire someone who aided unethical behavior?

Re: Yahoo scanned customer emails for US intelligence

#207

Post by odbol » Tue, Oct 04, 2016, 10:15 PM UTC

ethbro wrote: post #166

findK wrote: post #156

Earlier quoted context omitted.

isn't the whole premise that the Big Companies actually control the government? "They threaten the full weight of the US government's wraith and then tie every order up with classifications and gag orders." full weight? You mean like a small fine ? That's what happened to Wells Fargo. The govt . seems really angry about it, but what can they really do to a corp that is considered an entity?

> full weight? You mean like a small fine ? The amount of leverage NSA/FISA have is rather different than what the CFPB has at its disposal.

aka treason and the death penalty

Re: Yahoo scanned customer emails for US intelligence

#208

Post by tkinom » Tue, Oct 04, 2016, 10:16 PM UTC

Since all these companies (Yahoo, Google, FB, MSFT, etc) all operate and with users in other countries, what happen when other countries/governments demand the same "search/access" of info?

Re: Yahoo scanned customer emails for US intelligence

#209

Post by generj » Tue, Oct 04, 2016, 10:17 PM UTC

_audakel wrote: post #162

If she had wanted to this to get out, I wonder if she could have ordered the email team to go ahead and build out the sniffer so she is not in contempt of the court, but let her security team openly blog about it, without informing her, when they found it - which could lead to an inadvertent release of the info? If the sec team was not under the gag order maybe they would not have gotten in trouble. Or take her to a…

The security or email team could also blog about how to "hypothetically" implement real-time scan of email for keywords, and then stay mum about if they ever actually implemented something like their proposed program.

Totally protected speech.

Re: Yahoo scanned customer emails for US intelligence

#210

Post by generj » Tue, Oct 04, 2016, 10:23 PM UTC

jsmthrowaway wrote: post #189

dmix wrote: post #173

Earlier quoted context omitted.

The fact no-one has done this means the consequences must be absolutely devastating. Probably jail time for executives and potential financial collapse. Probably the only time an executive would go to jail for breaking the law in the US...

I remain unclear on the consequences. I don't think they're tested. 18 USC 2709(c) is what the government cites when they invoke nondisclosure. You win a prize if you find the consequences for violating that statute. Also, NSLs can be upgraded to court orders if the recipient is noncompliant. 18 USC 3511 discusses that: > the Attorney General may invoke the aid of any district court of the United States within the ju…

It's entirely possible a highly-paid legal counsel like Apple or Google has finds out the emperor is wearing no clothes and NSL's are unenforceable.

The question is: who is willing to find out? There's all kinds of nasty stuff the gov can do to you personally for trying to fight an NSL - loss of gov contracts, detention at custom and border control, no-fly list, etc.