Out-Law News 1 min. read

Yahoo used search tool to mass scan for information in user emails, report says


UPDATED: Yahoo last year complied with a demand from US authorities to carry out a mass search of incoming emails to its users' accounts for information sought by intelligence officials at the National Security Agency (NSA) and FBI, according to a report by Reuters news agency.

The company developed a bespoke piece of software for the purpose of meeting that demand, it said. Reuters cited three former employees of Yahoo among its sources for the story.

In meeting the demand, Yahoo scanned emails relevant to hundreds of millions of Yahoo Mail accounts, according to the report. Reuters said that it is only known that the intelligence officials were looking "to search for a set of characters", which its sources said could mean "a phrase in an email or an attachment".

In a short statement, Yahoo said it is "a law abiding company, and complies with the laws of the United States".

Yahoo recently announced that it believes the personal data of at least 500 million Yahoo account holders was stolen in a "state-sponsored" cyber attack in late 2014. If confirmed, the data breach would be the largest recorded in history. A number of data protection authorities, including the UK's Information Commissioner's Office (ICO), have said they are looking into the incident.

At the time, Yahoo chief information security officer Bob Lord said data that might have been stolen includes names, email addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers. Lord said the company has "invalidated unencrypted security questions and answers so they cannot be used to access an account".

Yahoo later described the report as 'misleading'

Editor’s note 06/10/16: The last paragraph of the story was added to make it clear that Yahoo later disputed the initial report. 

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.