U.S. scanning of Yahoo emails ‘would be illegal,’ NSA chief says

One day after a report claimed that Yahoo scanned users’ emails on behalf of U.S. intelligence agencies, the head of the NSA argued that getting a blanket look at hundreds of millions of Americans’ emails “would be illegal.”

“I’ve read this real quickly, and I thought, well, this is a little speculative,” Adm. Michael Rogers said at the Cambridge Cyber Summit on Wednesday.

Yahoo called the report “misleading” in a short and vague denial to reporters. 

“We narrowly interpret every government request for user data to minimize disclosure,” a Yahoo spokesperson wrote. “The mail scanning described in the article does not exist on our systems.”

There’s no telling what exactly that means, but, due to the lack of a strong denial, it’s reasonable to guess that some kind of scanning system does exist.

Since the report emerged a day ago, journalists and technologists have been hypothesizing about the specific nature of what’s been going on at Yahoo.

Robert Graham, at Errata Security, emphatically pointed out that the Reuters article lacked crucial details about how the scanning worked. Actually, he called the whole report garbage.

Well? Which is it? Did they “search incoming emails” or did they “scan mail accounts”? Whether we are dealing with emails in transmit, or stored on the servers, is a BFD (Big Fucking Detail) that you can’t gloss over and confuse in a story like this. Whether searches are done indiscriminately across all emails, or only for specific accounts, is another BFD. 

Rogers, who heads both the NSA and U.S. Cyber Command, argued that the U.S. does not engage in blanket domestic surveillance such as scanning all Yahoo emails.

“We don’t do that, and no court would ever grant us the authority to do that,” he said. “We have to make a specific case. And what the court grants is specific authority for a specific period of time for a specific purpose. It’s not a blanket, just everything.”

As usual, the details here are scant. But what is clear is that there is a whole lot more left to learn about exactly how much data the U.S. government gets from America’s biggest tech firms. Vague denials and secret court orders do little to educate the public on that front.

Patrick Howell O'Neill

Patrick Howell O'Neill

Patrick Howell O'Neill is a notable cybersecurity reporter whose work has focused on the dark net, national security, and law enforcement. A former senior writer at the Daily Dot, O'Neill joined CyberScoop in October 2016. I am a cybersecurity journalist at CyberScoop. I cover the security industry, national security and law enforcement.