I think the attitude here that most tech companies are rolling over and just complying without a single ethical consideration is misplaced.<p>The government has been doing an excellent job of basically extorting these companies into compliance. They threaten the full weight of the US government's wraith and then tie every order up with classifications and gag orders.<p>You aren't legally allowed to talk to other companies in the same position. Most your legal team probably doesn't get to know what's going on. You can't take your case to the public without being held in contempt.<p>I'm not giving these companies a complete pass for being complicit in the erosion of individual's civil liberties but treating this as if the decision is easy is vastly unfair.
Anyone remembers this?<p>> Barack Obama: NSA is not rifling through ordinary people's emails. US president is confident intelligence services have 'struck appropriate balance', he tells journalists in Berlin<p>edit: link fixed
<a href="https://www.theguardian.com/world/2013/jun/19/barack-obama-nsa-people-emails" rel="nofollow">https://www.theguardian.com/world/2013/jun/19/barack-obama-n...</a>
I was honestly a bit unhappy when Stamos left Yahoo in the middle of a bunch of (what seemed like) cool projects for users -- seemed like he was just jumping ship from an objectively pretty crappy company to a continuing-to-accelerate rocketship, presumably for career reasons.<p>However, if it went down like this -- he did probably the least destructive thing possible. I probably would have gone public or done something stupider, but at the very least not being a party to ongoing abuse of users' trust is necessary.<p>I'd like to see what other senior execs at Yahoo! were aware of the program and supported or at least tolerated it, so I can avoid ever working with any of them.
Lets take it a different way:<p>You're knowingly sending your data to a 3rd party. You're not encrypting. It's not through the USPS (special protections).<p>It seems bloody evident that, of course, your email provider can read your emails! Unless you're encrypting with GPG, then they can (and they can still read the signing keys).<p>Yahoo, Google, and friends all scan, dedup, and all sorts of tricks to determine marketing and quality content (spamming). If you're worried, run your own mailserver. It's what I do, along with using gmail. But I know that, at any time, people/scripts/ai are reading everything sent and received.<p>edit: I'd much prefer to hear commentary/how wrong/how right/how crazy I am, rather than -1's.I'd like to hear a discussion about the "Secrecy of text written on postcards"....
Most illustrative part:
"Yahoo President Marissa Mayer and the company's legal team kept the order secret from the company's security team."<p>If you have to hide things from your own security team, it's pretty clear you're doing something very bad and you know it.<p>And my imaginary hat off to Stamos for resigning when he found his boss betrayed user privacy and undermined security. If everybody had such level of integrity, doing shady stuff would be much harder.
It sounds like Yahoo will fit right in at Verizon... It also sounds like another leak designed to damage Marissa Mayer:<p>> According to the two former employees, Yahoo Chief Executive Marissa Mayer's decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc.
While it is damning that Mayer didn't go to Stamos about this and went straight to the email team, it's hard to say whether she felt it was necessary to tell him, or was even allowed to, since we don't see the court orders and what they entail. It's really easy to be against this and play armchair preacher but this is something she probably had no choice in, in many ways.<p>Also, I'm wondering if this story is bigger because people love to hate on Mayer. I am certain this kind of thing happened/happens at Facebook, Google, Twitter, WhatsApp, etc., so it's confusing why this is so newsworthy. It's not really newsworthy that data from an email provider is sent to NSA under secret court orders and NSA can search the full text of it. Is the newsworthy part that she asked the team to do it without consulting the security team? My question would be, why wouldn't a manager from the email team consult the security team if they had the power to?
Friendly reminder: the FBI and NSA are part of the executive branch of government and report to the President of the United States. Make no mistake -- there absolutely <i>is</i> someone who could stop this. The fact that this clearly unconstitutional activity not only continued after being exposed, but actually appears to has expanded in its scope, leaves us with but one conclusion: the President supports this activity and wants it to continue.
The scariest part of the whole piece answers this question:
Why are back doors with secret keys a BAD idea?<p>"... he had been left out of a decision that hurt users' security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails...."<p>The CEO of Yahoo must have known that this kind of scanning and storage puts their users at risk. She choose to do it anyway as being the path of least resistance against a more powerful adversary (US govt.).
Bad judgement compounded by zero spine... Verizon looks like the perfect fit.
I mean, think about the threats from .gov, right?<p>$250k per day doubling every week that can come with a gag order sounds like the sort of thing that could damage a business to the point of extinction, no?<p><a href="https://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsuit-documents-fine-user-data-refusal" rel="nofollow">https://www.theguardian.com/world/2014/sep/11/yahoo-nsa-laws...</a>
Secret URL for deleting your Yahoo account.<p><a href="https://edit.yahoo.com/config/delete_user" rel="nofollow">https://edit.yahoo.com/config/delete_user</a>
This reminds me of what happened to my grandfather in the early 30's. He was employed by a small glassworks in PA, a factory town that owned his home, the town store, post office everything. They opened his mail and fired him for trying to start a union. Three kids under five and a wife thrown out on the street. Seems like the Oligarchs are still reading the spues mail all of these years later.
Distribute, encrypt, and anonymize. The only way forward doesn't include them.<p>Congress is up for grabs. You can really change who is in congress this round. If you don't like the guy you have vote in another. Vote for people that want to cut surveillance programs and agencies that request them. We could save or reallocate mountains of money.
Ignoring fiduciary responsibility for a minute, what would happen if a publicly-traded company refused to comply with such a court order until they were required to release a financial statement? Wouldn't they be legally required to disclose that multi-million dollar fine?<p>How would a company under such a gag order announce bankruptcy? "Sorry, we lost all the money and we can't tell you why"?
The interesting part of the news is this:<p>"""
The sources said the program was discovered by Yahoo's security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in.
"""<p>this is from Reuters: <a href="http://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSK" rel="nofollow">http://www.reuters.com/article/us-yahoo-nsa-exclusive-idUSK</a><p>I can imagine being in that security team :) But there is also something more profound in this about secrecy in our times.
I find this hilarious since the only thing I use my yahoo address for is retailer sign-ups and things I know will land me a boat load of junk mail. It is my email landfill.
From the article: "Some surveillance experts said this represents the first case to surface of a U.S. Internet company agreeing to a spy agency's demand by searching all arriving messages, as opposed to examining stored messages or scanning a small number of accounts in real time."<p>The first case <i>to surface</i>. Anybody else could have been doing it for just as long, but we don't know yet.
I imagine Yahoo! Mail engineers being royally pissed about this. Well, I suppose that includes all Yahoo! folks who are still putting real effort into improving Y!'s services. Every odd day something surfaces about Y!'s execs questionable practices and decisions, every even day problems, leaks, bad press. Moral must have hit rock bottom.<p>Maybe the Yahoo! Board should have surveyed the startups scene, looking for founders who bootstrapped successfully and proven their worth, and recruit the best they could get. I am not very familiar with management of people and aspects of running a business, but I believe there is a lot more to it than being a smart person with computers.
If she had wanted to this to get out, I wonder if she could have ordered the email team to go ahead and build out the sniffer so she is not in contempt of the court, but let her security team openly blog about it, without informing her, when they found it - which could lead to an inadvertent release of the info? If the sec team was not under the gag order maybe they would not have gotten in trouble.<p>Or take her to a super boss level, she could have used whisper to talk to guccifer and let him know about some vuln that would allow access to the legal directory.... which would have to gag order. #wikileakitup
This is substantially worse than PRISM which operates on individual targeted persons and the upstream Verizon, AT&T program which collects plaintext over the public Internet.<p>This involved bulk search of data past the decryption layer.
Since all these companies (Yahoo, Google, FB, MSFT, etc) all operate and with users in other countries, what happen when other countries/governments demand the same "search/access" of info?
<p><pre><code> Yahoo Inc last year secretly built a custom software program to
search all of its customers' incoming emails for specific
information provided by U.S. intelligence officials, according
to people familiar with the matter.
</code></pre>
Wonder how much of the 4.8 billion can be attributed this <i>custom software program</i>?
This shit needs to stop. Immediately.<p>Like most people, I have no problem with the government using probable cause to get warrants that are in search of something specific (none of these grab-all bullshit orders). If you have a legitimate reason to be looking at someone, then there should be no problem getting a warrant.<p>These secret FISA court orders are a serious violation to the rights of Americans in many cases. At minimum, if we really do need these secret courts to prevent people from finding out they are the subject of surveillance, then there needs to be an expiration on those gag orders. This crap about never being able to mention it FOREVER has to go. There should be a limit, say 5 years, which is well beyond the length of time most investigations take. At that time, those orders should expire so that these government actions can be brought to light if there is any question of wrong-doing on the part of our overzealous law enforcement.<p>"Former NSA General Counsel Stewart Baker said email providers 'have the power to encrypt it all, and with that comes added responsibility to do some of the work that had been done by the intelligence agencies.'" Sorry, but no. That's not how it works. There is no obligation to do the work of government unless it is actually written into law (i.e. record-keeping laws). And it currently is not. This is precisely why everyone should be encrypting all communications on the CLIENT side themselves. It should never leave your device (PC, phone, whatever) unencrypted. That way, if the government wants to go on a fishing expedition or has an actual legitimate reason to look at you, they will have to get a warrant for the device itself, which will at least give you a head's up that they are trying to put you in the clink with a bunkmate named Bubba.<p>The NSA, and the government in general, has completely blown any goodwill they once had with the public. Under no circumstance will I ever advocate for anything that makes their job easier. And it is for no other reason than simply because they have proven time and again they cannot be trusted.<p>Honestly, I'm still not even clear why every employee of project PRISM isn't rotting a jail cell right now after Snowden shed some light on the program for the rest of us peasants. Every single employee of that program had to know the clear violations of the constitution they were helping to partake in. Keep in mind the constitution protects against unreasonable SEIZURE as well as search. Gobbling up communications in the manner they did clearly counts as seizure because they would not have had them otherwise - whether or not they actually search the records is immaterial.<p>I'm not an Apple fan, but when they told the government to go pound sand regarding that terrorist phone encryption case, that was the first time that I can recall I actually approved of Apple's political position on something.
Some people here laud some companies for being good about user privacy and security. This shows they have not yet reached table stakes for privacy and security.<p>This is why no provider can be trusted. Every routine communication should be e2e encrypted. Otherwise this WILL happen.
Note the attitude toward encryption:<p><i>Former NSA General Counsel Stewart Baker said email providers "have the power to encrypt it all, and with that comes added responsibility to do some of the work that had been done by the intelligence agencies."</i>
Is this is the best solution?
<a href="https://emailselfdefense.fsf.org/en/" rel="nofollow">https://emailselfdefense.fsf.org/en/</a><p>Getting anyone else I know to do this seems like a long shot. Is there something simpler?
Another reason for users and enterprises alike to avoid US companies and services. And another reason for entrepreneurs to start companies outside the US - escape the stigma, escape the potential clash with secret courts.
Any large company should openly defy such an order.<p>What will they do??? Fine, court, shut down the company? If that happened would the public not outcry?
So you really think that a free email service will "protect your privacy?" Any of them?<p>Why would you think that?<p>FWIW, SIGINT is a major part of the present festivities in the Woah on Terruh. It's simply unrealistic to expect anything transmitted through ordinary means to be remotely private.
To be frank, the more I hear about those stories, the less I'm shocked.<p>There is nothing to be shocked about. Unless nobody else than intelligence officials are getting access to this, and if the investigations are legit, then what?<p>News like this are trying to ride the whole Snowden train, but that's not what Snowden what whistle blowing about. Snowden was trying to warn about the abuse of those tools.<p>Now people moan and yell each time agencies try to do their job.
I'm sorry, but have you <i>used</i> Yahoo Mail?<p>I don't believe they are capable of writing the "siphon" they are accused of. To be honest, I don't think they actually have engineers. I think they just use summer interns.
In China and Russia, it is well known that <i>all</i> oligarchs are corrupt.<p>However, not all of them will go to prison -- only those who cross the politicians will ever be tried and convicted.
Can we merge <a href="https://news.ycombinator.com/item?id=12637302" rel="nofollow">https://news.ycombinator.com/item?id=12637302</a> into this? Same exact headline