Yahoo Issues Its First Transparency Report

Yahoo has joined the ranks of large online businesses like Google and Facebook who have made it a practice to disclose the number and kind (if not all the details) of requests they've received from government agencies for user data. Its first report (you can read it here) lists "12,444 requests from U.S. authorities relating to a total of 40,322 user accounts." Those numbers are only part of the story, though: at the bottom of the linked report, note this disclaimer from Yahoo: "The numbers reported above include all types of government data requests such as criminal law enforcement requests and those under U.S. national security authorities, including the Foreign Intelligence Surveillance Act (FISA) and National Security Letters (NSLs), if any were received. The U.S. Government does not permit us to disclose additional details regarding the number of requests, if any, under national security authorities at this time, or even to separate them in aggregate from other requests. Additionally, the government would not authorize us to separate NSLs from other government data requests or to express the NSLs that we have received, if any, as a range from 0 to 1,000—even though the government allowed other providers to do so in the past."

Comments

Heh.

[SeaFox]

I'm slightly amused the Yahoo icon on this story has a transparent background.

Re:Heh.

[FriendlyLurker]

I'm slightly amused the Yahoo icon on this story has a transparent background.

For all the good this transparency does to restore our confidence. The Snowden leaks/NSA documents clearly show that the NSA directly taps into the backend systems without any need to reque4st anything from these companies - Google, Yahoo, Facebook etc. The only time these companies receive extra requests like the ones being reported above is when the NSA want's to do more proactive monitoring or targeted individuals that requires hooking into the front end (monitoring search as you type etc). PR departments have been working overtime to try and muddle, confuse and distract from this small detail - do not let them off the hook so easily people - this is not transparancy.

Re:Heh.

[Kozz]

I'm slightly amused the Yahoo icon on this story has a transparent background.

Yeah, the icon design finally got out of alpha.

Re:Heh.

[davester666]

It's the old logo. The new one won't be quite so transparent.

Outraged, how dare the government violate me.

[Anonymous Coward]

We should be pissed about this. It reveals our fears about government overreach. They should not be digging into our private affairs regardless of where the data is stored. It is a human right to free from persecution over thoughts, feelings, beliefs, and intentions. Until a crime has been committed there should be no investigation and no violation of my space.

Re:Outraged, how dare the government violate me.

[Anonymous Coward]

This was Yahoo not Myspace! :-P

Re:Outraged, how dare the government violate me.

[Sqr(twg)]

Looking at the numbers, it is fair to assume that these requests could all relate to crimes. 12 400 requests in 0.5 years translates to about 8 requests per year per 100 000 population. (The homicide rate in the US is about 5 per year per 100 000 population, and that's not the only crime that might warrant acessing a suspect's email.)

Re:Outraged, how dare the government violate me.

[John.Banister]

So the number of requests disclosed and the number of requests you might expect from agencies that don't have the ability to force Yahoo not to disclose their requests kind of match?

I don't feel particularly paranoid, but I find it relatively difficult to feel much in the way of trust. Also, getting first ever transparency shortly after seeing lots of news highlighting the reason to believe there's a large possibility of transparency theater feels like the decision making of a committee in a PR department.

Re:Outraged, how dare the government violate me.

[smpoole7]

> Until a crime has been committed there should be no investigation and no violation of my space.

You've hit the nail on the head. In the US, we used to have a principle: "innocent until proven guilty."

The problem is, the more that the citizenry of the US come to believe in an all-powerful nanny state (forgive me for using the pejorative term, I haven't finished my coffee and can't think of a milder one), the more likely they are to scream, "why didn't the government *PREVENT* this from happening" ... whenever something bad occurs.

(Corollary: the people also yell, "why didn't the government *FIX* this faster when it DID happen," but that's arguably off-topic.)

The sad truth is that no politician, Dem or Repub, wants to be seen as having done nothing to prevent another 9/11. They know that their opponents will make hay about it. So, we get to live in a surveillance state.

Re:Outraged, how dare the government violate me.

[Anonymous Coward]

I'm old enough to remember the days when we didn't have email, there were still crimes committed and the perpetrators were still found and aprehended. If they could manage to fight crime 40 years ago without tapping into email accounts, I'm sure they can manage it today.

Re:Outraged, how dare the government violate me.

[HiThere]

Also, is there any particular reason to believe that they are telling the truth? Or that the person who put the report together would even KNOW the truth?

That said, yes, this feels like some kind of PR play. Just what kind I'm not sure.

Re:Outraged, how dare the government violate me.

[Anonymous Coward]

Sure, 8 requests per year per 100,000 out of a population of 310 million. Of course, this only actually works if the entire population uses Yahoo!

Re:Outraged, how dare the government violate me.

[John.Banister]

I think Yahoo wants the non-terrorist/murderer majority of their customers to know that in any conflict between the aggregate of those customers and the government, the sympathetic intent and ideological loyalty of Yahoo is on the side of the customers even while the actions of Yahoo will be whatever the government forces them to be. It's likely quite true, but it also comes across like the person about to behead me saying "Sorry about this. I think you got a bum deal," before proceeding to do his job.

idiots.

[strike6]

One would have to be an idiot to believe anything any of these entities say. What a waste that Slashdot gives them credibility by pretending they're telling the truth.

Re:idiots.

[Anonymous Coward]

don't slam yahoo here, they are telling the truth as much as the spooks will allow -- and besides, where would yahoo get the cash to fund a long, expensive, landmark court battle against the infinite funds of the three letters and the government?

Re:idiots.

[fastest fascist]

"Additionally, the government would not authorize us to separate NSLs from other government data requests or to express the NSLs that we have received, if any, as a range from 0 to 1,000" Did Yahoo just circumspectly say they have received between 0 and 1,000 National Security Letters?

Re:idiots.

[HiThere]

I'm sorry, but this doesn't feel like Yahoo telling as much truth as they are allowed. This feels like some kind of game. I'm just not sure WHAT kind of game. It could be that they want the government off their backs, it could be that they want to suppor the Republicans, it could be something else...and something else has a wide range of options.

But it doesn't feel like straight reporting.

Gag orders are a clear violation

[fustakrakich]

Too bad the people with the resources to fight it are so cowardly and greedy.

Re:Gag orders are a clear violation

[EuclideanSilence]

Too bad the people with the resources to fight it are so cowardly and greedy.

Yeah, and not only are they cowardly and greedy, the voters expect individual companies to risk jailtime fighting for the rights of the voters on their behalf so that they can continue living in a stupor.

Re:Gag orders are a clear violation

[Teun]

Indeed!

Although large companies could and should pick up the fight, not only for morality but also because snooping for a third party is supposedly not their core business (...), the real power is with the sheeple that allow these laws in the first place.

So pardon me but I don't feel in the slightest sorry for Americans on the receiving end of this abuse.

Re:Gag orders are a clear violation

[sirnomad99]

The people with the resources are either part of the problem or are sheep. Yes I am talking about the vast majority of the people you interact with on a daily basis. What's that? You do not understand? Every person in this nation is allotted a vote to decide who will speak for them in congress. Yet most of them can not be bothered to vote let alone get a hold of the people who work for them and tell them how they feel about important issues.Yes despite the way they strut around those people Senators and Representatives work for us, not the other way around. If the system is corrupt it is because we have given the job to corrupt people. 9/11 was a tragedy, what has happened to our nation since then is a disaster. We allowed corrupt individuals to vote themselves unlimited power to do whatever they want without having to answer to anybody for their actions. Worse, after we have suffered under these abominable laws that are blatantly unconstitutional laws for ten years and the opportunity came to set them aside we stood by as our representatives renewed them. People will argue that the danger from without is more important than our civil liberties. That the threat of terrorists justifies accepting these measures. I say this is the argument of the defeated and the prisoner. You are more likely to be struck by lightning or hit by a meteor than fall victim to terrorists. The world is actually a safer place today than it has been in the last century. The only difference is our ability to gather and share information. A gunshot in New York can be the evening news in LA and the outrage the morning news in London. For close to over 40 years this nation managed to survive having not one but two enemies with weapons that make the threat of these two bit hoodlums look like popguns. We have survived MAD where our enemies had in their hands the means to not just take out a building or town but kill every man, woman, and child in the world several times over. We not only survived it but outlived that threat, so we can outlive and defeat this one without sacrificing our most basic principles. Our civil liberties are the main reason that sets us aside from every other nation on this globe. They are the reason that year by year people flock to our shores seeking to become one of our citizens.And it is through jealousy of these freedoms that our enemies strike at us. The only times that we have been weak have come from within our own borders when we allowed people to make us believe we had stumbled. We are a great nation and the envy of all other nations, we can only be less than that if we decide to make ourselves so. It is well past time to tell the doomsayers that we will not be driven like sheep by their shadows and smoke. Tell the people in Washington that their illegal power grab is over and it is time to clean house and get back to showing the rest of the world that we are still the same nation that has been a beacon of hope for the last 200+ years.

Never forget...

[harvey the nerd]

"...He has erected a multitude of New Offices, and sent hither swarms of Officers to harass our people, and eat out their substance."
July 1776

Re:Never forget...

[swillden]

More to the point, I do like the quote tho..

Yahoo is a defunct site anymore, the EFF gave it "Trust Ratings" and Yahoo topped the list. But because they've dropped down in the internet world, the NSA and others can get what they want from Gaagle (Google), Asshole (Apple), Microshit (its got Micro in it) , ect....... Yahoo, at this point is of little interest to the NSA, except they do still have users that haven't registered to Google, MS's, network,s bla bla, you get the point..

If Yahoo had/has the popularity of the other companies, they would be right there in NOT PROTECTING YOUR PRIVACY, as the rest caught in bed with the NSA...

I probably shouldn't respond but... I don't get your point. You seem to be saying that Yahoo! is respecting user privacy by publishing this information, while other companies are not. But in publishing this report Yahoo is just doing what those other companies have already done. Google, in particular, was the one that started this transparency report trend, and was the company that spent a great deal of time and effort lobbying for permission to public NSL information, and in greater detail than Yahoo! has provided.

All I can conclude is that you don't really understand what you're talking about and just wanted to take jabs at Yahoo! for your perception of its irrelevancy.

On the issue of NSLs, I do have to wonder why it is that Yahoo! was denied permission to publish the data that other companies have been publishing. Google has already negotiated that permission, and others have been able to make use of it as well, so why not Yahoo!? I have no idea why that would be. Is, perhaps, the volume of NSLs sent to Yahoo! extraordinarily high or low relative to the size of their userbase? Maybe they've been sent unusually broad NSLs, so the average number of accounts per request is much higher than what we see in the numbers of other companies? I don't know... and the fact that the government wants to withhold permission makes me really want to know.

Re:Never forget...

[spire3661]

Has nothing to do with respecting user privacy. RIght now all the internet companies are pissed off at the NSA because they have hurt online trust. They dont give a shit about privacy. Its all about the lost dollars from people NOT using services due to known, ubiquitous NSA spying.

Re:Never forget...

[swillden]

RIght now all the internet companies are pissed off at the NSA because they have hurt online trust. They dont give a shit about privacy

You won't believe me, but I can tell you that's not true of Google (where I work). I doubt it's true of the others, either. Internet companies are composed of people, and most of those people do care about user privacy. Google in particular takes it very seriously, and not only because it's important for the business.

Re:Never forget...

[spire3661]

Has nothing to do with you and everything to do with the fact that you can be compelled to act and cant tell anyone about it. Its not 'you' we lack trust in, but the fact remains you can be turned at any second and there is nothing anyone can do to stop it.

Re:Never forget...

[swillden]

Has nothing to do with you and everything to do with the fact that you can be compelled to act and cant tell anyone about it. Its not 'you' we lack trust in, but the fact remains you can be turned at any second and there is nothing anyone can do to stop it.

That's a separate issue from caring about user privacy.

And, actually, there is something that can be done to stop it: we need to fix our damned government. There are and always will be situations in which it makes sense to allow government to compel private organizations to hand over data in response to warrants, subpoenas, etc., but those should all occur under appropriate supervision to combat abuses. We need to shut down this business of warrantless surveillance, unappealable secret warrants issued in ex parte proceedings, government agencies deliberately subverting security infrastructure, etc.

FWIW, Google and other Internet companies have been applying their lobbying resources towards these ends, but as long as voters continue to care more about "fighting terrorism" than preserving their own civil liberties, what they can accomplish is limited.

Re:Never forget...

[spire3661]

The problem is either we can have private comms or not. Right now the US government is saying that private communication is flat out illegal. If you have a service that is hardened against snooping they will force you to open it to them. If they have the capability to snoop, they will. Its a human fact. The time has come to stop this madness and tell the government private comms are a right. That CALEA-style laws ordering access is not in the best interests of our nation and has been proven to be repeatedly and unbelievably abused. There is no middle ground.

Re:Never forget...

[swillden]

The problem is either we can have private comms or not. Right now the US government is saying that private communication is flat out illegal.

That's an overstatement. Right now, you can PGP or S/MIME-encrypt all of your e-mail and they can't, and won't, do anything about it. There are a thousand ways you can have private communications, if you care to.

If you have a service that is hardened against snooping they will force you to open it to them.

What are you basing that claim on? We have reports that the NSA has been sneaking back doors into things, but clandestine operations being done without the support (or opposition) of law isn't the same as legal compulsion. If you're talking about Lavabits, that's also a bad example: Lavabits, as best we can tell, shut down rather than to comply with orders (perhaps lawful, perhaps not -- the secrecy and lack of oversight around NSLs is a huge problem) to provide information which they actually had access to. It wasn't hardened against snooping, it just promised not to allow snooping and discovered it couldn't fulfill that promise, and so chose to shut down.

I have seen no evidence that the government has tried, much less been able to, shut down services which truly are hardened. I'm involved (well, used to be, I haven't done much lately) in the Tahoe LAFS secure distributed file system, and a friend of mine is leading the development and running a company which provides secure cloud-based storage using Tahoe. It is also used to provide strongly-secure communications. No one is shutting him, or the project, down.

If they have the capability to snoop, they will. Its a human fact.

Why do you assume that the citizenry is powerless to control its government?

The time has come to stop this madness and tell the government private comms are a right. That CALEA-style laws ordering access is not in the best interests of our nation and has been proven to be repeatedly and unbelievably abused.

First, CALEA doesn't apply to Internet services. Second, I'm not so sure that you're right. There is a lot of value to society in providing limited, controlled ways for law enforcement to request access to private information, in precisely the same way as there is value in allowing them to search people's homes, vehicles, etc. The key is get rid of the mechanisms that allow them to do it without oversight or opposition. The problem isn't government access, it's unconstrained and secret government access.

There is no middle ground.

The middle ground is the one we've used for centuries. The catch is that it requires that we actually care to require our elected officials to rein in the agencies they create to police us.

While we're at it we also need to de-militarize the police, restore fourth amendment rights in the border zones and just generally roll back all of the civil liberties infringements we've allowed in the name of the wars on drugs and terror. This Internet communications bit is just one small piece of a much larger problem, and even if we can solve the Internet issue by encrypting everything, that won't address the rest of it.

US citizens need to retake control of our government. Personally, I think the best way to do that is by massively scaling back the federal government and moving much of its functions to the states, to decentralize the power, but regardless of that, we need to insist on strong limitations on government authority across the board.

Re:Never forget...

[swillden]

Internet companies are composed of people, and most of those people do care about user privacy. Google in particular takes it very seriously, and not only because it's important for the business.

Not intended as a personal criticism, but you seem to have some cognitive dissonance there. Google's whole business model is based on invading the privacy of users; saying Google takes users' privacy seriously sounds to me similar to a pimp being concerned about the chastity of his girls.

Nonsense. Google doesn't invade its' users' privacy. Google offers users an open trade: services in exchange for the ability to deliver advertising to you. Google provides a dashboard where you can see exactly what Google has or has not collected about you, and even provides tools you can use to opt out of personalized tracking and advertising, and to get your data out of Google's tools.

Also, if you decide that the trade is good for you, Google takes extreme care to ensure that information about you is only used to provide you with services and ads, and does not leak. Your analogy is completely wrong, because the pimp sells his girls' chastity, but Google does not sell users' privacy. The information it gathers about them is only used to select advertising to present to them. Effectively, your information is presented only to you.

Of course, Google will provide information about your activity on Google products (e-mails, web history, etc.) to government when served with a lawful, narrow and specific order -- and Google pushes back on those where it believes they don't comply with the law or are overly broad.

I stand by my statement that Google takes its users' privacy very seriously. My day job is building and maintaining the infrastructure that keeps Google users' most sensitive data secret, and I can tell you that Google does a far better job of it than anyone else I've ever seen, and since I was an IBM security consultant for 15 years, working with all sorts of large public and private institutions, I've seen a lot.

Not believing it

[Anonymous Coward]

With secret orders approved by secret courts under secret laws that Yahoo cannot disclose anything about, these reported numbers mean nothing.

Re:Not believing it

[geogob]

How was it again, what they said?
If you are not doing anything wrong, you don't have to hide it and don't have to worry?

It's a nice case of "look who's talking".

Re:Not believing it

[lxs]

Well if they weren't allowed to specify it as a number between 0 and 1000 I think it's safe to assume that it's over 1000.

Re:Good, but...

[AHuxley]

You get lots of extra utility or contractor visits based on time you arranged.
ie sneak and peek using the cover of you expecting a person on that day. If questioned they are a sub contractor, lost, new, a computer error....
In the distant past you might have some insight via very poor telephone line quality or faint extra sounds on the line.
Most would be very passive - internet logs, phonecalls, your life is tracked.
If you are politically active, the press or in contact with a person thats got something interesting (data, a story, documents) the tracking/contact may become more direct.

Re:Good, but...

[Anne Thwacks]

Simple: If you sent emails, the govermment accessed them. Dont you even have a tin-foil hat?

Re:Why does Yahoo keep blinking at me?

[Anne Thwacks]

Tha is why it is called a "lameness" filter :-{

Large?

[bored_engineer]

Egads.

Yahoo has joined the ranks of large online businesses. . .

Yahoo aren't big? They just spent a $billion on Tumblr. I can think of several large companies near me, but the nearest $billion+ company headquarters is 1500 miles from me. I know that Yahoo isn't the size of Google, but by whose measure are they not large? Should that have read "OTHER large online businesses?"

Re:Why does Yahoo keep blinking at me?

[gagol]

tried dot and dash... dice sucks bad!

Re:Why does Yahoo keep blinking at me?

[gagol]

dOt Dash doT d0t do7 Dot dOT DOt dASh DoT d0T
D0t dOt Dot doT DoT
dasH daSh dAsh Dash d0T DoT dASh DaSh dAsH dhot doht doth d0th dot

Re:Is it just me that doesn't care?

[lxs]

They don't until there is another wacky bomber manhunt that happens to cross your path. Now you may only have wanted to fix your own plumbing but those pipes you googled look suspiciously like the ones used in the unexploded pipe bomb they found. Before you know it the scene at your apartment building resembles the climax of the Professional.

Oh and by the way, not being interesting isn't something to be proud of.

So it's more than 1000

[liamoohay]

"Additionally, the government would not authorize us to separate NSLs from other government data requests or to express the NSLs that we have received, if any, as a range from 0 to 1,000" If they're not allowed to say that it's in that range, presumably it must lie outside that range.

Re:Two interesting things

[M. Baranczak]

I'm shocked that Yahoo even has 40,322 users.

Re:Good, but...

[__aaltlg1547]

You don't. Unless they present it at your trial.

Re:Two interesting things

[hlavac]

That means they spy on ALL 40,322 of the yahoo users :)

Why not publish all the numbers?

[bryanandaimee]

It's just metadata.

In fact tell us who requested data and which users data was requested. It's just metadata. As long as we don't know what the actual user data is then there can't be any harm in it. What's good for the goose is good for the gander.

Re:Is it just me that doesn't care?

[Gr8Apes]

This is precisely what the citizens of Germany thought in the early 1930s. That worked out well for them. It's also how citizens of North Korea used to think. Now, if you're kid or grand child does something, you go to jail, after watching them get executed for something as mild as having sex. I certainly hope you don't buy garden gnomes that appear to look like a caricature of the president of 2025....

I wear my politics on my sleeve

[superwiz]

BUT! Isn't California very quickly approaching the state where no company doing development there can credibly claim to be anything but an arm of the government? Since Yahoo forbade telecommuting a few months ago, it's hard to believe that they wouldn't fall to the leftist state's political pressure to monitor all user activity in secret. And how much can one really trust any transparency report issued internally? Corruption does not result from people acting contrary to their principles. It results from people allowing their human nature to take over when their principles conflict with one another.