Yahoo's Government Email Scanner Was Not A Modified Spam Filter, But a Secret Hacking Tool: Motherboard (vice.com)

The spy tool that the US government ordered Yahoo to install on its systems last year at the behest of the NSA or the FBI was a "poorly designed" and "buggy" piece of malware, according to two sources closely familiar with the matter, reports Motherboard. From the article: Last year, the US government served Yahoo with a secret order, asking the company to search within its users' emails for some targeted information, as first reported by Reuters this week. It's still unclear what was the information sought, but The New York Times, citing an anonymous official source, later reported that the government was looking for a specific digital "signature" of a "communications method used by a state-sponsored, foreign terrorist organization." Anonymous sources told The Times that the tool was nothing more than a modified version of Yahoo's existing scanning system, which searches all email for malware, spam and images of child pornography. But two sources familiar with the matter told Motherboard that this description is wrong, and that the tool was actually more like a "rootkit," a powerful type of malware that lives deep inside an infected system and gives hackers essentially unfettered access.

Comments

Hacking?

[ArtemaOne]

Are we going to continue to move away from the definition of this word? If they designed a program to sift through all of the email they host then that is not hacking. Using non-prescriptive methods is hacking. If a group of software engineers professionally designed this, that is not hacking.

Re:Hacking?

[ArtemaOne]

Email account holders were not users of the program. Email account holders were victims of an intentional intrusion that appears to violate constitutional law.

Re: Hacking?

[AHuxley]

AC, because your gov/mil reading your email is prevented by the Constitution.
Bulk domestic collection is not legal. The Foreign Intelligence Surveillance Act even has the word "Foreign" in it so courts, the wider public and staff can more easily understand what is legal.
The Church Committee https://en.wikipedia.org/wiki/... went all over that the last time vast domestic spying was discovered.

This is TRON, he fights for the Users.

[Thud457]

This is GREP, he snoops for the NSA.

Buggy rootkit = 500 million accounts hacked?

[JoeyRox]

I wonder what the timeline is between when the NSA-instructed "buggy rootkit" scanner was installed vs when the 500m - 1b accounts were hacked.

Re:Buggy rootkit = 500 million accounts hacked?

[Anonymous Coward]

The accounts were hacked in 2014 and this was put in place in 2015 so not related. Not to say yahoo wasn't doing something else we don't know about back then, or purposely not investing in security to give the feds a deniable way in, either seem likely for such a terrible company.

It's not the intrusion per se

[wickerprints]

As I have always maintained, what is most troubling is not the government's surveillance itself, but the complete lack of accountability and oversight with respect to such policy, and that this deliberate opacity is used to hide government malfeasance under the pretense of protecting national security.

In a recent NPR interview I listened to on the radio, this is how the conversation played out: the interviewer kept focusing on drawing comparisons to situations where companies that collect and relay personal data might filter or flag such data for legitimate purposes (e.g., child pornography), and the interviewee did a remarkably poor job of addressing the real issue as I have mentioned above. So long as we focus on the legality of the surveillance itself, such discussions are a losing battle for advocates of privacy and personal liberty, because there are always persuasive moral, legal, and ethical arguments to be made in favor of some kind of broad but algorithmic surveillance without explicit human intervention or judgment. The real point of attack, then, is to bring attention to the fact that the government does their spying on the general public in a way that so totally removes any liability on their part that in the vast majority of cases, we either (1) do not know or cannot confirm the existence of such surveillance in the first place; (2) private corporations are coerced to cooperate and are prevented from divulging the methods used by the government to spy on users; (3) individuals who are subjects of surveillance are unable to defend themselves in a court of law because they aren't granted access to evidence; (4) there is no oversight of such surveillance programs to ensure no abuses take place or that it even operates as is claimed; (5) no results are ever shown that demonstrate the utility or effectiveness of such programs.

In short, if the government wants to throw our constitutional protections out the window in the name of keeping us safe, they could at least do it in a way that makes it clear that it's happening. But since they don't, the only logical conclusion is that they are entirely aware that their programs are illegal, hence the need to lie and hide. And this, I argue, is the root of the problem.

Re:It's not the intrusion per se

[wickerprints]

In some sense, yes: the government really shouldn't have secrets, at least in the context of withholding information that is needed to maintain their accountability to the American public, who are in principle the source of the government's power. This is the essential meaning of the famous conclusion of Lincoln's Gettysburg Address: "...that government of the people, by the people, for the people, shall not perish from the earth."

The NSA is a good example of what happens when the government is entrusted to monitor the scope of its own secret-keeping. Their testimony to Congress after the Snowden revelations proves that they regard themselves as not accountable to the people, choosing to directly lie under oath to public officials, even if they believe that doing so ultimately serves the public interest.

To address your more specific case of "how do we catch terrorists or other enemies via their communications if we are obligated to announce how we are monitoring communications," one could just as easily turn the argument around and ask how police can catch criminals if they are obligated to have probable cause and obtain warrants. That is to say, the constraints imposed upon the enforcement of the law are not defined by what is technologically or physically possible or expedient, but from the rights and responsibilities guaranteed by the law itself, and that it is the duty of law enforcement to work within the legal framework they are sworn to uphold, rather than to define that framework and not only choose what tactics are permissible, but prevent anyone but themselves from knowing what is permissible or not. Otherwise, we have no rights, and the government can act with impunity (e.g., extrajudicial killings, summary executions, warrantless search and seizure, all in the name of rooting out crime and terrorism). And we can easily point to contemporaneous examples of the consequences of such policies and see how this is essentially tyranny of the state and the collapse of democratic governance.

How do we catch terrorists? To put it simply, good old fashioned detective work. Build and earn trust between the public and law enforcement. Rather than relying on the government to institute secret panopticon tactics, recognize that the public itself is a far better observer of illegal activities. There will be, of course, vehement criticism of such ideas as "naive" and "wildly idealistic." But it is actually eminently realistic because it begins with the recognition that not every threat can be stopped. What is unrealistic is the notion that a government can detect and respond to all threats through a sophisticated, secret, and pervasive surveillance network. That is the stuff of spy-thriller and dystopian sci-fi fantasy movies.

That which is dead can never die

[WillAffleckUW]

The problem is you have people who call themselves hackers, unfamiliar with the underlying code and why it was built that way, trying to use a hammer as a pry bar.

If you need a pry bar, make a pry bar. Make it from a cold pressed cylindrical bar, not from a piece of metal modifed from a spade.

We made the hammer, and the underlying code, for a different reason.

They need to realize if you intend to sup from the well of souls, that you must first be able to drink deeply and without ceasing. And that the act of doing so has impacts.

And, yes, they do care about you. FBI and NSA searches of specific people who are NOT supposed to be on the lists is a major problem, probably 90 percent of the actual individual searches. Happens in other spy systems as well. People are curious beasts, and they have their own motives which are contrary to the goals of the nation. They even justify violating our own Constitution by failing to understand WHY it says "Don't do this. Ever."