Yahoo scanned user email for signs of terrorist messages, report says

A government directive ordered Yahoo to scan all user email for the digital "signature" of a terrorist group linked to a nation-state, according to The New York Times.

Laura Hautala
Laura Hautala
Laura Hautala Former Senior Writer
Laura wrote about e-commerce and Amazon, and she occasionally covered cool science topics. Previously, she broke down cybersecurity and privacy issues for CNET readers. Laura is based in Tacoma, Washington, and was into sourdough before the pandemic.
Expertise E-commerce, Amazon, earned wage access, online marketplaces, direct to consumer, unions, labor and employment, supply chain, cybersecurity, privacy, stalkerware, hacking. Credentials
  • 2022 Eddie Award for a single article in consumer technology
Laura Hautala
2 min read
Watch this: Time to quit Yahoo? Site reportedly spied on emails for US government

Yahoo CEO Marissa Mayer, pictured at the Fortune Global Forum in San Francisco in 2015, complied with a US government order to scan all user email according to reports from Reuters and the New York Times.

Justin Sullivan, Getty Images

Yahoo went searching for something in particular when it reportedly scanned all of its users' emails on the orders of a US intelligence agency -- but what?

Yahoo was scanning for the digital "signature" of a terrorist group with ties to a foreign government, according to a report Wednesday from The New York Times that cited an unnamed government official. The company adapted systems it already had in place to scan for spam, malicious software and child pornography, the report continued.

The reported email scans first came to light Tuesday when Reuters reported the company had created tools to scan all user email in response to a government directive. The story prompted privacy advocates to cry foul over Yahoo's apparent about-face on complying with government orders to hand over user data.

In 2007, Yahoo fought the legal authority behind the NSA's Prism data collection program, eventually losing its challenge. National security experts said that the government is likely to continue issuing such orders to protect the country now that so many emails and other communications are encrypted as they flow across the internet.

Yahoo declined to comment further on Wednesday about the email scanning reports. Earlier on Wednesday, the company issued a statement calling the Reuters report "misleading."

"We narrowly interpret every government request for user data to minimize disclosure," the statement continued. "The mail scanning described in the article does not exist on our systems."

According to the source cited by the Times, the scan ordered by the US government on Yahoo's systems is no longer taking place. The order might have come from either the NSA or the FBI, according to Reuters' sources.

The FBI declined to comment and the NSA did not respond to requests for comment.

Updated Oct. 6, 10:25 PT: Changed to show that the FBI declined to comment.