On Tuesday, Reuters reported that Yahoo built a custom search program to monitor customers’ incoming emails, after receiving a request by U.S. intelligence officials likely from the National Security Agency or Federal Bureau of Investigation. It is the first known instance of a major U.S. internet company complying with a government search request of such scope.
It is not, however, the first time that Yahoo has been outed for cooperating with government-imposed surveillance. In 2008, the U.S. threatened to slap the company with a daily $250,000 fine should it fail to hand over user communications, a mandate that Yahoo fought in the secret Foreign Intelligence Surveillance Court of Review, or FISCR. However, Yahoo lost the case, making it one of the first U.S. internet companies to participate in the NSA’s PRISM mass surveillance program, which has been in operation since 2007 and was exposed by whistleblower Edward Snowden.
The problem with such cooperation between government actors and private internet intermediaries like Yahoo is that it is difficult to hold anyone accountable for violations of the Fourth Amendment, which protects against unreasonable search and seizure by government actors. Internet companies operate under certain privacy expectations delineated in their terms of service, which users assume they will honor. But in their capacity as deputies of law enforcement—in which they use their access to user data to conduct searches that the government cannot—they are not liable under the Fourth Amendment.
If indeed Yahoo is able to conduct an invasive search of all user data and flag suspicious sentence fragments or email attachments for the authorities, the company itself should be subject to the same principles as law enforcement: accountability, transparency, and due process. UNESCO argued as much in its 2015 white paper on the subject of internet freedom and online intermediaries. Additionally, individual users should be able to report grievances and obtain redress from a private company like Yahoo, as well as state authorities. Perhaps then Yahoo might respect an obligation to its users’ individual privacy concerns.