Yahoo webcam users reportedly watched by British spy agency
By BRANDON BAILEY | San Jose Mercury News | Published: February 28, 2014
A British spy agency collected webcam images from millions of Yahoo users who thought they were engaging in private video conversations, according to a news report Thursday that sparked fresh outrage from privacy groups and the Internet industry.
Many of the collected images were sexually explicit, according to the report by the Guardian newspaper, which said the British agency known as GCHQ tapped into transmissions between Yahoo users around the world, apparently with technical help from the U.S. National Security Agency.
The report is the latest in a wave of revelations about government spying, based on leaks from the former NSA contractor Edward Snowden, that have drawn condemnation from Internet users and companies that provide Internet services. Yahoo reacted furiously, saying it only learned of the operation, code-named Optic Nerve, from the Guardian.
“We were not aware of nor would we condone this reported activity. This report, if true, represents a whole new level of violation of our users’ privacy that is completely unacceptable,” said a Yahoo spokeswoman. “We strongly call on the world’s governments to reform surveillance laws consistent with the principles we outlined in December.”
The American Civil Liberties Union called the report “truly shocking” and said it underscores the need for reform. “This report also raises troubling questions about the NSA’s complicity,” said ACLU attorney Alex Abdo.
Without confirming details, the British and U.S. governments issued statements saying they follow laws that protect their citizens’ rights. The GCHQ, or Government Communications Headquarters agency, is a British counterpart to the NSA.
While it’s unclear how many Yahoo subscribers were affected in the United States or other countries, the Guardian said leaked documents showed the British agency collected webcam images from more than 1.8 million Yahoo users around the world during one six-month period of 2008.
The program lasted at least until 2012, according to the newspaper, which said GCHQ limited its analysts’ ability to view random images from the stockpile, but allowed them to view images from accounts that had names similar to those of investigative targets.
GCHQ also warned its analysts that many of the images — more than 7 percent of one sample — contained nudity.
“Unfortunately ... it would appear that a surprising number of people use webcam conversations to show intimate parts of their body to the other person,” said a document quoted by the Guardian, while another advised analysts “who may feel uncomfortable about such material” to not open those files.
Optic Nerve saved only still pictures from webcam transmissions — one image from every five minutes of a feed — to satisfy legal restrictions and avoid overloading GCHQ servers with video data, the Guardian said. The system was intended to monitor known targets of investigations and to be used as a searchable database for identifying new targets using facial recognition and other software.
GCHQ, which intercepted the video transmissions by tapping Internet cables, processed the information with help from NSA systems and expertise, according to the Guardian. It was unclear whether GCHQ monitored what people said during the video sessions or whether any information was shared directly with the NSA.
The NSA, which is generally restricted from spying on U.S. citizens, said Thursday that it “does not ask its foreign partners to undertake any intelligence activity that the U.S. government would be legally prohibited from undertaking itself.”
While the GCHQ documents only mentioned Yahoo, an industrywide trade group voiced outrage.
“This secret capturing and storage of images taken from millions of video chats indicates government privacy violations have reached an alarming new level of intrusiveness,” said Ed Black of the Computer and Communications Industry Association. He said the report “shows how government surveillance officials will go as far as they can to gather data with minimal regard for privacy expectations.”
Yahoo has fought legal battles against government demands for user data and joined other tech giants in calling for surveillance reforms. Some privacy activists, however, said Yahoo lagged other companies in adopting encryption technology that would protect users from surveillance.
“Yahoo’s failure to encrypt their customer data is inexcusable. They have exposed their users to surveillance by the U.S. government and every other government that has access to that data,” said Christopher Soghoian, principal technologist for the ACLU.
While Yahoo’s video chat service is not encrypted, in contrast with similar services offered by Google and others, CEO Marissa Mayer has promised all Yahoo services will be encrypted by the end of March.
“We are committed to preserving our users’ trust and security and continue our efforts to expand encryption across all of our services,” a spokeswoman said.