Yahoo CEO Marissa Meyer secretly ordered email engineers to write surveillance software for the NSA, Reuters revealed today, citing information from three former Yahoo employees and another person aware of the events. The software was designed to analyze all incoming e-mail messages for a certain phrase or string of characters, although Reuters was unable to determine what the exact phrase being targeted was. The directive to create a surveillance system was issued directly to engineers, bypassing Yahoo's own internal user security team. When the user security team discovered the software in May 2015, weeks after it was installed, they actually thought it had been placed there by hackers. Yahoo's response was brief: "Yahoo is a law abiding company, and complies with the laws of the United States."
Two other big email providers, Microsoft and Google, said they had never conducted such searches. Microsoft: "We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo." Google: "We've never received such a request, but if we did, our response would be simple: 'No way.'" Reuters says former Yahoo Chief Information Security Officer Alex Stamos left the company in June 2015 over the issue. While surveillance programs have been well-known since Edward Snowden leaked details of many classified NSA programs, security experts say this may be the first confirmed case of a service provider scanning all incoming mail, instead of doing spot searches on stored files. The case is also unique because it required Yahoo engineers to create a custom tool for the data collection—an issue reminiscent of Apple's refusal to create a custom tool to unlock the iPhone used by the San Bernardino shooters.