Yahoo Spies for Cash
When a graduate student in Indiana decided to learn more about the way online service providers aid government agencies in investigations, he found Yahoo’s menu of services–and their prices.
It turns out that Yahoo is more than happy to help government investigators learn more about Yahoo users–if the government is willing to pay for the help. The documents uncovered via a Freedom of Information Act Request reveals exactly what Yahoo knows about its users, how long they know it, and how much the Internet giant expects to receive from the government for the data.
Internet privacy is a huge concern for millions of users. People are increasingly concerned with how much data websites collect and how that information can be used. As such, it was not surprising that the Yahoo “spying price list” attracted a great deal of attention subsequent to its online publication.
Trying to Block the Information
Yahoo, recognizing that their willingness to sell user data to investigators would be poorly received, quickly took action to prevent the disclosure of the information via the FOIA request.
Yahoo filed a twelve-page objection to the request. It maintained that the information amounted to a trade secret. It also argued that disclosure of their spying price list was inappropriate because it might “confuse”, “shock” or otherwise irritate consumers. In other words, Yahoo basically asked the government to withhold the information to prevent its users from realizing that their data was for sale to government investigators because that knowledge might be bad for business!
The self-serving argument was not strong enough to prevent compliance with the FOIA request and the world soon discovered that Yahoo was more than happy to sell user information to the government.
The DMCA Takedown Attempt
The price list, which found a home at Cryptome, a website focused on whistle blowing, received substantial attention. Yahoo responded by issuing a Digital Millenium Copyright Act takedown notice. The company again argued that trade secrets were at play and also maintained that publication of their price list represented a copyright violation.
Despite their efforts to keep the information under wraps, the “Yahoo Compliance Guide for Law Enforcement” is still readily available online, making it easy for anyone to see just how much Yahoo values customer information.
What is Your Yahoo Privacy Worth?
Basic subscriber records cost $20 for the first user ID and an additional $10 for each additional ID. Basic Yahoo Group information, including details about moderators’ costs $20. The content of subscriber accounts, which includes user emails, is priced at “$30-$40 per user”. Law enforcement can receive the full content of any Yahoo Group for $40 to $80, according to the guide.
The guide also points out the limitations inherent in efforts to obtain Yahoo information. The bulk of user information is not stored indefinitely. In many cases, the cancellation of an account purges all of the data, as well. Yahoo may be able to provide the government with a great deal of data, but the total amount available may not be as high as one would think.
In Defence of Yahoo
It should be noted that Yahoo’s arguments against release of the data were not completely without validity. Yahoo observed that other telephone, cable and Internet service providers behave in a similar fashion, establishing price guidelines for law enforcement information requests. Yahoo also pointed out that the information was only available to investigators who had the appropriate warrant or subpoena. Investigators could not pay Yahoo a few dollars to help with a “fishing expedition” or for any other questionable endeavour.
By publishing Yahoo’s list without offering that kind of context, Yahoo rightfully feared that they would suffer more at the hands of consumers who might believe that the company’s policies were somehow unique or outlandish.
There is strong reason to believe that Yahoo was right about many of its concerns. A great deal of the discussion surrounding the price list failed to mention that other companies would work with investigators in a similar way. Almost none of the conversations about the spying price list mentioned the strict requirements the government would need to meet to obtain the information, either.
Conclusion
In any case, the information is available, and we now know the estimated value of Yahoo privacy. The price tag is not too high. Basically, the government can get its hands on user emails and Yahoo group data at a very low cost. If you have been planning any criminal enterprise via Yahoo and its properties, you might want to rethink your strategy!
If one takes a wider perspective on the spying price list and remembers the burdens placed on law enforcement before they can obtain the material, it seems silly to consider the compliance guide’s pricing an actual indicator of value.
Nonetheless, it is interesting to know that the Federal government can have a full copy of your emails for $20. That fact is so interesting that Yahoo did almost everything in its power to stop you from learning about it!
In the end, there is little cause for alarm, though. Protections are in place to prevent unwarranted privacy intrusions and Yahoo’s approach to providing investigators with user data appear to be fairly consistent with the policies of other service providers.
