Yahoo Faced $250,000-Day Fine for Not Giving U.S. Data

By Chris Stroh

Yahoo! Inc. (YHOO) might have had to pay millions of dollars per day in fines if the company kept refusing to comply with U.S. government requests for its users’ Internet data, newly released documents show.
In a small victory for Yahoo’s legal challenges to U.S. spying, a court permitted the company to release yesterday 1,500 pages of partly redacted documents that shed light on the scope and force of the government’s surveillance methods. One document shows the U.S. in May 2008 threatened Yahoo with a fine of $250,000 day that would double each week the
company failed to turn over data.
Yahoo complied on May 12, 2008, giving in to the National Security Agency’s Prism electronic surveillance program that had operated without public knowledge until former agency contractor Edward Snowden exposed it in 2013. The revelations ignited a debate about the scope of U.S. spying and prompted Internet companies to take additional measures to boost the use of encryption for e-mails and other communications.
“Abuse and excess take place in secrecy too easily,” said Ed Black, president and chief executive officer of the Computer and Communications Industry Association, a Washington-based trade group that represents phone and Internet companies including Yahoo. “This is hopefully a major step in having greater transparency about the secret world of surveillance.”

Photographer: Andrew Harrer/Bloomberg

The Yahoo! Inc. website is displayed on an Apple Inc. iPhone 5s and iPad Air in Washington.

The case stemmed from amendments to the Foreign Intelligence Surveillance Act that let the government to demand user information from online services without warrants.

10-Month Fight

Yahoo objected to the government’s warrantless foreign surveillance orders, waging an unsuccessful 10-month battle that started in 2007 in the Foreign Intelligence Surveillance Court and moved to an appeals panel that reviews rulings of the secret court, the declassified documents show.
“The released documents underscore how we had to fight every step of the way to challenge the U.S. government’s surveillance efforts,” Ron Bell, general counsel for the Sunnyvale, California-based company, said in a blog.
Confidence in technology companies began to be tested a year ago after the NSA document leaks by Snowden. In addition to the government asking Internet companies to turn over data about their users, the documents also uncovered NSA hacking of fiber optic cables abroad to steal data, and the physical interception of routers, servers and other network equipment to install surveillance tools before they were shipped to users.

Photographer: George Frey/Bloomberg

Protesters march along the roadside to the new National Security Agency Utah Data... Read More

Fourth Amendment

Other companies including Microsoft Corp. (MSFT), Google Inc. (GOOG) and Facebook Inc. (FB) were also asked to turn over user data.
Yahoo was the only company that refused to comply and fought the requests. The courts upheld the company’s right to assert violations of Fourth Amendment guarantees against unreasonable searches on behalf of its customers, while rejecting the substance of the constitutional claims.
“We refused to comply with what we viewed as unconstitutional and overbroad surveillance and challenged the U.S. government’s authority,” Bell said.
The directives were issued under a 2007 law permitting the NSA to intercept the communications of suspected foreign terrorists. That law allowed the e-mails and other communications of Americans to be intercepted without court warrants as long as they weren’t the target of the surveillance.

Kansas Citizen

“The directives will cause Yahoo! to capture the communications of a U.S. citizen sitting in his bedroom in Kansas while communicating in realtime to someone located overseas, who may also be a U.S. citizen temporarily located abroad,” the company said in a November 2007 court filing.
In response to questions from court, government attorneys said the NSA had a procedure to purge data that was found to have been improperly collected. The data, the government said, are “precisely labeled and controlled” and “stored in a limited number of known, established electronic repositories.”
In defense of the NSA’s requests, Michael McConnell, the Director of National Intelligence at the time, filed a statement with the court saying Yahoo’s refusal to comply with requests put the nation at risk.
“Any further delay in Yahoo’s compliance could cause great harm to the United States,” McConnell wrote. “Each day that Yahoo does not comply with the directive we are losing foreign intelligence information that may never be recovered.”
McConnell went on to become vice chairman at Booz Allen Hamilton Holding Corp. (BAH), which employed Snowden when he began to expose U.S. spying programs.

Obligatory Compliance

The government’s demands “are lawful” and “compliance with them is obligatory,” according to an August 2008 opinion by U.S. Circuit Judge Bruce Selya, who at the time was chief judge of the review panel.
“Notwithstanding the parade of horribles trotted out by the petitioner, it has presented no evidence of any actual harm, any egregious risk of error, or any broad potential for abuse in the circumstances of the instant case,” Selya wrote for a three-judge panel.
Selya also brushed aside Yahoo’s argument that warrantless surveillance placed too much power in the government’s executive branch.
“This is little more than a lament about the risk that government officials will not operate in good faith,” according to Selya. “That sort of risk exists even when a warrant is required.”
The Office of the Director of National Intelligence and Justice Department issued a joint statement last night that highlighted the parts of the case in which the court determined that the directives were lawful.
President Barack Obama and other senior administration officials have defended the Prism spy program and resisted efforts to restrict or alter it. The U.S. continues to compel Internet companies to turn over user data.