A FAILED turnaround and then, last month, the biggest data breach from a single site in history. Yahoo, an online firm, has had a bad run of news. On October 4th came a fresh blow when Reuters, a newswire, reported that the company had written customised software to scan all incoming e-mail for certain keywords, complying with a request either from America’s National Security Agency or the FBI.
The company’s first response was to say that it is a law-abiding company. It later issued a statement saying that the Reuters article was “misleading” and that the “mail scanning” the article described “does not exist on our systems”. But that is only a partial denial, and does not rule out the possibility that Yahoo did some kind of scanning. According to Reuters, Yahoo’s chief information-security officer, Alex Stamos, left Yahoo in 2015 because of a decision by Marissa Mayer, its chief executive, to obey an order from a government agency. (He now does the same job at Facebook.)
Even the possibility of a real-time wiretap raises important questions. If the government has demanded such bulk scanning it may represent an expansion of surveillance. If so, it would run counter to efforts by Congress to rein in such programmes, following revelations in 2013 by Edward Snowden, a former NSA contractor, of online spying (on October 5th it emerged that another NSA contractor was arrested in August for stealing classified information). Other tech firms, including Apple and Google, said this week that they had never received such a directive, nor would they accept it without challenging it in court.
Second, the alleged wiretap reinforces concerns about how Yahoo treats all of its user data. Last month it emerged that hackers, probably state-sponsored, had in 2014 stolen account details of more than 500m users, including phone numbers, birth dates and encrypted passwords. Critics found it galling that Ms Mayer is reported to have been aware of the theft since July but said nothing.
A third question is what all this means for the sale of Yahoo’s core business to Verizon, a telecoms operator, for $4.8 billion, a deal announced in late July. If Yahoo’s management did not disclose the data breach in the negotiations, Verizon could have the right either to walk away or to ask for a lower price. The allegations about e-mail scanning, if they are substantiated, would probably also be reason for further negotiations.
Verizon declined to comment this week. The news is another blow to Yahoo’s brand, which has sunk in recent years as a series of chief executives tried and failed to revive its fortunes. Many more of its users may now type in: “How do I delete my Yahoo account?”