Yahoo: Our spying policy would 'shock' customers

A little-noticed letter from Yahoo! to the US Marshals Service offers troubling insight into the surveillance policies of one of the Internet's largest email providers.

In response to a Freedom of Information Act request seeking details of Yahoo's! policies allowing the Justice Department to request wiretaps of its users and the amount they charge US taxpayers per wiretap -- the search engine leviathan declared in a 12-page letter that they couldn't provide information on their approach because their pricing scheme would "shock" customers. The news was first reported by Kim Zetter at Wired.

"It is reasonable to assume from these comments that the [pricing] information, if disclosed, would be used to "shame" Yahoo! and other companies -- and to "shock" their customers," a lawyer for the company writes. "Therefore, release of Yahoo!'s information is reasonably likely to lead to impairment of its reputation for protection of user privacy and security, which is a competitive disadvantage for technology companies."

Yahoo! also argues that because their price sheet for wiretaps was "voluntarily submitted" to the US Marshals Service, it is exempt from the Freedom of Information Act law.

Verizon, meanwhile, says (letter PDF) they can't provide details on how much they charge for wiretaps because it would be "confusing."

“Customers may see a listing of records, information or assistance that is available only to law enforcement,” Verizon writes, “but call in to Verizon and seek those same services. Such calls would stretch limited resources, especially those that are reserved only for law enforcement emergencies.”

Consumers might “become unnecessarily afraid that their lines have been tapped or call Verizon to ask if their lines are tapped (a question we cannot answer),” the telecom giant adds.

Verizon also revealed it "receives tens of thousands of requests for customer records, or other customer information from law enforcement."

The Freedom of Information request was filed by muckraker Christopher Soghoian.

"Assuming a conservative estimate of 20,000 requests per year, Verizon alone receives more requests from law enforcement per year than can be explained by any published surveillance statistics," Soghoian responds. "That doesn't mean the published stats are necessarily incorrect -- merely that most types of surveillance are not reported.

"In the summer of 2009, I decided to try and follow the money trail in order to determine how often Internet firms were disclosing their customers’ private information to the government," he adds later. "I theorized that if I could obtain the price lists of each ISP, detailing the price for each kind of service, and invoices paid by the various parts of the Federal government, then I might be able to reverse engineer some approximate statistics. In order to obtain these documents, I filed Freedom of Information Act requests with every part of the Department of Justice that I could think of."

Cox Communications, meanwhile, says they charge "$2,500 to fulfill a pen register/trap-and-trace order for 60 days, and $2,000 for each additional 60-day-interval," Zetter notes. "It charges $3,500 for the first 30 days of a wiretap, and $2,500 for each additional 30 days. Thirty days worth of a customer’s call detail records costs $40."

"Comcast’s pricing list," she adds, "which was already leaked to the internet in 2007, indicated that it charges at least $1,000 for the first month of a wiretap, and $750 per month thereafter."