SAN FRANCISCO - A British intelligence agency collected webcam images - many of them sexually explicit - from millions of Yahoo users, regardless of whether they were suspected of illegal activity, according to accounts of documents leaked by Edward Snowden.
The surveillance effort operated by Britain’s Government Communications Headquarters was code-named Optic Nerve. Images from Yahoo webcam chats were captured in bulk through the agency’s fiber-optic cable taps and saved to a database, where they could be queried by a search tool provided by the National Security Agency called XKeyscore, according to a report Thursday by The Guardian.
The report did not indicate whether the agency also collected webcam images from similar services, such as Google Hangouts or Microsoft’s Skype. The Guardian did say the British intelligence agency was studying the possibilities of using the cameras in Microsoft’s Kinect devices, which are used with its Xbox game consoles, to spy on users.
Microsoft had no immediate comment on the report.
Yahoo, which was named in Government Communications Headquarters documents, said in a statement Thursday that it was not aware of the program and expressed anger at the reports.
“This report, if true, represents a whole new level of violation of our users’ privacy that is completely unacceptable and we strongly call on the world’s governments to reform surveillance law consistent with the principles we outlined in December,” the company said in a statement. “We are committed to preserving our users’ trust and security, and continue our efforts to expand encryption across all of our services.”
Technology companies like Yahoo, Google and Microsoft send vast amounts of data - including video and webcam chats - through the fiber-optic lines between their data centers around the world. After recent disclosures about government tapping of some such lines, all three companies have said they are working to encrypt those links between their data centers to thwart spying.
Yahoo has said encryption will be in place for all of its services by March 31. Google has encrypted its video chat services, including Hangouts, since at least 2010.
In response to earlier concerns about potential government surveillance of the Kinect camera, Microsoft said last year that it would allow users to turn it off. The company also said it did not give any government broad access to Skype data or security technologies.
Documents dated between 2008 and 2010 show the Government Communications Headquarters was collecting still images from Yahoo webcam chats and storing them in an agency database.
The Optic Nerve program, which began as a prototype, was still active in 2012, according to an internal document.
Because the British agency lacked the technical means to filter out the content of British or U.S. citizens, and because it faces fewer legal restrictions than the National Security Agency in the United States, the British agency was collecting vast numbers of webcam images, documents show. In one six-month period in 2008, the agency collected webcam images from more than 1.8 million Yahoo user accounts globally, including those of Americans, according to the report in The Guardian.
The British agency restricted its collection by saving one image every five minutes from users’ feeds, partly to avoid overwhelming its servers. It also restricted its image searches to so-called metadata, information that tells analysts what content the files contain, such as the sender’s and receiver’s user names, file types, time, date and duration of their webcam chat.
But analysts were able to view the contents of webcam chats between users whose user names matched those of surveillance targets. One document instructs analysts that they are allowed to view “webcam images associated with similar Yahoo identifiers to your known target.”
The agency also apparently experimented with facial recognition technology, which searched webcam images for faces resembling those of Government Communications Headquarters targets. One undated document shows that the agency shuttered this capability.It was unclear if or when it was resurrected. It is also unclear if the National Security Agency also had access to the metadata and images.
The program posed unique challenges. According to one document, between 3 percent and 11 percent of collected Yahoo webcam images contained sexually explicit content.
“Unfortunately, there are issues with undesirable images within the data,” one document reads. “It would appear that a surprising number of people use webcam conversations to show intimate parts of their body to the other person.”
An internal agency survey of 323 Yahoo user names found that 7.1 percent of those images contained “undesirable nudity.”
One document advises analysts that they are forbidden to disseminate “offensive material” and that “retrieval of or reference to such material should be avoided.”
A Government Communications Headquarters spokesman declined to comment Thursday, citing “a long-standing policy that we do not comment on intelligence matters.”
“Furthermore,” the spokesman, who declined to be identified, said, “all of GCHQ’s work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorized, necessary and proportionate.”
Vanee Vines, a National Security Agency spokesman, said in a statement Thursday: “The National Security Agency does not ask its foreign partners to undertake any intelligence activity that the U.S. government would be legally prohibited from undertaking itself. NSA works with a number of partners in meeting its foreign intelligence mission goals, and those operations comply with U.S. law and with the applicable laws under which those partners operate.” Information for this article was contributed by Vindu Goel of The New York Times.
Front Section, Pages 7 on 02/28/2014