Yahoo, Verizon: Our Spy Capabilities Would ‘Shock’, ‘Confuse’ Consumers

[Eugen Leitl]

Shocked and awed, no doubt.

http://www.wired.com/threatlevel/2009/12/wiretap-prices/

Yahoo, Verizon: Our Spy Capabilities Would bShockb, bConfuseb Consumers

* By Kim Zetter Email Author * December 1, 2009  | * 3:30 pm  | * Categories:
Cover-Ups, Surveillance, privacy

Want to know how much phone companies and internet service providers charge
to funnel your private communications or records to U.S. law enforcement and
spy agencies?

Thatbs the question muckraker and Indiana University graduate student
Christopher Soghoian asked all agencies within the Department of Justice,
under a Freedom of Information Act (FOIA) request filed a few months ago. But
before the agencies could provide the data, Verizon and Yahoo intervened and
filed an objection on grounds that, among other things, they would be
ridiculed and publicly shamed were their surveillance price sheets made
public.

Yahoo writes in its 12-page objection letter (.pdf), that if its pricing
information were disclosed to Soghoian, he would use it bto bshameb Yahoo!
and other companies b and to bshockb their customers.b

bTherefore, release of Yahoo!bs information is reasonably likely to lead to
impairment of its reputation for protection of user privacy and security,
which is a competitive disadvantage for technology companies,b the company
writes.

Verizon took a different stance. It objected to the release (.pdf) of its Law
Enforcement Legal Compliance Guide because it might bconfuseb customers and
lead them to think that records and surveillance capabilities available only
to law enforcement would be available to them as well b resulting in a flood
of customer calls to the company asking for trap and trace orders.

bCustomers may see a listing of records, information or assistance that is
available only to law enforcement,b Verizon writes in its letter, bbut call
in to Verizon and seek those same services. Such calls would stretch limited
resources, especially those that are reserved only for law enforcement
emergencies.b

Other customers, upon seeing the types of surveillance law enforcement can
do, might bbecome unnecessarily afraid that their lines have been tapped or
call Verizon to ask if their lines are tapped (a question we cannot answer).b

Verizon does disclose a little tidbit in its letter, saying that the company
receives btens of thousandsb of requests annually for customer records and
information from law enforcement agencies.

Soghoian filed his records request to discover how much law enforcement
agencies b and thus U.S. taxpayers b are paying for spy documents and
surveillance services with the aim of trying to deduce from this how often
such requests are being made. Soghoian explained his theory on his blog,
Slight Paranoia:

    In the summer of 2009, I decided to try and follow the money trail in
order to determine how often Internet firms were disclosing their customersb
private information to the government. I theorized that if I could obtain the
price lists of each ISP, detailing the price for each kind of service, and
invoices paid by the various parts of the Federal government, then I might be
able to reverse engineer some approximate statistics. In order to obtain
these documents, I filed Freedom of Information Act requests with every part
of the Department of Justice that I could think of.

The first DoJ agency to respond to his request was the U.S. Marshals Service
(USMS), which indicated that it had price lists available for Cox
Communications, Comcast, Yahoo and Verizon. But because the companies
voluntarily provided the price lists to the government, the FOIA allows the
companies an opportunity to object to the disclosure of their data under
various exemptions. Comcast and Cox were fine with the disclosure, Soghoian
reported.

He found that Cox Communications charges $2,500 to fulfill a pen
register/trap-and-trace order for 60 days, and $2,000 for each additional
60-day-interval. It charges $3,500 for the first 30 days of a wiretap, and
$2,500 for each additional 30 days. Thirty days worth of a customerbs call
detail records costs $40.

Comcastbs pricing list, which was already leaked to the internet in 2007,
indicated that it charges at least $1,000 for the first month of a wiretap,
and $750 per month thereafter.

But Verizon and Yahoo took offense at the request.

Yahoo objected on grounds that its pricing constituted bconfidential
commercial informationb and cited Exemption 4 of the Freedom of Information
Act and the Trade Secrets Act.

Exemption 4 of the FOIA refers to the disclosure of commercial or financial
information that could result in a competitive disadvantage to the company if
it were publicly disclosed. The company claims its pricing is derived from
labor rates for employees and overhead and, therefore, disclosing the
information would provide clues to its operating costs b regardless of
whether these same clues are already available in public records, such as
those the company files with the Securities and Exchange Commission. The
company also claims that since Soghoian is trying to determine the actual
amounts the Marshals Service paid Yahoo for responding to requests, the price
lists are irrelevant, since bthere are no standard prices for these
transactions.b

But equally important to Yahoobs objections was the potential for bcriticismb
and ridicule. Yahoo quoted Soghoian on his blog writing that his aim was to
buse this blog to shame the corporations that continue to do harm to user
online privacy.b

Yahoo also objected to the disclosure of its letter objecting to the
disclosure of pricing information saying that brelease of this letter would
likely cause substantial competitive harmb to the company. The company added,
in a veiled threat, that if the Marshals Service were to show anyone its
letter objecting to the disclosure of pricing information, it could bimpair
the governmentbs ability to obtain information necessary for making
appropriate decisions with regard to future FOIA requests.b

If anyone out there has a copy of Verizon or Yahoobs law enforcement pricing
list and wants to share it, feel free to use our anonymous tip address.

Image: FBI.gov