British spy agency GCHQ has spied on millions of Yahoo users' webcam images as part of a bulk collection program codenamed Optic Nerve, according to the latest report based on documents provided by Edward Snowden.
The GCHQ, with help from the NSA, collected a vast number of webcam pictures from 1.8 million users over a six-month period by tapping fiber optic cables. The program began as a prototype in 2008 but was still active in 2012, The Guardian reported.
See also: AT&T's First Transparency Report Reveals 300,000 Requests for Data
A large number of images turned out to be pornographic: Between 3% and 11% of the entire database harvested by GCHQ contained "undesirable nudity," the documents read.
"Unfortunately […] it would appear that a surprising number of people use webcam conversations to show intimate parts of their body to the other person," the documents read, according to The Guardian. "Also, the fact that the Yahoo software allows more than one person to view a webcam stream without necessarily sending a reciprocal stream means that it appears sometimes to be used for broadcasting pornography."
Optic Nerve was used to monitor GCHQ's targets and find new targets; it was also an experiment to improve facial recognition technology. But the program cast a wide net: GCHQ analysts were allowed to collect and view images of Yahoo users with similar nicknames to known targets. The goal was to catch terrorists who were using multiple, similar IDs.
The GCHQ's tactics for collecting webcam images in bulk without hacking into targets' computers are unclear, but some theorize it may have been possible because Yahoo didn't encrypt the webcam feeds while in transit over the Internet.
Ashkan Soltani, a privacy and security researchers who has also worked on the Snowden leaks for The Washington Post, said this is likely how the GCHQ tapped the images. "It could also be gotten through a muscular capability," Soltani added, referring to the NSA's program to defeat web encryption.
Soltani told Mashable that people shouldn't be too surprised at the GCHQ or the NSA's ability to intercept Yahoo video chats.
"Until recently, most of Yahoo's services, including video, traverses the Internet unencrypted — allowing any actor that's able to monitor Internet traffic to capture it," he said.
Yahoo has not responded to our request for comment. In The Guardian, Yahoo said this "represents a whole new level of violation of our users' privacy that is completely unacceptable."
The GCHQ, on its part, only commented sending a standard statement of denial:
All of GCHQ's work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorized, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence services commissioners and the Parliamentary Intelligence and Security Committee.
This is the latest in a long string of bad news for civil liberties advocates.
"My extreme surveillance reductio [ad absurdum] used to be 'what if they installed cameras in all our homes & promised to only turn them on for bad guys?'" tweeted Julian Sanchez, a research fellow at the Cato Institute who focuses on technology and policy. "I have, disturbingly, been superseded by reality."
Others, like surveillance expert Chris Soghoian, pointed their fingers at Yahoo.
Save at least some of your outrage for Yahoo, which didn't care about users enough to encrypt their webcam traffic. Totally unacceptable.
— Christopher Soghoian (@csoghoian) February 27, 2014
It doesn't take a genius to know that webcam chats are used for sensitive (read: sexual) content. Yahoo should have encrypted from day one.
— Christopher Soghoian (@csoghoian) February 27, 2014
Have something to add to this story? Share it in the comments.