Since it had a gag order, she likely wouldn't have been allowed to tell him. The government doesn't care about the security implications of these backdoors, they just want the data.

Also, Yahoo spent many years fighting similar requests (I think before anyone else did) and won nothing.

She also was obviously being advised by Ron Bell, the GC. If she didn't tell Stamos, it was probably based on the guidance of Mr. Bell. I'm not sure we can fault Mayer much on this one.

She's the CEO, she gets paid to be responsible for everything at the company. Of course she is at fault.

Knowing Stamos' background, it's possible that she was specifically required not to tell him.

How do you slip something like this past a corporate security team? Stamos and @bcrypt never struck me as individuals that were "asleep at the wheel".

Surely there was evidence somewhere? If Stamos wasn't briefed as to the situation and a security engineer found the rootkit on their own how could they be bound by the terms of an NSL / gag order?

This seems like the more interesting question.

Whether Mayer went around him willingly or by legal requirement is basically unanswerable, except to note that the email team chose to do the same. There's not much to say when we can't tell collusion from compulsion.

The question of accidental discovery, by contrast, is a fascinating one. A gag order couldn't possibly compel someone who made the discovery on their own (for the simple reason that they wouldn't know about it to be compelled). So circumventing the security team, instead of simply including them in the NSL, raises an interesting discussion about the nature of the NSL and why the matter was kept from Stamos' team.

> A gag order couldn't possibly compel someone who made the discovery on their own (for the simple reason that they wouldn't know about it to be compelled).

If the company was gagged, I don't see how it would matter whether company employees knew about it in advance or found it by accident. Either way, the company is still gagged.

Also, while your comment makes common sense, national security restrictions don't have to make sense to be legal. For example there is information that is "born classified," meaning that even if it is independently developed, totally separate from the defense apparatus, it's still considered classified!

That particular employee may not be. Obvious solution is to have a page ran by some reasonably trustworthy organisation where people can report these breaches before passing them on to their superiors.

I don't know any more about this than you do; I'm learning about it from the same Reuters story. But according to the story, the decision to implant the backdoor wasn't discovered by Yahoo security; rather, the backdoor itself was discovered, weeks after it was deployed.

So is the speculation that Stamos' departure was related to this? The timing would seem suspicious otherwise.

If so, one wonders if he would take a similar principled stance a second time at Facebook. Much harder to jump ship for greener pastures while already riding the biggest rocketship in town.

I do not believe Stamos would remain at Facebook after something like this.

But we're not much more than acquaintances (we both worked at NCC, and were prior to that former business rivals or whatever you call two people with similar roles at competing firms). I like him.

I just want to be clear that I'm not speculating about Stamos's motives.

> Yahoo execs deliberately bypassed review from the security team when installing the backdoor. In fact, when members of the security team found it within weeks of its installation, they immediately assumed it had been installed by malicious hackers, rather than Yahoo’s own mail team. (This says something about what the backdoor code may have looked like.)

https://diracdeltas.github.io/blog/surveillance/

In a large pipelined, distributed architecture, there's probably dozens of consumers of the databases that all look rather similar: they do some queries and pack up some reports for internal consumption. Marketing, ab testing, user experience, etc. Yet another consumer sharing 99% of the same code might not stand out.

At the risk of being downvoted for possibly being pedantic...

Knowing Yahoo's mail architecture very intimately, your analogy here isn't very accurate unless you get very abstract with your usage of the words "database" and "queries".

Add it to the spam filter? The security team probably reviews the spam filter code, but perhaps not the particular weights and measures it uses on a daily basis. So you set up a parallel filter for "arabic spam" that generally looks like regular filter, just tuned a little differently.

The feds had an API that allowed them to download the mail caught in the "Arabic spam filter". How do you hide that?

Perhaps the ssh connection running 'tail -f spamlog' is what tipped off the security team.

Had Mayer specifically told him, he'd have been compelled to remain silent as she was...

I wonder if she knew the security team would find it if they weren't consulted, making not telling them the legal way to tell them.

Yahoo is a public company, it has to follow SOX which requires a security policy to be followed.

Weren't high level officials communicating over Yahoo! mail?

Was Yahoo given a contract, or otherwise compensated?