With the rise of cyber and computer-enabled crime, gathering and examining electronic evidence is often a critical part of a criminal investigation.
Yahoo! receives requests from government agencies around the world investigating criminal activity, administrative agencies, courts and others.
We investigate the various services provided by Yahoo!, the ways in which they respond to government requests for data and the applicable laws governing these interactions.
What information can Yahoo! Provide?
Yahoo! can provide general subscriber information supplied by the user at the time of registration, including name, location, date account created, services used and IP addresses.
Yahoo! provides its users with a variety of different products and services, some of which require separate log-ins or subscriptions and generate separate electronic records.
The availability of the data depends of the specific service. For example, general subscriber information is available for as long as the account is active, whereas chat/instant messenger logs are accessible for 45-60 days.
The different services provided by Yahoo! and associated data that can be provided include:
Yahoo! Mail: Any email available in the user’s mail account, including IP address of computer used to send email. Yahoo! Is not able to search for or produce deleted emails.
Yahoo! Chat/Messenger: Data including friends list, archived communications, time, date and IP address logs.
Yahoo! Groups: Member list, email addresses of members, date when members joined/left group, activity log including contents of the files, photos and message sections, and information about group moderators.
Yahoo! GeoCities, Domains, Web-hosting, and Stores: Active files user has uploaded to the website and date of file upload.
Yahoo! Flickr: Contents in Flickr account and groups, IP address and timestamp of uploaded content.
Yahoo! profiles: Contents of a user’s profile, time, date and IP address logs of content added.
How does Yahoo! respond to requests for data by government agencies?
The disclosure of information maintained by Yahoo! is governed in large part by the Electronic Communications Privacy Act, 18 U.S.C. § 2701, et seq. (“ECPA”), among other federal and state statutes.
Yahoo provides guidelines suggesting that in crafting a subpoena, court order, or search warrant for such information, law enforcement should be as specific as possible, as this produces faster results with fewer opportunities for misinterpretation.
Yahoo! is unable to search for and produce deleted material such as emails, unless a request is received within 24 hours of the deletion and is specifically requested by proper legal process.
Pursuant to 18 U.S.C. 2703(f), Yahoo! will preserve information related to a subscriber or customer for 90 days, which may be extended for an additional 90 days by a request to extend the preservation. Failing this, the preserved information may be deleted.
Emergency Disclosures
Under 18 U.S.C. §§ 2702(b)(7) and 2702(c)(4) Yahoo! is permitted, but not required, to voluntarily disclose data to a government entity if it believes in good faith that an emergency involving imminent danger of death or serious physical injury to any person requires such disclosure without delay.
Cost reimbursement policy
Federal law (See 18 U.S.C. § 2706) requires law enforcement to reimburse providers like Yahoo! for costs incurred responding to subpoena requests, court orders, or search warrants. Yahoo! generally requests reimbursement when responding to legal process, except for cases involving the abduction or exploitation of children, where they make an exception to this policy.
