Britain's surveillance agency GCHQ, with the help from the U.S. National Security Agency (NSA), intercepted and stored the webcam images of millions of unsuspecting internet users, secret documents reveal.
GCHQ files dating between 2008 and 2010 explicitly state that a surveillance program with the codenamed Optic Nerve has collected still images of Yahoo! webcam chats in bulk and saved them to agency databases, regardless of whether individual users were an intelligence target or not.
The report about Optic Nerve is based on documents provided by a whistle-blower Edward Snowden, a former NSA contractor who has received political asylum in Russia to The Guardian.
In a six-month period in 2008 alone, the agency collected webcam imagery - including explicit images and communications - from more than 1.8 million Yahoo! users globally.
From Facial Recognition to ID Searching
The secret program Optic Nerve began as a prototype in 2008 and was still active in 2012, according to an internal GCHQ wiki page accessed that year.
The system was formerly used for experiments in automated facial recognition: monitoring GCHQ's existing targets, and to discover new targets of interest. Such searches could be used to try to find terror suspects or criminals making use of multiple, anonymous user IDs.
Optic Nerve collects one image every five minutes from the users' feeds rather than collecting webcam chat to avoid overloading its servers. The still images taken was potential for the facial recognition program because people usually face the camera when chatting with webcam.
However, because analysts were shown the faces of people with similar usernames to surveillance targets, this could actually drag large number of innocent people in the process. One document tells agency staff they were allowed to display "webcam images associated with similar Yahoo! identifiers to your known target". But analysts can request automatic comparison of a face of a similar ID from their target to others.
The agency did make efforts to "limit analysts' ability" to see webcam images, restricting bulk searches to metadata only.
Optic Nerve collected information from GCHQ's massive network of internet cable taps, which was then processed into the XKeyscrore search system that NSA has provided. NSA research was used to build the tool which identified Yahoo!'s webcam traffic.
The leaked documents said that Yahoo! was chosen as a target because "Yahoo! webcam is known to be used by GCHQ targets."
GCHQ insists all of its activities are necessary, proportionate, and in accordance with UK law. The mass collection of the still images by GCHQ is governed by the UK's Regulation of Investigatory Powers Act, and requires certification by the foreign secretary.
Most People Were Not Intelligence Targets
The privacy risks of mass collection from video sources have long been known to the NSA and GCHQ, as a research document from the mid-2000s noted: "One of the greatest hindrances to exploiting video data is the fact that the vast majority of videos received have no intelligence value whatsoever, such as explicit materials, commercials, movie clips and family home movies."
Explicit materials and adult related images are what most people concern because they can affect their well being. The secret documents show that explicit materials were an issue the spy agencies had faced; they estimate that between 3 percent and 11 percent of Yahoo! webcam images were "undesirable."
"Unfortunately … it would appear that a surprising number of people use webcam conversations to show intimate parts of their body to the other person," one document states
The document suggested that GCHQ did not make any specific attempts to prevent these contents, or document collections, or storage of explicit images, but did eventually compromise by excluding images in which software had not detected any faces from search results.
However, the system wasn't able to compromise such things perfectly. An internal guide cautioned prospective Optic Nerve users that "there is no perfect ability to censor material which may be offensive. Users who may feel uncomfortable about such material are advised not to open them".
It further notes that "under GCHQ's offensive material policy, the dissemination of offensive material is a disciplinary offence".
Once collected, the metadata associated with the videos can be as valuable to the intelligence agencies as the images themselves.
In its statement to The Guardian, Yahoo! strongly condemned the Optic Nerve program, and said it had no awareness of or involvement with the GCHQ collection. As a company that had requested to disclose the government's effort, the news has made it "furious".
"We were not aware of, nor would we condone, this reported activity," said a spokeswoman. "This report, if true, represents a whole new level of violation of our users' privacy that is completely unacceptable."
"We are committed to preserving our users' trust and security and continue our efforts to expand encryption across all of our services."
The GCHQ said that it would not comment on intelligence matters, according to company policy. But a spokesperson did say that "all of GCHQ's work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorized, necessary and proportionate."
NSA spokeswoman Vanee Vines said the agency did not ask foreign partners to collect data it could not legally collect itself.