Legal representatives of a UK man are accusing Yahoo of violating email users’ privacy by preserving deleted emails. Deleting Yahoo email erases the version last saved by the user from the directories they have access to, while drafts of the “deleted” email could remain on the company’s mail server, according to court filings by Yahoo.
Yahoo responded to a discovery motion made by the defendant in a UK drug trafficking case, in which supposedly deleted emails make up part of the prosecution’s evidence.
Accomplices in a trans-Atlantic smuggling operation would save messages to each other as drafts in a Yahoo email account, which they would then delete, Vice Motherboard reports. Yahoo provided law enforcement with four “snapshots” of the account; two with email contents and two with only email headers. Based in part on these emails Russell Knaggs was sentenced to 20 years in prison, and his appeal includes allegations that the email evidence may not be allowable.
Knagg’s defense lawyer Sukhdev Thumber suggested to Motherboard that since the emails were deleted, it may be “(s)ome sort of bulk-data gathering, live monitoring, interception, continuous monitoring of the account which has allowed this data to be produced.”
“Unhappy with the truth – because Yahoo’s answers do not support his argument on appeal – Petitioner now demands that this court allow him to extract additional, cumulative, overbroad, and harassing discovery from Yahoo,” the company said in its response.
While Knaggs conviction will in the end stand without likely revealing anything truly new about Internet surveillance, it is Yahoo policy, as stated in the company’s Compliance Guide for Law Enforcement (PDF), that the company can neither search for nor produce deleted emails.
Yahoo could say that the deletion process extends beyond the user’s knowledge in the case of auto-save systems, or that the auto-save drafts it provided as evidence are separate items from the actual deleted emails.
While both cases involve email access and drug trafficking, the Knaggs case does not have the precedent-setting status of the ongoing battle between Microsoft and US law enforcement over emails stored at a data center in Ireland.
The Email Privacy Act, which passed the US House of Representatives unanimously in late April, and is currently being weighed in the Senate along with a raft of amendments, is unlikely to lead to updated email storage practices. More likely an extension of the “right to be forgotten” included in EU data privacy regulations could require European service providers to purge data associated with deletion requests.