I would think that since telecommuting users were on Yahoo's remote access VPN, the company would be able to see everything just as if the employee was physically in the office and on Yahoo's network. The encrypted tunnel exists between the network access server and the individual's machine, but once the data stream reaches the NAS, it has fulfilled it's task of secure transmission and should then be unencrypted. If a telecommuting employee wanted to hide their activity from their employer, they should probably not count on their employer's VPN to do it.