We've known for a long time both that malware has had this capability and that the U.S. government has infected machines with malware. It's not too much of a jump to assume that the FBI can remotely take control of your computer's camera.
The yahoo email account was the opportunity -- so they either MITM'd the session, used some kind of client/server injection, or -- more likely; they're in bed with yahoo? (We can confirm their involvement from Snowden's leaks...)
The only real fascinating part here is probably the browser exploit. The rest sounds like standard fluff for what happens when you let an unauthorized process onto your computer.
Back in the 90's, hackers used these tricks all the time. It was easy once you got onto someone's computer. See for yourself -- :)
https://www.google.ca/search?q=subseven&source=lnms&tbm=isch