9 ms·

Phone call metadata does betray sensitive details about your life

138 points by Libertatea 13y ago

moron4hire 13y ago
Don't mean to be rude, but literally thought this was common knowledge by now. Clearly, that is my own failing for not understanding that The People != Me. I think people are starting to get it, though, especially thanks to how creepy targeted advertising is getting on Facebook and the like. And that's kind of the thing, with all of the data that Facebook had on me, they couldn't figure out to not send me advertisements for skeezy dating services? That's the only solace I take from this story: it sucks that the security services are collecting all of this data, but if I can't do anything about it, it's good to know that they are drinking from a firehose.
- jcromartie 13y ago
  Loads of "truthy" political bullshit that goes around on Facebook and email chain letters is regarded as fact (by the test of gut feeling) by plenty of voting adults. There are different kinds of "common knowledge" among different groups of people. What's common knowledge to a person immersed in cyberculture for decades is going to be a world apart from a sales guy.
skywhopper 13y ago
If it didn't, the NSA would not be so interested in collecting it. Paranoid people who believe they might be being listened in on are unlikely to reveal much directly in the conversation itself anyway, so in those cases the metadata is more important. Also, the metadata can reveal anomalous behavior, which they look for mainly because it's easy to find, but also because it can reveal important information assuming the targets are correctly selected. Anyway, the only reason they aren't collecting the calls themselves is because the storage required is not yet available, so their begging off about "but we aren't storing the content" is disingenuous. They can, at any moment, capture any call going over the long-distance network (which would include pretty much all cell phone calls) so the only thing they're unable to do is to retroactively listen in on calls. If you are flagged for whatever reason (you know someone who knows someone who knows someone they suspect of sending money to a bad charity), you may well be being monitored.
- slashdotaccount 13y ago
  The amount of storage required for storing all of the call recordings (GSM, VoIP, land-line) are currently available. For example, Speex [1] can compress voice even in 2kbps. So storing everything e.g. in 8kbps you can store 916259 hours (104 years) of voice in just one 3TB disk. [1] http://speex.org/ http://speex.org/
  - Cthulhu_ 13y ago
    Let's take the US. 317 million people, assuming they call for an average of 10 minutes (based on nothing whatsoever, btw), gives approx. (10317) / 60 = 53 million hours of phone conversations a day. Given 916.259 hours = 3 TB, 53M / 916.259 = 57 3 TB = 172 TB of data /a day/. And that's just the US. Even if you adjust the average to just one minute a day, you're still looking at 17 TB / day, which should be sorta manageable I reckon. But it's not just the US. Let's assume they want to track all voice communications globally, rounding it to an even 7 billion, ten minutes a day. I'm counting 3819 TB/day. That's a lotta 3 TB hard drives. tl;dr: big data is big. disclaimer: I suck at basic arithmetic, I probably made a miscalculation.
    - slashdotaccount 13y ago
      I think they can handle it in Utah: "An article by Forbes estimates the storage capacity as between 3 and 12 exabytes in the near term" [1] [1] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
      - arg01 13y ago
        Which gives you between 2-10 years of storage if it was recording everyone in the world. (Based on the assumptions above).
    - dictum 13y ago
      ~200TB/day is entirely within the room the NSA's budget allows. You don't need to record all phones in the world if you have the metadata of all calls in the world. The NSA or another spy agency could record only calls that match a given pattern: place from which the call originates, who is being called, time of call, previous calls made or received by the line, when the line or phone was purchased, whether this phone's call patterns resemble another phone's call patterns, etc. They wouldn't achieve 100% coverage, but efficacy would probably be 99%+. I would guess the problem with this kind of semi-targeted collection is processing power to decide who is a target and schedule the line taps.
higherpurpose 13y ago
If it didn't, it would be even more troubling that US uses phone metadata to assign drone assassination targets, as if it wasn't troubling enough. https://firstlook.org/theintercept/article/2014/02/10/the-nsas-secret-role/ https://firstlook.org/theintercept/article/2014/02/10/the-ns...
prof_hobart 13y ago
I'm not doubting that it's entirely possible to identify a lot about people from their phone metadata. I don't think it takes a huge amount of creative thinking to establish that someone who calls a hydroponics dealer and a headshop is fairly likely to have some connection to drugs, and that tracking their phone calls would allow you to spot that. But I'm not sure that this article really adds a lot to the discussion with statements like "Owing to the sensitivity of these matters, Mayer explains that the researchers elected not to contact the three participants for confirmation that their inferences were correct" If they could have correctly identified a drug dealer from a pattern of seemingly innocuous phone calls (and actually validated that they are correct) then this could have been at least vaguely interesting. As it is, the story is "if you've phoned somewhere that deals with MS relapses, we can make a guess that you could have MS". Well thanks, Sherlock.
jcromartie 13y ago
As someone said recently "we know you have called a phone sex line 10 times in the last month, and a divorce lawyer last week, but we don't know what you talked about."
rayiner 13y ago
While this is certainly true, sentences like this one show that The Guardian doesn't understand the nature of the data/metadata distinction: "The researchers cite statements like that of President Obama, that the NSA was 'not looking at content,' and ask whether the legal distinction between metadata and content is matched by harm reduction in the real world." The distinction between data and metadata in U.S. law isn't about "metadata" being supposedly less harmful than "data." That has absolutely nothing to do with it. The distinction is based on the 4th Amendment's requirement that people have an expectation of privacy in the information in order for it to be protected. The idea is that if you have to expose certain information to a company in order for the communication to work at all, then you can't expect that information to be private. If you expose it, if you have to expose it, it's not private. The legal distinction reflects the underlying technical distinctions. You can encrypt a phone conversation, but you can't encrypt the signaling information and still have the system work. You can encrypt the contents of a packet, but you can't do the same for the IP headers. You have to expose this "metadata" in order for modern telephone and IP networks to work as they are currently designed, and it's this exposure that creates the distinction for 4th amendment purposes.
- maxerickson 13y ago
  So they just need to articulate that they see this as a problem with the way the 4th Amendment is written and interpreted? Along with much of the associated law of course. I guess a right to conduct day to day affairs without 3rd and 4th party institutional intervention is harder to reason about.
  - rayiner 13y ago
    Yes, the correct debate is about how the 4th amendment is written and interpreted. That said, there is a tactical reason why opponents of surveillance take the somewhat disingenuous approach of banging on the 4th amendment while raising issues that are not relevant to analysis under the 4th amendment. That tactical reason is that if you can make a government policy out to be a Constitutional violation, you need only convince the courts the policy is wrong, instead of convincing the public and the Congress. It's a lot easier. > I guess a right to conduct day to day affairs without 3rd and 4th party institutional intervention is harder to reason about. What I find puzzling about this sentence is that we conduct our day to day affairs in a way where 3rd parties are almost always involved, whether you're talking about AT&T, Google, etc. Most people who oppose surveillance want to set up a system where it's okay for AT&T, Google, etc, to be able to track you using metadata, but not okay for the government to do the same. That proposal might very well be a good idea, but there's simply no way to express that distinction in Constitutional terms. "Private" in the Constitution doesn't mean information is just between you, who you're talking to, and your hundred closest friends working at Google or Facebook. If people want the interpretation of the 4th amendment to change, it will be a lot easier if these services were actually private: i.e. encrypted content and obfuscated signaling so that third party service providers like AT&T and Google can't use the information for commercial purposes. Then you can make the "expectation of privacy" argument with a straight face.
deleted 13y ago
[deleted]
CurtMonash 13y ago
Just for the record -- unless somebody is also storing the contents of the calls, which the NSA strenuously claims isn't happening, it's NOT metadata. It's just data. Why? Because metadata is "data about data", so something is only metadata if there's other data for it to be data about. http://www.dbms2.com/2014/02/23/confusion-about-metadata/ http://www.dbms2.com/2014/02/23/confusion-about-metadata/
- delinka 13y ago
  Meh. The call itself, and the data about the call, traverse the telephone network. The data about the call, the metadata, is being logged and stored. Yes, by the time it gets to an NSA storage device, it's no longer "meta," but at the time the human made a call and generated the metadata, it was metadata. This is the tag we've chosen to stick on it. That the tag maybe should change doesn't really change the privacy implications, and would only serve to confuse the conversation to a populace that already doesn't seem to care.
- lucozade 13y ago
  Only if you define data as "something that the NSA has". I appreciate that they've overstepped their boundaries but this is probably taking things a bit far. The existence of metadata doesn't imply the continued existence of the original data. Just that it has existed.
- deathanatos 13y ago
  Let's be perfectly clear here: > Metadata is "data about data" Just shorten that to "Metadata is data." That's what it is, and always has been. This weird idea that it is some sort of second-class citizen of data is the problem and allows the government to hide behind "it's just metadata": it's still data, and should be treated as such. I wouldn't care if it were an empty file: it's still data, and you still need a warrant or probable cause, not a terrorist witch hunt.
Lagged2Death 13y ago
Researchers ... successfully identified a cannabis cultivator, multiple sclerosis sufferer and a visitor to an abortion clinic using nothing more than the timing and destination of their phone calls. Unfortunately, the political actors who are the biggest cheerleaders/defenders of total surveillance are also the ones most likely to be in favor of unconstitutionally severe pursuit and punishment of drug growers, in favor of ejecting sick people from the health care system (preferring that they instead die quickly and cheaply), and in favor of publicly shaming abortion patients. In other words, a result like this is particularly likely to re-enforce existing biases more than anything else. Plenty of Americans will respond to such news by suggesting such data should be used more, not collected less.
SilasX 13y ago
Well, yeah? The first thing I thought when the NSA story broke was "Just metadata? Okay Mr. President and members of Congress: how about we release a list of everyone you talked to and when? It's just metadata, right?"
- trebor 13y ago
  How about we perform a basic statistical analysis and see what locations you frequent. From that we can tell what religious, financial, and social organizations you are a member of, and can go beyond to what stores you patronize. And what routes you take to and fro. Metadata can be as harmful as recording the calls, if not moreso. Betcha they collect more than just the raw call metadata, and collect metadata on data connections. From that they can more easily determine the above, since you don't even need to be on a call for a service to connect to the 'net.
lalos 13y ago
This is a good slide that demonstrates the power of metadata. http://pbs.twimg.com/media/BeMm9qJCEAEHu9Y.jpg http://pbs.twimg.com/media/BeMm9qJCEAEHu9Y.jpg
epoxyhockey 13y ago
I think it is very naive (bordering on denial) to think the the NSA doesn't record the contents of every phone call it can get its hands on, not just meta-data.
- alecdbrooks 13y ago
  Sure, but I think it's useful to show that, even taking them at their word, metadata alone is dangerous.
wbracken 13y ago
Once again, if people are worried about NSA capturing cell phone meta-data, please, go check out what the CFPB is doing with credit card data. We are talking every transaction from millions of Americans. http://www.usnews.com/opinion/economic-intelligence/2014/02/10/why-is-the-cfpb-collecting-so-much-credit-card-data http://www.usnews.com/opinion/economic-intelligence/2014/02/...
waveman2 13y ago
Protip: the government scans and keeps the exterior of all mail that is sent. So, put the returning address on the inside of the envelope so that it is harder to work out who is sending mail to whom.

138 points by Libertatea 13y ago

Don't mean to be rude, but literally thought this was common knowledge by now. Clearly, that is my own failing for not understanding that The People != Me. I think people are starting to get it, though, especially thanks to how creepy targeted advertising is getting on Facebook and the like. And that's kind of the thing, with all of the data that Facebook had on me, they couldn't figure out to not send me advertisements for skeezy dating services? That's the only solace I take from this story: it sucks that the security services are collecting all of this data, but if I can't do anything about it, it's good to know that they are drinking from a firehose.

jcromartie 13y ago
Loads of "truthy" political bullshit that goes around on Facebook and email chain letters is regarded as fact (by the test of gut feeling) by plenty of voting adults. There are different kinds of "common knowledge" among different groups of people. What's common knowledge to a person immersed in cyberculture for decades is going to be a world apart from a sales guy.

skywhopper 13y ago

If it didn't, the NSA would not be so interested in collecting it. Paranoid people who believe they might be being listened in on are unlikely to reveal much directly in the conversation itself anyway, so in those cases the metadata is more important. Also, the metadata can reveal anomalous behavior, which they look for mainly because it's easy to find, but also because it can reveal important information assuming the targets are correctly selected. Anyway, the only reason they aren't collecting the calls themselves is because the storage required is not yet available, so their begging off about "but we aren't storing the content" is disingenuous. They can, at any moment, capture any call going over the long-distance network (which would include pretty much all cell phone calls) so the only thing they're unable to do is to retroactively listen in on calls. If you are flagged for whatever reason (you know someone who knows someone who knows someone they suspect of sending money to a bad charity), you may well be being monitored.

slashdotaccount 13y ago
The amount of storage required for storing all of the call recordings (GSM, VoIP, land-line) are currently available. For example, Speex [1] can compress voice even in 2kbps. So storing everything e.g. in 8kbps you can store 916259 hours (104 years) of voice in just one 3TB disk. [1] http://speex.org/ http://speex.org/
- Cthulhu_ 13y ago
  Let's take the US. 317 million people, assuming they call for an average of 10 minutes (based on nothing whatsoever, btw), gives approx. (10317) / 60 = 53 million hours of phone conversations a day. Given 916.259 hours = 3 TB, 53M / 916.259 = 57 3 TB = 172 TB of data /a day/. And that's just the US. Even if you adjust the average to just one minute a day, you're still looking at 17 TB / day, which should be sorta manageable I reckon. But it's not just the US. Let's assume they want to track all voice communications globally, rounding it to an even 7 billion, ten minutes a day. I'm counting 3819 TB/day. That's a lotta 3 TB hard drives. tl;dr: big data is big. disclaimer: I suck at basic arithmetic, I probably made a miscalculation.
  - slashdotaccount 13y ago
    I think they can handle it in Utah: "An article by Forbes estimates the storage capacity as between 3 and 12 exabytes in the near term" [1] [1] https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
    - arg01 13y ago
      Which gives you between 2-10 years of storage if it was recording everyone in the world. (Based on the assumptions above).
  - dictum 13y ago
    ~200TB/day is entirely within the room the NSA's budget allows. You don't need to record all phones in the world if you have the metadata of all calls in the world. The NSA or another spy agency could record only calls that match a given pattern: place from which the call originates, who is being called, time of call, previous calls made or received by the line, when the line or phone was purchased, whether this phone's call patterns resemble another phone's call patterns, etc. They wouldn't achieve 100% coverage, but efficacy would probably be 99%+. I would guess the problem with this kind of semi-targeted collection is processing power to decide who is a target and schedule the line taps.

higherpurpose 13y ago

If it didn't, it would be even more troubling that US uses phone metadata to assign drone assassination targets, as if it wasn't troubling enough. https://firstlook.org/theintercept/article/2014/02/10/the-nsas-secret-role/ https://firstlook.org/theintercept/article/2014/02/10/the-ns...

prof_hobart 13y ago

I'm not doubting that it's entirely possible to identify a lot about people from their phone metadata. I don't think it takes a huge amount of creative thinking to establish that someone who calls a hydroponics dealer and a headshop is fairly likely to have some connection to drugs, and that tracking their phone calls would allow you to spot that. But I'm not sure that this article really adds a lot to the discussion with statements like "Owing to the sensitivity of these matters, Mayer explains that the researchers elected not to contact the three participants for confirmation that their inferences were correct" If they could have correctly identified a drug dealer from a pattern of seemingly innocuous phone calls (and actually validated that they are correct) then this could have been at least vaguely interesting. As it is, the story is "if you've phoned somewhere that deals with MS relapses, we can make a guess that you could have MS". Well thanks, Sherlock.

jcromartie 13y ago

As someone said recently "we know you have called a phone sex line 10 times in the last month, and a divorce lawyer last week, but we don't know what you talked about."

rayiner 13y ago

While this is certainly true, sentences like this one show that The Guardian doesn't understand the nature of the data/metadata distinction: "The researchers cite statements like that of President Obama, that the NSA was 'not looking at content,' and ask whether the legal distinction between metadata and content is matched by harm reduction in the real world." The distinction between data and metadata in U.S. law isn't about "metadata" being supposedly less harmful than "data." That has absolutely nothing to do with it. The distinction is based on the 4th Amendment's requirement that people have an expectation of privacy in the information in order for it to be protected. The idea is that if you have to expose certain information to a company in order for the communication to work at all, then you can't expect that information to be private. If you expose it, if you have to expose it, it's not private. The legal distinction reflects the underlying technical distinctions. You can encrypt a phone conversation, but you can't encrypt the signaling information and still have the system work. You can encrypt the contents of a packet, but you can't do the same for the IP headers. You have to expose this "metadata" in order for modern telephone and IP networks to work as they are currently designed, and it's this exposure that creates the distinction for 4th amendment purposes.

maxerickson 13y ago
So they just need to articulate that they see this as a problem with the way the 4th Amendment is written and interpreted? Along with much of the associated law of course. I guess a right to conduct day to day affairs without 3rd and 4th party institutional intervention is harder to reason about.
- rayiner 13y ago
  Yes, the correct debate is about how the 4th amendment is written and interpreted. That said, there is a tactical reason why opponents of surveillance take the somewhat disingenuous approach of banging on the 4th amendment while raising issues that are not relevant to analysis under the 4th amendment. That tactical reason is that if you can make a government policy out to be a Constitutional violation, you need only convince the courts the policy is wrong, instead of convincing the public and the Congress. It's a lot easier. > I guess a right to conduct day to day affairs without 3rd and 4th party institutional intervention is harder to reason about. What I find puzzling about this sentence is that we conduct our day to day affairs in a way where 3rd parties are almost always involved, whether you're talking about AT&T, Google, etc. Most people who oppose surveillance want to set up a system where it's okay for AT&T, Google, etc, to be able to track you using metadata, but not okay for the government to do the same. That proposal might very well be a good idea, but there's simply no way to express that distinction in Constitutional terms. "Private" in the Constitution doesn't mean information is just between you, who you're talking to, and your hundred closest friends working at Google or Facebook. If people want the interpretation of the 4th amendment to change, it will be a lot easier if these services were actually private: i.e. encrypted content and obfuscated signaling so that third party service providers like AT&T and Google can't use the information for commercial purposes. Then you can make the "expectation of privacy" argument with a straight face.

deleted 13y ago

[deleted]

CurtMonash 13y ago

Just for the record -- unless somebody is also storing the contents of the calls, which the NSA strenuously claims isn't happening, it's NOT metadata. It's just data. Why? Because metadata is "data about data", so something is only metadata if there's other data for it to be data about. http://www.dbms2.com/2014/02/23/confusion-about-metadata/ http://www.dbms2.com/2014/02/23/confusion-about-metadata/

delinka 13y ago
Meh. The call itself, and the data about the call, traverse the telephone network. The data about the call, the metadata, is being logged and stored. Yes, by the time it gets to an NSA storage device, it's no longer "meta," but at the time the human made a call and generated the metadata, it was metadata. This is the tag we've chosen to stick on it. That the tag maybe should change doesn't really change the privacy implications, and would only serve to confuse the conversation to a populace that already doesn't seem to care.
lucozade 13y ago
Only if you define data as "something that the NSA has". I appreciate that they've overstepped their boundaries but this is probably taking things a bit far. The existence of metadata doesn't imply the continued existence of the original data. Just that it has existed.
deathanatos 13y ago
Let's be perfectly clear here: > Metadata is "data about data" Just shorten that to "Metadata is data." That's what it is, and always has been. This weird idea that it is some sort of second-class citizen of data is the problem and allows the government to hide behind "it's just metadata": it's still data, and should be treated as such. I wouldn't care if it were an empty file: it's still data, and you still need a warrant or probable cause, not a terrorist witch hunt.

Lagged2Death 13y ago

Researchers ... successfully identified a cannabis cultivator, multiple sclerosis sufferer and a visitor to an abortion clinic using nothing more than the timing and destination of their phone calls. Unfortunately, the political actors who are the biggest cheerleaders/defenders of total surveillance are also the ones most likely to be in favor of unconstitutionally severe pursuit and punishment of drug growers, in favor of ejecting sick people from the health care system (preferring that they instead die quickly and cheaply), and in favor of publicly shaming abortion patients. In other words, a result like this is particularly likely to re-enforce existing biases more than anything else. Plenty of Americans will respond to such news by suggesting such data should be used more, not collected less.

SilasX 13y ago

Well, yeah? The first thing I thought when the NSA story broke was "Just metadata? Okay Mr. President and members of Congress: how about we release a list of everyone you talked to and when? It's just metadata, right?"

trebor 13y ago
How about we perform a basic statistical analysis and see what locations you frequent. From that we can tell what religious, financial, and social organizations you are a member of, and can go beyond to what stores you patronize. And what routes you take to and fro. Metadata can be as harmful as recording the calls, if not moreso. Betcha they collect more than just the raw call metadata, and collect metadata on data connections. From that they can more easily determine the above, since you don't even need to be on a call for a service to connect to the 'net.

lalos 13y ago

This is a good slide that demonstrates the power of metadata. http://pbs.twimg.com/media/BeMm9qJCEAEHu9Y.jpg http://pbs.twimg.com/media/BeMm9qJCEAEHu9Y.jpg

epoxyhockey 13y ago

I think it is very naive (bordering on denial) to think the the NSA doesn't record the contents of every phone call it can get its hands on, not just meta-data.

alecdbrooks 13y ago
Sure, but I think it's useful to show that, even taking them at their word, metadata alone is dangerous.

wbracken 13y ago

Once again, if people are worried about NSA capturing cell phone meta-data, please, go check out what the CFPB is doing with credit card data. We are talking every transaction from millions of Americans. http://www.usnews.com/opinion/economic-intelligence/2014/02/10/why-is-the-cfpb-collecting-so-much-credit-card-data http://www.usnews.com/opinion/economic-intelligence/2014/02/...

waveman2 13y ago

Protip: the government scans and keeps the exterior of all mail that is sent. So, put the returning address on the inside of the envelope so that it is harder to work out who is sending mail to whom.