Your Metadata Reveals Quite a Bit

[marions ghost]

Anyone Brushing Off NSA Surveillance Because It's 'Just Metadata' Doesn't Know What Metadata Is
from the your-metadata-reveals-quite-a-bit dept

by Mike Masnick
Mon, Jul 8th 2013

http://www.techdirt.com/articles/20130708/01453123733/anyone-brushing-off-nsa-surveillance-because-its-just-metadata-doesnt-know-what-metadata-is.shtml

excerpt------------------


Just a few months ago, Nature published a study all about how much a little metadata can reveal, entitled Unique in the Crowd: The privacy bounds of human mobility by Yves-Alexandre de Montjoye, Cesar A. Hidalgo, Michel Verleysen, and Vincent D. Blondel. The basic conclusion: metadata reveals a ton, and even "coarse datasets" provide almost no anonymity:

A simply anonymized dataset does not contain name, home address, phone number or other obvious identifier. Yet, if individual's patterns are unique enough, outside information can be used to link the data back to an individual. For instance, in one study, a medical database was successfully combined with a voters list to extract the health record of the governor of Massachusetts. In another, mobile phone data have been re-identified using users' top locations. Finally, part of the Netflix challenge dataset was re-identified using outside information from The Internet Movie Database.

All together, the ubiquity of mobility datasets, the uniqueness of human traces, and the information that can be inferred from them highlight the importance of understanding the privacy bounds of human mobility. We show that the uniqueness of human mobility traces is high and that mobility datasets are likely to be re-identifiable using information only on a few outside locations. Finally, we show that one formula determines the uniqueness of mobility traces providing mathematical bounds to the privacy of mobility data. The uniqueness of traces is found to decrease according to a power function with an exponent that scales linearly with the number of known spatio-temporal points. This implies that even coarse datasets provide little anonymity.

Some of the figures they presented show how easy it is to track individuals and their locations, which can paint a pretty significant and revealing portrait of who they are and what they've done.
In an interview, one of the authors of the paper basically said that your metadata effectively creates a "fingerprint" that is unique to you and easy to match to your identity:

"We use the analogy of the fingerprint," said de Montjoye in a phone interview today. "In the 1930s, Edmond Locard, one of the first forensic science pioneers, showed that each fingerprint is unique, and you need 12 points to identify it. So here what we did is we took a large-scale database of mobility traces and basically computed the number of points so that 95 percent of people would be unique in the dataset." ........

More at link...http://www.techdirt.com/articles/20130708/01453123733/anyone-brushing-off-nsa-surveillance-because-its-just-metadata-doesnt-know-what-metadata-is.shtml

[marions ghost]

1. Another article that illustrates what can be done with metadata

--Describes Immersion--a project at MIT launched on July 4, 2013 --used to visually display personal metadata, which is not a bad thing. But it gives you some idea of how these tools can be used to paint a picture of you, and how important it is to protect the privacy of that data:

(geeky but accessible enough)

http://macroconnections.media.mit.edu/blog/immersion-a-brief-history/

--During that semester I became the first heavy user of Immersion. As I played with the tool the network that existed inside the screen started to slowly move into my brain. The act of sending an email became an explicit act of weaving. The fact that we nudge webs of people to accomplish goals becomes transparent, not implicit in our communication technologies. Immersion also started to slowly change the way I saw the world.

One thing that becomes conspicuous when you experience Immersion is that we participate in a number of clusters. So when we interact with people we are not having a dyadic experience, but interacting with a member of a well defined cluster. What also becomes clear to me is that each of these clusters had its own emotional and intellectual identity. A local zeitgeist if you may. In my case there was one particular cluster that was emotionally poisoned, not entirely, but at its core. So Immersion helped me visualize that it was time for me to reorganize my interactions and extirpate the emotional cancer. Immersion helped me understand how my network would evolve in that situation, and what were the links that I needed to strengthen to eventually reconnect the network, and heal that wound.

(More at Link)

Cesar A. Hidalgo
Somerville MA
July 6, 2013

http://vimeo.com/user12525262/adifferentperspectiveonemails

[marions ghost]

2. CNN article from yesterday

Your metadata can show snoops a whole lot. Just look at mine
By Derrick Harris July 08, 2013: 03:44 PM ET
---------------
http://money.cnn.com/news/newsfeeds/gigaom/articles/2013_07_08_your_metadata_can_show_snoops_a_whole_lot_just_look_at_mine.html

If I thought an NSA spy was sitting around in some foreboding government building, proactively trying to track my every move and figure out all my connections, I might not be sleeping so well. That’s because I know he’d be able to do it. It doesn’t take a wiretap to figure out what someone is up to when you have boatloads of metadata.

If I were involved in criminal activity, or concerned about individuals at ad platforms or web service providers snooping into my data, I’d really be losing my mind. Law enforcement agents tracking a specific individual can get all sorts of phone call, web account and transactional data without search warrants; in some cases, they can even put a GPS unit on my car for a little while.

Google, Facebook, direct-marketing firms and even grocery stores? Well, they know a whole lot about what we buy, where we go online and who we talk to. I’m confident most of this data is just used to train models and then lump me into a particular segment that computer systems can use to automatically present with ads or coupons, but a bad actor with access to my data could do some serious cyberstalking.

As you can see from just my few hours of tinkering with my personal data over the weekend, metadata can paint a pretty complete picture of a person’s habits and connections.

My first test was with my cellular phone calls and text messages, which I was able to download from my carrier. Phone numbers have been redacted to protect the innocent (or guilty …), but here’s how easy it is with even a simple tool like Datahero to visualize who I’m calling and at what times of the day. Of course, you could easily slice and dice by duration of calls, where the call was coming from/going to, or any other data points my carrier provides.

And just imagine what you could do with sophisticated indexing and graph analysis tools like what the NSA has — analyzing not just who I call, but how they’re all related and who else they know....(more at link) RE phone, text, email, FB, Twitter, LinkedIn

------------snip

The thing to remember about all this is that I got was able to analyze and visualize all this metadata (and some actual communication data, in the case of Twitter) using publicly available services, what limited data my service providers actually provide consumers and my own limited data-analysis skills. It’s hard to say what’s inside the guts of an intelligence database like those operated by the NSA, CIA and FBI, but I’ll assume it’s a lot more data about me (and anyone else) if the agencies were so inclined as to collect it. Combined with powerful graph algorithms and rich indexes, they could analyze connections and and track down individual people or communications with relative ease.

The million-dollar question then is what data agencies are collecting and how they’re choosing to use it. The NSA claims its efforts have foiled numerous terrorist plots, while the Boston bombers didn’t set off flags with the FBI even after a tip from the Kremlin. The CIA, well, as its CIO Ira “Gus” Hunt told us at Structure: Data in March, it wants to get at all your metadata — including your pedometer.

[marions ghost]

3. From The Guardian

http://www.guardian.co.uk/technology/2013/jul/07/nsa-gchq-metadata-reassurances

Over the past two weeks, I have lost count of the number of officials and government ministers who, when challenged about internet surveillance by GCHQ and the NSA, try to reassure their citizens by saying that the spooks are "only" collecting metadata, not "content". Only two conclusions are possible from this: either the relevant spokespersons are unbelievably dumb or they are displaying a breathtaking contempt for their citizenry.

In a way, it doesn't matter which conclusion one draws. The fact is that, as I argued two weeks ago, the metadata is what the spooks want for the simple reason that it's machine-readable and therefore searchable. It's what makes comprehensive internet-scale surveillance possible.

Why hasn't there been greater public outrage about the cynicism of the "just metadata" mantra?

One explanation is that most people imagine that metadata isn't really very revealing and so they're not unduly bothered by what NSA and its overseas franchises are doing. If that is indeed what they believe, then my humble suggestion is that they think again.

--------------snip---He references the MIT project

How have we stumbled into this Orwellian nightmare? One reason is the naivete/ignorance of legislators who swallowed the spooks' line that metadata-hoovering was just an updating of older powers to access logs of (analogue) telephone calls. Another is that our political masters didn't appreciate the capability of digital computing and communications technology. A third is that democratic governments everywhere were so spooked by 9/11 that they were easy meat for bureaucratic empire-builders in the security establishment.

But the most important reason is that all this was set up in secret with inadequate legislative oversight that was further emasculated by lying and deception on the part of spooks and their bosses. And, as any farmer knows, strange things grow in the dark.

[NineNightsHanging]

4. but IT ISNT JUST METADATA

The National Security Agency has acknowledged in a new classified briefing that it does not need court authorization to listen to domestic phone calls, a participant in the briefing said.

Rep. Jerrold Nadler, a New York Democrat, disclosed on Thursday that during a secret briefing to members of Congress, he was told that the contents of a phone call could be accessed "simply based on an analyst deciding that."

If the NSA wants "to listen to the phone," an analyst's decision is sufficient, without any other legal authorization required, Nadler said he learned. "I was rather startled," said Nadler, an attorney and congressman who serves on the House Judiciary committee.

http://news.cnet.com/8301-13578_3-57589495-38/nsa-spying-flap-extends-to-contents-of-u.s-phone-calls/

[marions ghost]

5. No, of course it's not just metadata

but there are still plenty of people who don't really even understand the dangers of mass metadata collection. They think that metadata collection is OK.

I thought since there were some articles relevant to the MIT launch of "Immersion" --the analyzing, linking and mapping tool--that just came out on July 4, that would be relevant to the whole concept of metadata. The fact that the developers at MIT have made Immersion accessible and even that they have revealed it, should be commended. It gives people a very good look at how easy it is to use metadata to provide specifics about a person and they even describe it as a unique fingerprint.

The propaganda that metadata is nothing to worry about is still being spread all over the place. For people who are not geeks (like me), it may take some time to understand how it works and to convince people that metadata is even more valuable for spying than actual phone call messages (which yes, we now know they have access to as well, without warrant).

Thanks for your input. I hope people who are techy will continue to post when new articles and opinions come along that are accessible to us "users" who want to know what's going on in a general sense. To pretend that we should leave this to experts is dangerous. That's what has gotten the congress and even some of the agency admins in a bad position. They didn't ask enough questions and they were satisfied with stock answers or too much geekspeak that can be used all too convincingly to hide the reality.

Nadler . My hope lies with these Dems who are NOT supporting secret surveillance. And also with citizen organizations that are directly concerned with privacy issues. I will not support any Dem who does not take a clear stand on this. This whole issue is a real eye-opener. Shows exactly who is really on our side, and who is not. I think we are in a watershed moment at least as earth-shattering as the Civil War in US history. We are in a cold civil war and this is one of the major fronts. What happens here will affect generations to come.

[DCBob]

6. Which is the whole point in why NSA collects it..

duh.

[marions ghost]

7. Yep

--and why they are going to resist any attempts to curtail access to it. And their rabid catapulting of the propaganda --that it is non-specific and there's "nothing to see here" --tells you just HOW valuable they think it is.

We have the picture, but a whole lot of people still do not understand the value of metadata.

[xchrom]

8. du rec.

[Brickbat]

9. Employers and retailers use it too. Big Data is the next big thing and businesses are scrambling to

get on it.

[marions ghost]

10. Sure

they wanted to go on quietly lapping it all up. Now the NSA has blown their cover. If you look at business schools, this kind of data mining is being touted as a great tool, and there is very little discussion of the ethics of it. As we know the Pirate Sector is ruthless and they want it all. The Pirate Sector joined with the Bushite Surveillance apparatus is seriously NOT on the side of the people. It's all about control of internet data and of course the high value that it has.