Here’s How Phone Metadata Can Reveal Your Affairs, Abortions, And Other Secrets - WaPo

[WillyT]

Here’s how phone metadata can reveal your affairs, abortions, and other secrets
By Timothy B. Lee - WaPo
Published: August 27 at 11:12 am

<snip>

The American Civil Liberties Union is challenging the National Security Agency’s dragnet surveillance of Americans’ phone calling records. On Monday, the ACLU asked the court to issue a preliminary injunction halting the program while its legality is litigated.

The program only collects metadata about Americans’ phone calls—who they call, when, and how long the calls last. In defending the program, the government has cited a controversial 1979 Supreme Court decision that held that phone records are not protected by the Fourth Amendment because consumers do not have a reasonable expectation of privacy in their calling records.

But Ed Felten, a professor of computer science at Princeton University (and, full disclosure, my former graduate school advisor) argues that this intuition is wrong. In a legal brief supporting the ACLU’s request, Felten argues that the distinction between call “contents” and “metadata” isn’t always clear. Sometimes, the mere fact that someone called a particular number reveals extremely sensitive personal information.

Certain telephone numbers are used for a single purpose, such that any contact reveals basic and often sensitive information about the caller. Examples include support hotlines for victims of domestic violence and rape, including a specific hotline for rape victims in the armed services.

Similarly, numerous hotlines exist for people considering suicide, including specific services for first responders, veterans, and gay and lesbian teenagers. Hotlines exist for suffers of various forms of addiction, such as alcohol, drugs, and gambling.

Similarly, inspectors general at practically every federal agency—including the NSA—have hotlines through which misconduct, waste, and fraud can be reported, while numerous state tax agencies have dedicated hotlines for reporting tax fraud. Hotlines have also been established to report hate crimes, arson, illegal firearms and child abuse. In all these cases, the metadata alone conveys a great deal about the content of the call, even without any further information.

And, Felten argues, metadata becomes even more revealing when it’s collected in bulk:

<snip>

More: http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/27/heres-how-phone-metadata-can-reveal-your-affairs-abortions-and-other-secrets/

[unblock]

1. even if we know what we do in public is "public", we don't want it closely tracked.

if someone peers into our cart at the supermarket, that's creepy and we tell them to buzz off.

but strictly speaking you're out in public and buying things in plain view, so anyone could track your purchases, right?

but the reality is that we don't want people doing that sort of thing without a good reason.

[bvar22]

2. Joe Biden AGREES!!!

[Manifestor_of_Light]

19. But did not Joe Biden...

call Julian Assange a "high tech terrorist"?? And imply that he should be tried by the U.S. government and executed??

Isn't this correct?

[bvar22]

21. Yeah! Thats the same guy,

...but the video was from BEFORE he was Vice-President.
His position on that issue has "evolved".

[uponit7771]

3. So can cameras looking at your car travel to those places...The article does have a point...

...on the potential of abuse

[jeff47]

4. Not really a meaningful standard.

There's a ton of information the government can learn from you by digging through your trash. Far more than phone metadata. That doesn't require a warrant either.

"You can figure stuff out" isn't the threshold for requiring a warrant. Expectation of privacy is.

You share your call history with the phone company, and you gave the phone company permission to sell that history to third parties (gotta read all those contract terms). You should not expect the information to be private, since you already agreed to not keep it private.

[Skinner]

6. The comparison of phone metadata with "digging through your trash" is absurd.

Unlike the phone call metadata dragnet, the government does not -- and probably could not ever -- have the ability to automatically log the contents of the trash cans of EVERY AMERICAN. Because digging though trash requires actual time and effort by human beings (a limited resource) we can be relatively confident that the government is only going to make the effort to dig through someone's trash if they think it is worth their time to do so. In other words: They're not going to just dig through trash at random hoping to get a hit.

In addition, there is an expectation of privacy when you make a phone call. Yes, I understand that I am sharing my call history with the phone company -- but that's because it's the phone company and I'm making a telephone call. When I use their service, I do so with the understanding that the phone company has a compelling business interest in protecting my privacy -- if they make my history of phone calls public, then they risk losing me as a customer. So my reasonable expectation of privacy is that the phone company is going to have my record of phone calls (because it would be impossible for them not to have it), but that the phone company is going to be reluctant to share my history of phone calls. Not because I believe the phone company is making a moral judgment to protect my privacy, but rather because the phone company exists to make a profit and they don't want to lose my business. I have not read the fine print in my phone contract, but I am going to hazard a guess (based on my reasonable expectations of phone company business behavior) that it gives the phone company the right to share my name and address with other companies who pay for it, but I doubt that it gives the phone company to hand over my complete list of phone calls to whomever wants it -- especially if the third party gives the phone company NOTHING in return. So, when the government forces the phone company to hand over the phone records of every customer, without any suspicion of wrongdoing, they have gone beyond my reasonable expectation of privacy -- and beyond any reasonable expectation of privacy. Phone companies are rational economic actors and they don't just give stuff away for free, at great risk to their own business.

[jeff47]

8. The example is not about scale. It's about expectations.

In addition, there is an expectation of privacy when you make a phone call. Yes, I understand that I am sharing my call history with the phone company -- but that's because it's the phone company and I'm making a telephone call. When I use their service, I do so with the understanding that the phone company has a compelling business interest in protecting my privacy

Except that the phone companies are already selling your metadata to third parties.

Kinda means there isn't a compelling business interest in protecting your privacy when they're already violating it for cash.

but I doubt that it gives the phone company to hand over my complete list of phone calls to whomever wants it -- especially if the third party gives the phone company NOTHING in return.

Except they are getting cash in return.

So, when the government forces the phone company to hand over the phone records of every customer, without any suspicion of wrongdoing, they have gone beyond my reasonable expectation of privacy

The point of the trash example is not because it would be practical to go through everyone's trash. The point is it is something where many people believe they have privacy. That doesn't mean they actually do have privacy.

Thanks to the 1979 SCOTUS decision, phone metadata falls into the same area as trash. A lot of people think it's private, but the law does not agree. That SCOTUS decision turned your metadata into the phone company's run-of-the-mill business records and stripped privacy protections.

The scale of the metadata collection does not change that SCOTUS decision. Just like hiring 10 million "trash inspectors" would not suddenly turn trash private.

Shouting "4th amendment violation" is both wrong and counterproductive. It's wrong because it is not a 4th amendment violation. And it's counterproductive because if it were true, no legislation would be required to make it private. We need to be pushing for new legislation, not erroneously claim existing law was broken.

[Skinner]

10. Yes, a phone company might share my data in exchange for cash.

But that is different from sharing my data and getting nothingin return. That is my point. It is a reasonable expectation for me to believe that the phone company will not share my private information in exchange for nothing. It is a reasonable expectation for me to believe that the phone company has a compelling business interest to use discretion when deciding how to share my private information. When a phone company shares my personal information, they incur a business risk (potential loss of my business) -- therefore they will only share my private information when they receive a benefit that outweighs that risk (eg: cash). The fact that I have chosen to give my phone information to the phone company does not automatically imply that I expect them to share it.

The fact that SCOTUS says my trash isn't private does not necessarily translate to phone metadata. It is about scale, but it's also about how the item is handled.

Imagine if we made a phone call in the same way we handle trash. If I wanted to make a phone call, I would write it down on a slip of paper and then place it on the curb out in front of my house -- maybe I put a small rock on top of it so it won't blow away. Then my "phone call" sits there for a few hours -- maybe even overnight -- completely unguarded. I might not want anyone to know who I'm calling, but I know that my "phone call" is sitting out there on the curb unprotected, and someone walking by might take a peek and see who I'm calling. Yes, I might want my phone call to remain private, but I have no reasonable expectation that it will actually remain private.

[jeff47]

15. What they get in return isn't legally relevant.

If they can share it for money, then it isn't private.

And they are definitely getting something in return for sharing it with the government. The government reimburses them phone companies for the cost of complying with the warrant. And complying with the law is rather helpful for their continued operations.

It is a reasonable expectation for me to believe that the phone company has a compelling business interest to use discretion when deciding how to share my private information.

Doesn't matter. It's boolean. It's private, or it's not private. "Share it only sometimes" doesn't make it private.

Consider what you have to do to transfer records between doctors, thanks to HIPAA - you have to sign a form each and every time you want doctors to transfer your records. That is private.

The phone company can share your metadata without asking you. That makes it not private. Even if they sometimes say "no". The fact that they can ever say "yes" means it isn't private.


Imagine if we made a phone call in the same way we handle trash.

You are trying to be far too literal. The trash example is only a situation where people erroneously think they have privacy. It is not a model of the only legal way information can be collected by the government.

And trash is not private even of you bring the can out the moment the trash truck pulls up, so it was not sitting out there for hours.

Again, if you want to make phone metadata private, you need to be pushing for new legislation that would do so. Claiming it was already private means no new legislation will be passed, and it will remain not private.

[Skinner]

17. What's legally relevant is my reasonable expectation.

I was providing an explanation for why I have a reasonable expectation that the phone company will not share my metadata. I believe they will share my name and address and my phone number, but I do not believe they are going to share a list of whom I call.

You said:

Even if they sometimes say "no". The fact that they can ever say "yes" means it isn't private.

But that does not mean the government can just take it. On at least two occasions, the federal government has contacted me -- the administrator of this website -- and asked me to hand over the IP addresses and email addresses of specific users of this website. In each of those cases, I could have said "yes" and just handed it over. I would have been within my rights to do so. but the fact that I can ever say "yes" -- to the government or to another third party that wants to buy it from me -- does not mean that I am REQUIRED to give this information to the government.

In both cases, I said "no". And guess what the government did next? They went to a court of law and got a subpoena and then came back to me with the subpoena. Once they legally compelled me to do it then I had to hand it over.

Now, I know what you're going to say: You're going to say that the FISA court gave the government the green light to collect everyone's phone call metadata -- just like a court gave the government a subpoena for my members' private information. But that is different from saying that "the fact that the phone company can ever say 'yes' means it isn't private." The phone company can say yes, but that does not mean the government is automatically free to take it.

The reason the government can take it is because the FISA court said so. My contention is that the FISA court was wrong to do so. (And I also think the FISA court itself is poorly conceived, but that's not the point of this post.) Sure, maybe the FISA court used the trash precedent to authorize mass collection of metadata from everyone, but I am not convinced that it is a particularly relevant precedent. There is certainly an argument to be made on phone metadata before SCOTUS. My best guess is that SCOTUS would split 5-4, and I honestly don't know which way Kennedy would go.

Having said all that, I agree that this problem could be solved by Congress, if there was the political will to do so.

[jeff47]

22. Yes, it does mean that.

I believe they will share my name and address and my phone number, but I do not believe they are going to share a list of whom I call.

Your beliefs do not overrule the 1979 SCOTUS decision. Nor do they overrule your subscriber agreement.

But that does not mean the government can just take it.

Yes, it does.

Privacy is boolean. It is true or it is false. If the phone company can share it without your permission, then it is not private.

I could have said "yes" and just handed it over. I would have been within my rights to do so. but the fact that I can ever say "yes" -- to the government or to another third party that wants to buy it from me -- does not mean that I am REQUIRED to give this information to the government.

Your unwillingness to cooperate does not make the information private.

But that is different from saying that "the fact that the phone company can ever say 'yes' means it isn't private." The phone company can say yes, but that does not mean the government is automatically free to take it.

Actually, it does. That's why they were able to get a court order for those IP addresses. It wasn't a search warrant (if it was, they would just seize the servers and look themselves).

That's not to say companies should just do it without a court order, but the information is still not private without a change in the law.

Continuing to argue that there's "kinda private" information isn't going to actually make phone metadata private.

[Skinner]

23. OK. It seems to me that if we are arguing what the law currently permits...

...then the FISA court's decision to allow the NSA to collect all phone metadata is, in fact, THE LAW. Because the court said it was permitted.

Is it your opinion that the FISA court decided this correctly? In both the "is" and "ought" sense? If the court said the government can go through somebody's trash can, does it necessarily follow that the government can compel the phone company to hand over the phone metadata for every American? And setting aside the question of legal precedent, do you believe that collecting phone metadata on every American is a power that the government ought to have?

[Supersedeas]

11. I follow you there...it is about expections

Just most people expect their phone calls to be private.

Even the use of public telephones, there is an expectation that the conversations on those phone are private though the actual phone and the physical use of the phone is public.

I think that you will find case law to suggest that there reasonable expectations to privacy in our use of telephones and that overcoming those expectations requires a warrant based on probable cause.

[jeff47]

14. You're trying to merge metadata and content.

They are separate. Content of a conversation (aka wiretap) requires a warrant. Metadata does not, thanks to that 1979 SCOTUS decision.

The NSA program only collects metadata, not content.

[TeamPooka]

5. K&R!

[BuelahWitch]

7. K & R

[myrna minx]

9. K&R n/t

[treestar]

12. So I've called planned parenthood

There could be a million reasons I called.

Even if I called a number that could be only for an abortion provider, it could have been for many reasons.

Affairs could hardly be outed by saying I called a number. I call a man, doesn't mean I'm having an affair with him. There are detectives who specialize in finding that our for divorce court proceedings. They don't have access to the metadata, and it would waste their time anyway.

If you're having an affair, your spouse can have you followed. A much surer way of finding out.

[Octafish]

13. The Abyss.

What Frank Church warned us about, we've fallen into it.

[Segami]

16. K&R

[randome]

18. Here is how the FBI COULD be spying on you.

Any questions?
[hr][font color="blue"][center]You should never stop having childhood dreams.[/center][/font][hr]

[JoeyT]

20. No they can't.

I shred my stuff. Not to prevent spying, but so it can be used for compost.

You can prevent them from digging through your garbage, you can't prevent them forcing every company you do business with to cough up all the information they have on you.