Why Metadata Matters

In response to the controversy around the NSA’s secret data collection, President Obama said:


James Clapper, the Director of National Intelligence, wrote in a letter:


It’s called protecting America,” said Sen. Diane Feinstein. “As you know, this is just metadata. There is no content involved. In other words, no content of a communication.”

The government’s position is mistaken or disingenuous. “Metadata” is often more revealing than “content.” The distinction usually doesn’t mean much.

I’ve been researching how metadata can reveal sensitive information. Metadata collection and analysis can do good things, like helping epidemiologists track the spread of disease or helping law enforcement catch terrorists. But the privacy implications are bigger than Obama, Clapper, and Feinstein admit. Metadata can uniquely identify you with only a few data points. The FBI used only metadata to track down former CIA Director David Petraeus’s love interest, Paula Broadwell. Metadata knows that you called an HIV clinic, your doctor, and your insurance company within the same hour.

I’ve annotated a collection of links on metadata. Click a title to jump to its annotation:

After revelations that Canada was conducting its own secret surveillance program, the Canadian government protested that it was only collecting metadata, not content. Michael Geist responds that technologies exist to mine personal information from metadata and that legal structures have fallen behind:

The problem is that surveillance technologies (including the ability to data mine massive amounts of information) have moved far beyond laws that were crafted for a much different world. The geographic or content limitations placed on surveillance activities by organizations such as CSEC may have been effective years ago when such activities were largely confined to specific locations and the computing power needed to mine metadata was not readily available. That is clearly no longer the case with geography often a distinction without a difference and the value of metadata sometimes greater than the actual content of telephone conversations. If we genuinely believe in preserving some privacy in an environment where everyone cellphone call is tracked, we must be open to significant legislative reforms and increased oversight that better reflects the realities of modern-day communications surveillance.


The Guardian explains how metadata works. The guide shows how the FBI used metadata to track down the identity of Gen. Petraeus’s paramour. It lets users select the services they use—email, mobile phones, cameras, Facebook, Twitter, search engines, and web browsers—and shows the metadata they reveal to third parties.


Roger Pilon and Richard A. Epstein argued that the NSA surveillance program is analogous to the pen registers that were at issue in Smith v. Maryland, only “on a grander scale.” They argued that the program’s harm to individual privacy is “trivial” compared to the potential harms of terrorist attacks.

Julian Sanchez responds that Smith “has long been widely condemned as mistaken and incoherent by legal scholars”—and even if we accept Smith‘s logic:

…it makes a difference when the acquisition is on a “grand scale.” In a 1983 ruling [United States v. Knotts] that found no Fourth Amendment violation in the short-term tracking of a single automobile, Justice Rehnquist acknowledged in passing that “dragnet-type law enforcement practices” involving mass tracking might require the Court “to determine whether different constitutional principles may be applicable.”

He also cites Justice Alito’s concurrence in United States v. Jones which raised concerns about the privacy implications of prolonged, fine-grained surveillance.


Ford brings up the AOL search log scandal from 2006, when AOL released massive, anonymized logs of search data, from which the public was able to identify individual users and reveal embarrassing details about their online activity. The NSA can draw similar insights from call metadata, he argues. The NSA’s program is part of a broader trend in data analysis:




In 2006, Joe Biden warned of the privacy risks of the government’s collection of call records:



The investigations following the Boston bombing showed how law enforcement mines mobile phone data and social media:



Since 2011, [DHS] has monitored public-facing social media networks, blogs and content aggregators. The monitoring has stirred up controversy among privacy advocates because of worries that DHS would be collecting personally identifiable information (PII) on social media users. The agency has stated that they’re not doing data mining for PII, but that they would use such information in exigent circumstances to rescue, say, an earthquake victims tweeting from under a pile of rubble or the victim of a terrorist attack trapped in a hotel. The National Operations Center at DHS “identifies and monitors only information needed to provide situational awareness and establish a common operating picture,” according to an April privacy impact assessment from DHS about the program.


This paper uses a Nokia dataset to show how mobile phone usage data can predict personal details of the user:

In this paper, we describe how we use the mobile phone usage of users to predict their demographic attributes. Using call log, visited GSM cells information, visited Bluetooth devices, visited Wireless LAN devices, accelerometer data, and so on, we predict the gender, age, marital status, job and number of people in household of users. The accuracy of developed classifiers for these classification problems ranges from 45-87% depending upon the particular classification problem.


Researchers analyzed Facebook data to show that a user’s pattern of “likes” can predict many personal traits:


The results were analyzed to produce correlations in more than a dozen categories, including five widely accepted personality attributes (openness, conscientiousness, extraversion, agreeableness and emotional stability). Those are the attributes analyzed on the “You Are What You Like” website. The other categories included IQ, religion, politics, sexual orientation, age, gender, race, relationship status, alcohol and drug use, tobacco use, life satisfaction, number of friends — and even whether a Facebook user’s parents had separated by the time the user was 21.


This article investigates how companies use customer data to predict personal traits—including the infamous story of Target’s algorithms learning that a woman was pregnant before she had told her family:






Robert Siegel interviews J. Kirk Wiebe, former NSA analyst, on how the NSA collects phone records and uses the aggregated metadata:

SIEGEL: This is serious? You can really infer things from big patterns of calls?

WIEBE: Absolutely. There’s a science, if you will, of intelligence called traffic analysis. It’s concerned with communications and looking for patterns in communications that can be associated with meaning that’s useful to get some insight in what someone’s intentions are.

SIEGEL: But if I understand this properly, I mean, what the NSA seems to be doing here is they’re deciding that in order to find the one dangerous needle, they must have access to the entire haystack.

WIEBE: Absolutely.

SIEGEL: And there’s no way that you could do some kind of predetermination of what part of the haystack you should be looking at?

WIEBE: You know…

SIEGEL: You have to have access to everybody’s phone logs or else it doesn’t work.

WIEBE: That’s right.


The NSA has shifted its focus from eavesdropping to metadata analysis:

The agency’s ability to efficiently mine metadata, data about who is calling or e-mailing, has made wiretapping and eavesdropping on communications far less vital, according to data experts. That access to data from companies that Americans depend on daily raises troubling questions about privacy and civil liberties that officials in Washington, insistent on near-total secrecy, have yet to address.



Intelligence agencies increasingly rely on metadata to sift huge amounts of information. In some cases, metadata can be more revealing than the content of the message itself:

Researchers at IDC have determined that the amount of global digital information, like e-mail, Twitter posts and digital photos, has risen from about 500 billion gigabytes in 2008 to almost four trillion gigabytes this year. By 2015, they estimate, there will be eight trillion gigabytes of material to go through, much of it from fast-growing countries with young populations, like China and Indonesia.


“Metadata is the least protected form of communications information, and that is a shame,” he said. “You just have to say it’s important to an ongoing investigation.”


This article shows how companies, ressarchers, and government agencies draw insights from “deceptively innocuous” metadata:

“When you can get it all in one place and analyze the patterns, you can learn an enormous amount about the behavior of people,” said Daniel J. Weitzner, a principal research scientist at MIT’s Computer Science and Artificial Intelligence Laboratory.


In 2007, researchers at Columbia University were able to identify the senior-most company officers at the bankrupt Enron Corp. by studying individual e-mail volume and average response time in 620,000 company e-mails. The highest-ranking officers got the most e-mail and the quickest responses.



Epidemiologists are mining phone metadata to build predictive models of the spread of diseases:

When [Buckee] and her colleagues studied the data, she found that people making calls or sending text messages originating at the Kericho tower were making 16 times more trips away from the area than the regional average. What’s more, they were three times more likely to visit a region northeast of Lake Victoria that records from the health ministry identified as a malaria hot spot. The tower’s signal radius thus covered a significant waypoint for transmission of malaria, which can jump from human to human via mosquitoes. Satellite images revealed the likely culprit: a busy tea plantation that was probably full of migrant workers. The implication was clear, Buckee says. “There will be a ton of infected [people] there.”


As part of a contest to improve its recommendation algorithm, Netflix released an anonymized dataset of the ratings of 500,000 of its members. Researchers demonstrated an algorithm to de-anonymize the records:


As shown by our experiments below, it is possible to learn sensitive non-public information about a person from his or her movie viewing history. We assert that even if the vast majority of Netﬂix subscribers did not care about the privacy of their movie ratings (which is not obvious by any means), our analysis would still indicate serious privacy issues with the Netﬂix Prize dataset.


The Times editorial board responds to the NSA’s secret surveillance program:




German politician Malte Spitz sued Deutsche Telekom to turn over six months of his own cell phone data. He then gave the data to Die Zeit, which compiled a detailed interactive map of Spitz’z location and communications:

Spitz map


Researchers show that four data points about a person’s location can identify that person with 95% accuracy:


The authors of the study published an editorial in response to the NSA surveillance leak:

Many players in government characterize the NSA’s use of metadata as more or less benign. The agency gathers the phone records, detects worrisome patterns that might threaten America’s security, and only then asks for a search warrant to dig into the communications content of certain individuals.

But metadata is more powerful than most people realize. For instance, something as simple as recording Facebook “likes” and website clicks can reveal a person’s religious and political views, economic standing, sexual preference, personality, mental health, ethnicity, use of addictive substances, and more. The ability to characterize groups by these traits might tempt some in the government to cross the line from finding terrorists to targeting groups because of their political leanings.

Because of the scale and connectedness of data collection and the inability of today’s institutions to squarely face the privacy issues involved, we strongly back a new approach to data privacy that we’re working on here at MIT’s Media Lab. It puts individuals in control of their personal data, allowing them to determine who can possess their data, how it can be shared, redistributed, and disposed of.

Each citizen would have a personal data store, like an email inbox, that would let them see where data about them goes and how it is being used. The NSA could still get a court order allowing it to use a person’s metadata to track terrorists, but at least an individual could see that something is happening – rather like seeing a police cruiser patrolling the neighborhood. The big difference from now is that individuals could see which companies or government agencies were using data about them, and control these groups’ access to that data.


Sociologist Kieran Healy analyzes a dataset of 260 18th-century American colonists’ names and their group affiliations. His goal is to find “persons of interest.” His analysis of the metadata leads him to Paul Revere:


Healy creates a social network map of the colonists:


In a follow-up post, Healy talks more about his methodology and about whether this data really is “metadata.”

The dataset and R code are on GitHub. Healy also links to a paper in which the author does a deeper social network analysis of the same dataset.


This article quotes Gary Pruitt, president of the Associated Press, on the harms of aggregated metadata:


It also quotes the court in United States v. Maynard on the mosaic theory:


Finally, it looks at how the NSA uses call records:

The primary purpose of large-scale databases such as the NSA’s call records is generally said to be data-mining: rather than examining individuals, algorithms are used to find patterns of unusual activity that may mark terrorism or criminal conspiracies.

However, collection and storage of this information gives government a power it’s previously lacked: easy and retroactive surveillance.


In essence, you’re being watched; the government just doesn’t know your name while it’s doing it.


A hacker at Co.Labs experiments with spying on himself:

He pulled 20 random phone numbers from his call history and marked whether they belonged to a man or a woman. Then he used all the calls from those 20 numbers as his test samples, including the time and duration of call. Google’s Prediction API gave his model a 67 percent confidence level in predicting the gender of a caller after training with those 861 test examples. Though by scientific terms, that’s not particularly accurate, Stein “found it surprisingly good at determining a caller’s gender.”


Jane Mayer interviewed Susan Landau about the dangers of metadata, as well as its usefulness for law enforcement:







Cryptocat, an encrypted chat provider, explains why it doesn’t store metadata from its users’ conversations:

If you’ve been following the news at all for the past week, you’d have heard of the outrageous reports of Internet surveillance on behalf of the NSA. While those reports suggest that the NSA may not have complete access to content, they still allow the agency access to metadata. If we were talking about phone surveillance, for example, metadata would be the time you made calls, which numbers you called, how long your calls have lasted, and even where you placed your calls from. This circumstantial data can be collected en masse to paint very clear surveillance pictures about individuals or groups of individuals.


The EFF gives examples of meaningful phone metadata:



« Previous post: Getting a National Security Letter

Next post: How the government gets your cell phone's GPS data »