Evaluating the privacy properties of telephone metadata

Abstract

Since 2013, a stream of disclosures has prompted reconsideration of surveillance law and policy. One of the most controversial principles, both in the United States and abroad, is that communications metadata receives substantially less protection than communications content. Several nations currently collect telephone metadata in bulk, including on their own citizens. In this paper, we attempt to shed light on the privacy properties of telephone metadata. Using a crowdsourcing methodology, we demonstrate that telephone metadata is densely interconnected, can trivially be reidentified, and can be used to draw sensitive inferences.C ommunications privacy law, in the United States and many other nations, draws a distinction between "content" and "metadata" (1). The former category reflects the substance of an electronic communication; the latter includes all other information about the communication, such as parties, time, and duration (2).* When a government agency compels disclosure of content, the agency must usually comply with extensive substantive and procedural safeguards. Demands for metadata, by contrast, are often left to the near-total discretion of authorities. In the United States, for instance, a law enforcement officer can request telephone calling records with merely a subpoena-essentially a formal letter from the investigating agency (3). An intelligence program by the National Security Agency (NSA) has drawn particular criticism; under the business records provision of the USA PATRIOT Act (4), the agency acquired a substantial share of all domestic telephone metadata (5). † In this paper, we empirically investigate factual assumptions that undergird policies of differential treatment for content and metadata. Using crowdsourced telephone logs and social networking information, we find that telephone metadata is densely interconnected, susceptible to reidentification, and enables highly sensitive inferences. ‡ The balance of the paper is organized into three parts. First, we discuss our data collection methodology and properties of our participant population. We next present our results. Finally, we discuss implications for policy and future quantitative social science research. Additional methodological detail and figures are available in the Supporting Information. MethodsWe collected the data in this study through an Android smartphone application ( Fig. 1). § Potential participants could discover the project through academic websites, the Google Play store, and references in media coverage. The application automatically retrieved historical call and text message [Short Message Service (SMS)] metadata from device logs. { In addition, the application retrieved information from a participant's Facebook account, to be used as ground truth for potential inferences. # Participants were provided an opportunity to view individualized features of their phone metadata, and then they were invited to uninstall the application. In total, 823 participants volunteered their metadata, which included 251,7...

Transactional information is remarkably revelatory

“…Here I take exception to one statement in the excellent paper by Mayer et al (2). The authors state, "[O]ur results strongly suggest that until 2013, analysts had legal authority to access telephone records for the majority of the entire US population" (2).…”

“…This, then, is the underlying context for the PNAS paper by Mayer et al (2). Communications transactional information was long believed to be personally revelatory, but proof was lacking.…”

“…They are not looking at people's names, and they're not looking at content. (1) Revealing What You Do However, as "Privacy properties of telephone metadata" by Mayer et al (2) demonstrates, communications metadata provides much more private information than the President's statement indicated. Traffic analysis, studying who talks to whom and when, has long been the backbone of signals intelligence.…”

“…Protecting users' privacy should be paramount in studies such as the one by Mayer et al (2). The authors carefully informed their volunteer participants of information being collected, enabling participants to remove data even after collection.…”

On the Anonymity Risk of Time-Varying User Profiles

“…Messaging services, or application able to access messages, or phone metadata, are able to predict conversations patterns, and eventually users' relationships. An example is the study of telephone metadata to infer whether a user is or is not in a relationship based on their mutual call frequencies [24]. A user's social graph and community network structures can therefore also be derived by studying communications patterns.…”