Metadata Equals Surveillance

https://www.schneier.com/blog/archives/2013/09/metadata_equals.html

by antsar • 13 years ago

320 106 13 years ago

schneier.com

scrrr• 13 years ago

Somebody should start selling bumper-stickers with catchy phrases like this. I'd get one for my car.

state2• 13 years ago

How about a t-shirt?

http://teespring.com/metadataequalssurveilance

mixmastamyk• 13 years ago

I like it, but it won't resonate with my non-technical family.

optymizer• 13 years ago

I don't know about all cases, but in some cases, that's spot on. The Government doesn't need to know WHAT you discussed with Saddam Hussein, they just need to know that you were there at some time talking to Saddam to place you under the radar. In other words, 'information about information'.

devx4• 13 years ago

And that's exactly how they're picking some of their drone targets, too. If you've talked to the leader of al qaeda, it doesn't really matter what you discussed (maybe he was just quering about the neighborhood or whatever), you'll probably end up dead.

So yes, metadata is very much "content", and can be very, very dangerous in the wrong hands.

comrade_ogilvy3• 13 years ago

That is the most ominous scenario, which is likely complete fiction (so far).

Finding the high value targets requires good detective work. Blowing up acquaintances is destroying good leads. The metadata creates leads, and helps narrow them down to a more promising and manageable subset.

sh1989• 13 years ago

"Metadata in aggregate is content" - Jacob Appelbaum

bediger4000• 13 years ago

Quantity has a quality all its own. - Stalin.

jensgk• 13 years ago

Everything counts in large amounts - Depeche Mode

TomasSedovic• 13 years ago

I found Cory Doctorow's recent short screenplay on the topic quite fitting:

http://www.theguardian.com/technology/2013/jul/05/metadata-w...

(features Winston Churchill, Alan Turing and Theresa May)

ijk• 13 years ago

Part of the problem, I think, is that our concept of privacy is tightly linked with our physical embodiment. But our concept of self is no longer limited to our bodies. We conceive of our online avatars as ourselves. But our instincts about privacy haven't kept pace.

comrade_ogilvy3• 13 years ago

Right. Once upon a time, the physical control over our bodies and our personal property was an adequate definition of privacy. Yes, there were many corner cases, even two centuries ago, but it was "good enough" approximately always. Why make messy legislation over small problems? The Constitution never even tried to touch these issues.

Over time the importance of all those corner cases has expanded, and the increased rate of growth of that importance is downright dizzying in the last decade or two.

In today's world we have our old fashioned physical privacy (for the most part), and HIPAA to cover some narrow issues. That is it.

In our brave new world, we do not really own our financial transaction records. For the most part those are privately owned records in the hands of various profit-driven corporations, and some of them happen to send us a copy of a subset of those records every month.

rayiner (above) discusses this topic rather well. But I want to emphasize a different point: we can have privacy but we need to recognize we are basically starting from scratch. Trying to bemoan that the laws have been broken is counterproductive -- the spies have good lawyers and they have correctly identified gigantic legal loopholes. Even if privacy advocates win a few battles, the spies are still going to win the war, until we change the basic rules of the game with new legislation.

state2• 13 years ago

Another way to look at it is that we haven't worked hard enough to build tools that adequately help us either build a new intuition, or maintain the physical metaphors.

Perhaps more fundamentally, we haven't found business models to sustain the practice of thinking about digital tools in that way.

rayiner6• 13 years ago

Schneier sets up and knocks down a strawman:

"Back in June, when the contents of Edward Snowden's cache of NSA documents were just starting to be revealed and we learned about the NSA collecting phone metadata of every American, many people -- including President Obama -- discounted the seriousness of the NSA's actions by saying that it's just metadata."

The NSA and Obama aren't "discounting" the NSA's actions because it's "just metadata." They're defending the legality of the NSA's actions by saying that it's "just metadata."

The legally relevant distinction isn't how informative data versus metadata is, but who generated and controls the information that's the subject of surveillance. AT&T's metadata about your calls is generated by AT&T's equipment, stored on its servers, and is generally not even accessible to you. That not only puts it squarely within the domain of the third party doctrine, but makes it very hard to argue that it fits within even a common sense lay person's reading of the 4th amendment (which guarantees "right of the people to be secure in their persons, houses, papers, and effects."). Arguing that AT&T's data is your data is an uphill battle to say the least.

Now, maybe third party doctrine is obsolete in a world where people voluntarily give over to third parties every detail about their lives.[1] But it doesn't contribute to that debate for Schneier to totally mischaracterize what Obama is saying.

[1] In my opinion, privacy is obsolete in a world where people voluntarily give over to third parties every detail about their lives, but reasonable minds can differ on that point.

richardjs• 13 years ago

Good point. On the other hand, many people have hand-waved the issues by saying "it's just metadata" in the sense that Schneier is describing. While Obama and the NSA might not have dismissed it that way, many people have, and it's that view that Schneier's objecting to.

chopin• 13 years ago

For phone calls, I wouldn't call it voluntarily. In order to call someone I need to dial a number and to rely on third party infrastructure, such as I have to at least put a receiver on a snail-mail. I believe the reason why past legislature did not have an eye on that is that it was not viable to slurp up this data en-masse. Such as writing down and correlating each mails sender and receiver. This is easily automatable nowadays. I am convinced that we need to fix this unless we want to live in some dystopian future.

Amadou3• 13 years ago

"Mr. President, no one is saying you broke any laws, we're just saying it's a little bit weird you didn't have to."

–John Oliver of the Daily Show on the NSA spying scandal

tptacek• 13 years ago

It is. But when you make that observation, you should be aware that the weirdness dates back into the 1800's (at least); metadata surveillance was litigated in the dawn of the telegram era.

rayiner6• 13 years ago

Third party doctrine cuts deep. See Couch v. US, 409 U.S. 322, 335 ("there can be little expectation of privacy where records are handed to an accountant..."). For example, all the prosecuting of banks and big corps that the Daily Show cheers on depends quite heavily on investigators having access to third-party accounting and financial records. The doctrine might need to be reformed, but it's a monumental task touching many areas and longstanding practices.

ensignavenger• 13 years ago

I think there were laws broken, though. It is my understanding that the NSA was restricted to spying on foreign targets, and not supposed to be collecting data of any sort on Americans domestic phone calls. Of course, the laws a purposefully kept complex and plenty of loopholes are snuck in, so I may be missing somthing.

asgard1024• 13 years ago

In my opinion, privacy is obsolete in a world where people voluntarily give over to third parties every detail about their lives, but reasonable minds can differ on that point.

This seems wrong. People have been giving details about their lives to their doctors, lawyers and priests for centuries, relying on convention that they keep it private. Why we cannot continue with the same convention in Facebook age?

dfxm12• 13 years ago

Doctors, lawyers and priests have legal, financial & spiritual repercussions for not keeping these details private.

Giving your details to Facebook is the pre-Facebook equivalent of putting an ad in the paper with your details. You're not just giving your details to Facebook, you're giving them to everyone who has access to your page.

saraid2166• 13 years ago

Doctors, lawyers, and priests are required to turn over to the police information that's explicitly criminal. IANAL and that's not the precise criterion, but the point is that such a convention doesn't actually maintain privacy and really never has.

anigbrowl• 13 years ago

People have been giving details about their lives to their doctors, lawyers and priests for centuries, relying on convention that they keep it private.

It's not convention. Those conversations are privileged (literally 'under private law' and the notion is relatively recent in legal terms. Until 1840, for example, a lawyer in Britain was not expected to defend a client that he knew to be guilty.

a3n• 13 years ago

It's not just a 4th Amendment search issue, it's also a 1st Amendment freedom of assembly issue. "We know who you're talking to" is a chilling effect on freedom of assembly.

3825• 13 years ago

In a podcast with Steve Gibson I was watching this morning, they were talking about whether it would be OK for us to follow all children on their way from home to school (and back) and everywhere they were in public, listening to (and logging) every single thing they say because they were talking in public.

The school district’s move has raised privacy concerns, with some comparing it to government-sponsored stalking.

http://nation.time.com/2013/09/14/glendale-school-district-h...

But on the other side of things, there is targeted collection of public data, where teens trashed a home in New York and caused over $20k in damages.

"parents of the hundreds of teens who broke into and destroyed former NFLer Brian Holloway's upstate vacation home are threatening to sue him for outing their brats on Twitter — saying he's spoiling their chances of getting into college."

http://www.npr.org/blogs/thetwo-way/2013/09/20/224382580/tee...

http://nypost.com/2013/09/20/parents-want-to-sue-former-nfle...

I don't understand why vandals would post on twitter to boast publicly (in a way that can be easily linked back to their name) about their deeds. It seems to me that the school being proactive is morally wrong [TM] while someone trying to piece together who was present at the home at the time of the vandalism is right [TM].

[TM] my personal interpretation of right vs wrong. Not a legal opinion.

devx4• 13 years ago

No, Obama actually sounded like he wanted to confuse the public about what they were doing. I didn't get the impression that he was discussing the legality of it in his speeches at all, when saying "metadata".

glasz4• 13 years ago

he will do anything BUT turning against his puppet masters. you all saw what could happen - dallas, 1963.

the good thing is: since then, nothing changed. keep calm, people.

DanBC• 13 years ago

But they are also blurring the lines between legally acceptable and what is acceptable to the public.

The UK has had similar discussions over new laws being introduced - people wanting the new laws have been saying "It's just metadata; it's not the content".

RexRollman• 13 years ago

" In my opinion, privacy is obsolete in a world where people voluntarily give over to third parties every detail about their lives, but reasonable minds can differ on that point."

I disagree. Just because some people give out personal data does not mean that I should lose my rights to privacy.

00rion• 13 years ago

We also give third parties the content of our calls as well. Under the third party doctrine, it's then legal for the government to listen to the content of our calls. The reason they claim they don't collect all the content of our calls is that they know people would be up in arms. But it's perfectly legal for them to do so according to the third party doctrine.

rayiner6• 13 years ago

So I actually think Katz, which held that wiretaps were a 4th amendment violation, was wrongly decided, or at least makes no sense in the context of packet-switched VOIP. And I think that for the reason you point out: it's hard to reconcile Katz with third party doctrine, at least when AT&T has digital copies of your calls.

But ultimately this is the problem with inventing "privacy rights" out of thin air and duct-taping them to the 4th amendment, which has no such broad concept of "privacy." There's no broad principles to rely on, just case-specific hacks.

pacala• 13 years ago

[1] In my opinion, privacy is obsolete in a world where people voluntarily give over to third parties every detail about their lives, but reasonable minds can differ on that point.

The surveillance done by the big marketing firms today has nothing to do with "give over voluntarily". It is digital stalking done with very little consent from the subjects. "Give over voluntarily" means the subjects actively provides information. "Stalking" means the system monitors the activity of the subject with no active participation other than (maaaybe) clicking once "I agree to the terms" five years ago, probably on a different ToS anyway.

aspensmonster• 13 years ago

Don't you know? Your continued use of the service constitutes acceptance of any and all ToS changes with or without notification, in perpetuity.

stcredzero• 13 years ago

just metadata

Entire national strategies for surveillance in wartime were entirely based on "just" metadata. (Japan in WWII. Back then, it was called "traffic analysis.")

jhart33335• 13 years ago

You left out the part where he knocks it down with 9 different articles from various credible sources on the VERY NEXT LINE. Who is trying to deceive people here?

rayiner6• 13 years ago

Of course he can knock it down with lots of sources--that's the whole purpose of a straw man (http://en.wikipedia.org/wiki/Straw_man).

Lagged2Death2• 13 years ago

Schneier sets up and knocks down a strawman ... The NSA and Obama aren't "discounting" the NSA's actions because it's "just metadata." They're defending the legality of the NSA's actions by saying that it's "just metadata."

Well, here's what the president actually said:

When it comes to telephone calls, nobody is listening to your telephone calls. That’s not what this program’s about. As was indicated, what the intelligence community is doing is looking at phone numbers and durations of calls. They are not looking at people’s names, and they’re not looking at content. But by sifting through this so-called metadata, they may identify potential leads with respect to folks who might engage in terrorism. If these folks — if the intelligence community then actually wants to listen to a phone call, they’ve got to go back to a federal judge, just like they would in a criminal investigation. So I want to be very clear. Some of the hype that we’ve been hearing over the last day or so — nobody’s listening to the content of people’s phone calls.

http://blogs.wsj.com/washwire/2013/06/07/transcript-what-oba...

He didn't make the "it's legal because it's only metadata" argument. He did claim that the program is legal, and that it is overseen by Congress and a secret court.

Maybe it's just a matter of opinion, but I'm very comfortable characterizing this reply as "discounting because it's just metadata."

I'm unhappy about this, and I voted for the guy twice.

comrade_ogilvy3• 13 years ago

Maybe it's just a matter of opinion, but I'm very comfortable characterizing this reply as "discounting because it's just metadata."

Perhaps. But keep in the mind the context: "nobody’s listening to the content of people’s phone calls"

The president spells out a specific concern that people are saying out loud. Is it "discounting" to disprove a specific concern by accurately characterizing the activity as something other than "listening to the content of people’s phone calls"? That he so happens to use "metadata" does not make his argument wrong or misleading. What word should he use?

tripzilch• 13 years ago

Yup, it's the GP that seems to be attacking (or rather defending?) a straw man.

nitrogen5• 13 years ago

[1] In my opinion, privacy is obsolete in a world where people voluntarily give over to third parties every detail about their lives, but reasonable minds can differ on that point.

A free society can only accept the obsolescence of privacy if there's a suitable replacement that affords the same level of independence of thought and action.

r0h1n• 13 years ago

Thanks for making that subtle but important distinction, and for calling Schneier on the straw man attack.

I've been feeling a bit jaded with the Schneier posts on HN lately. Between the reposts of his columns from other newspapers (sometimes a couple of weeks later) and generic meta summary posts with a dozen links to what others are saying, I'm finding it a bit hard to pin down the really insightful Schenier pieces.

Maybe it's impossible for him to keep posting superb stuff all so often. Or maybe many of us expect each of his posts to be superb nonetheless. Or maybe both :)

antsar3• 13 years ago

I think some of his writing is brilliant, but it is impossible to consistently come up with brilliant material on a schedule. However, if he were to publish a post only when he has enough insightful, original, and quality material, his posts would probably be weeks apart. Perhaps he wants to keep his blog more active than that, and does so by linking to others' writing deemed "good enough" in lieu of his own.

Personally, I like this approach because it exposes the reader to more sources which one can then subscribe to.

rossjudson• 13 years ago

You presume that a reader of the word "discounting" in thsi context doesn't infer "legality".

The big questions here are simple.

1. If any organization holds your data, is it still your data, or have you surrendered ownership of it?

2. Is there a concept of ownership for record-oriented data, captured by a third party?

If you store a copy of a screenplay you're writing in the cloud, you haven't surrendered ownership of it. The cloud provider cannot just copy your data and hand it to someone else, who now has ownership of it.

Let's say you are generating a novel by writing short paragraphs, which are then recorded by your cloud provider as records -- time and content. The contents of the fields are created by you. Can the cloud provider simply provide a copy of that data to anyone who asks?

There's not much difference between a phone call record and my time-content example. Most (all?) fields in a call record are generated as a result of the user, who is more or less the author. And as the author of the information in those phone records, do you hold the copyright?

This isn't AT&T's data. It's my data, or your data. When press the dial button, we are creating these fields of data. It is an act of creation. We expect that AT&T will use this data to bill us (and we find that acceptable). We do not, for example, expect AT&T to sell our call records to some company, for marketing purposes. If the data is owned by AT&T, then they would be perfectly free to do that.

There's a pretty simple principle that could be followed: If the cloud provider or telecom company wouldn't grant access to the information to any member of the general public, access shouldn't be granted to law enforcement without a warrant or review of some kind. If the government can convince a judge that access is warranted, then go for it.

To do otherwise creates an environment where it's far too easy to harass or pressure "regular" people.

jarrett4• 13 years ago

maybe third party doctrine is obsolete in a world where people voluntarily give over to third parties every detail about their lives.

In these types of analyses, the doctrine of reasonable expectation of privacy is a good candidate to supersede the third party doctrine. The argument would be: I reasonably expect that the third parties whom I entrust with my private data and metadata will not disclose it except as required by the courts.

The question then is whether this expectation is reasonable. One theory holds that any time you give your information to anyone else, it's the same as giving it to everyone. You have no reasonable expectations that someone else will keep your data private.

But that theory seems outdated to me. Participation in modern society is preconditioned on trusting others with our private data. It's not optional. (The response that "you can always live in a cave instead" is neither realistic, humane, nor consistent with the values of a free society.)

Not only must you allow third parties access to your private data, you rarely have a meaningful choice about which third party, or the ability to negotiate the terms. Where I live, there is exactly one ISP. There are a number of cell phone providers, but to my knowledge, none offer a privacy guarantee, and I can't negotiate for one.

Because we have no choice but to trust third parties, it seems morally right that we should have a reasonable expectation of privacy when we do so. You can voluntarily surrender your privacy, and that's fine, but you shouldn't be forced to do so in everyday circumstances. This is a subjective judgment, but it's one I make based on what I consider widely held beliefs about the nature of a free society.

In my opinion, privacy is obsolete in a world where people voluntarily give over to third parties every detail about their lives

The relevance or obsolescence of privacy is a spectrum, not a binary choice. Right now, we have less privacy than we used to, but we are far from the point of it being wholly obsolete. Have you really thought through what that world would be like? Are you OK with the idea that your every word and action is recorded forever and potentially subject to scrutiny by everyone who will ever live? (Extreme as that sounds, it's what we mean when we say privacy is truly and wholly obsolete. Anything less that that is just partway along the spectrum. So be careful when you say something like "privacy is obsolete" without any qualification.)

Consider the stress imposed by 24-hour surveillance. Every moment of your life, you would have to dedicate part of your consciousness to calculating how your actions may be interpreted by others, some of whom may be hostile to you.

When you search for something on Google, do you want your coworkers, bosses, friends, and enemies making inferences about your thoughts? Do you want to give potentially hostile parties the opportunity to build a damaging narrative around what are in truth innocuous searches?

When you begin typing a sentence, and then revise it because the first version didn't express what you wanted it to, do you want your critics to be able to read the first version and make claims about your "secret, true intentions?"

When you have a drink with your friends in the privacy of your own home, and you make an off-color remark, do you want to be the victim of an Internet witch hunt after it gets posted to YouTube?

When a gay middle schooler visits itgetsbetter.org, do you want the bullies at their school to know about it?

When you read a political blog, do you want your boss with diametrically opposed political views to find out about it and pass you over for promotion, never telling you why?

You may think these scenarios are far-fetched. But they are all logical implications of privacy's obsolescence. As I said before, anything less extreme would be an adjustment to our current notions of privacy, not the obliteration thereof.

Now, if you're arguing for the latter (adjustment not obsolescence), that's different. It's only realistic to believe that ideas of privacy change over time. And we must think carefully about how they're changing, and whether it's for the best. But that's far, far different from surrendering to the idea that privacy is obsolete altogether.

Karunamon• 13 years ago

Consider the stress imposed by 24-hour surveillance. Every moment of your life, you would have to dedicate part of your consciousness to calculating how your actions may be interpreted by others, some of whom may be hostile to you.

That stress only need exist when the lack of privacy is asymmetrical. When everybody has dirt on everybody else, it gets a whole lot harder to shame someone.

I do find myself wondering what a completely post-privacy society would look like and how/if it would function...

alexqgb2• 13 years ago

"[1] In my opinion, privacy is obsolete in a world where people voluntarily give over to third parties every detail about their lives, but reasonable minds can differ on that point."

Speaking of straw men...ha.

While your assertion here may be true, the world you describe (in which people - as in all nearly all of them - hand over EVERY detail) is not the world we live in. Not even close. You're knocking down a figment of your own imagination. In other words? Yup, a straw man.

Meanwhile, back in reality, lots of people have plenty to hide and do their best to keep their secrets. And this isn't just criminal activity. It's also their private feelings, impolitic thoughts, confidential business plans, romantic intentions, parameters of negotiating positions, health concerns, etc. Very, very obviously, they do not share "every detail."

To the extent that indiscriminate openness can be used against people, there are always going to be people who want more of it. For these assholes, the evaporation of privacy lowers the cost of abusing others while making the abuse itself far more profitable and / or intimidating. And obviously, there are a lot of businesses and government agencies that would love to see privacy norms, laws, and technical barriers rolled waaaay back. To the degree there's been natural erosion, they've seen how profitable and efficient this erosion can be. Of course they want moar, Moar, MOAR! Power and profit depends on nothing less!

And one of their favorite ways of getting it is by insisting that privacy is already dead, that protecting its ghost is a fool's errand, so honestly, why not give up already? Just submit! Why won't you submit?

dredmorbius• 13 years ago

AT&T's metadata about your calls is generated by AT&T's equipment, stored on its servers, and is generally not even accessible to you.

Two strawmen and a falsehood.

AT&T's equipment doesn't randomly go about generating customer metadata (given that much of the information is used for billing purposes, that's fraud). Rather, it is recorded based on the actions of customers AND those contacted by, or contacting, customers. Which is to say, it's a detailed record of activities of third parties (a large number of whom are not even AT&T customers).

In the case of data which merely transits AT&T's equipment, neither party need be an AT&T customer (instead some other telcoms provider is).

And the data collected is available through privacy rights, subpoena, or other processes.

coldcode• 13 years ago

The government does not care what we think it is.

Mordor• 13 years ago

Everyone assumes metadata doesn't include the source data.

Even a compressed copy of your telephone conversation isn't the actual call, just the 'metadata' describing how it is compressed...

ck2• 13 years ago

Remember when Nixon said "when the President does it, it's legal" ?

Well we've reached the point where the government is arguing whatever it wants to do is legal.

Of course metadata is surveillance, it is pretty darn obvious it is. It is just easier to spin.

cowboy_coder• 13 years ago

How can we hide or encrypt Metadata?

oceanstone• 13 years ago

The NSA has the actual data as well. The metadata is there to serve as an index, for easy searching.

Ref: http://www.wired.com/science/discoveries/news/2006/05/70944

Metadata Equals Surveillance

Related Stories