"We kill people based on metadata". Why who you talk to says more than what you say
The content of a conversation can be encrypted. Who called, whom, when and from where - that remains. And from this seemingly dull information, a whole life can be read.
In April 2014, a debate on surveillance was held at Johns Hopkins University. One of the participants was General Michael Hayden - formerly head of the NSA, later director of the CIA. The discussion was about metadata, that is, information about communication rather than its content. Hayden agreed with the statement that metadata tells you absolutely everything about a person. And then he added a sentence that has been quoted ever since in every serious conversation about privacy:
"We kill people based on metadata."
It was not a figure of speech. He was talking about the American drone strike programme, in which targets were selected partly on the basis of phone call patterns: who calls whom, how often, from which places and at what times. The general immediately added that the metadata of US citizens is not used in this way. But the point had been made.
What metadata actually is
Imagine a letter in an envelope. The content is inside, sealed - that is the data. On the envelope are the sender's address, the recipient's address, a postmark with the date and place of posting, the weight of the item - that is the metadata. The postman does not need to open the envelope to know a great deal.
In the digital world the envelope is far more talkative. For a phone call it is the caller's and recipient's numbers, the time, the length of the call and the base station the phone connected through - in other words, an approximate location. For an e-mail it is the sender, the recipients, the subject, the time and the IP address. For a photo - the phone model, the date, often precise GPS coordinates. For a visit to a website - the page address, the time, the browser, the operating system and the screen resolution.
Encryption protects the content of the letter. The envelope usually stays in plain view.
The politician who asked for his own data
In 2009, Malte Spitz, a German politician from the Green Party, decided to find out what his mobile operator knew about him under the data retention rules then in force in Germany. Deutsche Telekom did not want to hand the information over. Spitz went to court and eventually received the data.
He got a file with more than 35,000 records covering six months. It did not contain a single word of his calls or messages. It did contain call times, numbers, call durations and the location of his phone. Spitz gave the data to journalists at Zeit Online, who combined it with his public posts online and created an interactive map of his life.
From the map you could read where he lived and where he worked. What time he got up and what time he went to bed. When he travelled by train and how much time he spent in Berlin versus his home region. At what hours he called whom. When he attended demonstrations and party meetings. All without listening to a single conversation.
The Stanford experiment
Critics of mass surveillance were long told that they were exaggerating, because "it is only metadata". Researchers at Stanford decided to test this. More than 800 volunteers installed an app on their phones that passed the metadata of their calls and messages to the researchers - in total more than 250,000 calls and 1.2 million text messages. The results were published in 2016 in the prestigious journal Proceedings of the National Academy of Sciences.
Numbers and times alone were enough to draw very personal conclusions. One participant regularly called a cardiologist, a pharmacy and the hotline of a company that makes cardiac arrhythmia monitoring devices - it was easy to guess what he suffered from. Another contacted a gun shop and the customer service of a rifle manufacturer - he probably owned a semi-automatic weapon. The researchers also pointed out that a few months of data are enough to accurately read the patterns of someone's life. And when you follow not only one person but also their contacts and their contacts' contacts, the circle under observation quickly grows to tens of thousands of people.
Nobody had to listen in. Counting was enough.
Why metadata is more dangerous than content
It sounds paradoxical, but for someone conducting mass surveillance, metadata can be more valuable than content. Content is chaotic, multilingual and full of things left unsaid. To understand it, you have to read it. Metadata is structured, easy to store and easy for a computer to search. It can be kept for years, cross-referenced, sorted and overlaid.
For a journalist this means something very concrete. Even if a conversation with a source was encrypted, the mere fact that the day before publication their phone connected with the phone of a ministry official may be enough to point to the informant. In many countries, this is exactly how whistleblowers have been tracked down - not through wiretaps, but through call records.
This is not limited to authoritarian states. In 2013 it emerged that the US Department of Justice, looking for the source of a leak, had secretly obtained two months of call records for more than twenty phone lines of the Associated Press news agency - including newsroom numbers and journalists' personal phones. Nobody listened to their conversations. It was enough to check who had called whom.
Europe and data retention
For years, the European Union had a directive requiring operators to store the metadata of all customers for up to two years. In April 2014, the Court of Justice of the EU struck it down, ruling that the mass collection of data on entire societies violates the right to privacy. Later rulings confirmed this.
Even so, national data retention laws survived in various forms in many member states. In Poland, operators store call data for 12 months, and according to reports by non-governmental organisations, the services and police access it more than a million times a year, often without a court order. At EU level, the idea of mandatory scanning of private correspondence keeps coming back. Each time the justification sounds similar: security. Each time it affects everyone, not just suspects.
What protection looks like in practice
The good news is that metadata can be limited too. The best tools are designed from the outset to know as little about the user as possible.
When a US court demanded data from the makers of the Signal messenger concerning two phone numbers in 2016, the company could provide only two pieces of information: when the account was created and when it last connected to the server. It had nothing else - no contact list, no information about who talked to whom. Not because it refused. Because it simply did not collect that data.
The same principle applies to other tools. Tor hides from an observer which sites you connect to, and from the site where you are connecting from. Systems without telemetry do not send the manufacturer information about which programs you use and when. Removing metadata from photos and documents before sending them means the file does not reveal where and on what device it was created. Separate phones and separate identities for different purposes make it harder to stitch them together into a single profile.
None of these solutions is complete on its own. Together they create what specialists call footprint minimisation: the aim is not to disappear, but to leave behind as little material for analysis as possible.
The envelope that says too much
When someone says "I have nothing to hide", they usually mean the content: I do not write anything illegal, I am not planning anything bad. But the envelope speaks anyway. It says who your friends are, which doctor you see, whom you meet after hours, when you were at a protest and who called you just before an important publication.
General Hayden told the truth, though probably not with that intention. Metadata is enough to make decisions about human lives. That is why it is worth making sure it says as little as possible about yours.