Metadata Equals Surveillance

–John Oliver of the Daily Show on the NSA spying scandal

This seems wrong. People have been giving details about their lives to their doctors, lawyers and priests for centuries, relying on convention that they keep it private. Why we cannot continue with the same convention in Facebook age?

The UK has had similar discussions over new laws being introduced - people wanting the new laws have been saying "It's just metadata; it's not the content".

I disagree. Just because some people give out personal data does not mean that I should lose my rights to privacy.

The surveillance done by the big marketing firms today has nothing to do with "give over voluntarily". It is digital stalking done with very little consent from the subjects. "Give over voluntarily" means the subjects actively provides information. "Stalking" means the system monitors the activity of the subject with no active participation other than (maaaybe) clicking once "I agree to the terms" five years ago, probably on a different ToS anyway.

Entire national strategies for surveillance in wartime were entirely based on "just" metadata. (Japan in WWII. Back then, it was called "traffic analysis.")

You left out the part where he knocks it down with 9 different articles from various credible sources on the VERY NEXT LINE. Who is trying to deceive people here?

Well, here's what the president actually said:

When it comes to telephone calls, nobody is listening to your telephone calls. That’s not what this program’s about. As was indicated, what the intelligence community is doing is looking at phone numbers and durations of calls. They are not looking at people’s names, and they’re not looking at content. But by sifting through this so-called metadata, they may identify potential leads with respect to folks who might engage in terrorism. If these folks — if the intelligence community then actually wants to listen to a phone call, they’ve got to go back to a federal judge, just like they would in a criminal investigation. So I want to be very clear. Some of the hype that we’ve been hearing over the last day or so — nobody’s listening to the content of people’s phone calls.

http://blogs.wsj.com/washwire/2013/06/07/transcript-what-oba...

He didn't make the "it's legal because it's only metadata" argument. He did claim that the program is legal, and that it is overseen by Congress and a secret court.

Maybe it's just a matter of opinion, but I'm very comfortable characterizing this reply as "discounting because it's just metadata."

I'm unhappy about this, and I voted for the guy twice.

A free society can only accept the obsolescence of privacy if there's a suitable replacement that affords the same level of independence of thought and action.

I've been feeling a bit jaded with the Schneier posts on HN lately. Between the reposts of his columns from other newspapers (sometimes a couple of weeks later) and generic meta summary posts with a dozen links to what others are saying, I'm finding it a bit hard to pin down the really insightful Schenier pieces.

Maybe it's impossible for him to keep posting superb stuff all so often. Or maybe many of us expect each of his posts to be superb nonetheless. Or maybe both :)

The big questions here are simple.

1. If any organization holds your data, is it still your data, or have you surrendered ownership of it?

2. Is there a concept of ownership for record-oriented data, captured by a third party?

If you store a copy of a screenplay you're writing in the cloud, you haven't surrendered ownership of it. The cloud provider cannot just copy your data and hand it to someone else, who now has ownership of it.

Let's say you are generating a novel by writing short paragraphs, which are then recorded by your cloud provider as records -- time and content. The contents of the fields are created by you. Can the cloud provider simply provide a copy of that data to anyone who asks?

There's not much difference between a phone call record and my time-content example. Most (all?) fields in a call record are generated as a result of the user, who is more or less the author. And as the author of the information in those phone records, do you hold the copyright?

This isn't AT&T's data. It's my data, or your data. When press the dial button, we are creating these fields of data. It is an act of creation. We expect that AT&T will use this data to bill us (and we find that acceptable). We do not, for example, expect AT&T to sell our call records to some company, for marketing purposes. If the data is owned by AT&T, then they would be perfectly free to do that.

There's a pretty simple principle that could be followed: If the cloud provider or telecom company wouldn't grant access to the information to any member of the general public, access shouldn't be granted to law enforcement without a warrant or review of some kind. If the government can convince a judge that access is warranted, then go for it.

To do otherwise creates an environment where it's far too easy to harass or pressure "regular" people.

In these types of analyses, the doctrine of reasonable expectation of privacy is a good candidate to supersede the third party doctrine. The argument would be: I reasonably expect that the third parties whom I entrust with my private data and metadata will not disclose it except as required by the courts.

The question then is whether this expectation is reasonable. One theory holds that any time you give your information to anyone else, it's the same as giving it to everyone. You have no reasonable expectations that someone else will keep your data private.

But that theory seems outdated to me. Participation in modern society is preconditioned on trusting others with our private data. It's not optional. (The response that "you can always live in a cave instead" is neither realistic, humane, nor consistent with the values of a free society.)

Not only must you allow third parties access to your private data, you rarely have a meaningful choice about which third party, or the ability to negotiate the terms. Where I live, there is exactly one ISP. There are a number of cell phone providers, but to my knowledge, none offer a privacy guarantee, and I can't negotiate for one.

Because we have no choice but to trust third parties, it seems morally right that we should have a reasonable expectation of privacy when we do so. You can voluntarily surrender your privacy, and that's fine, but you shouldn't be forced to do so in everyday circumstances. This is a subjective judgment, but it's one I make based on what I consider widely held beliefs about the nature of a free society.

> In my opinion, privacy is obsolete in a world where people voluntarily give over to third parties every detail about their lives

The relevance or obsolescence of privacy is a spectrum, not a binary choice. Right now, we have less privacy than we used to, but we are far from the point of it being wholly obsolete. Have you really thought through what that world would be like? Are you OK with the idea that your every word and action is recorded forever and potentially subject to scrutiny by everyone who will ever live? (Extreme as that sounds, it's what we mean when we say privacy is truly and wholly obsolete. Anything less that that is just partway along the spectrum. So be careful when you say something like "privacy is obsolete" without any qualification.)

Consider the stress imposed by 24-hour surveillance. Every moment of your life, you would have to dedicate part of your consciousness to calculating how your actions may be interpreted by others, some of whom may be hostile to you.

When you search for something on Google, do you want your coworkers, bosses, friends, and enemies making inferences about your thoughts? Do you want to give potentially hostile parties the opportunity to build a damaging narrative around what are in truth innocuous searches?

When you begin typing a sentence, and then revise it because the first version didn't express what you wanted it to, do you want your critics to be able to read the first version and make claims about your "secret, true intentions?"

When you have a drink with your friends in the privacy of your own home, and you make an off-color remark, do you want to be the victim of an Internet witch hunt after it gets posted to YouTube?

When a gay middle schooler visits itgetsbetter.org, do you want the bullies at their school to know about it?

When you read a political blog, do you want your boss with diametrically opposed political views to find out about it and pass you over for promotion, never telling you why?

You may think these scenarios are far-fetched. But they are all logical implications of privacy's obsolescence. As I said before, anything less extreme would be an adjustment to our current notions of privacy, not the obliteration thereof.

Now, if you're arguing for the latter (adjustment not obsolescence), that's different. It's only realistic to believe that ideas of privacy change over time. And we must think carefully about how they're changing, and whether it's for the best. But that's far, far different from surrendering to the idea that privacy is obsolete altogether.

Speaking of straw men...ha.

While your assertion here may be true, the world you describe (in which people - as in all nearly all of them - hand over EVERY detail) is not the world we live in. Not even close. You're knocking down a figment of your own imagination. In other words? Yup, a straw man.

Meanwhile, back in reality, lots of people have plenty to hide and do their best to keep their secrets. And this isn't just criminal activity. It's also their private feelings, impolitic thoughts, confidential business plans, romantic intentions, parameters of negotiating positions, health concerns, etc. Very, very obviously, they do not share "every detail."

To the extent that indiscriminate openness can be used against people, there are always going to be people who want more of it. For these assholes, the evaporation of privacy lowers the cost of abusing others while making the abuse itself far more profitable and / or intimidating. And obviously, there are a lot of businesses and government agencies that would love to see privacy norms, laws, and technical barriers rolled waaaay back. To the degree there's been natural erosion, they've seen how profitable and efficient this erosion can be. Of course they want moar, Moar, MOAR! Power and profit depends on nothing less!

And one of their favorite ways of getting it is by insisting that privacy is already dead, that protecting its ghost is a fool's errand, so honestly, why not give up already? Just submit! Why won't you submit?

Two strawmen and a falsehood.

AT&T's equipment doesn't randomly go about generating customer metadata (given that much of the information is used for billing purposes, that's fraud). Rather, it is recorded based on the actions of customers AND those contacted by, or contacting, customers. Which is to say, it's a detailed record of activities of third parties (a large number of whom are not even AT&T customers).

In the case of data which merely transits AT&T's equipment, neither party need be an AT&T customer (instead some other telcoms provider is).

And the data collected is available through privacy rights, subpoena, or other processes.

Over time the importance of all those corner cases has expanded, and the increased rate of growth of that importance is downright dizzying in the last decade or two.

In today's world we have our old fashioned physical privacy (for the most part), and HIPAA to cover some narrow issues. That is it.

In our brave new world, we do not really own our financial transaction records. For the most part those are privately owned records in the hands of various profit-driven corporations, and some of them happen to send us a copy of a subset of those records every month.

rayiner (above) discusses this topic rather well. But I want to emphasize a different point: we can have privacy but we need to recognize we are basically starting from scratch. Trying to bemoan that the laws have been broken is counterproductive -- the spies have good lawyers and they have correctly identified gigantic legal loopholes. Even if privacy advocates win a few battles, the spies are still going to win the war, until we change the basic rules of the game with new legislation.

Perhaps more fundamentally, we haven't found business models to sustain the practice of thinking about digital tools in that way.

So yes, metadata is very much "content", and can be very, very dangerous in the wrong hands.

http://teespring.com/metadataequalssurveilance