Estimated read time: 3-4 minutes
This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.
UTAH COUNTY — A new study shows government agencies and others can effectively use “data about data” to learn more about people, and a Utah-based computer forensics expert warns of the risks.
The study from Stanford graduate students Jonathan Mayer and Patrick Mutchler found phone metadata is “unambiguously sensitive” and able to detect things like medical conditions, gun ownership and even religious beliefs.
Study authors used the “MetaPhone” app on the android phones of 546 participants. When it came to religion, the researchers were able to correctly identify 73 percent of those with a well-defined religious status on Facebook, simply by which religious institutions they called the most.
In one individual case, the study authors were able to correctly infer that a participant had a heart condition based on logged phone conversations with cardiologists at a major medical center, a conversation with a medical laboratory, received calls from a pharmacy, and sent calls to a reporting hotline for a medical device related to the monitoring of cardiac arrhythmias.
At Decipher Forensics in Orem, company co-founder Trent Leavitt — also a former FBI contractor — was not surprised about the capability that is available to government entities like the National Security Agency.
“You have a major government organization with an open wallet and they hire the best-of-the-best people,” Leavitt said. “If you’re using electronics — my opinion — you’re not going to get away from it.”
"They can see who is standing on a street corner in New York City at any given time." –Trent Leavitt, former FBI contractor
“In the business that I work in, everything we do relies on metadata,” he said. “If the metadata doesn’t exist, we wouldn’t have a job. Being able to find out information about people from, say, a cell phone call or a picture that’s sent or an email that’s sent from a phone — that’s information for the cases we’re asked to work on, that’s what we rely on every day. And taking that a little bit deeper, it’s easy to find out where people shop, it’s easy to find out who calls who, what organizations they belong to, what they’re interested in, what they’re not interested in — those are everyday things that we can find out.”
Leavitt and his colleagues need a phone or multiple phones to make inferences about possible relationships and interests. Government agencies, Leavitt said, do not.
“They can see who is standing on a street corner in New York City at any given time,” Leavitt said.
Last month, the ACLU posted a YouTube video highlighting how police could theoretically use available technology to assess DUI risk for an individual person by tracking their GPS data.
At the time, ACLU of Utah legal director John Mejia acknowledged he didn’t know the extent the tech was being used by local police agencies, but said there were “glaring and massive” potentials for abuse.
Related Story
NY judge rules NSA phone surveillance is legal
A federal judge on Friday found that the National Security Agency's bulk collection of millions of Americans' telephone records is legal and a valuable part of the nation's arsenal to counter the threat of terrorism.“Our concern is that they use them properly and with great regard and obviously complying with people’s rights,” Mejia said in February.
Mejia and Leavitt said the risk is government agencies can use the data to track people’s activities over time to determine their patterns, habits and associations.
“That is something that should trouble anybody who is interested in privacy,” Mejia said.
Rep. Jason Chaffetz, R-Utah, and others have supported limits on the use of the data, including the prospect of requiring warrants.
Leavitt said even the practice of photographing and sending a “selfie” from a smartphone can be revealing. Information that accompanies the picture can reveal the GPS latitude and longitude of where the photo was taken, and can provide identifying information about the phone that snapped the picture.
He demonstrated what could be gleaned from a simple photo of an instant oatmeal packet snapped in North Carolina, including the GPS coordinates.
“I don’t think that the person who took this picture has any idea that they gave up the latitude and longitude and the time they took the picture of an oatmeal packet,” he remarked. “They actually don’t need to see the photo to know a lot of information about you and the person you are sending it to.”
