18 Mar How great is thy bounty, metadata?

When documents released by Edward Snowden revealed that the US National Security Agency (NSA) routinely hovers hoovers up metadata on telephone calls made and received in that country, officials first lied about the practice, then defended it on grounds the information obtained was trivial.

President Obama insisted the gathering of metadata amounted only to “modest encroachments on privacy” and “a circumscribed, narrow system directed at us being able to protect our people.” He emphasized that NSA was “not looking at content.”

A new, crowdsourced study shows that telephone metadata—information that includes the date, time, and length of phone calls, and the numbers called, but not the conversations themselves—can reveal information most of us would regard as intrusively personal.

Researchers at Stanford University analyzed a few months of telephone records from just 546 volunteers to see just how much they could glean from metadata. With at least a modest degree of confidence, they were able to infer that one participant had been newly diagnosed with Multiple Sclerosis, a second had a heart arrhythmia, a third had purchased an AR semi-automatic weapon, a fourth was considering growing pot, and a fifth had had an abortion.

Participant A communicated with multiple local neurology groups, a specialty pharmacy, a rare condition management service, and a hotline for a pharmaceutical used solely to treat relapsing multiple sclerosis.

Participant B spoke at length with cardiologists at a major medical center, talked briefly with a medical laboratory, received calls from a pharmacy, and placed short calls to a home reporting hotline for a medical device used to monitor cardiac arrhythmia.

Participant C made a number of calls to a firearm store that specializes in the AR semiautomatic rifle platform. They also spoke at length with customer service for a firearm manufacturer that produces an AR line.

In a span of three weeks, Participant D contacted a home improvement store, locksmiths, a hydroponics dealer, and a head shop.

Participant E had a long, early morning call with her sister. Two days later, she placed a series of calls to the local Planned Parenthood location. She placed brief additional calls two weeks later, and made a final call a month after.

“We were able to corroborate Participant B’s medical condition and Participant C’s firearm ownership using public information sources,” the researchers noted. “Owing to the sensitivity of these matters, we elected to not contact Participants A, D, or E for confirmation.”

H/T: Ars Technica