When does mass data collection get personal? When it comes to the contents of our communications – what we say on the phone, or in emails – most people agree that’s private information, and so does US law and the constitution. But when it comes to who we speak to, and where we were when we did it, matters get far hazier.
That clash has been highlighted by a top secret court order obtained by the Guardian, which reveals the large-scale collection by the NSA of the call records of millions of Verizon customers, daily, since April.
The court order doesn’t allow the NSA to collect any information whatsoever on the contents of phone calls, or even to obtain any names or addresses of customers.
What’s covered instead is known as “metadata”: the phone number of every caller and recipient; the unique serial number of the phones involved; the time and duration of each phone call; and potentially the location of each of the participants when the call happened.
All of this information is being collected on millions of calls every day – every conversation taking place within the US, or between the US and a foreign country is collected.
The government has long argued that this information isn’t private or personal. It is, they say, the equivalent of looking at the envelope of a letter: what’s written on the outside is simple, functional information that is essentially already public.
That forms the basis of collection: because it’s not personal information, but rather “transactional” or “business” data, there’s no need to show probable cause to collect it. Collection is also helped by the fact this information is already disclosed by callers to their carriers – because your phone number is shared with your provider, you’re not treating it as private.
But that is not a view shared by privacy advocates. Groups such as the Electronic Frontier Foundation say that by knowing who an individual speaks to, and when, and for how long, intelligence agencies can build up a detailed picture of that person, their social network, and more.
Collecting information on where people are during the calls colours in that picture even further. One recent case that highlights this tension is the recent subpoenas of the call records of Associated Press journalists, which led to clashes between the media and the White House over what was widely seen as intrusion into a free press.
The information collected on the AP was telephony metadata: precisely what the court order against Verizon shows is being collected by the NSA on millions of Americans every day.
Gary Pruitt, the president of the Associated Press, setforth how monitoring even these “envelopes” could become a serious intrusion: “These records potentially reveal communications with confidential sources across all of the newsgathering activities undertaken by the AP during a two-month period, provide a road map to AP’s newsgathering operations, and disclose information about AP’s activities and operations that the government has no conceivable right to know.”
The view on whether such “transactional” data is personal, and how intrusive it can be, is also being tested in the appellate courts, and the supreme court is likely to see more cases on the issue in the near future.
Discussing the use of GPS data collected from mobile phones, an appellate court noted that even location information on its own could reveal a person’s secrets: “A person who knows all of another’s travels can deduce whether he is a weekly churchgoer, a regular at the gym, an unfaithful husband,” it read, “and not just one such fact about a person, but all such facts.”
The primary purpose of large-scale databases such as the NSA’s call records is generally said to be data-mining: rather than examining individuals, algorithms are used to find patterns of unusual activity that may mark terrorism or criminal conspiracies.
However, collection and storage of this information gives government a power it’s previously lacked: easy surveillance. If authorities become interested in an individual at a later stage, and obtain their number, officials can look back through the data and gather their movements, social network, and more – possibly for several years.
In essence, you’re being watched; the government just doesn’t know your name while it’s doing it. Until now, such actions have been kept a tightly guarded, speculated upon, suspected, and occasionally disclosed by sources, but never proven by documents.
Now the confirmation is in the open, the American public have the opportunity to decide which definition of private information they prefer: that of the privacy advocates, or that of the NSA and White House.