Data and Goliath (41 page)

the NSA chains together hops:
Marcy Wheeler (15 Oct 2013), “About that May 2007 FISC opinion,”
Empty Wheel
, http://www.emptywheel.net/2013/10/15/about-that-may-2007-fisc-opinion.

the same location as a target:
Marcy Wheeler (16 May 2014), “The ‘automated query’ at the telecoms will include
‘correlations,’”
Empty Wheel
, http://www.emptywheel.net/2014/05/16/the-automated-query-at-the-telecoms-will-include-correlations.
Marcy Wheeler (28 Jun 2014), “NSA’s new-and-improved call chaining process, now with
no calls required,”
Empty Wheel
, http://www.emptywheel.net/2014/06/28/nsas-new-and-improved-call-chaining-process-now-with-no-calls-required.

The NSA uses cell phone location:
The program is code-named CO-TRAVELLER. Barton Gellman and Ashkan Soltani (4 Dec
2013), “NSA tracking cellphone locations worldwide, Snowden documents show,”
Washington Post
, http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html.

The NSA tracks the locations of phones:
US National Security Administration (2012), “Summary of DNR and DNI Co-Travel analytics,”
https://www.eff.org/files/2013/12/11/20131210-wapo-cotraveler_overview.pdf.

The NSA has a program where it trawls:
Julian Sanchez (11 Oct 2013), “Other uses of the NSA call records database: Fingerprinting
burners?”
Just Security
, http://justsecurity.org/2013/10/11/nsa-call-records-database-fingerprinting-burners.

The NSA collects data on people:
Barton Gellman and Ashkan Soltani (4 Dec 2013), “NSA tracking cellphone locations
worldwide, Snowden documents show,”
Washington Post
, http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html.

phones that were used by a particular target:
The technique is basically CO-TRAVELLER. If there’s a phone that is always in the
same network as your primary phone, it’s likely to be found in your pocket. US Department
of Justice (13 Feb 2012), “Criminal complaint,”
United States of America v. Jose Aguijo, et al.
, (Case number under seal), United States District Court, Northern District of Illinois,
Eastern Division, http://www.justice.gov/usao/iln/pr/chicago/2013/pr0222_01d.pdf.

A single geofencing company:
Hiawatha Bray (30 Apr 2014), “How location-based apps will shape the future of shopping,”
Discover
, http://blogs.discovermagazine.com/crux/2014/04/30/how-location-based-apps-will-shape-the-future-of-shopping.

Microsoft does the same thing:
Lauren Johnson (9 Jun 2014), “Why Microsoft is wrapping location-based ads around
retail stores: Tests significantly lifted foot traffic,”
Advertising Week
, http://www.adweek.com/news/technology/why-microsoft-wrapping-location-based-ads-around-retail-stores-158189.

Sense Networks uses location data:
Hiawatha Bray (8 Jul 2013), “Cellphone data mined to create personal profiles,”
Boston Globe
, http://www.bostonglobe.com/business/2013/07/07/your-cellphone-yourself/eSvTK1UCqNOE7D4qbAcWPL/story.html.

Vigilant Solutions . . . collect license plate data:
Ali Winston (17 Jun 2014), “Plans to expand scope of license-plate readers alarm
privacy advocates,” Center for Investigative Reporting, http://cironline.org/reports/plans-expand-scope-license-plate-readers-alarm-privacy-advocates-6451.

the linking of identities:
This article discusses the FBI’s plans to do just that. Electronic Privacy Information
Center (Dec 2013), “The FBI’s Next Generation Identification program: Big Brother’s
ID system?”
Spotlight on Surveillance
, https://epic.org/privacy/surveillance/spotlight/ngi.html.

I have an Oyster card:
There were concerns about tracking people by their Oyster cards when the technology
was introduced in London in 2003. Aaron Scullion (25 Sep 2003), “Smart cards track
commuters,”
BBC News
, http://news.bbc.co.uk/2/hi/technology/3121652.stm.

the value of correlating different streams:
Greg Weston, Glenn Greenwald, and Ryan Gallagher (30 Jan 2014), “CSEC used airport
Wi-Fi to track Canadian travellers: Edward Snowden documents,”
CBC News
, http://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-track-canadian-travellers-edward-snowden-documents-1.2517881.

display personal information:
Alessandro Acquisti, Ralph Gross, and Fred Stutzman (4 Aug 2011), “Faces of Facebook:
Privacy in the age of augmented reality,” Black Hat 2011, Las Vegas, Nevada, http://www.heinz.cmu.edu/~acquisti/face-recognition-study-FAQ/acquisti-faces-BLACKHAT-draft.pdf.

software that correlates data:
Scott Ellart (7 Dec 1999), “System and method for converting data between data sets
(US 5999937 A),” US Patent and Trademark Office, http://www.google.com/patents/US5999937.

match your online profile:
Cotton Delo (22 Feb 2013), “Facebook to partner with Acxiom, Epsilon to match store
purchases with user profiles,”
Advertising Age
, http://adage.com/article/digital/facebook-partner-acxiom-epsilon-match-store-purchases-user-profiles/239967.

ExactData can sell lists of people:
Caroline Cooper and Claire Gordon (2 Apr 2014), “The people making money off your
drinking habits and STDs,” Al Jazeera, http://america.aljazeera.com/watch/shows/america-tonight/articles/2014/4/2/the-people-makingmoneyoffyourdrinkinghabitsandstds.html.

Chinese military hackers:
Max Fisher (19 Feb 2013), “Chinese hackers outed themselves by logging into their
personal Facebook accounts,”
Washington Post
, http://www.washingtonpost.com/blogs/worldviews/wp/2013/02/19/chinese-hackers-outed-themselves-by-logging-into-their-personal-facebook-accounts.

Hector Monsegur:
Paul Roberts (7 Mar 2012), “Chats, car crushes and cut ’n paste sowed seeds of LulzSec’s
demise,”
Threatpost
, http://threatpost.com/chats-car-crushes-and-cut-n-paste-sowed-seeds-lulzsecs-demise-030712/76298.

Paula Broadwell:
Chris Soghoian (13 Nov 2012), “Surveillance and security lessons from the Petraeus
scandal,” American Civil Liberties Union, https://www.aclu.org/blog/technology-and-liberty-national-security/surveillance-and-security-lessons-petraeus-scandal.

A member of the hacker group Anonymous:
Dan Oakes (12 Apr 2012), “Hacking case’s body of evidence,”
Sydney Morning Herald
, http://www.smh.com.au/technology/technology-news/hacking-cases-body-of-evidence-20120412-1wsbh.html.

Israeli assassins were quickly identified:
Ronen Bergman et al. (17 Jan 2011), “An eye for an eye: The anatomy of Mossad’s Dubai
operation,”
Der Spiegel
, http://www.spiegel.de/international/world/an-eye-for-an-eye-the-anatomy-of-mossad-s-dubai-operation-a-739908.html.

techniques for anonymizing data:
Paul Ohm (13 Aug 2009), “Broken promises of privacy: Responding to the surprising
failure of anonymization,”
UCLA Law Review
57, http://papers.ssrn.com/sol3/papers.cfm?abstract_id=145
000
6.

researchers were able to attach names:
Michael Barbaro and Tom Zeller Jr. (9 Aug 2006), “A face is exposed for AOL Search
No. 4417749,”
New York Times
, http://www.nytimes.com/2006/08/09/technology/09aol.html.

Researchers were able to de-anonymize people:
Arvind Narayanan and Vitaly Shmatikov (18–20 May 2008), “Robust de-anonymization
of large sparse datasets,” 2008 IEEE Symposium on Security and Privacy, Oakland, California,
http://dl.acm.org/citation.cfm?id=1398064 and http://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf.

correlation opportunities pop up:
Also for research purposes, in the mid-1990s the Massachusetts Group Insurance Commission
released hospital records from state employees with the names, addresses, and Social
Security numbers removed. Computer scientist Latanya Sweeney—then an MIT graduate
student—demonstrated that she could de-anonymize records by correlating birth dates
and ZIP codes with the voter registration database. Latanya Sweeney (Jun 1997), “Weaving
technology and policy together to maintain confidentiality,”
Journal of Law, Medicine and Ethics
25, http://onlinelibrary.wiley.com/doi/10.1111/j.1748-720X.1997.tb01885.x/abstract.

just a city, town, or municipality:
Latanya Sweeney (2
000
), “Simple demographics often identify people uniquely,” Carnegie Mellon University,
Data Privacy Working Paper 3, http://dataprivacylab.org/projects/identifiability/paper1.pdf.

Other researchers reported similar results:
Philippe Golle (30 Oct 2006), “Revisiting the uniqueness of simple demographics in
the US population,” 5th ACM Workshop on Privacy in the Electronic Society (WPES’06),
Alexandria, Virginia, http://crypto.stanford.edu/~pgolle/papers/census.pdf.

identify people from their anonymous DNA:
Melissa Gymrek et al. (18 Jan 2013), “Identifying personal genomes by surname inference,”
Science
339, http://www.sciencemag.org/content/339/6117/321.abstract. John Bohannon et al.
(18 Jan 2013), “Genealogy databases enable naming of anonymous DNA donors,”
Science
339, http://www.sciencemag.org/content/339/6117/262.

Alfred Kinsey’s sex research data:
Adam Tanner (11 Oct 2013), “Anonymous
sex survey takers get identified in data dive,”
Forbes
, http://www.forbes.com/sites/adamtanner/2013/10/11/decoding-the-secrets-of-sex-data.

It’s counterintuitive:
Arvind Narayanan and Vitaly Shmatikov (Jun 2010), “Myths and fallacies of ‘personally
identifiable information,’”
Communications of the ACM
53, http://dl.acm.org/citation.cfm?id=1743558.

We can be uniquely identified:
Ryan Gallagher (25 Aug 2014), “The surveillance engine: How the NSA built its own
secret Google,”
Intercept
, https://firstlook.org/theintercept/2014/08/25/icreach-nsa-cia-secret-google-crisscross-proton.

four time/date/location points:
Yves-Alexandre de Montjoye et al. (4 Feb 2013), “Unique in the crowd: The privacy
bounds of human mobility,”
Scientific Reports
3, Article 1376, http://www.nature.com/srep/2013/130325/srep01376/full/srep01376.html.

these sorts of tweaks:
I don’t mean to imply that it’s impossible to anonymize a data set, only that it’s
very difficult to do correctly and easy to get wrong. So many people think that replacing
sensitive data with random numbers is enough, but it’s not. Often, it doesn’t help
at all.

This is why regulation:
Here’s an example of the DHS regulations. Mary Ellen Callahan (Mar 2012), “Handbook
for safeguarding sensitive personally identifiable information,” US Department of
Homeland Security, http://www.dhs.gov/sites/default/files/publications/privacy/Guidance/handbookforsafeguardingsensitivePII_march_2012_webversion.pdf.

4: THE BUSINESS OF SURVEILLANCE

Brightest Flashlight Free:
Casey Houser (16 Oct 2013), “Use your flashlight app for trick-or-treating,”
Gazelle
, https://www.gazelle.com/thehorn/2013/10/16/use-your-flashlight-app-for-trick-or-treating.

the app collected location information:
Cecilia Kang (5 Dec 2013), “Flashlight app kept users in the dark about sharing location
data,”
Washington Post
, http://www.washingtonpost.com/business/technology/flashlight-app-kept-users-in-the-dark-about-sharing-location-data-ftc/2013/12/05/1be26fa6-5dc7-11e3-be07-006c776266ed_story.html.

researchers discovered it in 2012:
Jason Hong (30 Nov 2012), “Analysis of Brightest Flashlight Free for Android,”
Jason Hong’s Confabulations
, http://confabulator.blogspot.com/2012/11/analysis-of-brightest-flashlight-free.html.

The US Federal Trade Commission got involved:
US Federal Trade Commission (5 Dec 2013), “Android Flashlight app developer settles
FTC charges it deceived consumers: ‘Brightest Flashlight’ app shared users’ location,
device ID without consumers’ knowledge,” http://www.ftc.gov/news-events/press-releases/2013/12/android-flashlight-app-developer-settles-ftc-charges-it-deceived.

we are offered a package deal:
Sometimes surveillance is coerced. In order for me to get my warranty for a product,
I often have to give up personal information to the company that built the product.

Enterprises like DoubleClick:
Within days of searching Google for a particular vacation location, I started receiving
Travelocity ads for that location. I don’t even have a Travelocity account.

Most of the companies tracking you:
Peter Eckersley (21 Sep 2009), “How online tracking companies know most of what you
do online (and what social networks are doing to help them),” Electronic Frontier
Foundation, https://www.eff.org/deeplinks/2009/09/online-trackers-and-social-networks.

If you want to see who’s tracking you:
Samuel Gibbs (28 Oct 2013), “Mozilla’s Lightbeam Firefox tool shows who’s tracking
your online movements,”
Guardian
, http://www.theguardian.com/technology/2013/oct/28/mozilla-lightbeam-tracking-privacy-cookies.

One reporter discovered that 105:
Alexis Madrigal (29 Feb 2012), “I’m being followed: How Google—and 104 other companies—are
tracking me on the web,”
Atlantic
, http://www.theatlantic.com/technology/archive/2012/02/im-being-followed-how-google-151-and-104-other-companies-151-are-tracking-me-on-the-web/253758.