IEEE Technology and Society Magazine - September 2015 - 39

KEYNOTE

Bruce Schneier

Ubiquitous
Surveillance and Security
ove r n m e n t s a nd
corporations gather,
store, and analyze
the tremendous
amount of data we
chuff out as we move through our
digitized lives. Often this is without our knowledge, and typically
without our consent. Based on this
data, they draw conclusions about
us that we might disagree with or
object to, and that can impact our
lives in profound ways. We may not
like to admit it, but we are under
mass surveillance.
Much of what we know about
the United States National Security
Agency (NSA)'s surveillance comes
from Edward Snowden, although
people both before and after him
also leaked agency secrets. As an
NSA contractor, Snowden collected
tens of thousands of documents
describing many of the NSA's surveillance activities. Then in 2013
he fled to Hong Kong and gave
them to select reporters. For a
while I worked with Glenn Greenwald and the Guardian newspaper,
helping analyze some of the more
technical documents.

The first news story to break
based on the Snowden documents described how the NSA collects the cell phone call records of
every American. One government
defense, and a sound bite repeated ever since, is that the data they
collected is "only metadata." The
intended point was that the NSA
wasn't collecting the words we said
during our phone conversations,
only the phone numbers of the two
parties, and the date, time, and
duration of the call. This seemed
to appease many people, but it
shouldn't have. Collecting metadata on people means putting them
under surveillance.
An easy thought experiment demonstrates this. Imagine that you hired
a private detective to eavesdrop on
someone. The detective would plant
bugs in that person's home, office,
and car. He would eavesdrop on that
person's phone and computer. And
you would get a report detailing that
person's conversations.
Now imagine that you asked the
detective to put that person under
surveillance. You would get a different but nevertheless comprehensive report: where he went, what
he did, who he spoke to and for
how long, who he wrote to, what

Digital Object Identifier 10.1109/MTS.2015.2461232
Date of publication: 16 September 2015

september 2015

∕

IEEE Technology and Society Magazine

he read, and what he purchased.
That's metadata.
Eavesdropping gets you the conversations; surveillance gets you
everything else.
Telephone met adat a a lone
reveals a lot about us. The timing, length, and frequency of our
conversations reveal our relationships with each other: our intimate
friends, business associates, and
everyone in-between. Phone metadata reveals what and whom we're
interested in and what's important
to us, no matter how private. It provides a window into our personalities. It provides a detailed summary
of what's happening to us at any
point in time.
One experiment from Stanford Universit y exa mined the
phone metadata of about 500 volunteers over several months [1].
The personal nature of what the
researchers could deduce from the
metadata surprised even them, and
the report is worth quoting:
■■ Participant A communicated
with multiple local neurology
groups, a specialty pharmacy, a
rare condition management service, and a hotline for a pharmaceutical used solely to treat
relapsing multiple sclerosis.

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - September 2015