Australian Reporter Makes A Year's Worth Of His Metadata Available For Public To Rummage Through

from the brave-man dept

One of the key realizations over the last few years, especially post-Snowden, is that there is no such thing as "just metadata". Collecting metadata is not only as bad as collecting content, it is arguably worse. Whereas content must be parsed and understood -- something that is still quite hard to do well in an automated fashion -- metadata by definition is already classified and tagged. That makes it very easy to combine with other information, and in a way that scales, to reveal extremely intimate details about the person it refers to.

Techdirt has already run a couple of stories that demonstrate this. Back in 2011, the German politician Malte Spitz obtained his own phone location data, and cross-referenced it with his Twitter feeds, blog entries and other digital information to give a remarkably full picture of his daily life. More recently, Ton Siedsma went even further, allowing researchers to analyze all of the metadata generated by his phone -- with a predictably detailed picture of Siedsma emerging as a result.

Now a brave reporter from the Australian Broadcasting Corporation, Will Ockenden, has requested and made available a year's worth of his outgoing call and SMS records, and six months of his data sessions on a Web page:

All in all, this simple data request returned 13,000 individual records. There were 1,500 outgoing phone calls and SMSes but the vast majority -- 11,200 records -- were data sessions, complete with the time and date his phone connected to the mobile network and which cell tower it connected to.

In other words, by carrying a smartphone Will was in effect carrying a tracking device that logged roughly where he was every 20 minutes of every day, on average.

Government departments, police and security agencies have access to all the data Will received about himself -- and more -- without the need for a warrant.

As the article points out, this exercise has a special relevance for Australians because of a new data retention law that has been brought in this year. Like many other leaders doing the same, the Australian Prime Minister tried to soothe people's fears about this manifest intrusion into their private lives using the standard "it's just metadata" argument:

"We're talking here about metadata; we're not talking here about the content of communications," Prime Minister Tony Abbott said in February. "It's just the data that the system generates."

What's particularly valuable about this latest provision of real-life metadata is that the public can explore for themselves how much it reveals, by playing with the interactive tools provided on the site:

Over the coming days we're going to use these tools to delve deeper into Will's data and report back on what we discover.

We'll be writing about what we can infer about Will, as well as how police and other agencies might use data like this.

But we want your help. We're releasing these exploratory tools so you can tell us what you're able to find out about Will. You can also get the complete dataset to explore yourself.

This is a great way to get across to people that there is no such thing as "just metadata". Let's hope it encourages Australians to start questioning the huge data grabs of highly personal information being carried out by their government, along with its bogus assurances on privacy.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, data retention, metadata, privacy, revealed, will ockenden

Company That Lets Parents Spy On Their Kids' Computer Usage... Has Database Hacked And Leaked

from the after-denying-it-all dept

There are lots of apps out there for parents spying on their kids computer/smartphone activities -- with the marketing pitch often being about how this will help "keep them safe" or some other such thing. mSpy is one of those companies, advertising right on the front page about how its snooping software can "keep children safe and employees efficient." It leaves out the bit about making both distrustful, but that's another debate for another day. Brian Krebs recently revealed that a "huge trove of data" had been leaked from mSpy and was being shared around the darkweb. And it exposed not just customer names but "countless emails, text messages, payment and location data" of those children and employees that the company was supposedly making "safe" and "efficient."

mSpy's response? Well, first it was to deny the breach entirely, saying that it was a bogus "predatory" attack:

“There is no data of 400,000 of our customers on the web,” a spokeswoman for the company told the BBC. “We believe to have become a victim of a predatory attack, aimed to take advantage of our estimated commercial achievements.”

And, of course, a day or two later, mSpy actually admitted the truth... which was that of course it had been hacked and had the data leaked.

"Much to our regret, we must inform you that data leakage has actually taken place," spokeswoman Amelie Ross told BBC News.

"However, the scope and format of the aforesaid information is way too exaggerated."

She said that 80,000 customers had been affected. Initial reports suggested up to 400,000 customer details had been exposed.

"Naturally, we have communicated with our customers whose data could have been stolen, and described them a situation. We put in place all the necessary remedial measures and continue to work on mechanism of data encryption," she added.

We'll see. If history is any guide, the hack may be even worse. In almost every story of a big hack into corporate computer systems, the initial estimate on the number of accounts impacted is too low, and adjusted upward at a later date.

Either way, it appears that in the process of trying to make children "safe" -- the company may have ended up doing the exact opposite.

Filed Under: brian krebs, children, employees, hacked, leaked, parents, revealed, safety, spyware
Companies: mspy