Stanford Study: It’s Ridiculously Easy To Match Metadata to People

Stanford University researchers Jonathon Mayer and Patrick
Mutchler were skeptical when President Obama told
the nation that the NSA is just collecting metadata and thus
not violating Americans’ privacy — so they investigated how
easy it would be for someone to match metadata, which includes
information about a caller’s location, length, and number calls,
with a caller’s identity. They found it is
“trivially” simple to do, even for those with limited funds and
software.

Mayer and Mutchler, computer scientists who study technology
policy, decided to run an experiment testing the ease with which
one can connect metadata to names. For the experiment, volunteers
agree to use an Android app, MetaPhone,
that allows the researchers access to their metadata. Mayer and
Mutchler say that it was hardly any trouble figuring out who the
phone numbers belonged to — and they did it in a few
hours.

From their
blog:

So, just how easy is it to identify a phone number?

Trivial, we found. We randomly sampled 5,000 numbers from
our crowdsourced
MetaPhone dataset and queried the Yelp, Google Places, and
Facebook directories. With little marginal effort and just those
three sources—all free and public—we matched 1,356 (27.1%) of the
numbers. Specifically, there were 378 hits (7.6%) on Yelp, 684
(13.7%) on Google Places, and 618 (12.3%) on Facebook.

What about if an organization were willing to put in some
manpower? To conservatively approximate human analysis, we randomly
sampled 100 numbers from our dataset, then ran Google searches on
each. In under an hour, we were able to associate an individual or
a business with 60 of the 100 numbers. When we added in our three
initial sources, we were up to 73.

How about if money were no object? We don’t have the budget or
credentials to access a premium data aggregator, so we ran our 100
numbers with Intelius, a cheap consumer-oriented service. 74
matched. Between Intelius, Google search, and our
three initial sources, we associated a name with 91 of the 100
numbers.

The researchers conclude that, “If a few academic researchers
can get this far this quickly, it’s difficult to believe the NSA
would have any trouble identifying the overwhelming majority of
American phone numbers.”

The study confirms what numerous critics of the NSA have been
saying. A professor speaking on behalf of the ACLU, for instance,

said in an August court hearing testifying against the
program:

Although officials have insisted that the orders issued under
the telephony metadata program do not compel the production of
customers’ names, it would be trivial for the government to
correlate many telephone numbers with subscriber names using
publicly available sources. The government also has available to it
a number of legal tools to compel service providers to produce
their customer’s information, including their names.

Some government officials also aren’t buying the story that bulk
collection of
“just metadata” is harmless. In his
preliminary injunction against the program last week,
Judge Richard Leon said:

The Government maintains that the metadata the NSA collects does
not contain personal identifying information associated with each
phone number…[but] there is also nothing stopping the
Government… using public databases or any of its other vast
resources to match phone numbers with subscribers.