Phone Metadata Proves a Powerful Tool for NSA, Police
Phones Leave a Telltale Trail
By EVAN PEREZ and SIOBHAN GORMAN
The April robbery at the Cartier store in Chevy Chase, Md., was brazen and quick. After grabbing 13 watches valued at $131,000, the suspects fled in a waiting car and melted into traffic. It was one of more than a dozen similar capers that had stumped police and the Federal Bureau of Investigation.But, in recent weeks, the FBI was able to arrest two men. Cellphone records from Deutsche Telekom AG's T-Mobile USA and Sprint Nextel Corp. placed the suspects near the Cartier store at the time of the robbery, as well as near other heists, the FBI alleged in court filings. The T-Mobile records also allegedly showed the phone moving along the same path traveled by the suspects as police chased them.
This kind of information is at the center of the debate unleashed after a contractor leaked the details of the National Security Agency's phone-data collection program. The NSA program wasn't used in the ongoing robbery investigation, but the concept is the same. The so-called metadata represents one element of the voluminous digital trail left by most Americans in their daily lives. Each individual crumb might seem insignificant, but combined and analyzed, this data gives police and spies alike one of the most powerful investigative tools ever devised.
The data doesn't include the speech in a phone call or words in an email, but includes almost everything else, including the model of the phone and the "to" and "from" lines in emails. By tracing metadata, investigators can pinpoint a suspect's location to specific floors of buildings. They can electronically map a person's contacts, and their contacts' contacts.
The typical smartphone user can give off a total of nearly 100 pieces of highly technical data through calls, texts and other activities, according to research by Tracy Ann Kosa, a digital-privacy expert at the University of Ontario. This information includes the time that phones make contact with cellphone towers, the direction of the tower with respect to the phone and the signal strength at the time.
Ms. Kosa said much of the data is "insignificant on its own." But "every little piece counts," she said. "Think of it like footsteps—or calories."
One of the most dramatic examples of how metadata can be used came in the criminal investigation that separately uncovered retired Gen. David Petraeus's extramarital affair and ended his tenure as Central Intelligence Agency director.
An FBI investigation into a stalking complaint led agents to obtain location data from email addresses used to send the alleged threats, according to U.S. law-enforcement officials. FBI agents discovered the sender had used computers at a several hotels. Agents asked the hotels to provide lists of guests who'd used business centers around that time. That led them to Paula Broadwell, Mr. Petraeus's biographer. The data was used as probable cause to obtain a court order to monitor Ms. Broadwell's email accounts. Agents soon realized from her emails that the two were having an affair.
The woman who received the allegedly harassing emails, Tampa socialite Jill Kelley, said in a lawsuit filed later against the FBI that the bureau's investigation took off after agents took a single IP address from an email sent to her last June. The FBI said it closed the stalking investigation without filing any charges.
A U.S. law-enforcement official said the Petraeus case should not lead to privacy worries. The official said law enforcement is required to have a specific investigative purpose to collect and look at metadata.
Intelligence and law-enforcement agencies have been using metadata in their investigations for decades. Central Intelligence Agency officers routinely rifle through so-called pocket litter found on captured terrorist suspects and give information such as phone numbers to the NSA.
A cat-and-mouse game has evolved, with terror suspects frequently swapping SIM cards, or phone identification cards, to confuse intelligence agencies, former officials said. The U.S. has countered by devising how to monitor the phone and the SIM card separately.
"You keep pulling the thread. It's critical stuff," one former senior intelligence official said. "In every major terrorist operation or capture operation, metadata has played a huge role."
Some of the most important metadata, cellphone location information, varies depending on the area covered by a cell tower. In rural areas, one tower may serve wide swaths of territory, but in urban areas, towers are more targeted.
The number of cellular base stations that serve a single floor of an office building equaled or surpassed the number of standard cell towers in 2010 and continues to grow, University of Pennsylvania engineering professor Matt Blaze told Congress last year.
The increase in metadata has transformed the way intelligence agencies conduct investigations with domestic data. Traditionally, investigators had to meet various legal standards to collect any data, such as connecting the data they wanted to seize with a specific suspect.
Under the NSA phone program, the government collects domestic phone metadata without a specific investigative lead. Trained analysts only search the database in conjunction with a terrorism investigation, authorities say.
Intelligence agencies "basically reimpose at the level of analysis the standards you might ideally have for collection," said Timothy Edgar, a former top national-security privacy lawyer in the Bush and Obama administrations.
Mr. Edgar said the increasingly specific location data raises concerns about potential violations of Fourth Amendment protections against unreasonable searches and seizures. Once a person can be located within a building, the monitoring more closely resembles a search that would traditionally require a warrant.
The NSA program is accompanied by privacy restrictions, Obama administration officials say. To search the database, the government must have "reasonable suspicion" that the basis for the query is "associated with a foreign terrorist organization," they say. Search warrants approved by the secret Foreign Intelligence Surveillance Court are required before the contents of the calls may be monitored.
Some useful metadata isn't retained very long by phone companies, according to people familiar with the evidence-gathering. That could explain why in court orders phone companies have been instructed to turn over information daily.
The program's supporters note the Supreme Court has ruled the public has no reasonable expectation of privacy for information it turns over to a third party, such as a phone company. That 1979 ruling, however, predated cellphones. Moreover, cellphone technology has changed dramatically since the inception of the NSA data program in the early 2000s.
"On one hand, this could equip the government to electronically follow you around in public," said Jeremy Bash, until recently Pentagon chief of staff. "But even if they were to physically follow you around, you would not need a warrant for that," he said.
Mr. Bash added it is nonetheless "a fair question" whether metadata should trigger heightened Fourth Amendment scrutiny, because communications technology has changed so much.
"It's possible that 'dataveillance' could come under higher judicial scrutiny," he said, using a new term of art that means the ability to surveil people through their data trail.
—Devlin Barrett and Jennifer Valentino-DeVries contributed to this article. Write to Evan Perez at evan.perez@wsj.com and Siobhan Gorman at siobhan.gorman@wsj.com
沒有留言:
張貼留言