Phones Leave a Telltale Trail
The April robbery at
the Cartier store in Chevy Chase, Md., was brazen and quick. After
grabbing 13 watches valued at $131,000, the suspects fled in a waiting
car and melted into traffic. It was one of more than a dozen similar
capers that had stumped police and the Federal Bureau of Investigation.
But, in recent weeks, the FBI was able
to arrest two men. Cellphone records from Deutsche Telekom AG's T-Mobile
USA and Sprint Nextel Corp. placed the suspects near the Cartier store
at the time of the robbery, as well as near other heists, the FBI
alleged in court filings. The T-Mobile records also allegedly showed the
phone moving along the same path traveled by the suspects as police
chased them.
Reuters
Paula Broadwell's affair with
former CIA Director David Petraeus was uncovered last year as a result
of phone metadata in a stalking inquiry.
This
kind of information is at the center of the debate unleashed after a
contractor leaked the details of the National Security Agency's
phone-data collection program. The NSA program wasn't used in the
ongoing robbery investigation, but the concept is the same. The
so-called metadata represents one element of the voluminous digital
trail left by most Americans in their daily lives. Each individual crumb
might seem insignificant, but combined and analyzed, this data gives
police and spies alike one of the most powerful investigative tools ever
devised.
The data doesn't include the speech in a phone call or words in an
email, but includes almost everything else, including the model of the
phone and the "to" and "from" lines in emails. By tracing metadata,
investigators can pinpoint a suspect's location to specific floors of
buildings. They can electronically map a person's contacts, and their
contacts' contacts.
The NSA,
through secret court orders served to U.S. telecommunications firms,
scoops up metadata relating to almost all calls made into and within the
U.S., which it can later query as part of a terror investigation. U.S.
officials say that kind of work, in concert with other techniques, has
helped thwart "dozens" of terrorist plots in the U.S. and overseas.
Critics charge it represents an invasion of privacy.
The typical smartphone user can give
off a total of nearly 100 pieces of highly technical data through calls,
texts and other activities, according to research by Tracy Ann Kosa, a
digital-privacy expert at the University of Ontario. This information
includes the time that phones make contact with cellphone towers, the
direction of the tower with respect to the phone and the signal strength
at the time.
Ms. Kosa said much of the data is
"insignificant on its own." But "every little piece counts," she said.
"Think of it like footsteps—or calories."
One of the most dramatic examples of
how metadata can be used came in the criminal investigation that
separately uncovered retired Gen.
David Petraeus's extramarital affair and ended his tenure as Central Intelligence Agency director.
An FBI investigation into a stalking
complaint led agents to obtain location data from email addresses used
to send the alleged threats, according to U.S. law-enforcement
officials. FBI agents discovered the sender had used computers at a
several hotels. Agents asked the hotels to provide lists of guests who'd
used business centers around that time. That led them to Paula
Broadwell, Mr. Petraeus's biographer. The data was used as probable
cause to obtain a court order to monitor Ms. Broadwell's email accounts.
Agents soon realized from her emails that the two were having an
affair.
The
woman who received the allegedly harassing emails, Tampa socialite Jill
Kelley, said in a lawsuit filed later against the FBI that the bureau's
investigation took off after agents took a single IP address from an
email sent to her last June. The FBI said it closed the stalking
investigation without filing any charges.
A U.S. law-enforcement official said
the Petraeus case should not lead to privacy worries. The official said
law enforcement is required to have a specific investigative purpose to
collect and look at metadata.
Intelligence and law-enforcement
agencies have been using metadata in their investigations for decades.
Central Intelligence Agency officers routinely rifle through so-called
pocket litter found on captured terrorist suspects and give information
such as phone numbers to the NSA.
A cat-and-mouse game has evolved, with
terror suspects frequently swapping SIM cards, or phone identification
cards, to confuse intelligence agencies, former officials said. The U.S.
has countered by devising how to monitor the phone and the SIM card
separately.
"You keep pulling the thread. It's
critical stuff," one former senior intelligence official said. "In every
major terrorist operation or capture operation, metadata has played a
huge role."
Some of the most important metadata,
cellphone location information, varies depending on the area covered by a
cell tower. In rural areas, one tower may serve wide swaths of
territory, but in urban areas, towers are more targeted.
The number of cellular base stations
that serve a single floor of an office building equaled or surpassed the
number of standard cell towers in 2010 and continues to grow,
University of Pennsylvania engineering professor Matt Blaze told
Congress last year.
The increase in metadata has
transformed the way intelligence agencies conduct investigations with
domestic data. Traditionally, investigators had to meet various legal
standards to collect any data, such as connecting the data they wanted
to seize with a specific suspect.
Under the NSA phone program, the
government collects domestic phone metadata without a specific
investigative lead. Trained analysts only search the database in
conjunction with a terrorism investigation, authorities say.
Intelligence agencies "basically
reimpose at the level of analysis the standards you might ideally have
for collection," said Timothy Edgar, a former top national-security
privacy lawyer in the Bush and Obama administrations.
Mr. Edgar said the increasingly
specific location data raises concerns about potential violations of
Fourth Amendment protections against unreasonable searches and seizures.
Once a person can be located within a building, the monitoring more
closely resembles a search that would traditionally require a warrant.
The NSA program is accompanied by
privacy restrictions, Obama administration officials say. To search the
database, the government must have "reasonable suspicion" that the basis
for the query is "associated with a foreign terrorist organization,"
they say. Search warrants approved by the secret Foreign Intelligence
Surveillance Court are required before the contents of the calls may be
monitored.
Some useful metadata isn't retained
very long by phone companies, according to people familiar with the
evidence-gathering. That could explain why in court orders phone
companies have been instructed to turn over information daily.
The program's supporters note the
Supreme Court has ruled the public has no reasonable expectation of
privacy for information it turns over to a third party, such as a phone
company. That 1979 ruling, however, predated cellphones. Moreover,
cellphone technology has changed dramatically since the inception of the
NSA data program in the early 2000s.
"On one hand, this could equip the
government to electronically follow you around in public," said Jeremy
Bash, until recently Pentagon chief of staff. "But even if they were to
physically follow you around, you would not need a warrant for that," he
said.
Mr. Bash added it is nonetheless "a
fair question" whether metadata should trigger heightened Fourth
Amendment scrutiny, because communications technology has changed so
much.
"It's possible that 'dataveillance'
could come under higher judicial scrutiny," he said, using a new term of
art that means the ability to surveil people through their data trail.
—Devlin Barrett and Jennifer Valentino-DeVries contributed to this article.
Write to Evan Perez at
evan.perez@wsj.com and Siobhan Gorman at
siobhan.gorman@wsj.com
