Don’t Worry It’s Only Meta-Data!

By Darren Hamburger

We have previously been told by the Australian government not to worry, they only collect Meta-Data and not the full content of your messages. Given a large proportion of computer users wouldn’t even know what Meta-Data is, I thought I would write a short article about my views on meta-data and it’s collection. To prove my point that many computer users wouldn’t even know what Meta-Data was, I asked 20 people what Meta-data was and only two knew. So as it stands 2 in 20 people of my social circle who I know in person actually knows anything about meta-data. It was comical to listen to the government trying to alleviate concerned voters worrying about mass surveillance. In any case, it is important for all who use electronic devices to understand what Meta-data is and why it is important to understand why government, companies and other third parties want to collect your Meta-data so much.

As it stands, I see Meta-Data collection as a foot in the door approach to a policed state and even though the current government may not have any sinister motive, one can not predict how future governments will use the Meta-data or change future laws. I can understand and appreciate how others would view my statement as being extreme, and that is fine with me. So lets start with defining what Meta-data actually is.

What is Meta-data?

In its simplistic state, Meta-data can be defined as all the historical data residing within the whole data package. Therefore, to use an example of a photograph, all of the data which resides within the photograph including the photograph itself is the “whole package”, the small amount of data which lays within the photograph which provides the historical records of the photograph is Meta-data.

Can I alter Meta-data?

In short the answer is yes if you maintain the data, however you will have no control of the Meta-Data once the government has collected this information.

Where is Meta-Data stored

Historically what has changed to make Meta-data an issue of concern?

The state has moved from the usual approach of seeking to obtain information in individual cases ie. needing a court order to meet requirements to get the necassary information, to now the law has enabled the government to actively collect and retain every single citizen information 24/7. The once greens senator in a youtube video correctly identified issues with the data retention as “why does the Meta-Data of my 6 year old child have to be collected and retained? What terrorist threat is coming from my 6 year old child?“ In terms of the societal change it self, business and other third party no state organisation are able to obtain, store, and use the meta data to assimilate and complete psychological profiling of people.Thus enabling more effective psychological influence and control over it’s citizens.

How long is Meta-data Stored in Australia?

At the time of writing this article, the law requires all providers to keep records of all Meta-data “AKA Meta-Data Retention” for a period of two years after the closure of the account. This is pretty interesting stuff as most people I had general discussions regarding data retention laws in Australia had assumed it was 2 years over all. The Telecommunications (internet and access) act 2015 is the act to review should you be interested in the reading more about how information is handled.

Don’t Worry it’s just Meta-data!

Here is a basic question, if meta-data does not identify the specific information in the message, then why is the government still pursing this type of information? The answer is because the information meta-data contains still reveals a great deal of information about a person. Just how much information you ask? Let us take the example of a simple photo I took. Buried inside the photo is the Meta-data and below is a sample of just some of the data that was within a photo I had taken with my own camera. Please note the XXXXXX means I've edited the data for personal reasons. Below are the contents of meta-data just from one photo.

metadataimage
Meta-Data Photo Example

File Name : P8080248.JPG

Directory : XXXXXXX

File Size : 7.2 MB

File Modification Date/Time : 2017:08:08 13:07:06+10:00

File Access Date/Time : 2017:10:14 13:44:18+11:00

File Type : JPEG

Make : OLYMPUS IMAGING CORP.

Camera Model Name : E-M1

Modify Date : 2017:08:08 13:07:07

Artist : DARREN HAMBURGER

Copyright : DARREN HAMBURGER

Exposure Time : 1/1250

F Number : 5.0

ISO : 200

Camera ID : OLYMPUS DIGITAL CAMERA

Equipment Version : 0100

Camera Type 2 : E-M1

Serial Number : xxxxxxxxxx

Internal Serial Number : xxxxxxxxxxxxxxxxx

Body Firmware Version : 4.100

Lens Type : Olympus M.Zuiko Digital ED 60mm F2.8 Macro

Lens Serial Number : xxxxxxxxx

Lens Firmware Version : 1.200

Drive Mode : Single Shot

Date Time UTC : 2017:08:08 02:07:07

Camera Temperature : 14

Focus Distance : 0.7 m

Exposure Mode : Manual

Lens Info : 60mm f/2.

Lens Model : OLYMPUS M.60mm F2.8 Macro

GPS Location : XXXXXXXXX

Image Size : 4608x3456

Lens ID : Olympus M.Zuiko Digital ED 60mm F2.8 Macro

As we can see with the information above, even though I haven't mentioned anything about this photo, we can extract all sorts of meta-data information e.g the camera make, model and lens type, shutter speed, time of photo, GPS location the photo was taken, serial numbers of the camera body and camera lens, photo settings and of course the author of the photo. You may be thinking to yourself so what?, this information has no use. Well to be honest, this is not the only meta-data contained inside my photo, but the meta-data example that I was willing to share for this article. Other useful information for hackers are the software used editing the photo, computer OS, file location on the computer which are the types of information to collate if we were to start a system exploit. When I say hackers, I don’t mean just hackers, it also means state sponsored as well. For me the issue is not that they “will only use it for criminal investigations”, its the fact that it is possible to do in the first place! And if a government who routinely collects meta-data can do this, who else can do this? Over time the collection of data will see governments create profiles on people and use this information in ways the ordinary citizen can not fathom. It is not the government of the present day that I am concerned with, but the government of future generations and the possibility of targeting select individuals or select groups or communities of people. This is what real dangers lay ahead which is something not considered by most people because that thought is just too terrifying. A good example how governments may try to exploit data can been seen from Pakistan attempt to obtain Facebook data to persecute those who may contributed in blasphemy.

Oh, is that you I hear saying state sponsored attackers wouldn’t occur. Really? Perhaps you may wish to see the ATO outed abilities. The sad reality is that no one can be trusted and anyone ignorant enough who believes otherwise will see their system open to exploitation one way or another.

Still scratching your head?

Well I'll connect the dots for you. If I go to your social media or use any other photos you have, the chances are that certain meta-data will be useful to collate a pretty good profile about you. With the date, time and GPS data alone I can pin point the locations you have been too or in the event a photo was just uploaded, your current position. Over a period of time I am able to collate the data and cross reference it all to determine how frequent and what times you may go to a location. If we collect enough photos over a period of time we can then data match and link the relationships between you and other people, common traffic or public transport routes etc. As an example, Let us take a simple photo of children and lets say I’m foolish enough to frequently post images of my children on Facebook and other social media. Perhaps some photos of the children's school carnival, photos of the kids at school, favorite parks, with friends etc. Forget the issue that we don’t even know who online would be looking at these images in the first place, but hey these are harmless innocent images of my children right? With the meta data contained in photos, it could be very easy for a perpetrator to establish locations where the children have been, a person may be able to anticipate the likely hood where the children may go, where they will play, where the school is etc. So now I ask you, does meta-data sound important now even though the pictures were innocent and “had nothing to hide“. I’m thinking if I didn’t have your attention before, I would have your attention now. We will now remove the word perpetrator and insert the word government and now ask what right does any government have to know all the intricacies about you as an individual, because with meta-data collection this is what is occurring. Only a policed state is interested with this level of information, the everyday law abiding citizen should not be placed in the same category as criminals, thus our privacy rights should not be collated and abused as if were all criminals.

Ill give you a different analogy to give you a clearer understanding of what is being collected. I want you to take a notepad and pen and every time you interact with a person, Write down the date, time and who you spoke to and for how long. Now do the same for every TV show that you watch, Every radio station you listen to, every text message, email, VOIP transmission, every Internet search, every banking transaction, every purchase and the list goes on. At the end of the day you would quiet easily have over 50-100 interactions with something. This is the type of information that is being collected each day for each person. If we were to imagine in the matter of one week, It would be relatively easy to start to formulate what you do, where you live, type of personality, favorite locations, type of products you buy, where you go etc. Now imagine what predictive capability a computer or AI could calculate. What happens if you associate with a person you do not know is a member of a biker group, or a person who had done criminal activity, even a person planing a terrorist attack etc? This means you are then likely to be placed within the same group somewhat “guilty by association”. We do know that people are placed in categories as A or B, where the A is the target person and B is the person by association. Still don’t think I’m right about foreseeable dangers of mass meta-data collection? don’t take my word for it, check out the links below regarding the concerns these individuals have over Meta-data collection.

I had come across some interesting examples regarding the warnings of Meta-data.

Once data is collected, abuse is always possible regardless of the protections governments put in place and a good example is the article written about the Australian Federal Police Accessed Journalist's Metadata Without A Warrant. Another issue is that we must always assume any information existing on a computer network with Internet connection is always susceptible to attack, thus the information may fall into the hands of others who wish to do harm.

If you still don’t think Meta-data retention is worthy of your concerns, perhaps in the future you will as our future is already in the making which is no different to what is explained in the 2018 ABC article “China's Social Credit System seeks to assign citizens scores, engineer social behaviour”.

Conclusion:

The moral of this article is to be aware how information is collected, what information exists within electronic data and to understand the government is likely to try to alter the current rules of data collection at a later date. I say this because newly introduced laws have a habit of being a “foot in the door” technique to progress an ongoing desire to control and progressively eliminate the privacy rights for the individual Australian citizen. This is why I wrote the article Don’t Confuse Privacy with Secrecy (or intent), Speak now or forever shut up! to place emphasis on the importance of privacy. The elephant in the room regarding the future use of the Meta-data collected and how the data will invariably seep into the hands of third parties without the consent of the owner in which the Meta-Data directly relates too. I support making Meta-data collection, retention and the use of without individual consent illegal. No citizen who has no reason to be specifically monitored i.e law abiding citizen who has no criminal history should never be treated in a way as if they are a criminal in waiting. Thus any citizen who has a criminal history and known links to such persons would be seen as an acceptable action to monitor. The purpose of any Meta-data retention and use must only be restricted to criminal activity and the use in persecution of such criminal behavior and never permitted to be used to enter the civil or other third party atmosphere I.e business, financial reward.

Until next time...

Darren Hamburger


Page Last update:01/04/2018

return image Return to Author return image Return to Main Page

Copyright © 2018 Darren Hamburger. All rights reserved.