Metadata: Piecing Together a Privacy Solution

Imagine the government is constantly monitoring you — keeping track of every person you call or email, every place you go, everything you buy, and more — all without getting a warrant. And when you challenge them, they claim you have no right to expect this kind of information to be private. Besides, they’re not actually listening to what you say or reading what you write, so what’s the big deal anyhow? Unfortunately, this scenario is more real than imaginary. Government agencies ranging from the NSA to local police departments have taken advantage of weak or uncertain legal protections for “metadata” — descriptive information about our phone calls, emails, location, purchases, and more — to sweep up vast amounts of information about innocent Americans without a warrant. Limited privacy protections for metadata may have made sense decades ago when technology to collect and analyze data was virtually nonexistent. But in today’s “big data” world, non-content does not mean non-sensitive. In fact, new technology is demonstrating just how sensitive metadata can be: how friend lists can reveal a person’s sexual orientation, purchase histories can identify a pregnancy before any visible signs appear, and location information can expose individuals to harassment for unpopular political views or even theft and physical harm. Two separate committees assembled by the executive branch — the President’s Review Group on Intelligence and Communications Technology and the Privacy and Civil Liberties Oversight Board —have joined lawmakers, academics, and judges in calling for a reevaluation of the distinction between content and metadata. This paper examines how new technologies and outdated laws have combined to make metadata more important and more vulnerable than ever, and proposes a way forward to ensure that all of our sensitive information gets the privacy protection it deserves