Rebecca Greenfield is currently a staff writer at Fast Company, an award-winning magazine and Web site about technology, business, and design. Formerly, she was a staff writer at the Atlantic Wire, where her focus was technology and where this selection first appeared in June 2013. (The Atlantic Wire, now the Wire, is still associated with the Atlantic magazine and includes original reporting as well as news and opinion pieces aggregated from a number of media outlets.) As you read this selection, consider how Daniel J. Solove, author of the previous selection, “The Nothing-to-Hide Argument,” might respond to it; you might also consider a comment posted on the Wire Web site in response to this article: “the point is that if they can get their hands on the headers, they certainly can read the message content too.”

What Your Email Metadata Told the NSA about You

REBECCA GREENFIELD

746

President Obama said “nobody is listening to your telephone calls,” even though the National Security Agency could actually track you from cellphone metadata. Well, the latest from the Edward Snowden leaks shows that Obama eventually told the NSA to stop collecting your email communications in 2011, apparently because the so-called StellarWind program “was not yielding much value,” even when collected in bulk. But how much could the NSA learn from all that email metadata, really? And was it more invasive than phone data collection? The agency is well beyond its one trillionth metadata record, after all, so they must have gotten pretty good at this.

747

To offer a basic sense of how StellarWind collection worked — and how much user names and IP addresses can tell a spy about a person, even if he’s not reading the contents of your email — we took a look at the raw source code of an everyday email header. It’s not the exact kind of information the NSA was pulling, of course, but it shows the type of information attached to every single one of your emails.

Below is what the metadata looks like as it travels around with an email — we’ve annotated the relevant parts, based on what the Guardian reported today as the legally allowed (and apparently expanded) powers of the NSA to read without your permission. After all, it’s right there behind your words:

748

As you can see, at the bare minimum, your average email metadata offers location (through the IPs), plus names (or at least email addresses), and dates (down to the second). The Guardian’s Glenn Greenwald and Spencer Ackerman report that Attorney General Michael Mukasey and Defense Secretary Bob Gates signed a document that OK’d the collection and mining of “the information appearing on the ‘to,’ ‘from,’ or ‘bcc’ lines of a standard email or other electronic communication” from, well, you and your friends and maybe some terrorists.

5 But email metadata is more revealing than that — even more revealing than what the NSA could do with just the time of your last phone call and the nearest cell tower. For operation StellarWind, it must have been all about that IP, or Internet protocol, address. Hell, it’d be easy enough for your grandma to geolocate both parties from a couple of IPs: there are countless free services on Google that turn those numbers you give to the IT guy into your exact location. For example, using the two IP addresses in the email sent to me above, we can easily determine that it was sent from Victoria, Australia:

The IP address is like a homing pigeon, and that’s why the revelations of email metadata being authorized under the Bush and Obama administrations amount to a seriously revealing breach of personal security in the name of terror-hunting. “Seeing your IP logs — and especially feeding them through sophisticated analytic tools — is a way of getting inside your head that’s in many ways on par with reading your diary,” Julian Sanchez of the Cato Institute told the Guardian. Of course, the administration has another party line, telling the Los Angeles Times that operation StellarWind was discontinued because it wasn’t adding up to enough good intelligence of “value.” But with one of the many “sophisticated analytic tool” sets developed by the NSA over the last decade or so and leaked during the last month — like, say, EvilOlive, “a near-real-time metadata analyzer” described in yet another Guardian scoop today — America’s intelligence operation certainly can zero in on exactly where Americans are. Even if you’re just emailing your hip grandma.

749