Metadata is information about something, not the thing itself.  For example, when you take a digital picture the image is the data, and the information about the camera and where the picture was taken (its GPS location) is the metadata.

Likewise, when you make a phone call your conversation is the data, whereas the number of the person you called and the location of the devices is the metadata.

 

Why does it matter?

The distinction between data and metadata matters because different legal standards apply to their protection.  Whereas the content of your communications generally enjoys privacy protection under the law, the metadata does not.  

For instance, in most countries it takes a court ordered "wiretap" to record what you say, but no such protection applies to the metadata about your call, including the phone number, the name of the person, how long you talked or where your devices were located at the time.  All that and more is given almost no legal protection at all.

 

Metadata is incredibly useful 

The analysis of publicly available metadata can produce a stunning amount of information about someone without ever violating privacy protection laws. The basic problem is, although technically law is not being violated, the actual privacy of the people being analyzed sure is.

Let's say I'm interested in learning more about you, and I want to do it without a court order and entirely within the law.  

If I know who you talk to, and everyone who they in turn communicate with, I can learn a lot about your life without ever knowing what you are saying.  All I have to do is pay attention to when you communicate, with whom, and for how long.  

Simply by tracking the GPS location of your device, I can know where you are and, even more critically, who else is within a few feet of you.

By following the digital trails you leave, and correlating them with other devices near yours, I can gain a remarkably deep understanding of who you associate with, even if you never call or text them. The proximity alone is enough, most especially if the same devices appear together in various locations.  

By also matching up the websites you visit and the apps you run, I can get an extremely clear idea of your interests and habits.  It takes only a few days of electronic monitoring to build a stunningly accurate picture.  And I can do it without ever violating the laws that are supposed to protect your privacy.

I don't need to tap into your words, all I need to do is monitor and correlate who you are with, how often that happens, and at what times of day.  I can even know which devices "sleep" together, with obvious implications about the owners of those devices.

 

Metadata in action

Imagine you've had a difficult day at work.  You're twisted into an emotional knot, and you don't want to bring that to your family.  So on your way home you stop at a local park and sit on a bench for an hour chatting with passersby and enjoying nature.   

And that does the trick, you relax.  Of course, you're late getting home, but the problems of the day are behind you. 

Unfortunately, you forgot that you allow your location to be tracked by an app on your husband's device. And as you walk in the door he confronts you with some uncomfortable questions… Where were you? Why didn't you call me? Did you meet someone in that park

You've done nothing wrong, it was a genuine and innocent attempt to protect your family. And after a brief explanation your husband accepts it. Mostly.

Here's the fascinating thing: Your husband had no actual data because you intentionally avoided a conversation until you calmed down from the office crap.  All he had was metadata, from which it's easy to draw horribly wrong conclusions... even experts frequently screw it up.

So what do you do next time?  Turn off your GPS?  That looks suspicious.  Or maybe now because of metadata alone, it's better to forgo the freedom of such breaks?

 

Is this the world we want to live in?

It's become an expectation that we are being watched. So much so that many people are careful what they type into search engines because they know it's being recorded, and that limits the boundaries of their intellectual exploration.  "I'd better not type this word or that, for fear of what Big Brother will think".  Few if any legal protections apply to any of it.  

We all need private time, we all need freedom from omnipresent monitoring.

Solitary privacy is easy, the real trick is to achieve privacy in a crowd.

That's where Merlin comes in.