Metadata

The little bits that reveal your secrets.

When naturalist Gerald Durrell was on his way to the land of Bafut, in Cameroon, he stopped at a marketplace on his way and tried to take photographs of the people there.

I say “tried”, because, as soon as he took out his camera and tripod, panic broke out and everybody ran away screaming. Gerald Durrell later found out that this was because of one of the local superstitions. The people knew perfectly well what a camera was, and how it made pictures of you that you can look at. But they were also convinced that, when someone’s photo was taken, then the photographer also got a small part of the person’s soul along with the picture. And if enough photographs were taken, the photographer would get complete control over the person.

Gerald Durrell described this as an instance of witchcraft brought up-to-date. But now, it seems that those people were ahead of their time.

Even when he slyly took photos by pretending to look the other way, Gerald Durrell didn’t really gain control over anyone. But nowadays, photos are used by people—not quite to overpower you, but at least to manipulate you very effectively.

Actually, it’s usually not people collecting the photos, but companies like photo-sharing services and social networking websites. When you sign up for one of these websites, the Terms and Conditions that you never read often say something like “Anything you upload will still be yours, but we will get to collect and use the metadata”. Of course, they won’t say it in such a simple way. They’ll use many complicated words, while here we have only one complicated word. That’s the word I’ll explain now: metadata.

Dictionaries define metadata as “data about data”. But that’s not very helpful, so here’s a better one: Metadata is information that tells you about a piece of data. So for an email, it could be the sender’s ID, the recipient’s ID, the date and time the email was sent, the IP address of the sender, and several unique identifiers for that email—in short, everything about the email except for the message itself. Metadata can be thought of in the same way as the writing on an envelope. Anyone can see who the letter is for, and when it was sent (from the date-stamp), and perhaps the approximate weight (by counting the stamps). But they can’t see the actual message inside.

For photos that you upload, the metadata includes things like the date of the photograph, the camera model, and whether you used flash or not. Nowadays, it often also has a geotag, which is the GPS coordinates of where the photo was taken.

Metadata is useful. Google Photos uses it to help you sort your photos according to date. The India Biodiversity Portal looks at the geotag to find out where a particular species was observed. If your postman couldn’t see the address, he wouldn’t be able to deliver your letter. What you should know is that companies often collect your metadata and record it in their databases. Metadata is useful for them, too.

But before we look at that, here’s how metadata is useful for burglars.

A few years ago, a gang of thieves began robbing houses. This is not unusual, because thieves often rob houses. What was unusual was the way they selected empty houses: by looking on Facebook. That was the time when everyone’s posts were public by default, so all they had to do was scroll down and find people saying that they wouldn’t be home at a certain time. Then they would go to that person’s house at the specified time and take what they wanted.

The people who were robbed were only the ones who actually put a public post broadcasting when their house would be empty. In retrospect, that might seem like a silly thing to do. But when you do a simple thing like share a photo, you’re actually doing something very similar. By looking at the locations of many geotagged photos, it’s possible to build up a detailed picture of your travel habits. Have you ever received a Security Warning when you sign into Gmail from an unusual device, or an unusual place, or at an unusual time? This is useful, because you’ll get a warning if people try to hack into your account. But it also means that Google knows your habits, and the habits of every other Gmail user!

With the help of your search queries, Google also knows what kind of things you like, and uses that information to point advertisements at you. Sometimes it goes even further, like the person who went to visit his optician for an eye checkup—and started getting flooded on Facebook with advertisements for glasses. The person hadn’t even opened Facebook in the clinic, but the Location Tracking feature may have done the job, anyway.

A not-so-recent New York Times article featured a supermarket which tracked people’s shopping habits. Now, they send advertisements to customers for products that they didn’t even know they wanted yet.

Note that most of these things can be done using only metadata. They only need to know where the photos was taken; not the content of the photos itself. They only need to know the category of product whose ad you clicked; not which particular advertisement it was. A study by Stanford University tried to find out how much you can find out just by tracking the metadata for messages and phone-calls. They collected details like the time and duration of the call, or the time an SMS was sent, but not the message itself. Using a pool of 251,788 calls and 1,234,231 text messages from volunteers, they found they could predict things like relationship status and health condition with remarkable accuracy. In one case, they detected that someone had cardiac arrhythmia—and in another, that a person had just bought a gun.

The scary part is, when we “accept Terms and Conditions”, we often give companies permission to collect and store this metadata for their own use, without realising it. Next time, think twice before doing this. Just as you would with witchcraft!

This article was originally published in the 22 Jan — 4 Feb 2017 issue of Sirius (#237 “Metadata”). If you liked reading it, you consider clicking the ❤ to recommend it to others—though that will create some metadata, too!