The National Security Agency's mass surveillance of telephone metadata could yield detailed information about the private lives of individuals far beyond what the federal government claims, according to new Stanford research.

Stanford computer science student and CISAC cybersecurity fellow Jonathan Mayer and a fellow CS student, Patrick Mutchler, were able to acquire detailed information about people's lives just from telephone metadata: the phone number of the caller and recipient, the particular serial number of the phones involved, the time and duration of calls and possibly the location of each person when the call occurred.

The researchers did not do any illegal snooping – they worked with the phone records of 546 volunteers, matching phone numbers against the public Yelp and Google Places directories to see who was being called.

From the phone numbers, it was possible to determine that 57 percent of the volunteers made at least one medical call. Forty percent made a call related to financial services.

The volunteers called 33,688 unique numbers; 6,107 of those numbers, or 18 percent, were isolated to a particular identity.

Privacy issues

The metadata issue has taken on urgency in the wake of last summer's revelations about surveillance of American citizens by the NSA. Privacy experts have questioned the federal government's assertions on the subject.

President Obama has said, "They are not looking at people's names, and they're not looking at content."

Jonathan Mayer talks to Hari Sreenivasan on PBS Newshour in this video: 

Computer scientists such as Mayer say metadata are extremely sensitive and revealing.

They contend their research shows that metadata from phone calls can yield a wealth of detail about family, political, professional, religious and sexual associations.

"It would be no technical challenge to scale these identifications to a larger population," said Mayer.

At the outset, Mayer said, they asked, "Is it easy to draw sensitive inferences from phone metadata? How often do people conduct sensitive matters by phone? We turned to our crowdsourced MetaPhone dataset for empirical answers."

They crowdsourced the data using an Android application and conducted an analysis of individual calls made by the volunteers to sensitive numbers, connecting the patterns of calls to emphasize the detail available in telephone metadata, Mayer said.

"A pattern of calls will, of course, reveal more than individual call records," he said. "In our analysis, we identified a number of patterns that were highly indicative of sensitive activities or traits."

For example, one participant called several local neurology groups, a specialty pharmacy, a rare-condition management service, and a pharmaceutical hotline used for multiple sclerosis.

Another contacted a home improvement store, locksmiths, a hydroponics dealer and a head shop.

'Unambiguously sensitive'

The researchers initially shared the same hypothesis as their computer science colleagues, Mayer said. They did not anticipate finding much evidence one way or the other.

"We were wrong. Phone metadata is unambiguously sensitive, even over a small sample and short time window. We were able to infer medical conditions, firearm ownership and more, using solely phone metadata," he said.

All three branches of the federal government are now considering curbs on access to telephone metadata, Mayer noted. Consumer privacy concerns are also salient as the Federal Communications Commission assesses telecom data sharing practices, he added.

Vinton Cerf, who helped develop the Internet while at Stanford in the 1970s, will deliver the 2014 Drell Lecture at Stanford on Jan. 22. Now the vice president and chief Internet evangelist at Google, Cerf will talk about safety and security in a transnational environment.

Vinton Cerf, a pioneering computer scientist who helped launch the Internet, will talk at Stanford University on Jan. 22 about security in our highly wired, globalized world.

Cerf's talk, "Safety and Security in a Transnational World," is the 2014 installment of the Drell Lecture, which is sponsored by Stanford's Center for International Security and Cooperation at the Freeman Spogli Institute for International Studies. The lecture is named for CISAC's co-founder, Sidney Drell.

The event will take place from 4:30 p.m. to 6 p.m. in the Oak Lounge on the second floor of Tressider Memorial Union. The event is free and open to the media and public; no RSVP is required.

Cerf, who earned a bachelor's degree in mathematics at Stanford University, worked in the Silicon Valley computer industry before serving as an assistant professor at Stanford from 1972 to1976. During that time, he helped co-design the fundamental architecture underlying the Internet. In 1997, President Bill Clinton presented the U.S. National Medal of Technology to Cerf and his colleague, Robert E. Kahn, for founding and developing the Internet. Since 2005, Cerf has worked as the vice president and chief Internet evangelist for Google.

Cerf's lecture will include moderated questions and will be live-streamed online at www.ustream.tv/channel/stanford-cisac. CISAC will also be live-tweeting during the event and you can follow the conversation at #VintCerfFSI.

Clifton B. Parker is a writer for the Stanford News Service.

CISAC Honors Student Mailyn Fidler has been awarded a Marshall Scholarship to continue her studies in international technology policy. She investigates security implications of the global trade in "zero-day" software exploits. Fidler has also worked as a consultant for Google Glass, autonomous vehicles and Internet access through atmospheric balloons, and was the co-founder and co-editor-in-chief of the Stanford Journal of Public Health.

Marshall Scholarships are named for former U.S. Secretary of State and U.S. Army General George Marshall, and are given to intellectually distinguished Americans to study in Britain.