Thursday, January 28, 2021

WhatsApp's New Privacy Policy: Collecting Metadata and Its Implications

This article is by

Share this article

Article Contributor(s)

Vaishnavi Krishna Mohan

Article Title

WhatsApp's New Privacy Policy: Collecting Metadata and Its Implications

Publisher

Global Views 360

Publication Date

January 28, 2021

URL

Representative Image WhatsApp

Representative Image WhatsApp | Source: Rachit Tank via Unsplash

According to WhatsApp’s new privacy policy, the app is set to collect “only” user’s Metadata. Metadata can reveal a lot more than merely the app usage of a person. Former NSA General Counsel Stewart Baker stated, “Metadata absolutely tells you everything about somebody’s life. If you have enough metadata you don’t really need content.”

This article explores the ways in which WhatsApp is underselling the true estimation of the significance of Metadata.

Facebook owned WhatsApp recently announced the update of its privacy policy terms. 8th of February, 2021 was initially set as the deadline for users to either accept the new privacy policy or delete their account. By this time, most of us have already witnessed or been a part of the backlash that WhatsApp is experiencing. LocalCircles conducted a survey and the results indicated that 15% of India’s users are likely to move away entirely from the app while 36% will drastically reduce the usage and 67% of users are likely to discontinue chats with WhatsApp business accounts.

To reinstall trust in its users, WhatsApp released a clarification stating that the new policy update doesn’t compromise privacy of messages with friends and family. Furthermore, it explains that the update includes changes related to WhatsApp business accounts are optional too.

However, owing to severe backlash, WhatsApp has pushed the deadline to May 15 while they further clarify their policy updates.

It is true that WhatsApp cannot read our messages as it is end-to-end encrypted which implies that only a message’s sender and receiver can read it. The updated privacy policy intends to alert users that some businesses would soon be using Facebook-servers to store messages with their customers. By accepting the new privacy policy, users will be allowing WhatsApp to reserve all rights to collect your data and share it with the expansive Facebook and Instagram networks ‘regardless of whether you have profiles on those apps.’

A person using WhatsApp | Source: Andrés Rodríguez via Pixabay

By using WhatsApp, you may now be sharing your usage data, your phone’s unique identifier, your location when the location service is enabled, among several other types of metadata. A culmination of all your metadata is linked to your identity.

The value of metadata has been underestimated since the term isn’t clearly understood. Metadata is data about our data. For instance, in a cell phone conversation, the conversation itself isn’t metadata but everything except that is metadata. Data regarding who you called, how long you spoke for, where you were when you placed the call, where the other person on the line was and the time you placed the call. Consider a situation when every time you made a call to someone, you had to inform a particular person about who you called, how long you spoke for, when and where and all other details except the content spoken. This applies for every single call and everyone else’s metadata is also being recorded. The person owning the metadata can analyze and tell a lot about your personal life. Who you work with, who you spend time with, who you are close to, where you are at particular times and so on…

Kurt Opsahl, in his post in the Electronic Frontier Foundation, gives an example of how companies and governments collect intimate details about your life with the disguised use of the word called metadata. The following examples are an excerpt of his article:

“They know you rang a phone sex service at 2:24 am and spoke for 18 minutes. They know that you called suicide prevention hotline from the Golden Gate Bridge.

They know you spoke with an HIV testing service, then your doctor, then your health insurance company in the same hour.

They know you called a gynaecologist, spoke for a half hour, and then called the local Planned Parenthood's number later that day. But nobody knows what you spoke about.”

Metadata provides more than required context to know some of the most intimate and personal details of your lives.  When this data is correlated with the records of other phone calls, one can easily obtain a lot more data and track our daily routines. This is merely about phone calls. WhatsApp includes a lot more features and will collect metadata of chats, businesses and money transactions.

In WhatsApp’s words:

“We collect service-related, diagnostic, and performance information. This includes information about your activity (such as how you use our Services, how you interact with others using our Services, and the like), log files, and diagnostic, crash, website, and performance logs and reports.”

In addition to this, WhatsApp also collects information about IP address, OS, browser information and phone number.

Stanford’s computer scientists conducted an analysis to understand the extent of intrusion of privacy using metadata. The scientists built an app for smartphones. The app was developed to retrieve metadata of calls and text messages from more than 800 volunteers’ phone logs. The researchers received records of more than 250,000 calls and 1.2 million texts. Their inexpensive analysis revealed personal details of several people like their health records. Researchers were also able to learn that one of their participants owned an AR semi-automatic rifle with only metadata.

Gen. Michael Hayden | Source: Wikimedia

Gen. Michael Hayden, the former head of the National Security Agency once stated that “the U.S. government kill[s] people based on metadata.”

In 2016, Facebook was involved in the infamous data privacy scandal which centered around collection of personal data of over 87 million people by Cambridge Analytica, a political consulting and strategic analyst firm. The organization harvested user data for targeted advertising, particularly political advertising during the 2016 U.S. election. While the central offender was Cambridge Analytica, the apparent indifference for data privacy to Facebook facilitated Cambridge Analytical and several other organizations.

In June 2018, Facebook confirmed that it was sharing data with at least 4 Chinese companies, Huawei, Oppo, Lenovo and TCL. Facebook was under scrutiny from the U.S. intelligence agencies on security issues as they claimed that the data with the Chinese telecommunication companies would provide an opportunity for a foreign espionage.

In September 2019, there were reports that the Indian government contemplated making it mandatory for companies like Google, Facebook, and Amazon, to share the public data of users.

The Ministry of Electronics and IT (MeitY) was planning on issuing new guidelines under the Information Technology Act which according to which tech giants would have been required to share freely available data or the public information that they collate in the course of their operations, including traffic, buying and illness patterns.

Europe is exempted from WhatsApp’s new privacy policy as EU antitrust authorities fined Facebook 110 million euros for misleading the regulators during the takeover of WhatsApp in 2014. EU’s strict privacy laws empowers regulators to fine up to 4% of global annual revenue of the companies that breach the bloc’s rules.

Your Metadata is extremely personal. By giving WhatsApp the authority to access it, you are giving access to several other organizations, businesses and it also makes you more vulnerable to third-party hackers and trackers. WhatsApp has given multiple assurances about its updated privacy policy being noninvasive. However, most of these assurances are cleverly worded and misleading statements. It is important to read through the fine print of the new policy before accepting it.

Support us to bring the world closer

To keep our content accessible we don't charge anything from our readers and rely on donations to continue working. Your support is critical in keeping Global Views 360 independent and helps us to present a well-rounded world view on different international issues for you. Every contribution, however big or small, is valuable for us to keep on delivering in future as well.

Support Us

Share this article

Read More

February 25, 2021 12:44 PM

Constructing Panopticon: Israeli Surveillance Technology and its Implications for the Palestinians

Jeremy Bentham, an English philosopher and social theorist designed ‘Panopticon’ in the late 18th century. The panopticon is an institutional building which Bentham describes as “a new mode of obtaining power of mind over mind in a quantity hitherto without example”. The structure's central observation tower, placed within a circle of prison cells, allows a watchman to monitor the inmates of the building without the dwellers knowing whether or not they are being watched. Although it is physically impossible for a single watchman to observe all the occupants at once, the fact that the inmates cannot know when they are being watched means that they are motivated to act as though they are being watched at all times. Thus, compelling the inmates to regulate their own behaviour.

Michel Foucoault, a French Philosopher, uses panopticon as a metaphor to explore relations between systems of social control and people in a disciplinary situation. For Foucault, the real danger was not that the individuals are repressed by the social order but the fact that when only certain people or groups of people control knowledge, oppression is a possibility. Contemporary society uses technology for the deployment of panoptic structures ‘invisibly’ throughout society.

This article gives an overview of the massive panopticon that is built and operated by Israel in Occupied Palestine.

Israel’s unaccountable military rule over its Palestinian citizens in east Jeruselum, West Bank and Gaza Strip have kept the Palestinians under constant surveillance and control. As per a report by Amitai Ziv on Haaretz, Israel’s surveillance operation against Palestinians is (as of 2019) “among the largest of its kind in the world. It includes monitoring the media, social media and the population as a whole.”

Among various mechanisms of surveillance, the technological mechanisms of surveillance and control deployed or proposed in the region of Gaza Strip is most empowering to Israel in terms of gathering ‘intelligence’. This includes use of biometric identity cards, Israeli access to Palestinian census data, almost complete access to and control of the telecommunication infrastructure in the Gaza Strip, the ability to track individuals via cell phone, large surveillance zeppelins which monitor the entire electromagnetic spectrum and which can usurp control of these from Palestinian operators (for instance sending text messages to subscribers targeting different demographics) as well as optical surveillance, facial recognition technology, remote controlled and robotic machine gun towers guarding the border that are capable of identifying a target and opening fire automatically—without human intervention.

In the context of occupation, the use of biometric ID cards of Israeli citizens is the sharpest seepage of control technologies.  For a long time, Israel has used a system of differentiated ID cards to distinguish between Jewish and Non-Jewish, citizens and residents of Israel, and citizens and residents of the occupied territories.

These ID cards also have a record of ethnic/religious affiliation of the person, and the ID numbers themselves are coded so as to reflect this information. One’s status of whether they are an Israeli or Palestinian, whether they are a citizen or a resident determines their freedom to travel, their ability to find jobs, and even their ability to get married and avail social benefits.  The Palestinians in East Jerusalem—which was annexed after the 1967 war—are considered as “conditional residents” and not citizens. According to a Human Rights Watch report, a resident of Palestine occupied Israel reported that the Israeli authorities refused to issue birth certificates to his five children, all born in Jerusalem. Other Jerusalem residents without residency status, in their testimonials, described being unable to legally work; obtain social welfare benefits; attend weddings and funerals; or visit gravely ill relatives abroad, for fear Israeli authorities would refuse to allow them to return home.

Another significant technological mechanism is the Facial recognition technology which has found its way into use by Israeli police. Facial recognition system, a globally controversial and scientifically flawed system is being used by the police force in Israel to identify protestors and is also implemented at airports and border crossings.

Israel has also ratcheted its social media surveillance, especially Facebook, Palestinians’ preferred platform. In October 2015, Israeli invasion at the Al-Aqsa Mosque angered several Palestinians. Many teenagers who didn’t belong to military wing or the Palestinian political faction orchestrated the attacks. The Israeli government blamed the social media for instigating the attacks and the military intelligence increased the monitoring of Palestinian social media accounts. Consequently, over 800 Palestinians were arrested for their posts on social media, particularly Facebook. It was later revealed that these arrests were a result of a policing system which uses algorithms to build profiles of supposed Palestinian attackers. This system proctors thousands of Palestinian Facebook accounts sifting for words like shaheed (martyr), Zionist state, Al Quds (Jerusalem), or Al Aqsa. Further, the algorithm identifies a “suspect” based on ‘prediction’ of violence. These targets are marked suspicious and are a potential target for arrest on the grounds of “incitement to violence”. The term incitement refers to all types of resistance to Israeli practices. The Israeli Army declared Military order 1651 in 2010, according to which, anyone who “attempts, orally or otherwise, to influence public opinion in the West Bank area in a manner which may harm public peace or public order” or “publishes words of praise, sympathy or support for a hostile organization, its actions or objectives,” will serve a jail time of 10 years. The order defines this as “incitement”. One notable instance has been the poetry of Dareen Tatour. She is a Palestinian citizen of Israel. She expressed her call to “resist” the occupiers through a poem she posted online in October 2015. The video had less than 300 views. But it resulted in nearly three years of house arrest and five months imprisonment. The Israeli government charged Tatour with inciting violence and terrorism while her poem was a call for a non-violent resistance. This incident is a classic demonstration of how Israel uses vague terminology to criminalize online activity when it serves its discriminatory interests.  

Israel’s military industrial complex is a profound enabler of the digital surveillance of Palestinians. The nation not only implements surveillance and control but also manufactures and exports a massive amount of military and cyber security technologies. A report published by Privacy International—an NGO that investigates government surveillance and companies—in 2016—stated that Israel has about 27 surveillance companies which is the highest per capita in terms of surveillance that any country has in the world.

The Guardian collected testimonies from people who worked in the Israeli Intelligence Corps to understand the big brother surveillance of the Palestinians. One of the testimonies revealed that commoners and even completely innocent people were under the radar of surveillance. The attestor stated “As a soldier in Unit 8200, I collected information on people accused of either attacking Israelis, trying to attack Israelis, desiring to harm Israelis, and considering attacking Israelis. I also collected information on people who were completely innocent, and whose only crime was that they interested the Israeli security system for various reasons. For reasons they had absolutely no way of knowing. All Palestinians are exposed to non-stop monitoring without any legal protection. Junior soldiers can decide when someone is a target for the collection of information. There is no procedure in place to determine whether the violation of the individual’s rights is necessarily justifiable. The notion of rights for Palestinians does not exist at all. Not even as an idea to be disregarded.”

Another testimonial exposed that the data collected was hardly in accordance with the security needs. The testimony stated, “Throughout my service, I discovered that many Israeli initiatives within the Palestinian arena are directed at things that are not related to intelligence. I worked a lot on gathering information on political issues. Some could be seen as related to objectives that serve security needs, such as the suppression of Hamas institutions, while others could not. Some were political objectives that did not even fall within the Israeli consensus, such as strengthening Israel’s stance at the expense of the Palestinian position. Such objectives do not serve the security system but rather agendas of certain politicians. One project in particular, was shocking to many of us as we were exposed to it. The information was almost directly transferred to political players and not to other sections of the security system. This made it clear to me that we were dealing with information that was hardly connected to security needs. We knew the detailed medical conditions of some of our targets, and our goals developed around them. I’m not sure what was done with this information. I felt bad knowing each of their precise problems, and that we would talk and laugh about this information freely. Or, for instance, that we knew exactly who was cheating on their wife, with whom, and how often.”

While hidden and unknown surveillance is prominent, Israel has also imposed explicit panopticon surveillance and restrictions on Palestinians in numerous cases. In the village of Beit Ijza, northwest of Jerusalem, the house of Gharib’s family has been enclosed by a 6-meter-high fence, cutting them off from their olive gardens and rest of the village as Israel claimed ownership of the land surrounding the Gharib family's house and created a West Bank settlement over there. The house was built in 1979 on land the family says has belonged to them from as far back as the Ottoman era. “Ever since Israel occupied the West Bank, Jews have been offering my father to sell the house,” Gharib says. “They even brought him a suitcase of money. He refused.” Now, their every move is filmed as cameras have been set up on the bars of the fence. Along with loss of privacy, the panopticon internalized omniscience prevents the Gharib family from taking radical steps to protect their rights. In Israeli military language this is called an “indicative fence” which is also equipped with sensors.  When the fence was built, the family had to negotiate by phone with the police at the nearby Atarot industrial zone every time they wanted to go out and or they had to get the Red Cross to help out. “Sometimes we waited for several hours for them to come and open it” Gharib said.

Constant surveillance in real life as well as digital space is definitely a critical human rights violation. While the case of Palestinians is unique given the Israeli military occupation, the fight for their rights is global. World leaders, governments, civil societies, social media giants and all internet users have an essential role in the battle for a surveillance and censorship free state.

Read More