ADVERTISEMENT

Edward Snowden

Glenn Greenwald and Laura Poitras, The Guardian via AP

Spy agencies scour mobile phone apps for personal data

  • Article by: James Glanz, Jeff Larson and Andrew W. Lehren
  • New York Times
  • January 28, 2014 - 6:15 AM

When a smartphone user opens Angry Birds, the popular game application, and starts slinging birds at chortling green pigs, spy agencies have plotted how to lurk in the background to snatch data revealing the player’s location, age, sex and other personal information, according to secret British intelligence documents.

In their globe-spanning surveillance for terrorism suspects and other targets, the National Security Agency (NSA) and its British counterpart have been trying to exploit a basic byproduct of modern telecommunications: With each new generation of mobile phone technology, ever greater amounts of personal data pour onto networks where spies can pick it up.

According to dozens of previously undisclosed classified documents, among the most valuable of those unintended intelligence tools are so-called leaky apps that spew everything from users’ smartphone identification codes to where they have been that day.

The NSA and Britain’s Government Communications Headquarters were working together on how to collect and store data from dozens of smartphone apps by 2007, according to the documents, provided by Edward Snowden, the former NSA contractor. Since then, the agencies have traded recipes for grabbing location and planning data when a target uses Google Maps, and for vacuuming up address books, buddy lists, phone logs and the geographic data embedded in photos when someone sends a post to the mobile versions of Facebook, Flickr, LinkedIn, Twitter and other services.

The eavesdroppers’ pursuit of mobile networks has been outlined in earlier reports, but the secret documents offer far more details of their ambitions for smartphones and the apps that run on them.

The efforts were part of an initiative called “the mobile surge,” according to a 2011 British document, an analogy to troop surges. One NSA analyst’s enthusiasm was evident in the title — “Golden Nugget!” — given to a slide for a top-secret 2010 talk describing iPhones and Android phones as rich resources.

Collection details are unclear

The scale and the specifics of the data haul are not clear. The documents show that the NSA and the British agency routinely obtain information from certain apps, particularly some of those introduced earliest to cellphones.

With some newer apps, including Angry Birds, the agencies have a similar capability, the documents show, but they do not make explicit whether the spies have put that into practice.

Some personal data, developed in profiles by advertising companies, could be particularly sensitive: A secret 2012 British intelligence document says that spies can scrub smartphone apps that contain details like a user’s “political alignment” and sexual orientation.

President Obama announced new restrictions this month to better protect the privacy of ordinary Americans and foreigners from government surveillance, including limits on how the NSA can view “metadata” of Americans’ phone calls. He did not address the avalanche of information that the intelligence agencies get from leaky apps and other smartphone functions.

Nothing in the secret reports indicates that the companies cooperate with the spy agencies to share the information; the topic is not addressed.

The agencies have long been intercepting earlier generations of cellphone traffic like text messages and metadata from nearly every segment of the mobile network — and, more recently, computer traffic running on Internet pipelines.

Because those same networks carry the rush of data from leaky apps, the agencies have a ready-made way to collect and store this new resource. The documents do not address how many users might be affected, whether they include Americans or how often analysts would see personal data.

Agencies won’t elaborate

“NSA does not profile everyday Americans as it carries out its foreign intelligence mission,” the agency said in a written response to questions about the program.

The British spy agency declined to comment on any specific program, but said all its activities complied with British law.

One secret 2010 British document suggests that the agencies collect such a huge volume of “cookies” — the digital traces left on a mobile device or a computer when a target visits a website — that classified computers were having trouble storing it all.

The two agencies displayed a particular interest in Google Maps, which is accurate to within a few yards or better in some locations. Intelligence agencies collect so much data from the app that “you’ll be able to clone Google’s database” of global searches for directions, according to a top-secret NSA report from 2007.

“It effectively means that anyone using Google Maps on a smartphone is working in support of a GCHQ system,” a secret 2008 report by the British agency says.

In another example, a secret 20-page British report dated 2012 includes the computer code needed for snagging the profiles generated when Android users play Angry Birds. The app was created by Rovio Entertainment, of Finland, and has been downloaded more than a billion times.

Rovio drew public criticism in 2012 when researchers claimed that the app was tracking users’ locations and gathering other data. On its website, Rovio says that it may collect its users’ personal data, but that it abides by some restrictions. For example, the statement says, it does not “knowingly collect personal information from children under 13.”

Google declined to comment for this article, and Burstly did not respond to multiple requests for comment. Saara Bergstrom, a Rovio spokeswoman, said the company had no knowledge of the programs. “Nor do we have any involvement with the organizations you mentioned,” she said, referring to the NSA and the British spy agency.

© 2014 Star Tribune