Clipper and Traffic Analysis

[smb at research.att.com]

	 Speaking of phone records and such, btw, AT&T keeps phone
	 records for quite a long time.  About half a year or
	 so my girlfriend visited her relatives in Hong Kong
	 and I called her there to save them some major money.
	  
	 A few months ago, I get a letter/offer from AT&T
	 saying that I could save over xxx% on calls to HK,
	 Taiwan, etc...  Now, I'm a white boy and my name
	 would give them absolutely no hint of having
	 relatives or friends in Hong Kong.  Obviously they
	 keep records for waaaay far back, and keep them in
	 use!!!
	  
	 If they use'em for advertising, you can bet they
	 use them for other shady "law-enforcement" type info
	 for cops, etc....

That's a fairly strange conclusion to draw.  In fact, I was originally
going to use a much stronger word than ``strange'', but I forbore to
change my standing policy against flames.  Why, pray tell, do you
think that because AT&T uses its own information, that it gives it
to the government?  

For one thing, that would be illegal, as I read the law.  18 USC 2703(c)(1)(A)
specifically prohibits giving out records of subscriber information to
government agencies, except in reponse to a subpoena, warrant, or court
order.  (Oddly enough, it is permissible to give out the information
to non-government agencies; if I recall correctly what I've read of the legislative
history of the act, that was specifically intended to permit compilation
and sale of mailing lists and marketing data.)

For another, it isn't at all clear to me that it's in any way unethical
for a company to understand which of its products its customers buy.
*Selling* such data is another matter -- I don't like that at all -- but
that isn't what you're claiming.

You also say that AT&T is not using racial data or certain names to
pick out markets.  All you're saying is that you once called Hong Kong,
and that AT&T is now offering you a cheaper way to do so.  What's wrong
with that?  (Btw -- half a year is not at all a long time.  That's only
very slightly longer than they'd need to keep the data just to resolve
billing questions.)


		--Steve Bellovin

Disclaimer:  Obviously, I work for AT&T.  That doesn't mean I like
everything the company does -- but in this case, I fail to see the offense.