The tech giants know everything about you – whether or not you use their services.
Commercial mass surveillance: The business model
Your online behavior is the raw material from which one of the biggest economies in the history of the world has been built.
The internet has developed into an infrastructure where it’s pretty much possible to find out anything about anyone, any time. And this isn’t merely theoretical speculation, but a possibility that’s exploited every day. Surveillance has become the motor for the World Wide Web. Mapping everyone on Earth has produced one of the fattest cash cows in world history. This may sound a bit exaggerated coming from a company offering services for online privacy, but the fact is that this is what the harsh reality looks like. Every step we take is fed into huge systems where AI and machine learning is used to register, categorize and calculate what we’ll do next.
Essentially, there are two types of organizations carrying out mass surveillance in the digital world: those monitoring people to earn money (tech companies) and those monitoring people to control them (states). Often, their paths cross – not least when the latter step in and root around in the tech companies’ data storage. You can read about state surveillance here, while in this article we’ll be focusing on the organizations collecting huge amounts of data for commercial purposes.
Let’s start with the obvious stuff. The tech giants companies log your activity on their platforms to earn money. If you have a Facebook account, Meta collects data on your activity there, and if you use Messenger, Meta saves the private messages you write to family and friends (unless you click on end-to-end encryption, which they’ve launched recently). If you use Google’s services – for example if you send an email with Gmail or login to YouTube to check out a video – Google saves and categorizes everything you do, because you’re on their platforms. When you use apps on your phone, they of course log your activity too. And social networks freely swap this information back and forth between each other. Among other leaks, it’s been revealed that Meta leaked personal conversations to some of the 150 partners who seem to fall outside the privacy rules the company set up after the Cambridge Analytica scandal. These are collaborations that aren’t visible on the surface and which you can’t control in the user settings, but which often only come to public notice during leaks, trials and questions to congresses or parliaments. The collected data is used to tailor your filter bubble and to target information and advertising to you. As we’ve already said, this is obvious. This is the data you transfer when you accept the terms of use. It’s just as obvious that you can choose not to use this type of service. Of course there are alternative social media channels that have chosen another way (they aren’t exactly numerically superior right now, but they do exist). For example, you can choose the messaging service Signal if you want to communicate privately. But the huge problem with today’s widespread data collection is that you don’t even need to be active on the major services to contribute big data to big tech.
It’s enough to simply surf with a normal web browser to contribute to data collection.
The collected data that comes from your activity when you’re logged in on social media is just the tip of the iceberg. The really big data collection – the one that grinds along day in, day out and registers everything you do – continues regardless of whether or not you choose to use Facebook and Google. You could have avoided Meta your entire life – it still knows everything about you. It’s enough to simply surf with a normal web browser to climb aboard this carousel. But how is that possible? Meta actually reveals the method right there in its name. The technology it uses is metadata.
Metadata made it technically possible to rewind the events in someone's life going back months or even years.
Edward Snowden
In 2012, something happened that changed both how Edward Snowden viewed his employer (the NSA, which is responsible for foreign signals intelligence in the USA) and how he viewed the world around him. The governments in Australia and the UK proposed to make it mandatory to register metadata on the internet. In his book Permanent Record, he describes how “this was the first time that notionally democratic governments publicly avowed the ambition to establish a sort of surveillance time machine, which would enable them to technologically rewind the events of a person’s life for a period going back months or even years”. Snowden argues that it was a final mark of the western world’s transformation from being a creator and defender of the free internet to becoming its opponent and future destroyer. But to paraphrase the current NSA: it was only metadata.
So what is metadata? Bruce Schneier, a leading American cryptographer and security expert, describes it as data about data. In his book Data and Goliath, he writes: “In a text message system, the messages themselves are data, but the accounts that sent and received the message, and the date and time of the message, are all metadata. An e-mail system is similar: the text of the e-mail is data, but the sender, receiver, routing data, and message size are all metadata. Metadata may sound uninteresting, but it’s anything but.”
After Snowden leaked the NSA documents, Bruce Schneier worked with one of the journalists who was there in that hotel room in Hong Kong: Glenn Greenwald from the Guardian. Schneier helped Greenwald analyze the more technical parts of the leaks, and as he did so described the problem of dismissing metadata as something non-personal.
“One government defense is that the data collected is ‘only metadata’. This seemed to mollify many people, but it shouldn’t have. Collecting metadata on people means putting them under surveillance.”
Bruce Schneier compares it to hiring a private detective. A private detective can bug their target: listen in on everything the person says in their home, during their phone calls and so on. That’s data. But then the private detective can also choose to carry out surveillance on their target. And that produces a different type of report. Who the person meets, where they go, where they spend time, which people they write to, what they read and buy. That’s metadata.
“Eavesdropping gets you the conversations. Surveillance gets you everything else,” writes Schneier. “Metadata reveals our intimate friends, business associations. It reveals what and who we’re interested in and what’s important for us, no matter how private.”
Metadata absolutely tells you everything about somebody's life. If you have enough metadata you don't really need content.
Former NSA general counsel Steward Baker
The collection of metadata for commercial purposes means the tech giants can map your entire life. You can read more about how this works here, but essentially, metadata makes it possible to keep track of all the sites you visit, all the searches you do, all the people you talk to, how often you talk to them and for how long. In addition to this, the tech giants have the technical skill and not least the will to log everything on detail level as well: exactly what you buy online, which ads you look at, which products you like and which ones you quickly scroll past, which texts you read and which videos you watch (and once again, how often and for how long). And they have access to all this regardless of whether or not you’re logged into their services, because the internet’s infrastructure means that essentially every site in the world collaborates with the tech giants for commercial purposes.
Stewart Baker, former general counsel for the NSA, expressed this clearly: “Metadata absolutely tells you everything about somebody’s life. If you have enough metadata you don’t really need content.”
His colleague Michael Hayden, former director of the NSA and CIA, agrees, and in a debate at John Hopkins University referred to Baker when he said: “Baker is absolutely right. We kill people based on metadata.”
“We don’t lie to our search engine. They know more about what I’m thinking of than I do.”
As we said before, this article isn’t about state mass surveillance, but we think state representatives provide a clear picture of what metadata is and how accurately it can be used. It’s also important to emphasize this: the NSA categorizes search histories as metadata. Bruce Schneier says you can argue whether data from search engines is data or metadata, but the fact that NSA categorizes it as metadata should suffice to dismiss their ‘It’s only metadata’ argument.
“We don’t lie to our search engine,” says Schneier. “Google knows what kind of porn each of us searches for, which old lovers we still think about, our shames, our concerns, and our secrets. If Google decided to, it could figure out which of us is worried about our mental health, thinking about tax evasion, or planning to protest a particular government policy. I used to say that Google knows more about what I’m thinking of than my wife does. But that doesn’t go far enough. Google knows more about what I’m thinking of than I do, because Google remembers all of it perfectly and forever.”
Leah Elliott, who’s a satirical cartoonist and digital rights activist, is thinking along the same lines. In her series Contra Chrome – How Google’s Browser became a threat to privacy and democracy – she expresses it like this:
“You think you are browsing the web, when in reality, Google and others are browsing you. Extracting your experiences without your awareness, your knowledge, or your consent.”
Bruce Schneier’s comparison with a private detective is good, but it’s not quite sufficient, because the life we live digitally isn’t totally comparable with the life we live in the physical world. Because what we search for in search engines and on the sites we visit reflects our thoughts in a way that our physical behavior doesn’t. The internet has reduced the distance between thought and action in a way that has no equivalent in the physical world. If we’re worried that we drink too much, we can google it; we don’t need to go out and throw away all the whiskey bottles in the garbage, sneakily read a book on the subject at the library or go to a physical meeting with the private detective on our heels. Mapping people online means invading their heads and reading their thoughts before they blossom and become actions.
In the same way, metadata isn’t entirely comparable with the direct conversations we have online. There are parts of your life that you’re perhaps not ready to write or talk about with other people, but which you explore in private. Metadata even makes it possible to detect things we perhaps don’t even know about ourselves. Minor changes in the types of food you search for can indicate that you’re pregnant even before you’ve done a test. Metadata also equates to collection of data that isn’t legal in many countries. For example recording your political, sexual or religious orientation. If you visit your church website every Sunday, it’s probable you belong to that religious community. This is data that the tech giants have on you, but which is prohibited by law. The tech companies hide behind the argument that ‘it’s only metadata’ and that it’s anyway it’s anonymous data – but in the fraction of a second, this information could be de-anonymized and linked to you personally. Here you can read more about how it’s impossible to keep comprehensive data collection anonymous.
In the documentary The Big Data Robbery, Harvard professor Shoshana Zuboff calls metadata ‘waste’.
“Back in the year 2000, these data were considered just extra data. People called them things like data exhaust. Eventually it was understood that these so-called waste materials harbored these rich predictive data.”
This insight completely transformed the internet. The way people surfed became the true treasure, and the tech giants made a fortune from metadata. But it isn’t only the known large companies who are getting in on the new digital marketplace. For example, the new economy has attracted data brokers who grab a slice of the cake by simply collecting, buying and selling data about the sites people visit, the searches they do and so on.
Right from the start, they understood that these mechanisms had to be hidden. They had to observe through a one-way mirror. That's what makes it surveillance.
Shoshana Zuboff
Zuboff calls the internet’s new infrastructure ‘Surveillance Capitalism’. Capitalism because they make money from mapping people’s behavior on the internet. Surveillance because they observe us in secret and use methods developed to prevent us becoming aware of them.
“The companies like to say ‘We collect data so that we can improve our service’, and that’s true. They collect data and some of it is used to improve the service to you. But even more of it is analyzed to train what they call models, patterns of human behavior. So once I have big training models, I can see how people with these characteristics typically behave over time, and that allows me to fit your data right into that arc and predict what you’re likely to do, not only now but soon and later. This is what I call behavioral surplus; these data streams filled with these rich predictive data. Why surplus? Because right from the start these were more data than was required to improve products and services.”
Your behavior on the internet is sold to both banks and insurance companies.
In her book The Age of Surveillance Capitalism, Zuboff writes that the tech giants realized at an early stage that they would have to conceal their business model. In an interview in Contagious Magazine she explained her reasoning.
“Google understood that just grabbing your experience, bringing it into data for their own systems of production and sales, was not going to sit well with people. So, right from the start, they understood that these mechanisms had to be hidden. They had to observe through a one-way mirror. That’s what makes it surveillance.”
The actual mechanism is concealed. It’s hidden in hundreds of policy pages that nobody can be bothered to read (it’s much easier to just press ‘Accept’ when the cookie question pops up). Or not even known: like when Meta refuses to explain what data it collects, even when a court asks it. But the tech giants have been extremely transparent about the actual philosophy behind surveillance capitalism, right from the start. Mark Zuckerberg has talked about how privacy is no longer a social norm. Or when Eric Schmidt, Google CEO during the period 2001–2011, expressed it like this in an interview:
“If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.”
The funny thing was that Schmidt then blacklisted American media website CNET](http://gawker.com/5419271/google-ceo-secrets-are-for-filthy-people) because their journalists had revealed information about Schmidt in an article. Information they’d discovered simply by Googling.
An even clearer statement and proof of Google’s attitude in the early 2010s came in another interview where Schmidt said: “We know where you are. We know where you’ve been. We can more or less know what you’re thinking about.”
Since then, the quantity of data collected has only increased. As Tristan Harris, former design ethicist at Google and later founder of The Center of Humane Technology, expressed it in the documentary Social Dilemma: “They know when people are lonely. They know when people are depressed. They know when people are looking at photos of your ex-romantic partners. They know what you’re doing late at night. They know the entire thing. Whether you’re an introvert or an extrovert, or what kind of neuroses you have, what your personality type is like.”
”We build systems that spy on people in exchange for services. Corporations call it marketing.”
Bruce Schneier
Just like Shoshana Zuboff, Bruce Schneier is careful to point out this business model as surveillance and nothing else.
“Corporations call it marketing, but it’s surveillance. Surveillance is the business model of the internet. We build systems that spy on people in exchange for services.”
Surveillance is ultimately about control – that’s the whole point of it. And it’s clear that the business model prevailing on the internet today isn’t merely about observing. The infrastructure that’s been built makes it possible to use what Zuboff calls ‘future behavior’ to steer people in the direction you want. Behavioral data has become the tool used to tilt people in different directions, for financial or political gain. Zuboff says the tech giants have gone from monitoring to activating. In her book The Age of Surveillance Capitalism, she writes:
“Automated machine processes not only know our behavior but also shape our behavior at scale. With this reorientation from knowledge to power, it is no longer enough to automate information flows about us; the goal now is to automate us. Today’s prediction products are traded in behavioral futures markets that extend beyond targeted online ads to many other sectors, including insurance, retail, finance, and an ever-widening range of goods and services companies determined to participate in these new and profitable markets. In the thousands of transactions we make, we now pay for our own domination.”