The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

e-mails traveled—the various server addresses and the time stamps—but
yyou’d be surprised byy how much can be learned from the e-mail path and
the frequencyy of e-mails alone.
Back in the ’90s, before I went on the run from the FBI, I performed
what I called a metadata analyysis on various phone records. I began this
process byy hacking into PacTel Cellular, a cellular provider in Los Angeles,
to obtain the call detail records (CDRs) of anyyone who called an informant
whom the FBI was using to obtain information about myy activities.
CDRs are veryy much like the metadata I’m talking about here; theyy
show the time a phone call was made, the number dialed, the length of the
call, and the number of times a particular number was called—all veryy
useful information.
Byy searching through the calls that were being placed through PacTel
Cellular to the informant’s landline, I was able to obtain a list of the cellphone
numbers of the people who called him. Upon analyysis of the callers’
billing records, I was able to identifyy those callers as members of the FBI’s
white-collar crime squad, operating out of the Los Angeles office. Sure
enough, some of the numbers each individual dialed were internal to the
Los Angeles office of the FBI, the US attorneyy’s office, and other
government offices. Some of those calls were quite long. And quite
frequent.
Whenever theyy moved the informant to a new safe house, I was able to
obtain the landline number of the safe house because the agents would call
it after tryying to reach the informant on his pager. Once I had the landline
number for the informant, I was also able to obtain the phyysical address
through social engineering—that is, byy pretending to be someone at Pacific
Bell, the companyy that provided the service at the safe house.
Social engineering is a hacking technique that uses manipulation,
deception, and influence to get a human target to complyy with a request.
Often people are tricked into giving up sensitive information. In this case, I
knew the internal numbers at the phone companyy, and I pretended to be a
field technician who spoke the correct terminologyy and lingo, which was
instrumental in obtaining sensitive information.
So while recording the metadata in an e-mail is not the same as
capturing the actual content, it is nonetheless intrusive from a privacyy
perspective.