Metadata Is the Surveillance We Keep Forgetting

The Story on the Outside of the Envelope

We tend to visualize surveillance as a spy reading our diary. In reality, modern surveillance is a machine analyzing a graph. The Machine does not need to read your prose to understand your intent. It only needs to measure the traffic.

If you encrypt a file, you scramble the contents. However, the file still possesses attributes. It has a name. It has a weight. It has a time of birth. It has an owner.

This is Metadata. It is the address written on the envelope. The postman must read the address to deliver the letter. Consequently, the postman knows who is talking to whom.

[Image of a sealed envelope with ‘URGENT MERGER DOCUMENTS’ written in large red letters on the outside]

The False Security: The Encrypted Tunnel.

Vendors sell us “Encrypted Tunnels” (VPNs, HTTPS). They claim this blinds the observer. This is only partially true. The tunnel hides the content from the public internet, but it does not hide the metadata from the vendor itself.

Consider a law firm using a cloud collaboration tool.

• The Content: “The client is innocent.” (Encrypted).
• The Log: “User Lawyer_A accessed file Witness_List.docx at 2:00 AM on Sunday.”

The content is hidden. But the metadata reveals panic. It reveals a late-night crisis. If an adversary obtains these logs, they can reconstruct the timeline of your defense strategy without reading a single legal brief.

The Mathematical Reality: The Pattern of Life.

Metadata aggregates into a “Pattern of Life.” The Machine is excellent at pattern recognition.

If I analyze the file sizes of your email attachments, and I see a sudden spike in large encrypted archives sent to a personal email address on a Friday afternoon, I detect a data exfiltration event. I do not need to see the data to know it is being stolen.

Conversely, if a competitor can see that your CEO is suddenly scheduling meetings with a bankruptcy specialist—even if the meeting notes are private—the market will react.

Therefore, we must practice Metadata Minimization.

1. Sanitize Filenames: Never put the secret in the filename. Use random identifiers or code names. Client_X_Audit.xlsx is a liability. C99_Ref_01.xlsx is a control.
2. Audit the Logs: Ask your vendor: “How long do you keep the access logs?” If the answer is “Forever,” you are paying them to build a dossier on you.
3. Use Signal, Not Noise: Use communication tools that minimize retained headers.

Strictly speaking, you cannot eliminate metadata. You can only starve it of meaning. Do not write the secrets on the envelope.

FAQs

What exactly is metadata?

It is data about data. The filename, the file size, the author name, the creation timestamp. It is the context that The Machine needs to organize the file.

Can we encrypt metadata?

It is difficult. The server needs to know where to put the file. To hide metadata, you must use advanced architectures like onion routing or oblivious RAM, which are rare in business tools.

What is the easiest fix?

Stop naming files with sensitive details. Use project codes. `Project_Titan_v1.pdf` is safer than `Acquisition_Offer_v1.pdf`.