Title: Content or Metadata?

Release Date: 2015-09-25

Description: This undated GCHQ spreadshhet clarifies how the agency categorises different aspects of intercepted communications: see the Intercept article Profiled: From Radio to Porn, British Spies Track Web Users’ Online Identities, 25 September 2015.

Document: content-metadata-matrix-p1-normal.gif:
UK SECRET STRAP1

COMINT AUSiCAN'NZiUMJS EYES ONLY ORCON

CONTENT OR METADATA?

Categorisation of aspects of intercepted communications - GCHQ policy guidance.

GCHQ OPP-LEQ aid

Daalju ««rifed 20 Ja-ua'y 2310 tr, Version 2.

Data type soiled by data class (cdumn B ticfincd bdow) Class (see be low) Content (c) or Metadata (m) Note: For convenience, the terms ’Metadata*. "Events" and 'Communications Data" are often used interchangeably, although only the last is defined in UK law (RIPA).
attachment to e-mail, eg routing diagram, picture, video a C
e-mail address in the body of a message .1 c
name of a file atlached to an e-mail a c
authentication data to a communications service: login ID. usend. password ac m unless sent inside the body of a communication
an e-mail inside a messaqe c c
bulletin board oostina c c
chat-room discussions c c
content of a voice call c c
content of an e-mail c c
cookie as a whole (some elements are listed separately below) c c
DTMF data, as opposed to dialling c c
keystroke logs c c
search results c c
search strinqs c c
SMS or IM text c c
video c c
voice mail boxes c c
web cam transmissions c c
web forms filled in by people c c
to’ from', cc'. bcc'. and fwd' lines within e-mail header ca m
chat aliases, chat handles and other related or similar identifiers ca m
e-mail address from a cookie sent to set up a communication channel ca m
IMEI data ca m
IMSI caller ID ca m
IP addresses of the computers sending and receiving the message ca m
machine ID extracted from cookies (eg Yahoo B cookies) ca m

UK SECRETS! RAP 1

COWINT AuaCANTvZUK.'JS EYES ONLY CROONcontent-metadata-matrix-p2-normal.gif:
UK SECRET STRAP1

COMINT AUSiCAN'NZiUMJS EYES ONLY ORCON

Data type soiled by data class (column B defined below) Class (see beta«) Content (c) or Metadata (m) Note: For convenience, the terms "Metadata'*. "Events'' and "Communications Data" are often used interchangeably, although only the last Is defined in UK law (RIPAL
personal IDs extracted from cookies, mail headers, chat sessions or buddy lists ca m
telephone number ca m
content summanzation edd odd
file type of an attachment to an email edd odd
language or language fingerprinting odd odd
speaker's gender edd odd
speaker's ID edd odd
e-mail subject Ime ch c
dialling, signalling, routing, addressing or signalling information d m
call charge records, including info aboul ihe time and length of a call d m
Calling Line Identification, including numbers dialled d m
details of routers and IP addresses that have handled the message d m
DTMF dialling (not data) d m
location of parties to a communication, not derived from content d m
logs of visitors to chat rooms including how often they have vrsiteefiposted d m
network management, eg billmq, authentication or tracking of communicants d m
start and finish time of an internet session or phone call d m
status of chat sites. ie whether they are active and how many participants d m
URLs up to and including the domain name d m
session Initiation protocols d m
website registers including owner details; assume not UKUSA owncdi'registcrcd d m
creation oflacccss to draft message m m N.8. the contents of a draft message are Content
hustory of websites browsed (full URLs) m c
buddy lists for web mail, instant messenger or social networking m m
folders used to organise e-mails m m
address books or contacts lists for web mail etc m c
crypto keys m c
password to intern«! or telephony services other than communications services m c
URLs beyond the domain name, ie one that may include search terms m c

UK SECRET ST RAP 1

COWINT AUS.CAUNZiUK.US EYES ONLY ORCONcontent-metadata-matrix-p3-normal.gif:
UK SECRET STRAP1

COMINT AUSi'CAN'NZ/UKAJS EYES ONLY ORCON

Data type sorted by data class (ccJumn B defined bdow) Class (see below) Content (c) or Metadata (m) Note: For convenience, the terms -Metadata’. "Events’ and ’Communications Data" are often used interchangeably, although only the last is defined in UK law (RIPA).

Coding of data classes

a - attachment

ac - authentication of communications
c-content

ca - communications address

cdd - content denvcd data; some typer, in this class may be able lo be treated as communications data due to low levd of utrusion
ch - content header

d - traffic data including network management (excludes any such data sent inside the body of a commutation, eg by a CSP)
m - miscellaneous; seme types in this dass may be able to be treated as communications data

bulk unselected: as taken from bearers without filering or selection, save for national sensitivities

UKSECHETSTKAP1

OQWINT AUSCAUM2AJKUS EYES CfiLY ORCOT4

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh