Metadata

This ICRC/Privacy International report documents how even “off” phones can be tracked via cell tower pings, how messaging apps reveal relationships and behaviour patterns through metadata, and how mobile money creates financial profiles. The finding applies beyond humanitarian work: any organisation handling sensitive data faces the same metadata exposure risks.

The Electronic Communications Privacy Act of 1986 established the legal framework for government access to electronic communications in the US. It has three main parts: Title I (Wiretap Act) requires warrants for real-time interception of content. Title II (Stored Communications Act) governs access to stored communications with varying standards—a warrant for content under 180 days old, but only a subpoena for older content (though DOJ policy now requires warrants). Title III (Pen Register Act) covers metadata collection with minimal judicial oversight. ECPA’s framework predates cloud computing and treats email stored on servers differently than physical mail. Courts have struggled to apply 1986 concepts to modern services. The CLOUD Act amended ECPA to clarify extraterritorial application. For international users, ECPA’s relatively weak protections for stored data and metadata are a concern when using US services.