Content-Metadata Matrix

UK SECRET STRAP1 COMINT EYES ONLY ORCON CONTENT OR Categorisation of aspects of intercepted communications GCHQ policy guidance. POCs: of GCHQ OPP-LEG _@gchq.gov.uk) and of GCHQ OPP-HQ Date last verified: 20 January 2010 by Version 2. Note: For convenience, the terms "Metadata", "Events" and "Communications Data" are often Class (see Content or used interchangeably, although only the last is Data type sorted by data class (column defined below) below) Metadata defined in UK law (RIPA). attachment to e-mail, eg routing diagram, picture, video a e-mail address in the body of a message a name of a file attached to an e-mail a authentication data to a communications service: login ID, userid, password ac unless sent inside the body of a communication an e-mail inside a message bulletin board posting chat-room discussions content of a voice call content of an e-mail cookie as a whole (some elements are listed separately below) DTMF data, as opposed to dialling keystroke logs search results search strings 0 SMS or IM text video voice mail boxes 0 0 web cam transmissions web forms filled in by people ?to? ?from?, ?bcc', and ?fwd? lines within e-mail header ca chat aliases, chat handles and other related or similar identifiers ca e?mail address from a cookie sent to set up a communication channel ca IMEI data ca IMSI caller ID ca IP addresses of the computers sending and receiving the message ca machine ID extracted from cookies (eg Yahoo cookies) ca UK SECRET STRAP1 COMINT EYES ONLY ORCON

UK SECRET STRAP1 COMINT EYES ONLY ORCON Note: For convenience, the terms "Metadata", "Events" and "Communications Data" are often Class (see Content or used interchangeably, although only the last is Data type sorted by data class (column defined below) below) Metadata defined in UK law (RIPA). personal IDs extracted from cookies, mail headers, chat sessions or buddy lists ca telephone number ca content summarization file type of an attachment to an email language or language fingerprinting speaker?s gender speaker?s ID e-mail subject line ch 0 dialling, signalling, routing, addressing or signalling information call charge records, including info about the time and length of a call Calling Line Identification, including numbers dialled details of routers and IP addresses that have handled the message DTMF dialling (not data) location of parties to a communication, not derived from content logs of visitors to chat rooms including how often they have visited/posted network management, eg billing, authentication or tracking of communicants start and finish time of an internet session or phone call status of chat sites, ie whether they are active and how many participants URLs up to and including the domain name session initiation protocols website registers including owner details; assume not UKUSA owned/registered creation of/access to draft message NB. the contents of a draft message are Content. history of websites browsed (full URLs) buddy lists for web mail, instant messenger or social networking folders used to organise e-mails address books or contacts lists for web mail etc keys password to internet or telephony services other than communications services URLs beyond the domain name, ie one that may include search terms 0 UK SECRET STRAP1 COMINT EYES ONLY ORCON

UK SECRET STRAP1 COMINT EYES ONLY ORCON Data type sorted by data class (column defined below) Class (see below) Content or Metadata Note: For convenience, the terms "Metadata", "Events" and "Communications Data" are often used interchangeably, although only the last is defined in UK law (RIPA). Coding of data classes a - attachment ac - authentication of communications - content ca - communications address - content derived data; some types in this class may be able to be treated as communications data due to low level of intrusion ch - content header - traffic data including network management (excludes any such data sent inside the body of a communication, eg by a CSP) - miscellaneous; some types in this class may be able to be treated as communications data bulk unselected: as taken from bearers without filtering or selection, save for national sensitivities UK SECRET STRAP1 COMINT EYES ONLY ORCON