Smartphone Game Data Targeted by NSA: Angry Birds Cited

Millennial Media, a Baltimore based ad company, creates "intrusive" profiles of users of smartphone applications and games like Angry Birds, according to documents leaked to the media by whistleblower Edward Snowden. Such profiles have been exploited by intelligence authorities like the U.S. National Security Agency (NSA), say investigative journalists.

Snowden, who worked as a contractor to the NSA until he fled the U.S. last June, turned over thousands of internal agency documents to journalists at the Guardian newspaper, who have shared them in turn with other media organizations like the New York Times, Pro-Publica and the Washington Post.

Among the documents was a 20 page report published in 2012 from the UK Government Communications Headquarters (GCHQ) that explained how the spy agencies targeted applications and games used by smartphone users.

The GCHQ report explained that the agencies are essentially "piggybacking" on a number of smartphone games like Angry Birds, Farmville and Call of Duty that surreptitiously collect data about their users which they sell to brokers to analyze for sale. The data is gathered to generate ad revenue from "free" games in much the same manner that "free" weekly newspapers brought in money from local businesses buying page space next to news stories in the hope that readers would notice their ads.

Unlike their paper-based predecessors which sold ads based on generic profiles of the average reader and the prominence of the ad in the newspaper, smartphone ad buyers have access to a treasure trove of data on each actual reader in real time. This has created a whole new advertising business called "real-time bidding" where ad companies can push ads to specific users within milliseconds of determining their location, their interests (such as searches or games played) and their past history.

Companies like Burstly, Google and Millennial Media have dominated this thriving new trade, creating custom packages for sale. Thus a political party, organization or a company can buy ads that can be narrowly fine tuned to the specific user. Any two people sitting next to each other might get very different advertisements on their cell phones - even if they were playing the same game or doing the same search - because the ad targeting would be based on their own personal histories while conversely two people in different cities might get the same ad.

The data that these companies gather can be very detailed. If matched up with the actual identity of the user, this information would allow literally minute by minute details of their private lives, the potential of which has attracted the attention of government authorities.

A New York Times article notes that Millennial Media - which incidentally is the first of these new ad companies to go public - offers buyers "optional" extras "including ethnicity, marital status and sexual orientation, suggest that much wider sweeps of personal data may take place."

"Possible categories for marital status," the newspaper added, "include single, married, divorced, engaged and "swinger"; those for sexual orientation are straight, gay, bisexual and "not sure." Such data does not appear to be available to buyers of Burstly and Google ad services.

Millennial Media sells its services to Activision in California which makes Call of Duty; Rovio of Finland which makes the Angry Birds game; and to Zynga - also from California - which makes Farmville.

The 2012 GCHQ document is not the first to lay out the potential of gathering data about individuals from their smartphones.

The Guardian notes that an NSA document from 2010 also notes that the agency believes it "would be able to collect almost every key detail of a user's life: including home country, current location (through geolocation), age, gender, zip code, marital status ... income, ethnicity, sexual orientation, education level, and number of children."

While the GCHQ and NSA documents spell out the potential for their collection efforts, they do not offer any concrete examples of success in tracking terrorists or criminals by analyzing data from games and applications.

For its part, the NSA denies that it is spying on ordinary people. "The communications of people who are not valid foreign intelligence targets are not of interest to the National Security Agency," an NSA spokeswoman told the newspaper. "Any implication that NSA's foreign intelligence collection is focused on the smartphone or social media communications of everyday Americans is not true."

Game makers have reacted with alarm. "Our fans' trust is the most important thing for us and we take privacy extremely seriously," Mikael Hed, CEO of Rovio Entertainment in a public statement issued Tuesday. "We do not collaborate, collude, or share data with spy agencies anywhere in the world."

"As the alleged surveillance might be happening through third-party advertising networks, the most important conversation to be had is how to ensure user privacy is protected while preventing the negative impact on the whole advertising industry and the countless mobile apps that rely on ad networks.

Hed added that the game company would re-evaluate its relationship with advertising companies.

Perhaps by coincidence - or perhaps not - Paul Palmieri, the founder of Millennial Media, quit his job at the company on Monday.

• 116 Human Rights