Cape, a privacy-focused telecommunications company, says it has introduced a feature that automatically deletes a user\u2019s call data records, such as who they call and when, every 24 hours. These \u201cdisappearing call logs\u201d as Cape describes them break with the telecom industry standard of keeping hold of call logs for months if not years.\u201cOne of our first design principles was to minimize the amount of data that we collect and the amount of data that we store,\u201d John Doyle, CEO of Cape, told 404 Media in an interview. \u201cThere\u2019s no other business purpose to keep most of these logs more than like a day.\u201dCall data records, or CDRs, are metadata about a user\u2019s phone call and text records. This includes the phone number the user contacted. This information can be especially revealing, showing that a particular person called an abortion clinic, for instance. In 2024, hackers stole \u201cnearly all\u201d of AT&T customers\u2019 call records spanning several months. That in turn started a rush from the FBI to protect the identities of confidential informants, Bloomberg reported. That hack was so damaging in part because AT&T kept its customers\u2019 call records for an extended period of time.\ud83d\udca1Do you know about any other similar tools? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.Cape is a mobile virtual network operator (MVNO), meaning it runs its service on top of other companies\u2019 existing telecommunications infrastructure. Cape isn\u2019t building cellphone towers; it\u2019s making software to add security benefits. Cape is able to make changes to how long it retains data and other technical aspects because it runs its own mobile core\u2014all of the software necessary to route messages and essentially be a telecom.\u00a0404 Media asked Cape to demonstrate that CDRs were being deleted. In response, Cape made a video describing the process. It appeared to show that the databases Cape uses to store CDRs did only contain data from a 24 hour period. Previously, Cape stored CDRs for 60 days, \u201cwhich was already well short of industry standards,\u201d Doyle said. Cape says it does hold \u201cbilling CDRs\u201d for longer, for 30 days. These records are used to determine how much Cape has used carriers\u2019 infrastructure.<\/p>\n
Cape\u2019s CDRs are made when a customer uses the Cape phone number assigned to their account. The change wouldn\u2019t impact data generated by an app such as Signal; those are separate, and Signal already has various metadata protections.Doyle said Cape did not warn law enforcement about the change to CDR retention beforehand. \u201cI guess they\u2019ll find out in the same way everyone else does,\u201d he said. He added that the company still is in keeping with CALEA, or the Communications Assistance for Law Enforcement Act, which requires telecommunications companies to respond to legal demands for data.Because Cape is piggybacking off other carriers\u2019 infrastructure, that does mean that somewhere along the line those other companies could store their own copy of Cape users\u2019 data.\u201cIt\u2019s definitely true that some of our carrier partners may collect some information,\u201d Doyle said, including the IMEI, a unique identifier assigned to a device.Since I first covered Cape in 2024, I occasionally get emails asking me if Cape is a honeypot, in the sense that maybe it is a ruse to then provide data to the authorities. Doyle is also formerly of Palantir.\u201cAll I can do is say we definitively are not a honeypot,\u201d Doyle said. \u201cIt\u2019s so hard to prove a negative, but I say it out loud every chance I get.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"