In 2024, a massive data breach at **AT&T** exposed the communication logs of 109 million customers, affecting nearly a third of Americans. This trove of sensitive information, dating from May to October 2022 and January 2023, included phone numbers, call and text counts, call durations, and location data. While **AT&T** stated that the breach did not include call content, customer names, or Social Security numbers, the implications of exposed metadata are far-reaching. Even seemingly innocuous call logs can paint a detailed picture of an individual's personal life, including their closest relationships, home and work locations, and daily routines.  ### Understanding Call Logs Every call, text, and data session generates records within a carrier's network. The two primary types are: * **SIP messages (Session Initiation Protocol):** These manage calls and texts, primarily used by carriers for troubleshooting dropped calls and failed texts. * **Call Detail Records (CDRs):** CDRs summarize each communication session, detailing participants, timestamps, duration, and often the cell site used. Carriers utilize them for billing and settling charges with roaming partners. Access to these logs can enable detailed reconstructions of an individual's activities. As demonstrated by **Malte Spitz** in 2011, who sued his telecom for his data and received 35,000 records, call metadata can be correlated with publicly available information to derive identities and reconstruct years of activity.  ### Why Call Logs Are Vulnerable Several factors contribute to the vulnerability of call logs: * **Extended Retention Periods:** Most carriers retain data for extended periods, often far longer than necessary for service provision. In 2022, carriers disclosed to the **FCC** that geolocation data could be held for up to five years, partly for monetization purposes. * **Centralized Data Targets:** Carrier databases represent large, attractive targets for attackers. The **AT&T** breach is not an isolated incident; **AT&T** was one of many **Snowflake** customers affected by credential-based thefts, alongside entities like **Ticketmaster** and **Neiman Marcus**. Campaigns like **Salt Typhoon**, linked to China, have reportedly compromised every major US carrier. * **Commercial Value:** Retained logs are often used to build behavioral profiles, sold to ad networks and data brokers, and sometimes provided to government agencies. This incident with **AT&T** underscores a critical takeaway: the data was available to be stolen because it was retained. ### **Cape: A New Approach to Mobile Privacy** Addressing these concerns, **Cape** offers a privacy-first mobile carrier service designed to minimize data retention. Unlike traditional carriers, **Cape** operates its own mobile core, allowing direct control over log deletion policies. **Cape's** "Disappearing Call Logs" feature sets aggressive retention windows for various record types: | Record | Cape | Other Carriers | | :--------------- | :------ | :------------- | | SIP messages | 14 days | Months | | Internal CDRs | 1 day | Years | | Billing CDRs | 30 days | Years | | Daily totals | 60 days | Years | This means SIP messages are kept for 14 days for debugging, internal CDRs for just one day, and daily totals (call, SMS, MMS, data usage counts) for up to 60 days for billing and spam prevention. Billing CDRs from partner networks are held for 30 days to facilitate bill disputes. Furthermore, **Cape** rotates the identifiers seen by tower operators, weakening their ability to link these logs to individual subscribers.  ### Independent Audit Confirms Privacy Claims To ensure transparency and verify its claims, **Cape** commissioned **Trail of Bits** to audit its data retention practices in May and July 2026. The audit's attestation confirmed two key claims: 1. CDR files are deleted within the stated retention policy. 2. **Cape** does not extract or retain individual customer data from CDRs beyond daily totals, which are deleted within 60 days. This independent verification provides a level of assurance for privacy-conscious users. ### The Path Forward: Less Data, Less Risk While robust carrier security is essential, the most effective control against data breaches is to minimize the data held. Records deleted days after creation cannot be compromised years later. For IT security professionals, journalists, executives, and any user concerned about their digital footprint, a carrier's data retention policy is a critical component of their threat model. Prioritizing providers that actively reduce their data footprint is a proactive step in enhancing personal and organizational privacy.