Forget about personal privacy: Google and Apple know where you are

[PaddyJoe]

There's another scare story today about location info being stored on your Apple iPhone. It seems that the info is only on the phone and can be synced to your pc when connected but will not be sent to Apple.

Meanwhile it has been revealed this week that in the case of Google, according to new research by security analyst Samy Kamkar, an HTC Android phone collected its location every few seconds and transmitted the data to Google at least several times an hour. It also transmitted the name, location and signal strength of any nearby Wi-Fi networks, as well as a unique phone identifier.So it looks like if you have a smart phone your location details are not your own any more. Combine that with a Face Book account and you might as well streak across Croke Park on All Ireland Final Day :D

Google and Apple are gathering location information as part of their race to build massive databases capable of pinpointing people's locations via their cellphones. These databases could help them tap the $2.9 billion market for location-based services—expected to rise to $8.3 billion in 2014, according to research firm Gartner (http://online.wsj.com/public/quotes/main.html?type=djn&symbol=IT) Inc.
In the case of Google, according to new research by security analyst Samy Kamkar, an HTC Android phone collected its location every few seconds and transmitted the data to Google at least several times an hour. It also transmitted the name, location and signal strength of any nearby Wi-Fi networks, as well as a unique phone identifier.
Google declined to comment on the findings.

Read more: http://online.wsj.com/article/SB10001424052748703983704576277101723453610.html#i xzz1KD8t2Xgw

[Captain Con O'Sullivan]

Don't use a registered phone. Have a cheapo one on a pay-as-you-go deal so your name is not registered to that phone in the first place.

It'll be interesting to see how they try to sell that data or use it elsewhere. The Germans are already limbering up to fine Google for unauthorised data collection. I'm on facebook under an assumed name.

The amount of outliers such as people doing what I've said about phones and facebook and so on will corrupt/degenerate the database and reduce its value.

[mutley]

I think the general idea is to use it for location based advertising

[Captain Con O'Sullivan]

Sure ... but why not make sure if companies are going to sell data on you to the advertising industry that a certain amount of the information is 'dirty'? Let 'em waste their money if they want.

I can always tell I'm doing okay by the fact that I never get any junk mail at home.

[jmcc]

Don't use a registered phone. Have a cheapo one on a pay-as-you-go deal so your name is not registered to that phone in the first place.Yes but the Supercruncher [1] approach to that one is to examine your social network and compare it with similar ones from other data sets. Naturally this would require more than one set of data.


It'll be interesting to see how they try to sell that data or use it elsewhere.Well it would be an excellent tool for location based marketing.


The Germans are already limbering up to fine Google for unauthorised data collection.What Google was doing was nasty. Technically it was wardriving - moving around areas looking for WiFi connections and snarfing data including e-mail content, usernames and passwords.

A few years ago, a researcher in AOL accidentally released a set of searches that had been conducted on AOL's search engine interface. I think that one of the main US newspapers managed to analyse the data to such an extent that they were able to identify individual users even though the identification data had been scrubbed and replaced. John Battelle (a tech commentator) referred to what Google (and other search engines) had at their disposal as a "database of intentions". The AOL data confirmed this as some of the searches were related to future intentions and actions.


The amount of outliers such as people doing what I've said about phones and facebook and so on will corrupt/degenerate the database and reduce its value.The danger of relying on technology journalists (I have a far greater respect for the journalists in the WSJ than I have for some Irish technology journalists. I've dealt with a few in the past and their approach is eons ahead of what passes for tech journalism in Ireland.) for analysis of such issues is that they are not specialists and often are Arts types with little detailed understanding of the technology, capabilities, possibilities or limitations of the use of the data. Their reaction is often one of unknowing fear whereas the Supercruncher's response is to see the possibilities arising from the use of such data. The irony is that these outliers are actually making themselves more obvious because they exist uniquely in particular social networks. And then there is always those "circle of friends" discounts that the telcos use as a marketing tool.

Regards...jmcc
[1] A Supercruncher is someone analyses large sets of data to provide useful information or detect trends. In financial circles people doing this kind of work might be referred to as 'Quants'. In other fields, it could be Business Intelligence or Data Mining.

[Captain Con O'Sullivan]

Didn't know that about Supercrunchers- I'm well aware of Quants as they are the bedrock engineers behind trading platforms and hedgefund modelling as well. The hedgefunders recruit direct from Universities such as Imperial College in London (along with other agencies) to the extent that they put posters up around noticeboards directed at the math grads and Phd students offering handsome salaries.

The trouble is that the vast majority of people hand away information willy nilly as if they were distributing fivers along the street without even realising it. I'm in two minds about it really as the more people sign up for social networks under their real name and post their lives on them plus drop their 'friends' into the database as well the more people who DO manage information about themselves quietly are left off the emerging grid.

I'm treating it a bit like an entertaining game. I've got to the stage now where my name on a google search comes back with no returns or for people with the same name but ain't me- my boss doesn't even know where I live as I moved shortly after joining the company and forgot to update the records.

No junk mail. No jury service. I'm not even on the census as I was (cough) away on a short holiday abroad when the census was taken. The only thing left is tax records from my pay and I'm working on that.

Hopefully I'll be as far as the databases are concerned completely invisible by next year.

[jmcc]

The trouble is that the vast majority of people hand away information willy nilly as if they were distributing fivers along the street without even realising it. I'm in two minds about it really as the more people sign up for social networks under their real name and post their lives on them plus drop their 'friends' into the database as well the more people who DO manage information about themselves quietly are left off the emerging grid.The Tesco/Dunnes etc club cards are a great illustration of that point. Most people don't realise the data that can be derived from a shopping cart and it makes economic sense for the supermarkets to crunch that data to provide personalised offers to get people to buy more.


Hopefully I'll be as far as the databases are concerned completely invisible by next year.The trick is to rely on data silos (databases that don't supply data to other databases.).

Regards...jmcc

[C. Flower]

Bloody toolbars seem to me to be like flypapers, gathering stuff.

:(

[jmcc]

Bloody toolbars seem to me to be like flypapers, gathering stuff.

:(Yep. :) And Google Analytics, Google Adsense, Statcounter and all those other widgets.

Regards...jmcc

[Griska]

YouTube - iPhone4 vs HTC Evo

[Captain Con O'Sullivan]

IPhones are a bloody disaster from the point of view of data privacy I reckon. Even though my phone is an unregistered pay as you go job it has internet access but I don't use it at all as even using internet search on your phone regularly to and from work would reveal an awful lot about you and where you are going next when combined with the software to bring up ads for products you might be interested in.

Store cards are right out as far as I am concerned. The latest wheezy idea is for ads from stores to be beamed to your phone as you walk past them. You can imagine what sort of info that would give any database manager when combined with your buying habits.

I sometimes have to profile people and organisations as I work in a research field and it never fails to amaze me what is available on people, their friends, their pet dog, their hideaway in the hills just from open sources such as social networks and 'likes' on facebook front pages and so on.

[Apjp]

Yes but the Supercruncher [1] approach to that one is to examine your social network and compare it with similar ones from other data sets. Naturally this would require more than one set of data.

Well it would be an excellent tool for location based marketing.

What Google was doing was nasty. Technically it was wardriving - moving around areas looking for WiFi connections and snarfing data including e-mail content, usernames and passwords.

A few years ago, a researcher in AOL accidentally released a set of searches that had been conducted on AOL's search engine interface. I think that one of the main US newspapers managed to analyse the data to such an extent that they were able to identify individual users even though the identification data had been scrubbed and replaced. John Battelle (a tech commentator) referred to what Google (and other search engines) had at their disposal as a "database of intentions". The AOL data confirmed this as some of the searches were related to future intentions and actions.

The danger of relying on technology journalists (I have a far greater respect for the journalists in the WSJ than I have for some Irish technology journalists. I've dealt with a few in the past and their approach is eons ahead of what passes for tech journalism in Ireland.) for analysis of such issues is that they are not specialists and often are Arts types with little detailed understanding of the technology, capabilities, possibilities or limitations of the use of the data. Their reaction is often one of unknowing fear whereas the Supercruncher's response is to see the possibilities arising from the use of such data. The irony is that these outliers are actually making themselves more obvious because they exist uniquely in particular social networks. And then there is always those "circle of friends" discounts that the telcos use as a marketing tool.

Regards...jmcc
[1] A Supercruncher is someone analyses large sets of data to provide useful information or detect trends. In financial circles people doing this kind of work might be referred to as 'Quants'. In other fields, it could be Business Intelligence or Data Mining.

what about android samasungs? They're touchphones, but not iphones. I'm looking at getting one as me phone, although it works fine here and in France, is 7 years old. And i need a new camera too as well as wanting proper ringtones. Would I be tracked too? If anyone tells me how to get pogues ringtones and if the smartphones all track then i'll happily stick with the one i have. This brick couldn't be tracked.

[Apjp]

IPhones are a bloody disaster from the point of view of data privacy I reckon. Even though my phone is an unregistered pay as you go job it has internet access but I don't use it at all as even using internet search on your phone regularly to and from work would reveal an awful lot about you and where you are going next when combined with the software to bring up ads for products you might be interested in.

Store cards are right out as far as I am concerned. The latest wheezy idea is for ads from stores to be beamed to your phone as you walk past them. You can imagine what sort of info that would give any database manager when combined with your buying habits.

I sometimes have to profile people and organisations as I work in a research field and it never fails to amaze me what is available on people, their friends, their pet dog, their hideaway in the hills just from open sources such as social networks and 'likes' on facebook front pages and so on.

The reality is though most people don't care. I mean they can send us all the adverts they like-does it honestly mean you'll change yer corn flakes for shreddies? I mean I have had the same phone for over seven years and I only now will consider getting a new one for 14 years. Bur really, are we fussing over what is merely used for junk mail and so on? I mean Steve Jobs isn't gonna care if me dogs name is Toby and I like bringing him with me in the car as I drive upto the mountains and open forests with a different woman every weekend. Though there are extremities-if the govt. uses cloud computing national information such as that in the census could become widely available to MNC's at large. Are we overplaying this? Just how serious is it? And is it only Iphones? What about Samsung and Sony ericcson androids?

[Captain Con O'Sullivan]

Its mostly harmless of course and only to do with commercial tracking of consumers. The problem comes with access to that system by police or state agencies with malicious intent. Someone's life could be effectively halted by a computer operator- bank account frozen, cards cancelled or notified as stolen, passport flagged, identities 'accidentally' slipped on to watch lists which would be nightmarish to sort out. There's nothing to stop a computer operator doing all that to an activist inside an hour.

On the other hand technology is useful in that all demonstrations and police actions at those demonstrations can be recorded and used as evidence against the old police backing up each other evidentially for example with the Tomlinson case at G20 demos where a cop essentially struck a man who was guilty of nothing with a baton and set a dog on him before rushing up behind him and pushing him over from behind. Tomlinson had a heart attack and died and the cop had come up with some hokey story that he had felt threatened by Tomlinson.

The photos taken on phone cameras show a very different story to the one the cop wanted put about. In that case also there were three different autopsy opinions given- directly at odds with each other on important points. The option accepted by the police was from a pathologist who had been censured three times as a police witness before the Tomlinson case.

Used the right way technology can be pretty good but the potential for damage exercised by malignant authority is so easy that it should have much better safeguards around it.

The Blair government in the UK opened up and allowed the sale of electoral register details to commercial companies which should never have been allowed. There should be 'opt-in' rules to databases tied to reward rather than having to battle to keep your life private.

[Apjp]

Its mostly harmless of course and only to do with commercial tracking of consumers. The problem comes with access to that system by police or state agencies with malicious intent. Someone's life could be effectively halted by a computer operator- bank account frozen, cards cancelled or notified as stolen, passport flagged, identities 'accidentally' slipped on to watch lists which would be nightmarish to sort out. There's nothing to stop a computer operator doing all that to an activist inside an hour.

On the other hand technology is useful in that all demonstrations and police actions at those demonstrations can be recorded and used as evidence against the old police backing up each other evidentially for example with the Tomlinson case at G20 demos where a cop essentially struck a man who was guilty of nothing with a baton and set a dog on him before rushing up behind him and pushing him over from behind. Tomlinson had a heart attack and died and the cop had come up with some hokey story that he had felt threatened by Tomlinson.

The photos taken on phone cameras show a very different story to the one the cop wanted put about. In that case also there were three different autopsy opinions given- directly at odds with each other on important points. The option accepted by the police was from a pathologist who had been censured three times as a police witness before the Tomlinson case.

Used the right way technology can be pretty good but the potential for damage exercised by malignant authority is so easy that it should have much better safeguards around it.

The Blair government in the UK opened up and allowed the sale of electoral register details to commercial companies which should never have been allowed. There should be 'opt-in' rules to databases tied to reward rather than having to battle to keep your life private.

Im betting our census is also open to MNCs considering CACI is the company operating it-an MNC too, right?

[Captain Con O'Sullivan]

The Americans have been trying like blazes to get hold of European databases to add to their SWIFT financial system and the NSA resources.

I don't know whether you've seen the Bourne films which featured a system called '*Echelon*' where a whizzy computer tracking system featured heavily in the plot using security CCTV at street level and phone tracking?

The Americans spent years denying such a system existed and an eventual EU investigation dig some digging and came to the conclusion that the *Echelon* system certainly did exist and was in use by the NSA.

It probably isn't as swish as the one depicted for dramatic purposes in the Bourne films but it exists alright. Tie that in with satellite systems that can photograph an individual walking down a city street and you are into Orwellian territory.

Nothing much for the average citizen to worry about but the implicit threat behind it is if you pissoff someone with the authority to flag you to the system then your life can get turned upside down automatically. Where does that leave dissent and activists?

[Apjp]

The Americans have been trying like blazes to get hold of European databases to add to their SWIFT financial system and the NSA resources.

I don't know whether you've seen the Bourne films which featured a system called '*Echelon*' where a whizzy computer tracking system featured heavily in the plot using security CCTV at street level and phone tracking?

The Americans spent years denying such a system existed and an eventual EU investigation dig some digging and came to the conclusion that the *Echelon* system certainly did exist and was in use by the NSA.

It probably isn't as swish as the one depicted for dramatic purposes in the Bourne films but it exists alright. Tie that in with satellite systems that can photograph an individual walking down a city street and you are into Orwellian territory.

Nothing much for the average citizen to worry about but the implicit threat behind it is if you pissoff someone with the authority to flag you to the system then your life can get turned upside down automatically. Where does that leave dissent and activists?

For americans I agree its bad. I'd like to see them use it for harassment here. Wouldnt work. The safest place to be it would seem, as far as privacy is concerned, is in deppest africa where theres no electricity!

[Starfire]

It begs a privacy law were anyone would be in breach as an inquisitor even state organisations including police who will use access as the 'security' excuse.

[Captain Con O'Sullivan]

Aye. There's definitely a mission creep going on with regards to data collection. I've my suspicions as well that the Gardai may not have the resources to go that route yet in Ireland but it wouldn't surprise me at all if the Irish digital exchanges are linked in quietly to the UK grid and processed via a famous horse racing festival town in the home counties (G*C*H*Q).

Perhaps too paranoid but with digital exchanges and a small population and also given the increase in cross border cooperation it wouldn't surprise me at all.

[Kid Ryder]

Aye. There's definitely a mission creep going on with regards to data collection. I've my suspicions as well that the Gardai may not have the resources to go that route yet in Ireland but it wouldn't surprise me at all if the Irish digital exchanges are linked in quietly to the UK grid and processed via a famous horse racing festival town in the home counties (G*C*H*Q).

Perhaps too paranoid but with digital exchanges and a small population and also given the increase in cross border cooperation it wouldn't surprise me at all.

This would be the facility you are thinking of. Ministry of Defence hid microwave phone-tap tower inside nuclear plant (http://www.lamont.me.uk/capenhurst/original.html)

BTW the existence of this 'facility' was exposed by the author of this website (Richard Lamont) in April 1999. To date, no Oireland Inc. govt. has ever protested the violation of Irish citizens' privacy by British spies working this listening post. In fact, Oireland Inc. security agencies (AGS Crime & Security Branch, G2) may have been getting transcripts of calls listened into there, but not 'officially' since the Capenhurst tower was operating illegally under UK law. No doubt this was also part of the ECHELON network, as it fits into the whole covert RAF sigint complex which is/was a significant chunk of ECHELON's infrastructure (Menwith Hill (north Yorkshire), Bude (Cornwall), etc.). British commercial interests in Ireland may have been sold confidential information on their competitors 'intercepted' by this site, as there is evidence presented to the European parliament as part of their ECHELON debates/inquiry that this did happen in other cases and in other countries.

It is believed that this base stopped being used by spooks in 1994. The listening tower was demolished in 2004. The locus of Britain's snooping on Ireland's telecommunications is now somewhere else. It is quite likely to be based in the six counties now, or maybe even in the south. It is quite likely the exchange systems that O2, Meteor and Vodafone use have back-doors for use by her majesty's spooks. Privacy of citizens' communications is a great concept, but the principle has never been honoured by any state power, and the electronic age has simplified snooping and extended its scope no end.


The RAF has often acted as a `front' organisation for GCHQ and its American big brother(!), the National Security Agency. The radio intercept station at nearby Cheadle, Staffs was known as `RAF Cheadle', and `RAF Menwith Hill' in Yorkshire is the site of the largest American intelligence gathering base outside the USA itself.

For decades, NSA, GCHQ and other partner agencies have attempted to tap many different international communications links, [6][7] but this is the first time a covert terrestrial microwave intercept has been found in the UK.

The tower appears to have been operated from about 1990 to 1994, when apparently it was abandoned. Recently it came onto the market, along with hundreds of other defence sites, for sale to private owners. Several mobile phone companies have been to have a look at it and it was not long before engineers who visited the site guessed its sinister purpose.

The 'follow-up' page is well worth looking at too: The Capenhurst Tower (http://www.lamont.me.uk/capenhurst/followup.html)

[Captain Con O'Sullivan]

It is hardly surprising as the whole of Britain has been a giant US spying station on the rest of Europe since world war two.

I think even De Gaulle gave that as one of his reasons for vetoing British entry to the Common Market twice in the 60's saying openly that Britian was no more than an American colony.

He was right as well. Or as Ronnie Reagan once remarked; 'Britain. Our unsinkable aircraft carrier.'

I wouldn't doubt for a second either that the Gardai have access to British intercepts in Ireland and very likely from a station in Northern Ireland. I'd be surprised if G2 didn't have some kind of request system in place with the British/GCHQ. Which means the British have access at will to digital telecommunications in Ireland.

It wouldn't be such a tough task either as Ireland is relatively small, has digital exchanges which means a computer software system streaming information would only have to flag up calls to and from watch-list mobile phones or otherwise act off flagwords to relay a copy to a human listener in Northern Ireland or Cheltenham.

If you put that together with abilities like the software which analysed the calls between mobiles between the 7/7 bombers in London where you don't even have to hear the calls but just analyse the patterns of numbers called in a group to figure out which one was in command of the operation then things start to become really interesting.

[Captain Con O'Sullivan]

Kind of strange too when you think of all the companies you deal with that all have a little note on the bottom of their phone contacts page which says 'Calls may be monitored for training purposes'.

I've never heard of any company using real customers for staff training purposes. They are pretty much exclusively done by scenario training.

The reason in the UK for that note on the bottom of such paperwork is because it is illegal in the UK to run surveiilance including recording someone without their permission and is inadmissible as evidence in court. There are exception for emergency services and defence people of course.

Its the corporate legal get-out clause that allows them to record all incoming calls if they want to by claiming it is for training purposes.

[Count Bobulescu]

Just to demonstrate that CNET is worthwhile. You can sign up for various interweb emails.


http://news.cnet.com/8301-31921_3-20056344-281.html?part=rss&subj=news&tag=2547-1_3-0-20&tag=nl.e703

[C. Flower]

Google Street cars grabbed personal data from unprotected wifi systems they passed - fine of 47 million.

http://www.independent.ie/world-news/google-to-pay-47m-privacy-fine-29126103.html