Guest Blog by Brenda McAllister¹

GPS offers fantastic benefits, but there's almost no protection for the staggering amount of data it reveals about people. That needs to change!

 

What's GPS?

Global Positioning Systems (GPS) consist of a set of medium altitude satellites controlled from a handful of ground stations.

Each satellite has an extremely accurate clock and emits a data and timing signal beamed at earth. GPS receivers use those signals to determine their location anywhere on Earth, expressed as latitude, longitude and altitude.

Currently there are three global systems, one operated by the USA, another operated by Russia, and a European Union system with even higher accuracy, coming fully online over the next few years.

Additionally, China has a regional system it plans to expand to global coverage, and there are independent regional augmentation systems operated by Japan and India.

A vast array of devices have GPS receivers in them, including most modern vehicles, many tablets, almost all recent mobile phones, and a tremendous variety of other hardware. The receivers are used to locate the user's position anywhere on Earth with impressive precision.

For example, a GPS-enabled app on a smart phone can tell the difference between your waiting in line or standing at the counter of a fast food restaurant.

This is astonishingly useful, but as you'll see the type of device is critically important, most especially if in addition to providing location data to you, it's also capable transmitting it to someone else. 

 

How does it work?

The position of each satellite at any given instant is known with tremendous precision. By measuring the time it takes for signals from several satellites to simultaneously reach your device, the distance your device is from each one can also be known with great precision, just as if you instantly stretched invisible measuring tapes.

From there simple geometry takes over in a process called triangulation to determine the receiver's position on earth to within about 2 meters (6 feet) or better. Even greater accuracy is planned, sufficient for example, to tell if you switch hands while talking on your phone.

Supplementary ground-based transmitters can also be installed in special cases to improve  accuracy to within a centimeter (less than half an inch). 

Two other methods augment geolocation when GPS reception is poor or impossible. A mobile device with cellular capability can be triangulated from nearby cell towers to within about 20 meters (about 66 feet), and sometimes much more accurately using increasingly common phased-array antennas and something called multipath analysis.

Additionally, mobile devices with WiFi can derive geolocation from nearby routers, even if they're not connected, by looking up the router names (SSIDs) in remarkably comprehensive databases of known routers and locations.

 

The benefits are almost incalculable

Geolocation technology can automatically land airplanes, guide your drive across counties or continents, and help emergency services find you for the fastest assistance possible.

And of course, there's the military uses for which GPS was originally designed, including high-precision weaponry. 

It also enables a vast array of scientific and industrial applications, everything from measuring volcanic swelling to automatically steering farm equipment (and soon, cars). 

 
GPS technology ensures the accuracy of survey instruments, guides flight paths and measures the movement of buildings after an earthquake. With the appropriate in-vehicle devices, GPS technology can reduce (or increase!) your insurance rates depending on how you drive, locate lost or stolen items, and if enabled, show you where family members are at any given moment. 

In short, GPS is a modern 'miracle technology'. Unfortunately, like most things in life, it also has a dark side.

 

Who do you trust?

Imagine how you'd feel if a nosey neighbor planted a GPS tracking device in your car and watched every move you made. Would you be ok with that? 

Probably not. Most of us would be very upset because armed with detailed information about your whereabouts, such an individual could cause great harm. Of course, the problem is not so much the data itself, but the intention of those who possess it. 

Almost everyone understands that the location of their device can be tracked. And most people are ok with it because they assume that if it's happening at all, it's being done by well-regulated agencies authorized to make a permanent record of their minute-to-minute path through the world each day, and for good reasons.

And they'd be right, if only it were true. It's not. 

 

But so what?

Is a person's location data really so sensitive as to warrant concern?

For most people the answer is no, not especially. Do I really care who knows that I drove to the convenience store, or which aisles I walked down?

But what if my destination is a courthouse, or a therapist's office, or perhaps a specialized women's clinic? 

 

What if the accuracy is enough to tell who I'm with to within a meter or two (3 to 6 feet), and how long I'm there?

What deeply personal conclusions could they draw? 

Or what if in order to make ends meet, I work a second job that my employer would frown on, and my geolocation data reveals my regular presence there?

Damn, now I care.

Worse still, what if rather than an authorized government agency looking at the data, instead it's hundreds of companies of all sizes, employing thousands of people with access to it, all with the intent to sell or otherwise use the data? 

And what of unintentional problems, as one completely innocent farming family discovered? Or the beleaguered folks living in a house in Ashburn, VA, where 17 million IP address were mapped (because there are a number of large data centers nearby, but someone goofed — now fixed). A recent analysis shows that there are thousands of such "default" mappings.

So beyond intentionally intrusive uses of location information, there's also virtually no protection against mistakes, negligence or intentional abuse.

 

GPS: Global Personal Surveillance?

It's a facile myth that sensitive GPS information is known only to well-supervised organizations with a legitimate purpose.

For example, a weather app I recently installed asked me to grant access to my location data so it could provide personalized forecasts. That sounded sensible and I agreed.

But then I thought, hey, wait a minute. Is my location being used in some way other than to tell me it's going to rain? I wondered, what else might come down on my head?

 

So I dug up as much technical documentation as I could find, and I read all 31 pages of the license agreement. I found what I feared: Every minute or so the app sends my location back to the people who made it, and thus to their business partners, whoever they might be. 

Interesting. Basically their app is free because they can instead make money by selling who and where I am, day and night, rain or shine.

Simply by using a weather app my path through the world is known to a stunning degree of accuracy to thousands of people with access to that data. Mostly those are advertisers who buy the data from the people who make the weather app, but in principal it could be anyone. 

Learning that, I became curious about what would happen if I changed my settings to deny the app access to my device's location services.

And guess what? it wasn't a problem at all… the next time I ran the app it asked for my location, which I told it manually by typing in my zip code (more than accurate enough for a weather forecast). I had to enter it only once, it remembered it from there.

Now, rather than a moment to moment track of my whereabouts, the only thing that gets sent back to their servers — and hence sold to others — is my zip code, which is fixed no matter where I go.

 

A little or a lot?

If a simple weather app is doing this, then what else is? I decided to find out, so I dedicated an evening to reading the license agreements for a lot of the apps I've installed over the years. 

Turns out that many apps periodically send information about me from my device to their servers. Sometimes it's anonymized (such that they can only see that someone female age 35-44 was in this place or that), but mostly it's not, and they know my name, address, phone number and each specific place I went, all the time.

The Pew Research Center examined this for slightly over one million different Android apps, and discovered that 217,304 request approximate geolocation data from the devices on which they are installed, and another 247,420 apps request precise location data.

So it's not just some weather app, an astonishing total of 464,724 (44%) different apps want to know where you are.

Even more staggering, 859,684 (82%) of all Android apps request direct access from the app code to the internet. Some of that's perfectly innocent, of course, but for free apps, it also likely includes sending a lot of data about you to the makers of the app so they can monetize you — basically it's how they can afford to give the app itself away or sell it for just a buck or two.

 

What does it mean to me?

Although it's a bit of an oversimplification, essentially it means that an astonishing number of people have unfettered access to extremely detailed histories of your movements.

For example, the people who produce the fruit juice I serve my kids know that I left work an hour early yesterday. And that my husband and I were at a bar on Saturday. And that I was in a medical clinic last Tuesday for 4 hours. That's right, the orange juice company knows all that.  

Seriously?  Yes.

Just by noticing that I'm regularly in a different office two evenings a week, and that my husband is home with the kids on exactly those same two evenings (yes, he has the same weather app), they can also easily deduce that I'm moonlighting a second job.

That's something that although not prohibited by my employer, could put me in a difficult spot should it become known, despite the fact that it's my own private time to do with as I see fit.

I once thought that the chances such information were to somehow make its way into the public domain and then to my employer were vanishingly small. But now I'm not so sure what might pop up on some new website, whether legally or illegally.

My teenagers have smart phones too. To me it's right that I should know where they are, but is it right that companies of all sorts also know which street my daughter's walking down at any given moment, or which rack of hygiene products she's presently standing in front of in the drug store?

Shopping malls are also in the game, leveraging both GP and supposedly free WiFi to track your every move, analyzing who you are and what you buy in an effort to get you to spend more.

The list goes on and on.  

 

Beyond Smart Phones

There's a great image of a device the size of a quarter affixed under the seat of a bicycle, sold under the brand name TrackR. Take a look.

This device is a clever integration of low-power bluetooth technology with the GPS reporting capabilities of mobile devices it happens to be near. You can purchase these inexpensive devices for $29 each (or buy 4 and get 4 more free) and attach them to valuable items to find them when they go missing.

A functionally identical technology is also sold under the "Tile" brand. Attach these little things to your valuables, and you'll know where they are all the time. Sounds good.

But wait… what if someone wanted to track you? How hard would it be to stick one of these things on your car, motorcycle or bike, covered with a strip of black tape? How often do you check under the seat? Even if you did spot it, would you recognize it for what it was and not something normally part of the car?

On their website they say it works anywhere in the world, which only makes sense because GPS works anywhere in the world. The devices are cheap, and no subscription is required. According to them, they've built a potent global collection of subscriber's devices.

My concern is not for how the device is supposed to be used, I think it's a great product². My worry is about how it might be abused by anyone with a few bucks. This is GPS surveillance for the masses, with absolutely no control over who tracks who beyond a tepid advisory that "…we do not advise that TrackR be used on people. We would recommend that you look into live GPS tracking service instead".

But that's merely advice, not even a prohibition. As a practical matter, what's really to stop someone from misusing the technology? Essentially anyone can become 007, with companies like TrackR being analogous to Q branch.

Of course, for years there have been other means to accomplish the same thing, but it's been costly (for example, here, here, or here).

But with the advent of technology this cheap, what concerns me is that anyone could surreptitiously track another person with only trivial expense and effort.

 

Build it and they will come

We are seeing an increasing number of apps with sophisticated geolocation used as a fundamental 'currency' in exchange for being able to use the app for free. This is especially true for games such as Pokémon Go, as discussed in this blog.

These apps are designed such that geolocation is baked in as an essential part of what the developers hope will be a gaming experience so compelling that you'll be willing to overlook the fact that they are tracking you and selling that information. 

Many will go to great lengths to avoid mentioning that this is the real reason they give you the game for free.

Don't buy into that, it's an illusion. Nothing is ever free. 

 

It's even in your pictures

Are you aware that pictures taken with a smart phone or recent digital camera have GPS data embedded in them, in addition to information about the camera or smartphone itself? 

Even today most people don't know that, nor do they understand that this can have seriously alarming implications whenever they upload or share a picture. 

Speaking of pictures...

 

What's next?

It's fascinating to consider what impact improving or emerging technologies might have on these issues in the near future. Here are a few developments I think deserve our attention:

• Increasingly accurate composite geolocation services, literally enough to tell which pocket your phone is in.
• The kind of low-power detection / location tracking used by TrackR, but built right into the operating system so every device can do it.
• Longer-lasting and more power-dense batteries, allowing longer run times and greater volumes of data transmission.
• Richer and more fine-grained cellular coverage (microcell and picocell) able to triangulate using land-based signals with far greater accuracy.
• An increasing diversity of applications, including in such exciting areas as virtual reality, again monetized using data about users sold to whomever wants to buy it.
• More comprehensive databases of mobile devices, routers and owners, allowing the GPS tracks of different people to be correlated across place and time.

Remember, the servers to which these apps send your GPS data have an exhaustless capacity to save your personal trail through life, potentially for a very long time.

Almost none of it is protected by law, and currently most of it is extremely vulnerable to hacking because it's not considered sensitive enough to deserve even the basic protections afforded to things like credit card information or medical records. 

This data will soon be so comprehensive that 10 years from now almost anyone will be able to find out where you were this past Tuesday at 2:34pm, what you were doing and who you were with, with a reliability far better than you yourself could possibly remember it.

 

What can I do?

The single most important action you can take is to revoke geolocation permission for every app that's not absolutely essential to you, carefully considering which apps you really need in the first place. As I discovered with the weather app, that usually doesn't have much of a negative effect.

Beyond that, what we should all do is press our legislators to recognize geolocation tracks as being sensitive personal information and create laws to better protect it.

Perhaps the biggest concern of all is also among the most surprising: as the Royal Academy of Engineering pointed out years ago, what do we do if the system fails? This is entirely possible if we get hit with a bad enough solar flare, or if it's attacked by some belligerent force, either physically or via hacking.

It's an important life lesson not to become too dependent on any one thing, but that's exactly what's happening.  By all means use GPS, but don't throw away your old maps just yet.

 

And finally…

We often hear people say, "I don't need privacy, I'm not doing anything wrong". But that confuses privacy with criminality. 

You're not doing anything wrong when you undress at night or use the toilet, yet you still close the door. Doesn't information about where you go and who you're with deserve at least that much respect?

If you found this blog informative please like us on Facebook... just click this button: 

 

---

 

1. Guest blogs contain noteworthy sentiments, but do not necessarily reflect the opinion of management.

2. MetaLuminous has no affiliation with the makers of TrackR or Tile, or their business partners.