No hiding place

Posted on 10 Nov 2009 at 12:53

• 
• 
• 
• 
• 
• 
• 

 1 of 7

Gallery

"To protect user privacy, the Gears Geolocation API server does not record user location. However, third-party sites may do so, and we recommend that users only allow websites they trust to access their location," the company says.

The problem is that, for most users, it will be very difficult to keep track of which sites they have given permission to trace their location. With an ever-widening pool of sites with access to that information, the potential for data leakage grows exponentially.

"Most of these people are reliable and responsible, and so are the phone companies who already have access to location trace information," says Philippe Golle, a security and privacy expert at the Palo Alto Research Center. "But more and more people are signing up to location-based services, often with smaller companies. That means more people have access to the traces, and the more people that have access, the more chance there is of somebody leaking, losing or stealing that information."

One suggestion for reducing the impact is to scale back the accuracy so only the town or neighbourhood rather than the exact address is available, but even introducing this fuzzy layer of geo noise won't mean that people aren't able to identify you and your address from the data, even if you conceal your name.

"Anonymised geolocation data can easily be traced back to the person if anyone got hold of the records," says Golle. "It's easy to identify the place they spend the most time, which is usually home, and then the second most time, which is the office. Even if that data is anonymised, there are many people who are unique in where they spend their time, so it's very easy for anyone to work out who you are."

But is there really any reason to be concerned? Can the world's corporations, the authorities or even gangs of cybercriminals really do anything harmful by knowing your movements throughout the day?

"There are lots of people who'd like to see what you are up to and where you go," says Golle. "Imagine if your health insurance could see how often you went to a fast-food restaurant - they might up your premium based on your diet. Or a car insurance company could see how fast you drive on the motorway and up the price. That's to say nothing of how many divorces there might be."

Although internet tracking is the biggest growth area in geo-placement, mobile phone tracking is the oldest of the common geolocation standards, and still remains fairly accurate. The phone companies have known where you are for several years. They need the information to pass your call from one cell to another as you move through their range. They retain that information for regulatory purposes - so the police can demand your details if your phone has been logged near a murder scene, for example.

However, the potential for abuse of mobile phone tracking technology is huge. Companies such as traceamobile.com offer services to both parents and employers that allow them to track the whereabouts of any phone that's signed up to the service. These services show the location of a registered phone on a map in a web browser, following its movement in real time. This has major privacy implications if abused. Privacy advocates have criticised just how easy it is for an employer or parent to give a snooping phone to workers or children without informing them.

Traceamobile says it sends out occasional text messages to the phone to remind or alert them that they are being tracked, but privacy campaigners have in the past complained that it is far too easy to "borrow" someone's phone, set up the service, then hand back the phone - all primed for its role as a mobile snooper.