iPhone and Location: Don't Panic

stonemirror writes "There's a lot of blind panic out there over the discovery of a database file on the iPhone which contains dated location information. Without actually looking at the data, a lot of folks have proclaimed that the 'iPhone is tracking your every move.' I actually did take a look at the data, and it's not doing anything like that."

Comments

Anecdotal

[RocketRabbit]

This story is entirely anecdotal. Sure, it may not be tracking your "every move" but we have no way of knowing if this guy's phone was even on for his whole train ride (for example).

His conclusion is "We don't know why Apple is collecting this information but it's not a big deal." What the hell? How do we know it's not a big deal?

Sorry, Apple, you guys fucked up. A random blog-pologist isn't going to save this one for you.

Re:Anecdotal

[Anonymous Coward]

and saying that its OK because 'it isn't accurate' is just fucking stupid. This type of personal intrusion cannot be accepted.

if we don't take action now, we'll settle for nothing later.

Re:Anecdotal

[Pieroxy]

The most interesting thing in the article is the last sentence:

[UPDATE: Exactly the same kind of information seems to be getting stored on Android phones. Here's an application you can use to dump it out...]

So Apple users know they're not alone ;-)

Re:Anecdotal

[h4rr4r]

This "but my friends are all doing it too" argument did not work when I was a kid and I don't see how it holds water now.

Re:Anecdotal

[tripleevenfall]

Agreed.

It's not enough to say "Well, you agreed to the TOS" when you know full well nobody reads it. If you are tracking my physical movements, I should have to opt-in to that in an obvious way.

It doesn't even clearly state that this stops if you turn off Location Services, or what happens to the backed up files if you do.

Re:Anecdotal

[Americano]

No, but it is interesting that another platform is doing similar things. Understanding why it happens on Android may provide insight into why it's happening on iOS, as well.

Re:Anecdotal

[Lumpy]

Personal intrusion? your cellphone provider has a nice database of your every move that is accurate. They've had this for years. THAT is what you need to be outraged about, not a file that is safely on your phone that is not sent to anyone.

Re:Anecdotal

[Anonymous Coward]

Wow. Not only is Apple trying to track your every move, but they also suck at it.

Re:Anecdotal

[Qwavel]

It's not the same kind of information at all. The android file (only available if you have root) is a temporary cache. That is totally difference then the Apple file which holds the data about your location since you bought the phone.

The fact that he considers them the same, and the rest of his article, make it clear that he is merely some obscure, inaccurate, apologist.

With this story being reported all over the Internet, by media and blogs both respectable and ridiculous, why did /. choose to use this ridiculous one. /. seems to have turned into a sort-of FOX news of tech discussion - without even a pretense of objectivity.

Speaking of which, here's one of my favorites pieces so far. A Forces columnist asks whether this discovery (of the Apple location history file) is cool or creepy and concludes that it is cool. She decides that it is actually a great feature and pushes Google to get to it and see if they can come up with a similar feature:
http://blogs.forbes.com/kashmirhill/2011/04/20/cool-or-creepy-your-iphone-and-ipad-are-keeping-track-of-everywhere-you-go-and-you-can-see-it/

So maybe the blog post that /. choose for this whole saga is not actually the worst piece written on the topic.

Re:Anecdotal

[Anonymous Coward]

There's a lot of stuff thats being reported about this that is somewhere between sensationalist and wrong. The "researchers" who published this have been pretty sloppy in what they are claiming. I've helped out police forces with using extracting and trying to use this data, over a number of years so I've a reasonably good idea what is there and what isn't.

The data is not new to iOS 4, it has been there at least back to iOS 2, its just the name of place that it is stored is different.

This existence of this data isn't secret, the use of this data is the subject of a session for Apple Developers at the World Wide Developers Conference each year - usually something like "Using Location Services in iOS" or similar in title.

The location data is not the GPS location of the user, it is the location of cell towers the phone can see. All the location data is time stamped, and stamped with the carrier network ID, and the ID of the individual and there's no way you can be in 3, or 6, or 9 different locations at the same time. Depending on how many cell towers were visible, all this tells you is that the phone was within maybe a few km, but up to 25-50km of the tower. If you then take that data and use it to triangulate the users location, you'd typically get a location that was at best accurate to a bit under 1km, and more likely a few km.

The collecting of the data isn't continuous, it appears to be event based. Anecdotally - the phone waking from sleep and reconnecting to the carrier network appears to be one of the events, as is rebooting the phone, and re-connecting to the carrier's network when you come out of a dead spot. It seems plausible, that it may also be snapshotted every time Location Services is fired up, eg by launching the Maps App and consenting to use of location services. That pattern of even driven acquisition would explain the differences that various people out there on the net report.

Similar data is also being tracked and logged by the carrier, but in their case, its harder to get to as it is sitting on carrier systems on their internal network. That is true for all phones. In this case, the data is pretty easy to get to if you have physical possession of the phone.

Thats good enough to tell that you actually went off to Hawaii with your mistress when you told your wife you were going on a work trip to California, but for most people , most of the time, it will only be pretty vague as to where they where - knowing that you are in Baltimore when thats where you live and work isn't that big a revelation.

If the user of the phone opts out of Location Services, the file isn't updated. This is done from Settings.

Like all files that need to be read/written in the background by the system, its always readable to root - it isn't readable (directly) to Apps , although they benefit from it indirectly by Location Services calls responding faster. If you jailbreak your phone, then Apps can read this data and transmit it for their own purposes.

Files in that data protection class can be recovered off the filesystem over USB tether. Technically it is encrypted, but the encryption is really only of use for a fast remote wipe of the device, and it isn't being encrypted in a class that increases the security of the data.

It does reside in the backup, so thats certainly a good reason to always encrypt your iPhone backups and use a strong passphrase for them.

Apple has also been clear in its earlier deposition response as to how user location data is anonomised when it is collected.

Its entirely possible that the persistence of the file is actually a bug - I can see why it would be useful to cache it for a few days to maybe a month at the high end, but back to the start of the epoch seems excessive. In my view its the persistence of the file thats the biggest issue. That not hard for them to fix.

So its bad, but its not where near as extreme a situation as what some people are saying.

Re:Anecdotal

[BlueStrat]

It's not an invasion of privacy if your privacy hasn't been invaded. No-one has access to this file unless you fail to lock your phone, or fail to protect your PC.

Unless you get stopped by the Michigan State Police with your phone in your possession. This was covered here a short time ago.

http://slashdot.org/story/11/04/19/2231240/Michigan-Police-Could-Search-Cell-Phones-During-Traffic-Stops

The more data your phone collects, the more you risk giving to the State. All I carry is a disposable phone with the battery removed in the glove box for emergencies.

Of course, one *could* open the phone and disconnect pin 2 and pin 3 (the 'Data +' and 'Data -' pins) of the micro-USB connector. They can't slurp what they can't connect to. The phone would charge normally, but unless you install a secret/internal switch to re-enable the pins you won't get any data in or out of that connector.

When their toy fails to steal your data and they question you, just say "You broke my PHONE with that stupid toy!?!? What, are you gonna wreck my car or torch my house with some other new toys there, "Inspector Gadget"? I hope your department's budget can take the hit for a new phone!".

It's still a new device and patrol officers are likely unfamiliar enough with the finer points of the new concepts, equipment, & techniques involved here that they may just suddenly be in a hurry to be done with you and send you on your way in such a scenario.

I wonder when someone will publish a "Surviving The Police State For Dummies" how-to book.

"Interesting times", indeed.

Strat

The Point

[tripleevenfall]

The point is not what it's currently doing, the point is (a) what COULD be done (by Apple, a malevolent third party, whomever) simply because this information exists when it should not and (b) whether this level of personal tracking information should be stored in the first place without it being clear to the user.

Perspective

[bennomatic]

It's interesting that on /. when the Fukushima reactor issue began, there appeared to be two camps forming: one that said, "maybe we should be concerned about this,' and another that said, "fucking libtards are going to use this as an excuse to push for tougher limitations on the expansion of nuclear power in other countries!"

With this issue, the two camps appear to be coming down to, "this may not be a huge issue; hopefully Apple will begin truncating this file with an upcoming update" and "fucking Apple fanbois will take anything that His Steveness rams up their rear! This is an outrage!"

It'd be interesting to track the outrage quotient on various issues and see where various /. users land on that chart. I wonder how many people who are vigorously defending nuclear power are busting a blood vessel over this iPhone thing.

Re:Anyone tried the Android version?

[subspacemsg]

Yes i just dumped out the data from my Android Phone, it's got 3 days worth of location information. It does not have GPS based location, seems like a temp cache for Apps to get location based on Cell tower/Wifi data. The Iphone data described seems far more extensive.....

Not remotely the same thing

[jdev]

The info on Android phones is totally different from iPhones. The infamous iPhone log file records your complete geo-location history since you started using your phone. The Android log file just records your recent coordinates and it overwrites itself regularly.

So even if you get root access on an Android phone, you only end up getting your current location. Most people allow apps to have that permission anyways.

The info on the iPhone is a huge privacy concern. The Android file is a non-issue.

What difference does it make?

[Tangential]

Get over it.

When you decided to turn on a cell phone, you gave up any semblance of privacy that your location has. Worst of all, that data isn't stored in a file you can clear on your phone...It is stored in servers at kind and gentle companies like AT&T and Verizon where it is imminently available to most any agency that needs it.

Google sets cookies in your browser and tracks your location by IP address on every query you make (or map you hit or gmail you read or ...) Your ISP does much the same thing. How are they less dangerous to your privacy?

If you really want to remain anonymous and not be tracked then don't have or use a cell phone or 3G data service. Don't have any internet service. Constantly clear your browser temp files/data and store them only in a ram disk. Also, change your mac address every time you connect in any way to the internet. Better yet. Pick a random library and use their computer.

Staying away from credit/debit cards would be a good idea as well. Just use cash and buy gift cards.