Mobile Phone Use Patterns Identify Individuals Better Than Fingerprints

← Back to Stories (view on slashdot.org)

Mobile Phone Use Patterns Identify Individuals Better Than Fingerprints

Posted by Soulskill on Wednesday March 27, 2013 @12:12AM from the but-not-conveniently-etched-on-your-thumb dept.

chicksdaddy writes "Mobile phone use may be a more accurate identifier of individuals than even their own fingerprints, according to research published on the web site of the scientific journal Nature. Scientists at MIT and the Université catholique de Louvain in Belgium analyzed 15 months of mobility data for 1.5 million individuals who the same mobile carrier. Their analysis, 'Unique in the Crowd: the privacy bounds of human mobility' showed that data from just four, randomly chosen 'spatio-temporal points' (for example, mobile device pings to carrier antennas) was enough to uniquely identify 95% of the individuals, based on their pattern of movement. Even with just two randomly chosen points, the researchers say they could uniquely characterize around half of the 1.5 million mobile phone users. The research has profound implications for privacy, suggesting that the use of mobile devices makes it impossible to remain anonymous – even without the use of tracking software."

58 of 88 comments (clear)

Min score:

Reason:

Sort:

Many thanks for this submit ! by Taco+Cowboy · 2013-03-27 00:25 · Score: 3, Interesting

I learn something very useful today !!
It really sends chills up my spine reading TFA --- it IS that easy to identify and track and predict the location of any individual based on what TFA has outlined !!
Man ... I think I gotta get more cellphones with different phone companies, that way I can rotate the use of the phones to cut down of the chance of being identified

--
Muchas Gracias, Señor Edward Snowden !
1. Re:Many thanks for this submit ! by Anonymous Coward · 2013-03-27 01:52 · Score: 1
  
  Man ... I think I gotta get more cellphones with different phone companies, that way I can rotate the use of the phones to cut down of the chance of being identified
  I just give mine to my toddler for eight hours a day.
2. Re:Many thanks for this submit ! by Anonymous Coward · 2013-03-27 08:25 · Score: 1
  
  Man ... I think I gotta get more cellphones with different phone companies, that way I can rotate the use of the phones to cut down of the chance of being identified
  How would that help? The same math also applies to cameras and face recognition.
  Take some images of you walking down street A, shopping at supermarket B, getting coffee at store C, and walking past bank D, all captured at different times on different days. That is enough to establish a mobility fingerprint that uniquely identifies you.
  The really horribly brutal punchline: changing your habits in an attempt to hide just makes you easier to identify.
Construct the Big Brother by puddingebola · 2013-03-27 00:32 · Score: 2

And there I was, seriously considering running out and buying a dumbphone and a pay as you go plan, and then more news of the Orwellian nightmare we are all dilegently constructing. Isn't there some wisdom in smashing your computer with a hammer and throwing your cell phone in the toilet?
1. Re:Construct the Big Brother by Seumas · 2013-03-27 00:42 · Score: 1
  
  It's called "being unemployed", which is the result most Slashdotters would face if they threw away their phones and computers that they, you know, do their job on.
2. Re:Construct the Big Brother by Anonymous Coward · 2013-03-27 00:47 · Score: 1
  
  Sure there is some wisdom in that but it will only help to save you. And with the millions of rodents using privacy destroying services like for example Failbook and Ogle, soon you will stand out clearly as an outcast and cannot even take a shit without an account. So while intuitive, this is a wrong solution. The actual solution is to keep everybody safe so Big Brother will not get a beachhead. We must affect dramatic legal changes and demand our civil rights. The predatory corporations must be stopped.
  https://www.eff.org/
3. Re:Construct the Big Brother by alen · 2013-03-27 00:50 · Score: 1
  
  smash the old style phone as well because a combination of your address and calling patterns can identify you just as well
Re:I did not consenet by SJHillman · 2013-03-27 00:32 · Score: 5, Insightful

You signed a TOS or contract for a cell phone. Go read it and you'll find you consented to a lot of things. Except lube, you opted out of that.
+5 Bullshit by Anonymous Coward · 2013-03-27 00:34 · Score: 1

A use pattern is NOT comparable to a unique and unchanging physical characteristic as an identification method.
1. Re:+5 Bullshit by SJHillman · 2013-03-27 00:35 · Score: 3, Interesting
  
  For many people, changing their fingerprints is easier than changing their cell phone habits.
2. Re:+5 Bullshit by SJHillman · 2013-03-27 07:04 · Score: 1
  
  "Can you use it to tell where I went?"
  If you know what my fingerprints look like, but I wear gloves then you can't tell where I went either. Unlike most cell phone articles, this one is about identifying a person - not locating them. A very important distinction given that location is part of the formula needed to identify.
3. Re:+5 Bullshit by DKlineburg · 2013-03-31 21:51 · Score: 1
  
  Based on your comment and theirs I would say they are identified. Identified as someone who doesn't carry there phone much. Only shows up for short periods of time. If on is mostly likely at one location, their house. That would be unique in comparison to those who have there phone full time. Use on the same bus route at the same time to the same job to the same bus route to the same home 5 days a week.
  
  --
  Memory is deceptive because it is colored by today's events. - Albert Einstein
Re:I did not consenet by swilde23 · 2013-03-27 00:35 · Score: 2

Not that you really have a choice, but which link in the Humancentipad do you want to be?

--
There are 10 types of people in the world. Those that understand this sig, and those that beat up people who do.
Profound implications! by openfrog · 2013-03-27 00:35 · Score: 4, Insightful

Profound implications for privacy... The analogies are perplexing. Should I also worry about the fact that I have ten fingers with ten fingerprints at the end of them (not mentioning toes) means that it is impossible for me to have privacy? Recent research on 1.5 Million users shows that phone numbers uniquely identify subjects 100% of the time. That does not sound like this has profound implications for privacy, does it? Now admittedly, they talk about randomly chosen "spatio-temporal points", meaning, if you think of it, that you have a good chance at any time, of being either at home or at your place of work. But since your phone number already identifies you, the profound implications for privacy referred to in the article somehow escape me...
1. Re:Profound implications! by gmclapp · 2013-03-27 00:49 · Score: 2
  
  Well said. Consider this hypothetical: You're looking for a specific person, the only information you have about them is their phone number. So, to identify them, you pick two random cell phone towers that their phone linked to and try to determine who they are.... But you already know who they are... I feel pretty safe knowing that people with that level of common sense are chasing me...
  
  --
  Common Sense (+1)
2. Re:Profound implications! by foniksonik · 2013-03-27 01:12 · Score: 3, Interesting
  
  Here's what it does mean.
  With access to this data (even if its through an abstraction API), I could match back a profile created based on one device (using a device ID) with a new device owned by the same person.
  So lets say I'm a retailer and I want to track your visits to my stores based on your device ID. That works and is anonymous assuming that I'm not allowed to access your PI directly (as is the case). I can of course ask you to identify yourself through an app or whatnot to attach a name/email to you and match that to my CRM system.
  Now the problem is that when you change devices, pow, I'm out of luck for the anonymous tracking (the app would transition easily enough and could be cross platform, assuming you have an incentive to get it again).
  However with this abstracted "fingerprint" API I could conceivably request a match back for your new device against the database and get your old device ID in response, voila - anonymous transition of the profile to your new device. I can now continue tracking you with no lost history.
  
  --
  A fool throws a stone into a well and a thousand sages can not remove it.
3. Re:Profound implications! by Anonymous Coward · 2013-03-27 01:15 · Score: 1
  
  Profound implications for privacy... The analogies are perplexing.
  And again, RMS has predicted it twenty years in advance. But people just never learn...
4. Re:Profound implications! by openfrog · 2013-03-27 01:39 · Score: 1
  
  Here's what it does mean.
  With access to this data (even if its through an abstraction API), I could match back a profile created based on one device (using a device ID) with a new device owned by the same person.
  So lets say I'm a retailer and I want to track your visits to my stores based on your device ID... with this abstracted "fingerprint" API I could conceivably request a match back for your new device against the database and get your old device ID in response, voila - anonymous transition of the profile to your new device. I can now continue tracking you with no lost history.
  Mmmmh! You begin with the proviso: "With access to this data"...
  Well if you have access to this data, you will not be a retailer...
5. Re:Profound implications! by silanea · 2013-03-27 01:41 · Score: 4, Insightful
  
  The issue is not that they can tell which phone number you use, obviously. As I see it there are three problems with this kind of tracking technology:
  Firstly they could potentially track you across devices based on your behaviour. Think "disposable" phones. Sure, here in the Western world those are mostly used by criminals, so being able to track them may appear to be a good thing. But such technology usually ends up in the hands of repressive regimes.
  Secondly, mass surveillance is not just about you as an individual. By looking at where you go when and how long you stay there and correlating this with who else goes there at the same time one can make deductions about social networks within society without ever looking at one person up close. We already have a rampant practice of police doing what is in German called "Funkzellenabfrage": they request the names of every person logged into one specific radio cell at a given time. Essentially hundreds or thousands of people are made into suspects based on one point of data and consequently investigated, often to the point of harassment.
  And, even more importantly, algorithms can tell when you deviate from your regular pattern. This is the Next Big Thing in the security theatre. And I for one do enough "random" stuff to be worried that I may in the future find myself singled out by law enforcement based on what some computer says. Geo-caching alone should make my movements stand out quite a bit from the general population. Just look at the abundance of issues with existing "dumb" solutions like the US no-fly list or the European anti-terror watch lists.
  
  --
  Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.
6. Re:Profound implications! by openfrog · 2013-03-27 02:07 · Score: 1
  
  The issue is not that they can tell which phone number you use, obviously. As I see it there are three problems with this kind of tracking technology:
  Secondly, mass surveillance is not just about you as an individual. By looking at where you go when and how long you stay there and correlating this with who else goes there at the same time one can make deductions about social networks within society without ever looking at one person up close.
  I am with you on abuse from repressive regimes. But when you say "with this technology", I fail to understand. All the uses and abuses you mention are already not only possible, but routinely done by repressive regimes, and some. "This technology" adds nothing to the equation, except perhaps marginal cases where they would want to track you "across devices".
  In this regard, I can only find that the profound implications mentioned in the article are not so much profound as they are obscure.
7. Re:Profound implications! by h4rr4r · 2013-03-27 02:09 · Score: 1
  
  Odds are the person holding the phone is the owner.
  This might not be 100% of the time, but I bet it works 90% of the time. Which is good enough.
8. Re:Profound implications! by IwantToKeepAnon · 2013-03-27 02:53 · Score: 1
  
  But since your phone number already identifies you, the profound implications for privacy referred to in the article somehow escape me...
  Of course it does and the phone company already knows you, your #, your address, etc... That's not the point. What about mapping software? You tell google (or whomever) I am at coordinate A and need to go to coordinate B. You didn't volunteer your phone # but by mining logs you can be identified (at least as user X if nothing else). The implications is that just about any app you run has the potential to track you even if you don't sign in w/ an account or volunteer any personal information.
  
  --
  "Happy families are all alike; every unhappy family is unhappy in its own way." -- Anna Karenina by Leo Tolstoy
9. Re:Profound implications! by fearofcarpet · 2013-03-27 04:12 · Score: 1
  
  The implication isn't so much that someone can say "I'm looking for openfrog" and then find you through your cell phone habits. Law enforcement can easily just ask your cell carrier "where is openfrog" and they instantly know the last cell tower that you were on and track you in real time. This practice is akin to dusting for prints or checking last known addresses; it happens when there is a reason to look for an individual.
  The privacy implication is that data that are considered "anonymized" are valuable commodities that drive the Big Data economy. What this research suggests is that such data are not at all anonymous and therefore probably shouldn't be treated as such. We make an implicit deal at the moment to let cell carriers monetize anonymous statistics for, in theory, lower prices, just like we agree to use "free" websites by sacrificing some personal information. But if those data can so easily be used to reveal the identities of random people, that implicit deal is invalid, and I would imagine that the majority of people would not agree to be tracked by their cell phone companies just so they can make an extra buck. I for one would find it creepy to start seeing targeted ads in GMail for the specific businesses that I pass on my way to work.
  It also raises questions about regulating such data. "Anonymous usage statistics" probably aren't that closely regulated, controlled, or protected. But if a criminal organization got a hold of them they could effectively case hundreds or thousands of homes remotely, with a high degree of certainty, and with no chance of being caught (as opposed, for example, to being parked in a van across the street for a week.)
  In other words, it not really about the identity of a specific individual, it is about the ability to resolve the identities of large numbers of individuals at random. It would be like having all of the usernames on /. suddenly replaced with real names.
  
  --
  Actually, I wrote my thesis on life experience.
10. Re:Profound implications! by Bengie · 2013-03-27 05:05 · Score: 1
  
  The point isn't that they can identify who you are, but can have good reason to understand that you are the same anonymous person, entirely based on your habits. Even if your phone number was randomly generated every day, they could still track you, because you are the only person who does what you do the way that you do it.
11. Re:Profound implications! by Artraze · 2013-03-27 06:43 · Score: 1
  
  So, am I to understand that the point of your post is that they can connect the ID from your old phone to the ID of your new phone?
  Still a total non issue.
  Consider:
  > I can of course ask you to identify yourself through an app or whatnot to attach a name/email to you and match that to my CRM system.
  Well, wouldn't the new device offer the the same app and attachment? Why worry about the fingerprint when the person put their id/email into an app and sent it to you?
  I'm still with the OP: this identification is a non-issue. You already have an IMEI identifying your phone and a SIM/SSN/etc identifying your account/number. Quite possibly you even have a name/email for your store. Anyone that could come up with this fingerprint, well, would have to already have those things in order to collect the info needed to fingerprint to begin with. What more does this provide?
  If the notion is that this would allow someone to logically link, say, a prepaid burn phone to someone's contract phone I find that highly dubious. If you have two devices they are almost certainly for two different situations: thus, two different fingerprints. It's not like you randomly decide which phone you're taking shopping on a given day.
12. Re:Profound implications! by demonlapin · 2013-03-27 07:30 · Score: 1
  
  Or you could just buy a phone with a removable battery.
13. Re:Profound implications! by cffrost · 2013-03-27 07:55 · Score: 1
  
  Recent research on 1.5 Million users shows that phone numbers uniquely identify subjects 100% of the time.
  
  Do you have a link to that research? It sounds incredible, due to loaning, theft, caller ID spoofing, etc.
  
  --
  Thank you, Edward Snowden.
  
  "Arguments from authority are worthless." —Carl Sagan
14. Re:Profound implications! by DKlineburg · 2013-03-31 22:00 · Score: 1
  
  So what I hear you saying is I know phone one does xyz. xyz is unique. I than look for any phone I don't know about that does xyz, and test to see if phone 2 doing xyz is same person? is stretch, but as someone below said would only really identify people using burners, and the number changes, but the pattern doesn't. drug dealers may throw away there phone, but I bet they sell at the same locations.
  
  --
  Memory is deceptive because it is colored by today's events. - Albert Einstein
15. Re:Profound implications! by DKlineburg · 2013-03-31 22:02 · Score: 1
  
  It might be lower, I don't know. (70% of statistics are made up anyway). I know my immediate family have 3 phones. I can get 1-3 people at any one given time. Does that mean that it is like I will get a random person? No, but it is food for thought.
  
  --
  Memory is deceptive because it is colored by today's events. - Albert Einstein
Re:What if... by SJHillman · 2013-03-27 00:46 · Score: 1

This world of cell phone ubiquity, a lack of a phone can be the biggest identifier of all.
"An unknown person was spotted at location X at 3:45pm on a Thursday. There were no cell phone signals in the area at that time. It must be John Doe, he's the only one in that area that never uses a cell phone at that time on a Thursday."
Privacy? by tsa · 2013-03-27 00:47 · Score: 1

The research has profound implications for privacy, suggesting that the use of mobile devices makes it impossible to remain anonymous – even without the use of tracking software.
We've known that since the 1990s. Why get all upset about that now?

--
-- Cheers!
1. Re:Privacy? by rwise2112 · 2013-03-27 00:56 · Score: 1
  
  This is a little different though. They were tracking the device before, but now if you change phones withhout your carrier's knowledge your usage on the new device still identifies you as an individual.
  
  --
  
  "For every expert, there is an equal and opposite expert"
Re:What if... by Dins · 2013-03-27 00:48 · Score: 1

Smoke signals?
We always knew that by Hentes · 2013-03-27 00:51 · Score: 5, Insightful

But now we also have scientific proof that when carriers sell our cell data claiming it has been anonymized they are lying. There's no such thing as anonymous location data.
1. Re:We always knew that by confusedwiseman · 2013-03-27 01:00 · Score: 2
  
  This is the key point that should get action, but won't.
2. Re:We always knew that by Bengie · 2013-03-27 05:07 · Score: 1
  
  Anonymized means just that, to be anonymous. They still don't know who you are, only that you're the same person. Anonymous: "(of a person) Not identified by name; of unknown name."
3. Re:We always knew that by Hentes · 2013-03-27 06:30 · Score: 1
  
  As I said, there's no such thing as anonymous location data. Once they know where you live and where you work, all it takes is a Google search to find out who you are. What this research has shown is that breaking up the data to small timescales doesn't help either.
start calling random numbers by alen · 2013-03-27 00:52 · Score: 3, Interesting

all this proves is that most people do the same thing every day. wake up, go to work in the same place, hit the same cell towers and call the same people
i bet if you start calling random numbers every day it might make it harder to identify you
1. Re:start calling random numbers by hrvatska · 2013-03-27 01:32 · Score: 1
  
  Your normal calling pattern would still be there even with the background noise of random calls. It would take a bit more processing to tease that pattern out, but it could still be identified. Calling random numbers would be more of an inconvenience for you and the people receiving those calls than the software analyzing your call patterns.
2. Re:start calling random numbers by Laxori666 · 2013-03-27 02:57 · Score: 2
  
  Then you'll be easily identifiable as one of the only ones that makes all those random calls.
3. Re:start calling random numbers by IwantToKeepAnon · 2013-03-27 02:59 · Score: 2
  
  all this proves is that most people do the same thing every day. wake up, go to work in the same place, hit the same cell towers and call the same people
  i bet if you start calling random numbers every day it might make it harder to identify you
  'spatio-temporal points' ... 'uniquely identify 95% of the individuals, based on their pattern of movement'. Your argument is faulty.
  
  --
  "Happy families are all alike; every unhappy family is unhappy in its own way." -- Anna Karenina by Leo Tolstoy
Druglords by spectrokid · 2013-03-27 00:55 · Score: 4, Insightful

The one use I can see here is tracking criminals who use throw-away phones. Unless the "spatio-temporal points" are dependent on your phone model of course. (No I did't read the article...)

--
10 ?"Hello World" life was simple then
Re:What if... by Anonymous Coward · 2013-03-27 01:09 · Score: 2, Funny

Far more elaborate than that, he talks out his arse
Re:And moreover... by JustOK · 2013-03-27 01:21 · Score: 1

FBI = Facebook International?

--
rewriting history since 2109
95% confidence is not "unique" identification. by EmagGeek · 2013-03-27 01:36 · Score: 1

"Your honor, we are 95% sure the fingerprints we recovered from the murder scene belong to the defendant."
Can't leave your fingerprints at home by PPH · 2013-03-27 02:05 · Score: 1

It has been known for some time that when one wants to commit a crime, one leaves their mobile at home.

--
Have gnu, will travel.
Re:What if... by h4rr4r · 2013-03-27 02:20 · Score: 1

Good for you, those of us with jobs gave up the freedom for the paycheck.
Schedule flight mod by jago25_98 · 2013-03-27 02:47 · Score: 1

Schedule flight mode. Schedule email and SMS checking.
Why won't /. let me post smartass short replies? :p

--
A blog I run for the wealth
Re:What if... by IwantToKeepAnon · 2013-03-27 02:56 · Score: 1

Area Man Constantly Mentioning He Doesn't Own A Television

--
"Happy families are all alike; every unhappy family is unhappy in its own way." -- Anna Karenina by Leo Tolstoy
VOIP over tunnels? by Herve5 · 2013-03-27 02:58 · Score: 1

Oh yes, you are THIS slashdot user, the only one, that does this. I identified you very easily :-D

--
Herve S.
1. Re:VOIP over tunnels? by pushing-robot · 2013-03-27 06:12 · Score: 1
  
  And the obligatory comic.
  
  --
  How can I believe you when you tell me what I don't want to hear?
Edges of the Bell Curve by Venotar · 2013-03-27 03:05 · Score: 1

I wonder how this research would have shifted if they'd only sampled geo-cachers and Ingress "agents"
Nothing new here, move along now. by Jane+Q.+Public · 2013-03-27 04:15 · Score: 2

The VERY SAME result -- within margin of error anyway -- was found like 10 or 12 years ago. There is absolutely nothing new here.

All this tells us is that law enforcement and other 3rd parties should not be allowed to get their hands on your cell phone location data without a warrant.
Hello World, The Solution... by DontScotty · 2013-03-27 04:19 · Score: 2

regarding... "makes it impossible to remain anonymous â" even without the use of tracking software."
Hello World -
You are carrying a PHONE. Your PHONE is a mobile phone, and requires a radio link to the local tower to connect your call.
Yes, this means that a system must be able to locate you to deliver your connection, and maintain your connection while you move from cellular tower to cellular tower.
You must chose:
1) If you want to remain anonymous, then have your radio information delivered to you by one-way-broadcasting. Turning on your car-radio allows you to receive the broadcasts, without actively revealing your location. Drawback: it's not a conversation.
2) If you want to have a two-way conversation, then you're going to have your call routed to you, and your radio phone sending back. You will not now, nor never will be anonymous in this scenario.
The solution: make choices based on your values. Stop waiting for a Deus ex Machina.
If societal norm is carrying a phone, and you chose not to - then you are in sync with your values, and not society.
Similar to a person who chooses a "car-free" lifestyle, biking 20 miles each direction for a work commute. Not typical, but not harmful to society. People might think it's odd, but will either adapt (or, stop inviting that person to breakfast meetings at the office, because they are stinking of sweat :-) )
In conclusion: It's your life. Choose. Choose with the understanding that no two way radio phone conversation is anonymous.
Home address + job = unique identifier by coldsalmon · 2013-03-27 07:13 · Score: 1

This is very unsurprising. Most people spend the majority of their time at home or at work, so location information will give you those two data points. If I gave you my address and my employment and you told me my name, I would not be very impressed. Why is anyone surprised or impressed by the results of this research?
One group that defies their tracking analysis by WebManWalking · 2013-03-27 10:20 · Score: 1

In a recent Slashdot poll, 7% of all respondents didn't have a mobile phone. I'm one of them.

Not having a mobile phone doesn't mean you're paranoid about privacy. It could just as easily mean that you're waiting for the technology to mature. I notice that everyone seems to hate something: hardware quality, hardware cost, no signal, dropped calls, awful sound quality, basic service cost, roaming charges, long term contracts, etc. The list of complaints goes on and on.

Why do you guys put up with that crap? They never address the basic problems. They dangle flashy new features in front of you, you eagerly gobble them up and then gradually you realize that you still have the same old litany of problems hobbling your new gadget.

Vote with your money. Use land lines till they solve the fundamentally flawed user experience. In the meantime, you don't have to worry about your phone use identifying you better than fingerprints.
Re:I did not consenet by swilde23 · 2013-03-27 12:17 · Score: 1

Whoever marked this insightful... good job!
teehee

--
There are 10 types of people in the world. Those that understand this sig, and those that beat up people who do.
Re:And moreover... by JustOK · 2013-03-31 22:01 · Score: 1

no, F you

--
rewriting history since 2109