Apple Tracks Location with iPhone, iPad Data (Your Location)

[You must be registered and logged in to see this image.]

Apple Tracks Location with iPhone, iPad Data

Hidden File Stores Devices' Position, Security Researchers Show

[You must be registered and logged in to see this image.]
By KI MAE HEUSSNER
April 20, 2011

If you've got an iPhone in your pocket, Apple could be recording where you go, a pair of security researchers revealed today.

Ahead of a presentation at the Where 2.0 Conference in Santa Clara, Calif., Alasdair Allan and Pete Warden published a description of their findings online at O'Reilly Radar, saying that the Apple iPhone and iPad 3G record the device's geographic position and corresponding time stamp in a hidden file. They said the data collection started when the company released its latest iOS4 mobile operating system.

"We're not sure why Apple is gathering this data, but it's clearly intentional, as the database is being restored across backups, and even device migrations," the researchers wrote.

Allen and Warden did not immediately respond to requests for comment. Apple also did not reply to an interview request from ABCNews.com.

Emphasizing that the recorded location data have privacy and security implications, the researchers said that files are unencrypted and unprotected and can be transferred to any machine synced with the device. Depending on when users installed the new operating system to their devices, their phones could be storing a year's worth of location history.

Web Application Plots iPhone Owners' Location History

To show users exactly what Apple's devices have recorded, Allen and Warden created a Web application that plots a user's iPhone data on a map. Once downloaded to the computer, users sync with their Apple device and the application scans through backup files to look for the hidden file with the location information. When it spots the file, the application shows the location history on a map.

"By passively logging your location without your permission, Apple have made it possible for anyone from a jealous spouse to a private investigator to get a detailed picture of your movements," the researchers said in the "frequently asked questions" section accompanying their application.

Researchers: Location Information Is 'Sitting in Plain View'

The researchers said they believe that the coordinates of the phone are determined by cell-tower triangulation. While the location data aren't always precise, they said the phones may have recorded up to tens of thousands of data points. However, there's no evidence that the data is being transferred beyond the devices or computers that sync with them, they said.

"The cell phone companies have always had this data, but it takes a court order to access it," the researchers wrote. "Now this information is sitting in plain view, unprotected from the world."

Aaron Higbee, chief technology officer and co-founder of mobile security firm Intrepidus Group, said that while this was the first he'd heard of the devices' tracking capabilities, his company can confirm that the files store historical location data.

"This is a good discovery," he said. "What's different in this location story is this one has a history, it's not just your point-in-time location."

Jealous Spouses, Hackers Could Exploit Data

While other rogue applications may be able to spot your location at a specific moment, this kind of tracking could be exploited by others for more nefarious reasons.

"There's a market out there for people worried about cheating spouses. I could see someone developing a app that could help open up this file and see where they've been," he said.

Cyber criminals also could create malware intended to grab a person's location history, he said.

"Things like this lead to other uses," he said. "Now, let's say you were speeding and you were required to hand over your phone to the officer? They could see where you were all day."

The location files may exist because Apple plans to roll out a future product using them or because they're an artifact of another feature on the phone, he said, but he agreed with the researchers that the discovery has privacy implications. While there isn't evidence that Apple is receiving location data now, he said, it's possible that a future operating system could retrieve it.

Apple Discovery Is Just Latest Example of Location Privacy Issues, Technologist Says

Digital rights advocates say that while the latest Apple discovery is worrisome, it's just one more example of the vulnerabilities related to location data.

"These location records can reveal a wealth of sensitive information about you: your attendance at a gun rally or prayer meeting, your frequent visits to a health clinic and more," said Chris Conley, a technology and civil liberties fellow at the ACLU of Northern California. "Control over this information needs to be in your hands, not Apple's."

If any good comes of this discovery, he said, it's that Apple is forced to answer some tough questions.

"I think people will be horrified to learn some of the places where their data is going," said Peter Eckersley, a senior staff technologist at the Electronic Frontier Foundation.

It's not just Apple that knows people's locations, but map providers like Google, cell phone companies and location-based services like Foursquare, he said.

"Location data is very sensitive," he said. It can reveal where you live and work, where you frequent for movies and dinner and even if you've spent the night at someone else's house.

Previously, Eckersley said, the EFF was concerned about location data stored with third-parties (like cell phone companies and location-based services), but this latest finding opens up another set of potential problems.

Once people realize how many parties can access their location data, he said, we will need to redesign our phones so that we can benefit from location-based services "without phoning home to 10 different mother ships showing where we are."

"The phone is such an intimate window into our lives," he said. "It needs to be treated with an appropriate level of caution."

[You must be registered and logged in to see this link.]

Why Are Apple, Google Tracking Your Phone?

[You must be registered and logged in to see this image.]
A man holds an iPhone at a shop of German telecommunications provider Deutsche Telekom in Berlin, Germany in this February 23, 2010 file photo. Sean Gallup/Getty Images

By KI MAE HEUSSNER (@kheussner)
April 22, 2011

Just days after researchers demonstrated that some Apple iPhone and iPad owners have had their locations tracked by their devices, another security researcher revealed that Android phones, which use Google's mobile operating system, store users' geographic information in a very similar manner.

Citing security analyst Samy Kamkar, the Wall Street Journal today reported today that Google has been collecting location data from its Android smartphones.

When the phone recognizes a wireless network (regardless of whether or not it's encrypted), it sends information, including GPS coordinates, "up to the mothership," Kamkar wrote on his website.

In a statement, Google said, "All location sharing on Android is opt-in by the user. We provide users with notice and control over the collection, sharing and use of location in order to provide a better mobile experience on Android devices. Any location data that is sent back to Google location servers is anonymized and is not tied or traceable to a specific user."

On Wednesday, researchers Alasdair Allan and Pete Warden revealed that, since Apple released its latest iOS4 mobile operating system, the iPhone and iPad 3G have been storing unencrypted and unprotected logs of users' geographic coordinates in a hidden file.
PHOTO:Â Why Are Apple, Google Tracking Your Phone?
Sean Gallup/Getty Images
A man holds an iPhone at a shop of German telecommunications provider Deutsche Telekom in Berlin,... View Full Size
PHOTO:Â Why Are Apple, Google Tracking Your Phone?
Sean Gallup/Getty Images
A man holds an iPhone at a shop of German telecommunications provider Deutsche Telekom in Berlin, Germany in this February 23, 2010 file photo.
Apple Tracking Users Watch Video
Online Photos May Give Away Your Privacy Watch Video
Angry Birds App Addiction Watch Video

In a post about their finding, Allan and Warden wrote, "We're not sure why Apple is gathering this data, but it's clearly intentional, as the database is being restored across backups, and even device migrations."

Apple has not responded to requests for comment from ABCNews.com.

Apple Letter Shows Company's Location Data Policies, Practices

Their research sparked criticism from digital rights activists and questions from lawmakers (not to mention a minor media frenzy).

But though the "discovery" was eye-opening for many Apple customers, it seems that the company had previously disclosed its location data practices in a letter to congressmen a year ago.

In response to a June 2010 letter from Congressmen Edward J. Markey, D-Mass., and Joe Barton, R-Texas, inquiring about Apple's privacy policy and location-based services, the company's general counsel Bruce Sewall wrote a letter explaining how and why the company gathers location data. The letter, dated July 2010, was unearthed and posted online by Wired magazine.

After emphasizing Apple's commitment to users' privacy, Sewall's letter said that to provide location-based services, Apple, its partners and licensees, may collect, use and share customers' precise location data, including GPS information, nearby cell towers and neighboring Wi-Fi networks.

But he added that the information is collected anonymously and the devices give users controls for disabling the location features. In addition to giving Apple customers the ability to turn off all location features with one "on/off" toggle switch, Apple requires applications to get explicit customer when it asks for location information for the first time.

Apple also stores the location information in a database only accessibly to Apple, the letter says.

But though Apple says that its location data practices support the services its customers want, analysts and activists say the practice still raises serious questions.

Aaron Higbee, chief technology officer and co-founder of mobile security firm Intrepidus Group, said that by collecting and storing information about users' locations, instead of just letting their phones rely on GPS technology, Apple and Google are able to speed up navigation applications and other popular location-based services.

"The theory is that by using this data, the phone can roughly figure out where it is quicker and enhance the experience for the user," he said.

Analyst: Who Else Could Access Your Location Data?

For Apple, other possible motivators could be targeted ads based on location or geographically-informed market analysis, Higbee said.

"But the bigger question is who else will find creative uses for this data in the future?" Higbee asked, adding that even though Apple may be using the information in a responsible manner now, there's no guarantee that things won't change in the future.

While Apple and Google may say the data is safe as long as users don't install malicious applications, it's still possible that crooks could create malware intended to access and exploit that location information.

And research shows that smartphone users are worried about sharing their location through their phones.
Apple Tracking Users Watch Video
Online Photos May Give Away Your Privacy Watch Video
Angry Birds App Addiction Watch Video

On the heels of this week's Apple news, research firm Nielsen released data suggesting that the majority of smartphone app users, especially women, are concerned about giving up their location via their mobile phones. In a blog post Thursday, the company said that 59 percent of women and 52 percent of men expressed privacy concerns when asked about location-sharing.

Peter Eckersley, a senior staff technologist at the Electronic Frontier Foundation, earlier told ABCNews.com that as people realize how many different parties can access their location information, they "will be horrified."

"Location data is very sensitive," he said. It can reveal where you live and work, where you frequent for movies and dinner and even if you've spent the night at someone else's house.

Once people realize where their location data is going, he said, we will need to redesign our phones so that we can benefit from location-based services "without phoning home to 10 different mother ships showing where we are."

"The phone is such an intimate window into our lives," he said. "It needs to be treated with an appropriate level of caution."

[You must be registered and logged in to see this link.]