4 ms·

What honest purposed TelCos would have to even sell this data? all of them replied saying "we will cut clients not following the program guidelines"... what ar

by gcbw2 8y ago

What honest purposed TelCos would have to even sell this data? all of them replied saying "we will cut clients not following the program guidelines"... what are those guidelines?! and why is that arbitrary for the companies to decide, and not mentioned anywhere on the consumer agreements other than some vague "we may share your data with whoever"? This sounds like Cambridge Analytic for TelCos.

kevcampb 8y ago
Providers who uses these services need to agree to follow guidelines such as obtaining opt-in, sending notifications to devices being tracked with option to opt-out by replying with STOP, etc. The guidelines are not enforced or audited.
- rhacker 8y ago
  I wonder why the opt-in wasn't performed by the telco itself!!! I'm just learning about this whole thing now and I'm very upset.
  - wlesieutre 8y ago
    Right, if the cell company says user consent is required it ought to text them "X is requesting permission to track your location, reply YES to allow" And provide a straightforward mechanism of checking what has had access, what still has access, and a way to revoke it.
    - AnimalMuppet 8y ago
      Well, most of the clients of this service are law enforcement. "The FBI is requesting permission to track your location, reply YES to allow"? Yeah, that's not going to happen. But as I read the article, the location data is only at the resolution of which cell tower they're connected to. Doesn't 911 get better location info than that?
      - k_sh 8y ago
        I'm not certain what the actual product uses, but the LocationSmart demo posted here last week had three data sourcing options: "[Cell Tower], AGPS, Best Available"
      - Fnoord 8y ago
        What if law enforcement knew? What if this was an intentional backdoor for law enforcement to abuse? I know, you can apply that on any vulnerability (what if X knew), "don't assume malice [...]", merely hypothetical but still.
    - Consultant32452 8y ago
      I worked for a "household name" towing insurance company years ago. Often times people calling in don't actually know where they are, because it's on a highway somewhere unfamiliar. We integrated with a service provider to be able to get the GPS through the phone. It worked largely like you suggest, we hit an API, it asks them permission, they grant it, we get GPS.
      - arm 8y ago
        Would that be Geico? They were mentioned doing that in the comment here¹: “It's funny that this is coming up now. The other day I was on the phone with Geico's roadside assistance and they wanted to know my location. I told them I didn't have their app downloaded, they said it wasn't a problem and they could get it without it. Sure enough they could. I checked their disclaimers [1] and they purchase the data from my cell carrier. They didn't even have to know which one. [1] https://www.geico.com/web-and-mobile/mobile-apps/roadside-assistance/ https://www.geico.com/web-and-mobile/mobile-apps/roadside-as... (see disclaimers at the bottom)” ―――――― ¹ — https://news.ycombinator.com/item?id=17082583 https://news.ycombinator.com/item?id=17082583
      - gcb0 8y ago
        One I called 911 to report someone driving on the wrong side of a freeway. I was half sleep in the passenger seat and didn't notice we were on another interstate already. When i said "on highway A" the operator corrected me "don't you mean highway B?" and she was right. I did not get any GPS alert on my phone or confirmation, which given the service I was calling I think it was fine. It is definitely based entirely on inferred data from cell tower usage. No gps involved whatsoever.
0xfeba 8y ago
Don't worry though, they really support NN even though they want the NN rules gone...
monort 8y ago
Maybe they even don't sell the data, it's a vulnerability of SS7 protocol. https://www.ptsecurity.com/upload/iblock/8c0/8c065c70984c93d3001234ed6e6d865b.pdf https://www.ptsecurity.com/upload/iblock/8c0/8c065c70984c93d...
- nneonneo 8y ago
  The telcos are almost certainly selling it. Verizon used to have a page noting that LocationSmart was a "Network API Partner": https://archive.li/tCLrd https://archive.li/tCLrd
- kevcampb 8y ago
  To do this you need access to the SS7 network. I don't believe this is the issue in question, as the providers have APIs for partners doing location services. Source: I used to have direct access to such an API

by gcbw2 8y ago

kevcampb 8y ago

Providers who uses these services need to agree to follow guidelines such as obtaining opt-in, sending notifications to devices being tracked with option to opt-out by replying with STOP, etc. The guidelines are not enforced or audited.

rhacker 8y ago
I wonder why the opt-in wasn't performed by the telco itself!!! I'm just learning about this whole thing now and I'm very upset.
- wlesieutre 8y ago
  Right, if the cell company says user consent is required it ought to text them "X is requesting permission to track your location, reply YES to allow" And provide a straightforward mechanism of checking what has had access, what still has access, and a way to revoke it.
  - AnimalMuppet 8y ago
    Well, most of the clients of this service are law enforcement. "The FBI is requesting permission to track your location, reply YES to allow"? Yeah, that's not going to happen. But as I read the article, the location data is only at the resolution of which cell tower they're connected to. Doesn't 911 get better location info than that?
    - k_sh 8y ago
      I'm not certain what the actual product uses, but the LocationSmart demo posted here last week had three data sourcing options: "[Cell Tower], AGPS, Best Available"
    - Fnoord 8y ago
      What if law enforcement knew? What if this was an intentional backdoor for law enforcement to abuse? I know, you can apply that on any vulnerability (what if X knew), "don't assume malice [...]", merely hypothetical but still.
  - Consultant32452 8y ago
    I worked for a "household name" towing insurance company years ago. Often times people calling in don't actually know where they are, because it's on a highway somewhere unfamiliar. We integrated with a service provider to be able to get the GPS through the phone. It worked largely like you suggest, we hit an API, it asks them permission, they grant it, we get GPS.
    - arm 8y ago
      Would that be Geico? They were mentioned doing that in the comment here¹: “It's funny that this is coming up now. The other day I was on the phone with Geico's roadside assistance and they wanted to know my location. I told them I didn't have their app downloaded, they said it wasn't a problem and they could get it without it. Sure enough they could. I checked their disclaimers [1] and they purchase the data from my cell carrier. They didn't even have to know which one. [1] https://www.geico.com/web-and-mobile/mobile-apps/roadside-assistance/ https://www.geico.com/web-and-mobile/mobile-apps/roadside-as... (see disclaimers at the bottom)” ―――――― ¹ — https://news.ycombinator.com/item?id=17082583 https://news.ycombinator.com/item?id=17082583
    - gcb0 8y ago
      One I called 911 to report someone driving on the wrong side of a freeway. I was half sleep in the passenger seat and didn't notice we were on another interstate already. When i said "on highway A" the operator corrected me "don't you mean highway B?" and she was right. I did not get any GPS alert on my phone or confirmation, which given the service I was calling I think it was fine. It is definitely based entirely on inferred data from cell tower usage. No gps involved whatsoever.

0xfeba 8y ago

Don't worry though, they really support NN even though they want the NN rules gone...

monort 8y ago

Maybe they even don't sell the data, it's a vulnerability of SS7 protocol. https://www.ptsecurity.com/upload/iblock/8c0/8c065c70984c93d3001234ed6e6d865b.pdf https://www.ptsecurity.com/upload/iblock/8c0/8c065c70984c93d...

nneonneo 8y ago
The telcos are almost certainly selling it. Verizon used to have a page noting that LocationSmart was a "Network API Partner": https://archive.li/tCLrd https://archive.li/tCLrd
kevcampb 8y ago
To do this you need access to the SS7 network. I don't believe this is the issue in question, as the providers have APIs for partners doing location services. Source: I used to have direct access to such an API