8 ms·

Despite promises, cell carriers are still selling your real-time location data

225 points by jbegley 8y ago

mschuster91 8y ago
This is why "promises" and "industry self regulation" are meaningless. People need government to protect them from companies' greed, which here means: regulatory agencies with teeth. "Self regulation" only works when there is a monetary incentive for companies to keep their word, for example in ecological agriculture. As for mitigation, does anyone know if MVNO users are also subjected to their data being sold?
- ravenstine 8y ago
  Are today's government officials more starstruck with or paid off by big corporations than they were back in the Microsoft antitrust era? Big business gets away with so much bad behavior today but, in the US at least, it seems like years go by and nobody cares enough to pass regulation to preserve the basic right to privacy.
  - torpfactory 8y ago
    With notable exceptions, today's political campaigns are often financed by wealthy individuals and companies. The type of politicians which receive contributions are, unsurprisingly, the type whose views best align with those individuals and companies. This funding is instrumental in lifting many of these politicians into office. When a question of political control or regulation of companies arises, it is also unsurprising that these politicians often see things from a certain perspective.
    - rayiner 8y ago
      Corporations aren’t allowed to “finance” “political campaigns.” When OpenSecrets says stuff like “Google” contributed $X million to Democrats, it’s lying. What really happens is Google employees contributed that money.
      - torpfactory 8y ago
        While on paper there is are still limits on direct contributions to campaign organizations, the Citizen's United decision (combined with SpeechNOW vs. FEC) enables companies to instead donate to SuperPACs which are in theory independently controlled. I personally believe the distinction is for all intents and purposes meaningless. Doubly so when considering how little enforcement of the separation has actually been pursued. So, yes, I do believe companies finance political campaigns. Whether the money flows through campaign organizations is not an important distinction to me.
        rayiner 8y ago
        It’s not a matter of what you “believe.” In election law, the “campaign” is a specific thing and financing it is something with specific meaning. Having an independent entity run ads because it happens to support that candidate is not “financing the campaign.” Leaving that aside, SuperPACs account for just 15% of election spending in 2016. It’s inaccurate to even suggest that corporate money and money from wealthy donors is the dominant factor in campaigns.
      - harpastum 8y ago
        While this is technically true, it's de facto false. With the Citizens United ruling, corporations can donate unlimited funds: "[Super PACs] can raise funds from individuals, corporations, unions, and other groups without any legal limit on donation size."[1] [1] https://en.wikipedia.org/wiki/Political_action_committee https://en.wikipedia.org/wiki/Political_action_committee
        rayiner 8y ago
        SuperPACs can’t use that money to “finance campaigns.”
      - joeyo 8y ago
        For most intents and purposes this changed with Citizens United v FEC.
      - 8y ago
  - rayiner 8y ago
    We’re in a decades long reaction to government regulation that pervades the west. The government used to tell airlines and trucking companies what routes they could sell and what prices they could charge. That level of government regulation proved to be such a disaster, that everybody abandoned it starting in the 1980s. As a result, you have an entire generation of administrators, on both sides of the aisle, who grew up with an extreme aversion to government intervention.
  - wilde 8y ago
    The Republican Party’s official position is that business should be as unregulated as possible [1]. So we shouldn’t expect to see any regulatory action under Republican administrations. Obama focused on blocking mergers among companies with products that they charged consumers for. It looks mainly like the precedent of consumer harm is undefined when the products are free to start with, and no one has gone back to try to patch the hole. [1] https://gop.com/platform/restoring-the-american-dream/ https://gop.com/platform/restoring-the-american-dream/
  - dangwth31337 8y ago
    Dozens of politicians are elected over and over. Richard Byrd from Virginia retired from the Senate in 2010 after 51 years. That's the current "record". It's similar in the House. John Conyers just stepped down due to scandal after 52 years. IMO, that there are no term limits is absurd. Thomas Jefferson got it: https://www.monticello.org/site/jefferson/quotations-jefferson-memorial#Panel_Four https://www.monticello.org/site/jefferson/quotations-jeffers... As we've improved our understanding of the human brain through neuroscience, and how can see that ideals will get lodged in people's brains and not change, having people serve that long just leads to stagnant idealism controlling politics.
- SonnyWortzik 8y ago
  c'mon lets get real, 'Self Regulating' means someone actually has to be honest of something but as long as there is profit to be made, honesty takes a back seat.
  - WillPostForFood 8y ago
    Things like the MPAA rating system seem to work, even though it is against the financial interests of studios.
  - wutbrodo 8y ago
    No it doesn't. Self-regulation is often motivated by 1) collective action problems where coordination benefits every company in a way that individual action wouldn't or 2) to ward off govt regulation by showing the govt that you can behave, as an industry. Neither of these require anything but self-interest and the profit motive from the involved parties.
    - SonnyWortzik 8y ago
      > collective action problems where coordination benefits every company in a way that individual action wouldn't Remember we are talking about Capitalist corporations that answer to investors. Your point is great if there is an incentive to only benefit the consumer. The benefit in this case is to maximize profit at all cost. Profit creed(not greed) is to ingrained the need to maximize profit. Because of that, greed is the ultimate driver against achieving 'self regulation', hence the reason why we have gov regulations in the first place.
      - wutbrodo 8y ago
        > Your point is great if there is an incentive to only benefit the consumer. The entire point of my comment was explicitly claiming that this isn't required in order for regulation to benefit companies' bottom-line. I'll repeat: there are collective action problems where coordination (between companies) benefits every party (company) in a way that individual (company) action wouldn't, even when the coordination takes the form of constraints on individual behavior. My comment was assuming the model of corporations as solely profit-maximizers, and it still occurs under that assumption. It's fairly basic game theory. If the defect-defect equilibrium leaves everyone worse off, and defect-cooperate leaves the defector better off than cooperate-cooperate would, then then under certain fairly reasonable assumptions, putting constraints on the behavior of all parties (i.e., regulation) makes the cooperate-cooperate equilibrium stable in a way it otherwise wouldn't be.
- dd36 8y ago
  And forced arbitration of class claims has destroyed the private accountability mechanism. Government is literally the only option.
  - mdpopescu 8y ago
    Out of curiosity, how do they force arbitration? Do companies have military personnel they send to threaten those who want to sue them?
    - mschuster91 8y ago
      Courts simply reject these cases because you "voluntarily" agreed to waive your right to a a court proceeding.
      - mdpopescu 8y ago
        These courts belong to the government, right? The one that is "literally the only option"?
        dd36 8y ago
        No. Courts don’t govern. They mediate disputes. When your state AG or the CFPB are the only way to stop collective harm, it’s a problem. Private rights of action were a thing until recently. I’d imagine a whole lot of these privacy breach issues would be closer to resolved if class actions were holding these big companies accountable.
- deleted 8y ago
  [deleted]
- jimmy1 8y ago
  Then you have the issue of regulatory capture. Often those in charge of the regulations are just as corrupt: selective enforcement is the name of the game.
- Yhippa 8y ago
  > As for mitigation, does anyone know if MVNO users are also subjected to their data being sold? As a Google Fi user I am very interested in this.
- _jal 8y ago
  Frankly, given carrier behavior, re-nationalizing telecom starts looking appealing. If you're concerned with privacy from government, don't be - you already lost that war. If you're concerned with a drop in innovation, don't be - we're already far behind most of the rest of the developed world. If you're concerned about prices going up, don't be - we already pay insanely high rates compared to peer-countries. Welcome to the "free" "market".
  - oldmanhorton 8y ago
    One reason to be more concerned about privacy in a nationalized communication network is because it removes a middle man - one who cares at least a little about PR backlash - from the current system. In a nationalized system, there is likely much less friction for a bureaucrat to block entire classes of content than there is today (where they need to deal with a handful of companies whose goal is to make money rather than silence dissident opinion).
  - atemerev 8y ago
    I am much more worried about the government spying for my phone than about corporations spying for my phone. All that corporations want is money.
    - jjgreen 8y ago
      Governments tend to have quite a bit of money.
    - zigzaggy 8y ago
      I agree with you, in theory. But these days, with the revolving door between gov leadership and corporate leadership (1) this is a distinction without much of a difference. And we all probably know about the vast data collection by the PRISM program (2), and access given to tech databases by the Freedom Act (3). And of course our current president signed 702 rauthorization last Jan. (4) so this cozy relationship could continue. I guess my point is that it sure feels like we’re in a pretty hopeless state, given the deep ties between business and government. At one time I was not so cynical about this topic. But after seeing the inside of the political process in both campaign work and working in the defense industry, my eyes have been opened. The only solution involves political activism on topics most people either don’t understand or don’t care about. (1)https://googletransparencyproject.org/articles/googles-revolving-door-us https://googletransparencyproject.org/articles/googles-revol... (2)https://en.m.wikipedia.org/wiki/PRISM_%28surveillance_program%29 https://en.m.wikipedia.org/wiki/PRISM_%28surveillance_progra... (3)https://en.m.wikipedia.org/wiki/USA_Freedom_Act https://en.m.wikipedia.org/wiki/USA_Freedom_Act (4)https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008 https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveil...
- BurningFrog 8y ago
  There is a perfectly good and time tested alternative to regulatory agencies: Promises in the form of legally binding contracts.
- airstrike 8y ago
  Self regulation works in industries in which there aren't significant barriers to entry. Unfortunately, Telecommunications is notoriously asset heavy and complex and the historical lack of competition creates behemoths with outsized influence in politics. The FCC then is effectively powerless barring the election of a president who personally cares about the matter. In sum, self regulation works in free markets. You would switch to a better carrier if there were one, I'm certain.
adrr 8y ago
I thought carriers required user consent to get the E911 location data? It does have some legitimate uses. This location data is used by financial companies and one of the reasons you don't need to do travel notices at some of the major banks. They'll actually ping the E911 location when they see a credit card auth in new geographic location. Check your TOS at your bank, there's probably something buried in it about consenting to pulling mobile phone location to prevent fraud.
- guelo 8y ago
  That's not a legitimate use. 911 is for emergencies. Emergency, security, terrorism are always the excuse used to strip us of our rights and our privacy.
  - adrr 8y ago
    E911 is the data set. It's just the triangulation data from the cell towers. There's also GPS data which is more accurate but the carrier doesn't get that data but apps can get it.
- oldmanhorton 8y ago
  A lot of people willingly install their bank's app. I don't see why this couldn't just be a case where people who have the app installed get this nice convenience and people who don't (willingly or because they don't have a smart phone) just have to notify their bank, as people have done for many years.
- ken 8y ago
  I've heard from multiple sources (including a former Seattle police officer who taught the first aid class I took last fall) that 911 operators here do not get any location data from cell phone calls. Maybe that's the intent or justification behind collecting the data, but it isn't getting to those people.
kakarot 8y ago
> ...given that two-thirds of the U.S. population aren’t going to switch to a carrier that doesn’t sell your location data. To be fair, what are our options, exactly? If we want anything near acceptable coverage and price, that is.
- x2f10 8y ago
  >To be fair, what are our options, exactly? This is key. This is how citizens will lose their expectation to privacy. I fear that in the near future there will be no 'safe' option and you will be forced to forfeit your privacy rights to participate in the digital world.
  - kakarot 8y ago
    Mobile will become as essential as internet in general has become to participate in larger society. I see it starting at the bottom. Tired of being tracked and trapped inside class barriers, the homeless and destitute will be the first to adopt extreme privacy-oriented protocols such as regularly cycling burner phones, using mobile VPNs, stripped-out GPS modules, and anonymous software such as Signal but which don't rely on phone numbers as identifiers. The poor will stop using phone numbers altogether. Perhaps charity services will exist which help aid this transition. It will also start from the top, as we already see high-level CEOs using encrypted messaging and privacy-oriented protocols. They will see the obvious need for such services. The overwhelming majority, the middle class, will be the last to adopt such practices and take back control of their privacy.
TACIXAT 8y ago
This stuff makes me so mad. It's to the point I don't want to carry a phone anymore. Why is it that people aren't allowed to record my conversations but they can record my real time location? It's a problem at every level of the stack. I have a phone device that I have very little control over (thanks Apple and Google!) that talks to service providers who know who I am. Those service providers are shady and sell my real time location and I have literally no choices for a cell provider who doesn't do this. Then there is obviously a huge market for buying this collected data. Where in the stack do we fix this? Do we need a data custody law first so I can track who the problem players are? Do we need devices that we have some control over so we can manage when they beacon out? Can we simply say that we (US citizens) have some right to privacy over our electronic data? Seriously, these practices are abhorrent.
- pjc50 8y ago
  The US has no general privacy law, but there's a clue in one of its hilariously specific privacy laws: https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act The way to get a cellphone privacy law is to get the locations of congresspeople (especially Republicans), and use this against them.
  - microcolonel 8y ago
    The U.S. has some privacy laws, but at the same time, the U.S. (along with Canada) also obligates carriers to gather and store location data. A law saying they can not sell that is not a major step, it just takes an act of congress, and if the whiners and complainers would get off their ass and actually select their congresspeople based on policy, they might get things like this. For the time being a couple percent of the electorate selects your house member because almost nobody else even knows that a race is under way. Hyperbole "The U.S. has no...", and tribal bashing "especially Republicans", is probably part of why the handful of people who have even heard their chosen congressperson speak, still choose based on tribe.
    - pjc50 8y ago
LinuxBender 8y ago
When I was in the wireless industry, we did many shady things and had all the lawyers and lobbyists to back us up. We could change any laws that got in our way. My employer was never remotely interested in ethical issues. They were only interested in paying subscribers. I could go on all day with examples if HN were interested. As a funny side note, we would joke that our best customers were drug dealers. They always paid on time and always in cash. They could not afford to miss any calls.
- astazangasta 8y ago
  Go on, go on. What are some examples of laws you had changed and what was the result?
  - LinuxBender 8y ago
    One example was hands free laws. That was supposed to happen in 96/97. Our lobbyists kicked that can down the road quite a long ways. I had a major project queued up in PoC phase with an AI that listened in the background to everything you said. You could tell her to conference in someone, call someone, hang up the call, etc.. This was before "smart" phones. It was the same software used by the gov. to monitor calls for key phrases. No training required, she could understand any language, accent and context. Really cool software actually. Another incident was around someone that broke the GSM encryption algorithms and was going to go public. My boss and a federal official met with them and explained what prison they would disappear into and for how long. Such things were postponed until long after the internet had grown and disclosures became more common. Nowadays people know that the GSM algo's have been broken for some time. Another one was a spammer that managed to get his own SS7 signaling link and was spamming phones with text messages. I suggested dropping his link and I was told to let it go, since he was paying for the link... There are no laws against spamming mobile devices because they are not landlines. The laws around unsolicited advertisements only applies to landlines and fax machines. As I am sure you all know, having your own SS7 link means you can spoof the caller ID, do caller-id blocking override, drop callers on congested cell sites and much more. This is why 2FA on cell phones is less effective. This one isn't so much about laws but rather ethics, and phone theft. From day one, we had the ability to brick any GSM phone over the air. We chose not to do this however, as customer support could accidentally brick the wrong phones. As you know, this led to phone theft being very profitable. That was the very thing that GSM bricking was supposed to stop, but we were just not willing to do it. There were no laws requiring us to use our capabilities to remove incentive to steal phones. There was discussion of making laws to require this, but we blocked all discussion from happening. Some of the other issues I can think of would be rather risky to post here, despite being well after the statute of limitations, as they could cause embarrassment for certain agencies and could risk HN getting censored.
driverdan 8y ago
This is blogspam that adds nothing new to Vice's original journalism: https://motherboard.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile https://motherboard.vice.com/en_us/article/nepxbz/i-gave-a-b... HN discussion here (still on the front page as of my reply): https://news.ycombinator.com/item?id=18857220 https://news.ycombinator.com/item?id=18857220 It's frustrating that TechCrunch seems to get a pass on their worthless blogspam when other blogspam posts are removed.
- floatingatoll 8y ago
  You could email the mods at the footer Contact link and ask them to change the link and explain why. They might say yes!
- dang 8y ago
  It was posted an hour ago. Things take time!
m-p-3 8y ago
The frustrating part is that you cannot protect yourself from that outside of turning your cellphone off or putting it in airplane mode.
- general8bitso 8y ago
  Airplane mode does not disable GPS. It could be queuing positional and temporal data, and awaiting a connection to later send.
  - lawnchair_larry 8y ago
    That isn’t how this data is obtained though. It’s all known on the carrier side. It does not rely on your phone submitting it.
  - roywiggins 8y ago
    The data they're selling is coming from signal triangulation, it's not coming from software implanted on your phone.
whitepoplar 8y ago
If Apple really wanted to put its cash to use, it could build its own cellular network. Privacy focused, no surprise fees, integrated billing for desktop/laptop/iOS/watch devices. There's enough bad will against the existing ISPs/mobile carriers that Apple could swoop in and gain a lot of market share very quickly. And customers could save money by combining their home internet with their mobile plans. The future is a singular wireless data subscription without any routers or modems.
- localhost 8y ago
  Really love this idea. $237BB in their piggy bank according to their most recent 10K. Since the era of carrier subsidies is more or less over in North America, this might accelerate their transition into services company in a major way.
  - whitepoplar 8y ago
    A buildout of a nationwide cellular network is almost tailor-made for the amount of cash they have in the bank, and almost the entirety of their would-be competition is universally hated. Seems like a no-brainer to me, and unlike other things they could spend their money on, a cellular network could always be sold off if needed. Not true for investment in A.I./self-driving cars/marketing/failed products/etc.
- snazz 8y ago
  They would never be able to replace existing providers unless they could quickly provide service to significant portions of the country (and eventually, world). However, they might be able to make some serious waves in the market if they focus on a small, highly populated part of California. It’s better than the Google Fi route except for the service coverage.
- bluGill 8y ago
  Unlikely, they would be blocked at the first step: they couldn't get any radio frequencies to build on. Not only are all frequencies assigned, but all attempts to get them would be blocked by anti-monopoly laws.
deleted 8y ago
[deleted]
kekebo 8y ago
Are there any known ways to obfuscate cell location data? There are sim addons that can change IMSI to circumvent carrier lock[0], would IMSI obfuscation be a viable option to defend against cell tracking? [0] https://en.m.wikipedia.org/wiki/Turbo_SIM https://en.m.wikipedia.org/wiki/Turbo_SIM
- roywiggins 8y ago
  The carrier needs to know which cell you're talking to do route calls to your phone, and after that it's just a matter of triangulation to narrow it down. But even without triangulation the company knows what neighborhood you're in, by design.
luckydata 8y ago
It's pointless to think the industry will regulate itself, they can't help it. If there's a shred of profit to be made in anything give it time and it will be done as long as it's not illegal and often even if it is.
danso 8y ago
FWIW this post is a summary of an investigation posted and discussed yesterday: https://news.ycombinator.com/item?id=18857220 https://news.ycombinator.com/item?id=18857220 (The TC summary is lengthy enough that it’s not necessarily blogspam)
h0mEDw 8y ago
US needs (something like) GDPR. 2% to 4% of revenue is a good starting point for a penalty. In the absence of a penalty why would anyone running a Telco company not take the extra cash from selling data.
wpdev_63 8y ago
.
CarriersSuck 8y ago
Of course they are. They have to show growth quarter after quarter. Until investors stop punishing companies for not increasing growth every quarter, this will continue. Everything is money driven. There's no thought to the consumer any more. There doesn't have to be as there isn't any accountability to the consumer; they have nowhere else to go.

225 points by jbegley 8y ago

This is why "promises" and "industry self regulation" are meaningless. People need government to protect them from companies' greed, which here means: regulatory agencies with teeth. "Self regulation" only works when there is a monetary incentive for companies to keep their word, for example in ecological agriculture. As for mitigation, does anyone know if MVNO users are also subjected to their data being sold?

ravenstine 8y ago
Are today's government officials more starstruck with or paid off by big corporations than they were back in the Microsoft antitrust era? Big business gets away with so much bad behavior today but, in the US at least, it seems like years go by and nobody cares enough to pass regulation to preserve the basic right to privacy.
- torpfactory 8y ago
  With notable exceptions, today's political campaigns are often financed by wealthy individuals and companies. The type of politicians which receive contributions are, unsurprisingly, the type whose views best align with those individuals and companies. This funding is instrumental in lifting many of these politicians into office. When a question of political control or regulation of companies arises, it is also unsurprising that these politicians often see things from a certain perspective.
  - rayiner 8y ago
    Corporations aren’t allowed to “finance” “political campaigns.” When OpenSecrets says stuff like “Google” contributed $X million to Democrats, it’s lying. What really happens is Google employees contributed that money.
    - torpfactory 8y ago
      While on paper there is are still limits on direct contributions to campaign organizations, the Citizen's United decision (combined with SpeechNOW vs. FEC) enables companies to instead donate to SuperPACs which are in theory independently controlled. I personally believe the distinction is for all intents and purposes meaningless. Doubly so when considering how little enforcement of the separation has actually been pursued. So, yes, I do believe companies finance political campaigns. Whether the money flows through campaign organizations is not an important distinction to me.
      - rayiner 8y ago
        It’s not a matter of what you “believe.” In election law, the “campaign” is a specific thing and financing it is something with specific meaning. Having an independent entity run ads because it happens to support that candidate is not “financing the campaign.” Leaving that aside, SuperPACs account for just 15% of election spending in 2016. It’s inaccurate to even suggest that corporate money and money from wealthy donors is the dominant factor in campaigns.
    - harpastum 8y ago
      While this is technically true, it's de facto false. With the Citizens United ruling, corporations can donate unlimited funds: "[Super PACs] can raise funds from individuals, corporations, unions, and other groups without any legal limit on donation size."[1] [1] https://en.wikipedia.org/wiki/Political_action_committee https://en.wikipedia.org/wiki/Political_action_committee
      - rayiner 8y ago
        SuperPACs can’t use that money to “finance campaigns.”
    - joeyo 8y ago
      For most intents and purposes this changed with Citizens United v FEC.
    - 8y ago
- rayiner 8y ago
  We’re in a decades long reaction to government regulation that pervades the west. The government used to tell airlines and trucking companies what routes they could sell and what prices they could charge. That level of government regulation proved to be such a disaster, that everybody abandoned it starting in the 1980s. As a result, you have an entire generation of administrators, on both sides of the aisle, who grew up with an extreme aversion to government intervention.
- wilde 8y ago
  The Republican Party’s official position is that business should be as unregulated as possible [1]. So we shouldn’t expect to see any regulatory action under Republican administrations. Obama focused on blocking mergers among companies with products that they charged consumers for. It looks mainly like the precedent of consumer harm is undefined when the products are free to start with, and no one has gone back to try to patch the hole. [1] https://gop.com/platform/restoring-the-american-dream/ https://gop.com/platform/restoring-the-american-dream/
- dangwth31337 8y ago
  Dozens of politicians are elected over and over. Richard Byrd from Virginia retired from the Senate in 2010 after 51 years. That's the current "record". It's similar in the House. John Conyers just stepped down due to scandal after 52 years. IMO, that there are no term limits is absurd. Thomas Jefferson got it: https://www.monticello.org/site/jefferson/quotations-jefferson-memorial#Panel_Four https://www.monticello.org/site/jefferson/quotations-jeffers... As we've improved our understanding of the human brain through neuroscience, and how can see that ideals will get lodged in people's brains and not change, having people serve that long just leads to stagnant idealism controlling politics.
SonnyWortzik 8y ago
c'mon lets get real, 'Self Regulating' means someone actually has to be honest of something but as long as there is profit to be made, honesty takes a back seat.
- WillPostForFood 8y ago
  Things like the MPAA rating system seem to work, even though it is against the financial interests of studios.
- wutbrodo 8y ago
  No it doesn't. Self-regulation is often motivated by 1) collective action problems where coordination benefits every company in a way that individual action wouldn't or 2) to ward off govt regulation by showing the govt that you can behave, as an industry. Neither of these require anything but self-interest and the profit motive from the involved parties.
  - SonnyWortzik 8y ago
    > collective action problems where coordination benefits every company in a way that individual action wouldn't Remember we are talking about Capitalist corporations that answer to investors. Your point is great if there is an incentive to only benefit the consumer. The benefit in this case is to maximize profit at all cost. Profit creed(not greed) is to ingrained the need to maximize profit. Because of that, greed is the ultimate driver against achieving 'self regulation', hence the reason why we have gov regulations in the first place.
    - wutbrodo 8y ago
      > Your point is great if there is an incentive to only benefit the consumer. The entire point of my comment was explicitly claiming that this isn't required in order for regulation to benefit companies' bottom-line. I'll repeat: there are collective action problems where coordination (between companies) benefits every party (company) in a way that individual (company) action wouldn't, even when the coordination takes the form of constraints on individual behavior. My comment was assuming the model of corporations as solely profit-maximizers, and it still occurs under that assumption. It's fairly basic game theory. If the defect-defect equilibrium leaves everyone worse off, and defect-cooperate leaves the defector better off than cooperate-cooperate would, then then under certain fairly reasonable assumptions, putting constraints on the behavior of all parties (i.e., regulation) makes the cooperate-cooperate equilibrium stable in a way it otherwise wouldn't be.
dd36 8y ago
And forced arbitration of class claims has destroyed the private accountability mechanism. Government is literally the only option.
- mdpopescu 8y ago
  Out of curiosity, how do they force arbitration? Do companies have military personnel they send to threaten those who want to sue them?
  - mschuster91 8y ago
    Courts simply reject these cases because you "voluntarily" agreed to waive your right to a a court proceeding.
    - mdpopescu 8y ago
      These courts belong to the government, right? The one that is "literally the only option"?
      - dd36 8y ago
        No. Courts don’t govern. They mediate disputes. When your state AG or the CFPB are the only way to stop collective harm, it’s a problem. Private rights of action were a thing until recently. I’d imagine a whole lot of these privacy breach issues would be closer to resolved if class actions were holding these big companies accountable.
deleted 8y ago
[deleted]
jimmy1 8y ago
Then you have the issue of regulatory capture. Often those in charge of the regulations are just as corrupt: selective enforcement is the name of the game.
Yhippa 8y ago
> As for mitigation, does anyone know if MVNO users are also subjected to their data being sold? As a Google Fi user I am very interested in this.
_jal 8y ago
Frankly, given carrier behavior, re-nationalizing telecom starts looking appealing. If you're concerned with privacy from government, don't be - you already lost that war. If you're concerned with a drop in innovation, don't be - we're already far behind most of the rest of the developed world. If you're concerned about prices going up, don't be - we already pay insanely high rates compared to peer-countries. Welcome to the "free" "market".
- oldmanhorton 8y ago
  One reason to be more concerned about privacy in a nationalized communication network is because it removes a middle man - one who cares at least a little about PR backlash - from the current system. In a nationalized system, there is likely much less friction for a bureaucrat to block entire classes of content than there is today (where they need to deal with a handful of companies whose goal is to make money rather than silence dissident opinion).
- atemerev 8y ago
  I am much more worried about the government spying for my phone than about corporations spying for my phone. All that corporations want is money.
  - jjgreen 8y ago
    Governments tend to have quite a bit of money.
  - zigzaggy 8y ago
    I agree with you, in theory. But these days, with the revolving door between gov leadership and corporate leadership (1) this is a distinction without much of a difference. And we all probably know about the vast data collection by the PRISM program (2), and access given to tech databases by the Freedom Act (3). And of course our current president signed 702 rauthorization last Jan. (4) so this cozy relationship could continue. I guess my point is that it sure feels like we’re in a pretty hopeless state, given the deep ties between business and government. At one time I was not so cynical about this topic. But after seeing the inside of the political process in both campaign work and working in the defense industry, my eyes have been opened. The only solution involves political activism on topics most people either don’t understand or don’t care about. (1)https://googletransparencyproject.org/articles/googles-revolving-door-us https://googletransparencyproject.org/articles/googles-revol... (2)https://en.m.wikipedia.org/wiki/PRISM_%28surveillance_program%29 https://en.m.wikipedia.org/wiki/PRISM_%28surveillance_progra... (3)https://en.m.wikipedia.org/wiki/USA_Freedom_Act https://en.m.wikipedia.org/wiki/USA_Freedom_Act (4)https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008 https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveil...
BurningFrog 8y ago
There is a perfectly good and time tested alternative to regulatory agencies: Promises in the form of legally binding contracts.
airstrike 8y ago
Self regulation works in industries in which there aren't significant barriers to entry. Unfortunately, Telecommunications is notoriously asset heavy and complex and the historical lack of competition creates behemoths with outsized influence in politics. The FCC then is effectively powerless barring the election of a president who personally cares about the matter. In sum, self regulation works in free markets. You would switch to a better carrier if there were one, I'm certain.

adrr 8y ago

I thought carriers required user consent to get the E911 location data? It does have some legitimate uses. This location data is used by financial companies and one of the reasons you don't need to do travel notices at some of the major banks. They'll actually ping the E911 location when they see a credit card auth in new geographic location. Check your TOS at your bank, there's probably something buried in it about consenting to pulling mobile phone location to prevent fraud.

guelo 8y ago
That's not a legitimate use. 911 is for emergencies. Emergency, security, terrorism are always the excuse used to strip us of our rights and our privacy.
- adrr 8y ago
  E911 is the data set. It's just the triangulation data from the cell towers. There's also GPS data which is more accurate but the carrier doesn't get that data but apps can get it.
oldmanhorton 8y ago
A lot of people willingly install their bank's app. I don't see why this couldn't just be a case where people who have the app installed get this nice convenience and people who don't (willingly or because they don't have a smart phone) just have to notify their bank, as people have done for many years.
ken 8y ago
I've heard from multiple sources (including a former Seattle police officer who taught the first aid class I took last fall) that 911 operators here do not get any location data from cell phone calls. Maybe that's the intent or justification behind collecting the data, but it isn't getting to those people.

kakarot 8y ago

> ...given that two-thirds of the U.S. population aren’t going to switch to a carrier that doesn’t sell your location data. To be fair, what are our options, exactly? If we want anything near acceptable coverage and price, that is.

x2f10 8y ago
>To be fair, what are our options, exactly? This is key. This is how citizens will lose their expectation to privacy. I fear that in the near future there will be no 'safe' option and you will be forced to forfeit your privacy rights to participate in the digital world.
- kakarot 8y ago
  Mobile will become as essential as internet in general has become to participate in larger society. I see it starting at the bottom. Tired of being tracked and trapped inside class barriers, the homeless and destitute will be the first to adopt extreme privacy-oriented protocols such as regularly cycling burner phones, using mobile VPNs, stripped-out GPS modules, and anonymous software such as Signal but which don't rely on phone numbers as identifiers. The poor will stop using phone numbers altogether. Perhaps charity services will exist which help aid this transition. It will also start from the top, as we already see high-level CEOs using encrypted messaging and privacy-oriented protocols. They will see the obvious need for such services. The overwhelming majority, the middle class, will be the last to adopt such practices and take back control of their privacy.

TACIXAT 8y ago

This stuff makes me so mad. It's to the point I don't want to carry a phone anymore. Why is it that people aren't allowed to record my conversations but they can record my real time location? It's a problem at every level of the stack. I have a phone device that I have very little control over (thanks Apple and Google!) that talks to service providers who know who I am. Those service providers are shady and sell my real time location and I have literally no choices for a cell provider who doesn't do this. Then there is obviously a huge market for buying this collected data. Where in the stack do we fix this? Do we need a data custody law first so I can track who the problem players are? Do we need devices that we have some control over so we can manage when they beacon out? Can we simply say that we (US citizens) have some right to privacy over our electronic data? Seriously, these practices are abhorrent.

pjc50 8y ago
The US has no general privacy law, but there's a clue in one of its hilariously specific privacy laws: https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act The way to get a cellphone privacy law is to get the locations of congresspeople (especially Republicans), and use this against them.
- microcolonel 8y ago
  The U.S. has some privacy laws, but at the same time, the U.S. (along with Canada) also obligates carriers to gather and store location data. A law saying they can not sell that is not a major step, it just takes an act of congress, and if the whiners and complainers would get off their ass and actually select their congresspeople based on policy, they might get things like this. For the time being a couple percent of the electorate selects your house member because almost nobody else even knows that a race is under way. Hyperbole "The U.S. has no...", and tribal bashing "especially Republicans", is probably part of why the handful of people who have even heard their chosen congressperson speak, still choose based on tribe.
  - pjc50 8y ago

LinuxBender 8y ago

When I was in the wireless industry, we did many shady things and had all the lawyers and lobbyists to back us up. We could change any laws that got in our way. My employer was never remotely interested in ethical issues. They were only interested in paying subscribers. I could go on all day with examples if HN were interested. As a funny side note, we would joke that our best customers were drug dealers. They always paid on time and always in cash. They could not afford to miss any calls.

astazangasta 8y ago
Go on, go on. What are some examples of laws you had changed and what was the result?
- LinuxBender 8y ago
  One example was hands free laws. That was supposed to happen in 96/97. Our lobbyists kicked that can down the road quite a long ways. I had a major project queued up in PoC phase with an AI that listened in the background to everything you said. You could tell her to conference in someone, call someone, hang up the call, etc.. This was before "smart" phones. It was the same software used by the gov. to monitor calls for key phrases. No training required, she could understand any language, accent and context. Really cool software actually. Another incident was around someone that broke the GSM encryption algorithms and was going to go public. My boss and a federal official met with them and explained what prison they would disappear into and for how long. Such things were postponed until long after the internet had grown and disclosures became more common. Nowadays people know that the GSM algo's have been broken for some time. Another one was a spammer that managed to get his own SS7 signaling link and was spamming phones with text messages. I suggested dropping his link and I was told to let it go, since he was paying for the link... There are no laws against spamming mobile devices because they are not landlines. The laws around unsolicited advertisements only applies to landlines and fax machines. As I am sure you all know, having your own SS7 link means you can spoof the caller ID, do caller-id blocking override, drop callers on congested cell sites and much more. This is why 2FA on cell phones is less effective. This one isn't so much about laws but rather ethics, and phone theft. From day one, we had the ability to brick any GSM phone over the air. We chose not to do this however, as customer support could accidentally brick the wrong phones. As you know, this led to phone theft being very profitable. That was the very thing that GSM bricking was supposed to stop, but we were just not willing to do it. There were no laws requiring us to use our capabilities to remove incentive to steal phones. There was discussion of making laws to require this, but we blocked all discussion from happening. Some of the other issues I can think of would be rather risky to post here, despite being well after the statute of limitations, as they could cause embarrassment for certain agencies and could risk HN getting censored.

driverdan 8y ago

This is blogspam that adds nothing new to Vice's original journalism: https://motherboard.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile https://motherboard.vice.com/en_us/article/nepxbz/i-gave-a-b... HN discussion here (still on the front page as of my reply): https://news.ycombinator.com/item?id=18857220 https://news.ycombinator.com/item?id=18857220 It's frustrating that TechCrunch seems to get a pass on their worthless blogspam when other blogspam posts are removed.

floatingatoll 8y ago
You could email the mods at the footer Contact link and ask them to change the link and explain why. They might say yes!
dang 8y ago
It was posted an hour ago. Things take time!

m-p-3 8y ago

The frustrating part is that you cannot protect yourself from that outside of turning your cellphone off or putting it in airplane mode.

general8bitso 8y ago
Airplane mode does not disable GPS. It could be queuing positional and temporal data, and awaiting a connection to later send.
- lawnchair_larry 8y ago
  That isn’t how this data is obtained though. It’s all known on the carrier side. It does not rely on your phone submitting it.
- roywiggins 8y ago
  The data they're selling is coming from signal triangulation, it's not coming from software implanted on your phone.

whitepoplar 8y ago

If Apple really wanted to put its cash to use, it could build its own cellular network. Privacy focused, no surprise fees, integrated billing for desktop/laptop/iOS/watch devices. There's enough bad will against the existing ISPs/mobile carriers that Apple could swoop in and gain a lot of market share very quickly. And customers could save money by combining their home internet with their mobile plans. The future is a singular wireless data subscription without any routers or modems.

localhost 8y ago
Really love this idea. $237BB in their piggy bank according to their most recent 10K. Since the era of carrier subsidies is more or less over in North America, this might accelerate their transition into services company in a major way.
- whitepoplar 8y ago
  A buildout of a nationwide cellular network is almost tailor-made for the amount of cash they have in the bank, and almost the entirety of their would-be competition is universally hated. Seems like a no-brainer to me, and unlike other things they could spend their money on, a cellular network could always be sold off if needed. Not true for investment in A.I./self-driving cars/marketing/failed products/etc.
snazz 8y ago
They would never be able to replace existing providers unless they could quickly provide service to significant portions of the country (and eventually, world). However, they might be able to make some serious waves in the market if they focus on a small, highly populated part of California. It’s better than the Google Fi route except for the service coverage.
bluGill 8y ago
Unlikely, they would be blocked at the first step: they couldn't get any radio frequencies to build on. Not only are all frequencies assigned, but all attempts to get them would be blocked by anti-monopoly laws.

deleted 8y ago

[deleted]

kekebo 8y ago

Are there any known ways to obfuscate cell location data? There are sim addons that can change IMSI to circumvent carrier lock[0], would IMSI obfuscation be a viable option to defend against cell tracking? [0] https://en.m.wikipedia.org/wiki/Turbo_SIM https://en.m.wikipedia.org/wiki/Turbo_SIM

roywiggins 8y ago
The carrier needs to know which cell you're talking to do route calls to your phone, and after that it's just a matter of triangulation to narrow it down. But even without triangulation the company knows what neighborhood you're in, by design.

luckydata 8y ago

It's pointless to think the industry will regulate itself, they can't help it. If there's a shred of profit to be made in anything give it time and it will be done as long as it's not illegal and often even if it is.

danso 8y ago

FWIW this post is a summary of an investigation posted and discussed yesterday: https://news.ycombinator.com/item?id=18857220 https://news.ycombinator.com/item?id=18857220 (The TC summary is lengthy enough that it’s not necessarily blogspam)

h0mEDw 8y ago

US needs (something like) GDPR. 2% to 4% of revenue is a good starting point for a penalty. In the absence of a penalty why would anyone running a Telco company not take the extra cash from selling data.

wpdev_63 8y ago

CarriersSuck 8y ago

Of course they are. They have to show growth quarter after quarter. Until investors stop punishing companies for not increasing growth every quarter, this will continue. Everything is money driven. There's no thought to the consumer any more. There doesn't have to be as there isn't any accountability to the consumer; they have nowhere else to go.