10 ms·

An investigation into the smartphone tracking industry

405 points by danso 7y ago

john_minsk 7y ago
This page doesn't work for me and it doesn't show any errors... Update: Firefox fixes it...
- deleted 7y ago
  [deleted]
ajb 7y ago
Web page is broken. Only works for me if I scroll past the stupid animation before it finishes loading, otherwise it gets stuck.
- AznHisoka 7y ago
  If you are viewing on safari, reader modes shows you the content.
- mstokholm 7y ago
  Scrolling past animation worked for me on Firefox
- tyingq 7y ago
  None of the interactivity, and only one of the map images, but at least you can read it: https://outline.com/nVTtcg https://outline.com/nVTtcg
wrkronmiller 7y ago
Reader View on mobile Safari seems to work
bilekas 7y ago
The animation intro is detrimental to the actual article.. You need to delete the HTML element with class `video-stepper-content` So annoying. if lazy : Console cmd : `document.getElementsByClassName('video-stepper-content')[0].parentNode.removeChild(document.getElementsByClassName('video-stepper-content')[0])`
- jraph 7y ago
  Trying to optimize your line for non-whitespace character count since I have nothing else to do right now, I just discovered $ can be used in any webpage from the browser console: $('.video-stepper').style.display = 'none'
  - tyingq 7y ago
    If we're golfing, and jQuery is there: $('.video-stepper').hide()
    - jraph 7y ago
      I tried, it's not in this article, I am really interested for a shorter solution however :-) edit: $('.video-stepper').remove() works
      - tyingq 7y ago
        Ahh, I see. No jQuery. The Chrome developer console is aliasing $() to document.querySelector() https://developers.google.com/web/tools/chrome-devtools/console/utilities#queryselector https://developers.google.com/web/tools/chrome-devtools/cons... I didn't know it did that.
        bilekas 7y ago
        Thats actually pretty interesting.. Wonder which would take preference if I have a bespoke definition for $ in an extension/worker somewhere. Even a browser level event listener on it. O_o Clearly I don't have much either to do today.
        deleted 7y ago
        [deleted]
scarface74 7y ago
As I suspected, the article is nowhere near technical enough to get any sense of how third parties can tie a name to a phone. NYT’s articles about technology are usual horrible.
- denzil_correa 7y ago
  NYT will reveal more details in subsequent articles. > In this and subsequent articles we’ll reveal what we’ve found and why it has so shaken us.
- tyingq 7y ago
  It does say this: "In most cases, ascertaining a home location and an office location was enough to identify a person. Consider your daily commute: Would any other smartphone travel directly between your house and your office every day?" Then they back it up with: "With the help of publicly available information, like home addresses, we easily identified and then tracked scores of notables." And provided the specific example of Mary Millben. It was manual and not automated, but the tech details of finding work and home addresses, based on the two most visited spots, seems not novel. Similar for extrapolating that into a name.
  - jc01480 7y ago
    Do some patent searches for the companies pioneering the technology. Read their white papers. You can begin to assemble an idea of how they do it. It’s not entirely revealing and is very tedious. But you can connect the dots. NYT is somewhat half-hearted when it’s not a political subject.
- rchaud 7y ago
  It's the NYT, not the Journal of Telecom Engineering. They're writing for a general audience.
  - scarface74 7y ago
    It doesn’t have to be a telecom. Did they say which mobile platforms? Which apps? How to prevent apps from tracking you by using the permission system built into the OS? Instead they created an article with a presentation style that looked like a MySpace page. I was half expecting early 2000s music.
bilekas 7y ago
> Work in the location tracking industry? Seen an abuse of data? I would have thought those things go hand in hand no.. Kind of like the oxymoron: A privacy conscious social media company..
- jc01480 7y ago
  Funny you mention this. Outside the Guantanamo prison complex is a sign bearing the unit symbol of the military branch operating the facility. This is affixed to a fence bearing “maximum security” signage, etc. Displayed on this sign was their motto which contained verbiage about defending “freedom”. I found this ironic as there was a prisoner staring out through the fence standing next to the sign.
boring_twenties 7y ago
> Work in the location tracking industry? Seen an abuse of data? We want to hear from you. Using a non-work phone or computer, contact us on a secure line at 440-295-5934 Would be nice if they clarified what the hell exactly a "secure line" means
- mike-cardwell 7y ago
  One that isn't recorded and routinely listened to by your manager?
  - boring_twenties 7y ago
    That would seem to have already been covered by the first half of the sentence?
    - mike-cardwell 7y ago
      So if you read and understood the first half of the sentence, then you must have an idea of what a secure line is then.
      - boring_twenties 7y ago
        This doesn't seem to make any sense. The first half isn't explaining what the second half is going to mean. It reads like two separate things of which you need to do both.
        mike-cardwell 7y ago
        It's almost as if you're parsing the sentence as a computer would.
- tyingq 7y ago
  Wouldn't it just mean "a line where your employer cannot monitor or log calls?"
- 7y ago
bilekas 7y ago
It would have been nice if the report listed and documented all the mobile services that were doing this and stept to clean it up as best as possible.
- boring_twenties 7y ago
  Wouldn't it be more tractable to list the few that aren't doing this, if there even are any?
  - bilekas 7y ago
    Hmm, yes, but then you're in the realm of trying to convince non-privacy savy people to use other services that replace the tracking ones. Its all extremely frustrating and does nothing to ease my anxiety!
mfer 7y ago
One of the things I appreciate about the iPhone is the fine grained settings for location tracking. I have had to turn off access to numerous apps and have limited other apps to only using my location when I use the app. To limit the tracking I had to personally do an audit. I noticed the location indicator was on most of the time and it annoyed me. I found too many apps using location tracking that just did not need it. Most people will not do this. We need better laws.
- bilekas 7y ago
  Its amazing when you hear people say they appreciate being able to stop individual tracking after its defaulted. Instead of expecting that nothing tracks you until you permit it. FWIW: This 'ability' is not specific for Iphone
  - john_minsk 7y ago
    Then it works as expected. It doesn't track you before you approve it. Which 99% of us do when opening an app.
    - bilekas 7y ago
      No application should `require` location services to start/let you in. If you have `Facebook` app installed first time, upon opening the app, there should not be any requirement to access location data. Only at the point of posting with a 'Share Location' the app should request the Location tracking. And I don't see why it then needs to be permenantly permitted from then on. (Unless manually remove again) They are scummy tactics and I agree, people just click okay to remove the inconvenience, but the creators are creating problems in order to get those 'Allow access'. Its gross. Almost like selling a solution to a problem you created.
      - zo1 7y ago
        >"No application should `require` location services to start/let you in." Exactly this. Rejecting apps from getting into your store ecosystem that request permissions that they can't justify based on the purpose of the application should be one of the first and major things app-store curators do. Now to enforce this with browsers as well and include things such as "push notifications".
foreigner 7y ago
I was about to shrug this off but quickly checked my phone - 25 apps have access to my location?!!
john_minsk 7y ago
1) There is no Facebook, Apple and Google on the list of "location data" companies. These guys have records on you for years of tracking and it didn't cause nytimes to create a fancy article on them? 2) Funny how the only big company mentioned in the article is Apple, while iOS is far more difficult to convince to share location data with 3rd parties compared to Android.
- deleted 7y ago
  [deleted]
- danso 7y ago
  The story discusses the provenance of the data after the opening paragraph: > THE DATA REVIEWED BY TIMES OPINION didn’t come from a telecom or giant tech company, nor did it come from a governmental surveillance operation. It originated from a location data company, one of dozens quietly collecting precise movements using software slipped onto mobile phone apps. You’ve probably never heard of most of the companies — and yet to anyone who has access to this data, your life is an open book. Is your suggestion that the NYT wait until every large tech company leaks their databases to their reporters?
  - criddell 7y ago
    Facebook, Apple, and Google don't have to leak anything. They don't conceal what they collect. If you haven't looked at it yet, Google's dashboard is pretty eye opening. You can see where you were every minute of the day years ago.
    - danso 7y ago
      Yes, I know of these systems and have been downloading/analyzing my personal data for years. And the press has written on the implications and risks of this data for years. I guess I don't understand what you're getting at? The NYT is not entitled to my or anyone else's data unless I give it to them. Ostensibly, the story under discussion is interesting because it is personal data for millions of users who have consented (via agreeing to terms of services) to the collection, but haven't fully grasped what happens when that data can reveal to a third party.
DanielBMarkham 7y ago
I try to avoid sarcasm online. It can be taken the wrong way. But I would like to welcome the NYT to 20 years or so ago when Google realized that there was money in the data. Or ten years ago or so, as privacy advocates started seriously bouncing off the walls realizing that we were tagging and tracking people in a way dictators of the past could only dream of. I'm glad they might be catching up, but for a big news organization like that, it's sad to see it take so long. I wonder if, like so many of these blow ups in the past, there'll just be a spike of public interest and then it'll all die away. One of the most amazing things about the news in the last few years is how stories that used to have international, severe impact and political repercussions just drift off into the ether now. No follow-up, no continuing coverage. It's all about immediate spikes in shares, likes, tweets, and readers. They know people don't care about the follow-up that much; heck the data tells them that. So there's no follow-up, only the next sensation. I hope this amounts to something. I have my reservations.
- BLKNSLVR 7y ago
  > there'll just be a spike of public interest and then it'll all die away Panama Papers, Paradise Papers. Very little has come out of this and it's so disappointing. What this says to me is that enough of the people powerful enough to change any of it are in on it. Or, there just isn't the critical mass at the bottom, and this, where we find ourselves as a global population, is the stability between comfort and outrage. The "Or" above, maybe should be an "And". I wonder whether one of the reasons that seemingly illogical conservatism is as successful as it is, is because the bigger the world economy gets, and the larger the population, the harder it is to change anything meaningful without wiping out a pillar-sized part of the economy, the results of which are too unpredictable for anyone in power to want to take responsibility for. This position only leads to further conservatism, in that any changes 'we let pass' must be war-gamed to the nth degree to ensure they don't cause societal collapse. I'm not conservative, but the above is almost the only way I can process seemingly illogical conservatism that is actually anything other than "maintaining the status quo because I'm part of it". It's almost believing their own FUD. Hubbard-style. But it might not be entirely wrong.
  - 7y ago
crashhacker 7y ago
This is going to get much more severe if proper checks specifically ethical checks which should be done. the GDPR is a good start but it needs a lot of work when information to track users can be done with a lot of sensors nowadays.
prolonge 7y ago
Think of the modern Truman Burbank. The next step is to assume everything is live at all times and behave as such. Stop trying to prevent everyone being aware of each other. Scheming is irrelevant now and if you are reversing the progress of the tribe then you should spend your days on your computer trying to come up with a new Tor and then you'll approach the end of your life knowing that all you did was try to avoid everyone's gaze so you could "get ahead."
- jc01480 7y ago
  Assuming everything is live presumes that we should have to care about what others think about any given conduct. Social justice is what this is plain and simple. Rule of law (or the absence thereof) is meaningless in modern society?
  - prolonge 7y ago
    I've heard the "eye of Sauron" metaphor in a few podcasts that commentate on the ease of mass surveillance. This has less to do with individual smartphone tracking - individual smartphone users have the power to zero in on certain topics and ideas (viral) relatively instantly since news can travel along a global internet unhindered. Chinese Social Credit automated aggregation of all citizen smartphone activity feeds is the "rule of Law". We will be economically limited by our inefficient (bad) deeds.
onreact 7y ago
That's one of the reasons why I gave up smartphones. Radiation, addiction and 24/7 workweek were some of the others. When your phone is smarter than you something is wrong.
- kleiba 7y ago
  I've never seen any credible claim on negative implications through radiation when using smartphones. Do you know any?
  - inimino 7y ago
    There is strong anecdotal evidence that some people are affected by it. However few, or however small the effect size, it is not strictly the same thing as known zero risk.
  - onreact 7y ago
    The WHO says: "The electromagnetic fields produced by mobile phones are classified by the International Agency for Research on Cancer as possibly carcinogenic to humans" https://www.who.int/news-room/fact-sheets/detail/electromagnetic-fields-and-public-health-mobile-phones https://www.who.int/news-room/fact-sheets/detail/electromagn...
throwaway8291 7y ago
As a thought experiment: Imagine all that data was open and everybody could query and use it. Because my gut tells me, it will be in a decade or two.
deltron3030 7y ago
Nice graphics, powered by Svelte?
mmjaa 7y ago
I wish I had this data, myself. I mean, my own personal data - it would be so incredibly useful for me to be able to go back through the last years and see my location and tracking data. I could finally get those timesheets updated with correct details .. But, alas, no. Its not available to me. Only third parties can access it. This is a terrible situation.
- worldsayshi 7y ago
  You can download your google data at https://takeout.google.com/ https://takeout.google.com/ Not sure if this is only for EU citizens.
  - mmjaa 7y ago
    Yeah, its better than nothing but that's still not quite as simple as just having a database I can copy off my own phone with all the details.
    - danso 7y ago
      If you have an iPhone, you can use a utility to extract the location database: https://reincubate.com/support/how-to/export-view-iphone-location-data/ https://reincubate.com/support/how-to/export-view-iphone-loc... If you have an Android, using Google Takeout would likely be the easiest route: https://takeout.google.com/settings/takeout https://takeout.google.com/settings/takeout
baybal2 7y ago
One more reason to fight for the right to anonymous SIM cards. No way to underestimate how important this is. Second to it, you guys need to push for removing tracking infrastructure that Google shoves into Android. Not a single application should be allowed access to anything amounting to a "Device ID" or fingerprinting method, implicit or explicit
- Fnoord 7y ago
  Isn't the IMEI still publicly available?
  - baybal2 7y ago
    If you didn't know, Google even added a special API in Android for Apps to use to get device IDs, IMEI included. The very point of it is to allow tracking by Apps. In Android 6 they even made a special callback result to indicate that the user has refused to give his permission rather than indicating that modem/phone ID wasn't found. Clearly they are aware of this and do that deliberately.
    - ParanoidShroom 7y ago
      What special API is this ? Can you post a link, thanks.
      - baybal2 7y ago
        android.telephony.TelephonyManager.getDeviceId() android.os.Build.getSerial()
- dopylitty 7y ago
  One of the key points of the article is that location data itself is nearly impossible to anonymize. Even if person had an anonymous SIM it would be trivial to identify them by the locations where they spent most of their time.
  - 7y ago
ENOTTY 7y ago
My questions for any company that collects location data or receives it from a third party would include: Do you associate the geo data with individualized identifiers? In other words, can individual data points be linked to one another (linkability)? (Obviously the answer is yes for whichever company this dataset came from) Do you resell the raw data to other third parties, and if so, what kind of vetting and data controls are levied upon them? Where are these customers located? Let us see one of your contracts. I generally think this story would have be more impactful if the Times tried to pose as a customer and bought the data from a company to expose flaws in that system. As it stands, the location companies are very willing to admit they sell this data, but they would claim that nothing bad will happen to you. Disprove that and now there’s a cause for action.
adam0c 7y ago
there's a very limited amount of people around the world that actually care about this those of us do our best to not allow this to happen but then there is the others, the people that don't read terms, that live for the gram etc these are the main demographic target because they're quite simply dumb. People constantly make jokes at me for wanting to be off the grid for trying to keep a low profile etc for complaining about having to accept cookies for any website you want to use these days. data mining has been big bucks for far too long and will remain that way until the masses join us which I sadly fear they never will along with the fact that these big data companies are all working with bigger government and political groups. its been this way for a long time as others have pointed out and its a sad fact that it will remain this way for the foreseeable future unless people educate themselves on these matters because the companies getting away with it will continue to and not educate the masses as that means a loss of profit.
sithadmin 7y ago
There was a pretty interesting talk presented at DefCon this year on tracking and other personal data being exfiltrated from mobile devices over Tor (in plaintext!!!). After noticing this activity on some end user devices, the presenters set up some exit nodes and started looking for similar traffic, and uncovered a shocking amount of data being moved about in this manner from a variety of mobile applications. Unfortunately, the presenters didn't name and shame (though they did imply some well-known brands were guilty), and it was presented at the SkyTalks venue, so no recording was allowed and the slides won't be published. But given the data that they were collecting and where the impacted users seemed to be located, it appeared like a majority of the tracking traffic they were intercepting was coming from users in China, Russia, and other states with civil liberties issues.
CuriousReader13 7y ago
This data seems highly valuable to hedge funds: if a fund could pin the devices of well-known bankers and executives of potential acquisition targets, it could see deals coming before announcements. Is this legal?
- 7373737373 7y ago
  Hell, track their social relations, and the same for all of their employees, estimate their personal relations with social models, quantify and predict their mood on an organizational level. Then go long or short on the company. Rinse and repeat for everything on this planet.
K0nserv 7y ago
I encourage everyone to try routing your own device's traffic through mitmproxy and observing this in real time. It's eye opening. Apps like Deliveroo, which have legtimate reasons for high accuracy location access, send your data to marketing companies on every launch with very high precision. I've written a guide[0] about how to use mitmproxy to look at the data escaping your device. 0: https://hugotunius.se/2019/01/23/going-spelunking-with-mitmproxy.html https://hugotunius.se/2019/01/23/going-spelunking-with-mitmp...
- colesdefectum 7y ago
  While it may not catch everything, another way I've picked up on various tracking services is simply running pihole and customizing the lists based on permitted dns lookups. It's interesting and troubling just how much of my internet browsing is blocked at the DNS level on a day to day basis with no perceivable impact on what's being viewed. I do wonder how many services might start trying to hardcode IP addresses to get around such things in the future. I'll have to try mitmproxy and see what I might be missing.
  - K0nserv 7y ago
    Yup I do this too and I agree with your observations, about one third of my home network's DNS request are rejected with nearly no impact on my internet browsing. I've also observed the same thing when browsing the web with uBlock Origin set to block third party scripts by default. On most sites whitelisting ~20% of scripts is enough to make the site functional, the other ~80% apparently being redundant for the purpose of the site's core functionality.
- mobilemidget 7y ago
  Am I understanding it correctly that the app on your mobile is directly sending the data to marketing companies? They don't even collect it and hand it to marketing companies through a separate channel?
  - K0nserv 7y ago
    No they dont't usually collect the data and forward it to third parties. With most stuff like this apps will embed a binary SDK which is initialized when the app starts. Because the SDK runs in the app's process it has all the same permission and data access that the app itself has. The SDK communicates with the relevant APIs directly. On the web similar models are often used with third party scripts loaded in the main page context. For example here's Braze's developer integration guide https://www.braze.com/docs/developer_guide/platform_integration_guides/ios/initial_sdk_setup/cocoapods/#step-1-install-cocoapods https://www.braze.com/docs/developer_guide/platform_integrat...
34679 7y ago
The US government has agreed with the US government's argument that any information transmitted over a 3rd party server is not protected by the 4th Amendment. This is why the US government will not do anything to stop or slow the mass collection of private data. They have asserted and affirmed their right to Hoover that shit in tandem. The best way that I can see to force the government's hand on this issue is to use a dataset like the one the NYT obtained to expose a few politician's extramarital affairs. Once they realizes this information can be used against them, they'll suddenly consider it to be a very big issue.
bokbok8379 7y ago
Blah blah blah if you go to the strip club every day, someone's going to know.
ng7j5d9 7y ago
I'm waiting for instant decisions about my service worthiness based on algorithmic analysis of my data points. If the data know that I live in a nice neighborhood and commute every day to a office park job then Facebook will expend compute cycles on showing me things of interest to me. If an inner-city poor tries to get on Facebook, it can just show them a blank page. No money to be made there.
bytematic 7y ago
oh yeah, I'm suprised nobody is talking about Pilgrim. https://enterprise.foursquare.com/products/pilgrim https://enterprise.foursquare.com/products/pilgrim
- adrianpike 7y ago
  Wow, Foursquare. There's a company I haven't heard about in a hot minute.
  - bytematic 7y ago
    They figured out that they can make a lot more doing enterprise-level tracking
chrisMyzel 7y ago
So can once and forever tell me someone why I can be tracked by a 3rd party app when I explicitly disable location services in my android phone? I'm not.talking about the device vendor or OS maker. Can it really be so many people are so god damn stupid to leave that service on all the time or is it me here being goddamn stupid and naive :)

405 points by danso 7y ago

john_minsk 7y ago

This page doesn't work for me and it doesn't show any errors... Update: Firefox fixes it...

deleted 7y ago
[deleted]

ajb 7y ago

Web page is broken. Only works for me if I scroll past the stupid animation before it finishes loading, otherwise it gets stuck.

AznHisoka 7y ago
If you are viewing on safari, reader modes shows you the content.
mstokholm 7y ago
Scrolling past animation worked for me on Firefox
tyingq 7y ago
None of the interactivity, and only one of the map images, but at least you can read it: https://outline.com/nVTtcg https://outline.com/nVTtcg

wrkronmiller 7y ago

Reader View on mobile Safari seems to work

bilekas 7y ago

The animation intro is detrimental to the actual article.. You need to delete the HTML element with class `video-stepper-content` So annoying. if lazy : Console cmd : `document.getElementsByClassName('video-stepper-content')[0].parentNode.removeChild(document.getElementsByClassName('video-stepper-content')[0])`

jraph 7y ago
Trying to optimize your line for non-whitespace character count since I have nothing else to do right now, I just discovered $ can be used in any webpage from the browser console: $('.video-stepper').style.display = 'none'
- tyingq 7y ago
  If we're golfing, and jQuery is there: $('.video-stepper').hide()
  - jraph 7y ago
    I tried, it's not in this article, I am really interested for a shorter solution however :-) edit: $('.video-stepper').remove() works
    - tyingq 7y ago
      Ahh, I see. No jQuery. The Chrome developer console is aliasing $() to document.querySelector() https://developers.google.com/web/tools/chrome-devtools/console/utilities#queryselector https://developers.google.com/web/tools/chrome-devtools/cons... I didn't know it did that.
      - bilekas 7y ago
        Thats actually pretty interesting.. Wonder which would take preference if I have a bespoke definition for $ in an extension/worker somewhere. Even a browser level event listener on it. O_o Clearly I don't have much either to do today.
        deleted 7y ago
        [deleted]

scarface74 7y ago

As I suspected, the article is nowhere near technical enough to get any sense of how third parties can tie a name to a phone. NYT’s articles about technology are usual horrible.

denzil_correa 7y ago
NYT will reveal more details in subsequent articles. > In this and subsequent articles we’ll reveal what we’ve found and why it has so shaken us.
tyingq 7y ago
It does say this: "In most cases, ascertaining a home location and an office location was enough to identify a person. Consider your daily commute: Would any other smartphone travel directly between your house and your office every day?" Then they back it up with: "With the help of publicly available information, like home addresses, we easily identified and then tracked scores of notables." And provided the specific example of Mary Millben. It was manual and not automated, but the tech details of finding work and home addresses, based on the two most visited spots, seems not novel. Similar for extrapolating that into a name.
- jc01480 7y ago
  Do some patent searches for the companies pioneering the technology. Read their white papers. You can begin to assemble an idea of how they do it. It’s not entirely revealing and is very tedious. But you can connect the dots. NYT is somewhat half-hearted when it’s not a political subject.
rchaud 7y ago
It's the NYT, not the Journal of Telecom Engineering. They're writing for a general audience.
- scarface74 7y ago
  It doesn’t have to be a telecom. Did they say which mobile platforms? Which apps? How to prevent apps from tracking you by using the permission system built into the OS? Instead they created an article with a presentation style that looked like a MySpace page. I was half expecting early 2000s music.

bilekas 7y ago

> Work in the location tracking industry? Seen an abuse of data? I would have thought those things go hand in hand no.. Kind of like the oxymoron: A privacy conscious social media company..

jc01480 7y ago
Funny you mention this. Outside the Guantanamo prison complex is a sign bearing the unit symbol of the military branch operating the facility. This is affixed to a fence bearing “maximum security” signage, etc. Displayed on this sign was their motto which contained verbiage about defending “freedom”. I found this ironic as there was a prisoner staring out through the fence standing next to the sign.

boring_twenties 7y ago

> Work in the location tracking industry? Seen an abuse of data? We want to hear from you. Using a non-work phone or computer, contact us on a secure line at 440-295-5934 Would be nice if they clarified what the hell exactly a "secure line" means

mike-cardwell 7y ago
One that isn't recorded and routinely listened to by your manager?
- boring_twenties 7y ago
  That would seem to have already been covered by the first half of the sentence?
  - mike-cardwell 7y ago
    So if you read and understood the first half of the sentence, then you must have an idea of what a secure line is then.
    - boring_twenties 7y ago
      This doesn't seem to make any sense. The first half isn't explaining what the second half is going to mean. It reads like two separate things of which you need to do both.
      - mike-cardwell 7y ago
        It's almost as if you're parsing the sentence as a computer would.
tyingq 7y ago
Wouldn't it just mean "a line where your employer cannot monitor or log calls?"
7y ago

bilekas 7y ago

It would have been nice if the report listed and documented all the mobile services that were doing this and stept to clean it up as best as possible.

boring_twenties 7y ago
Wouldn't it be more tractable to list the few that aren't doing this, if there even are any?
- bilekas 7y ago
  Hmm, yes, but then you're in the realm of trying to convince non-privacy savy people to use other services that replace the tracking ones. Its all extremely frustrating and does nothing to ease my anxiety!

mfer 7y ago

One of the things I appreciate about the iPhone is the fine grained settings for location tracking. I have had to turn off access to numerous apps and have limited other apps to only using my location when I use the app. To limit the tracking I had to personally do an audit. I noticed the location indicator was on most of the time and it annoyed me. I found too many apps using location tracking that just did not need it. Most people will not do this. We need better laws.

bilekas 7y ago
Its amazing when you hear people say they appreciate being able to stop individual tracking after its defaulted. Instead of expecting that nothing tracks you until you permit it. FWIW: This 'ability' is not specific for Iphone
- john_minsk 7y ago
  Then it works as expected. It doesn't track you before you approve it. Which 99% of us do when opening an app.
  - bilekas 7y ago
    No application should `require` location services to start/let you in. If you have `Facebook` app installed first time, upon opening the app, there should not be any requirement to access location data. Only at the point of posting with a 'Share Location' the app should request the Location tracking. And I don't see why it then needs to be permenantly permitted from then on. (Unless manually remove again) They are scummy tactics and I agree, people just click okay to remove the inconvenience, but the creators are creating problems in order to get those 'Allow access'. Its gross. Almost like selling a solution to a problem you created.
    - zo1 7y ago
      >"No application should `require` location services to start/let you in." Exactly this. Rejecting apps from getting into your store ecosystem that request permissions that they can't justify based on the purpose of the application should be one of the first and major things app-store curators do. Now to enforce this with browsers as well and include things such as "push notifications".

foreigner 7y ago

I was about to shrug this off but quickly checked my phone - 25 apps have access to my location?!!

john_minsk 7y ago

1) There is no Facebook, Apple and Google on the list of "location data" companies. These guys have records on you for years of tracking and it didn't cause nytimes to create a fancy article on them? 2) Funny how the only big company mentioned in the article is Apple, while iOS is far more difficult to convince to share location data with 3rd parties compared to Android.

deleted 7y ago
[deleted]
danso 7y ago
The story discusses the provenance of the data after the opening paragraph: > THE DATA REVIEWED BY TIMES OPINION didn’t come from a telecom or giant tech company, nor did it come from a governmental surveillance operation. It originated from a location data company, one of dozens quietly collecting precise movements using software slipped onto mobile phone apps. You’ve probably never heard of most of the companies — and yet to anyone who has access to this data, your life is an open book. Is your suggestion that the NYT wait until every large tech company leaks their databases to their reporters?
- criddell 7y ago
  Facebook, Apple, and Google don't have to leak anything. They don't conceal what they collect. If you haven't looked at it yet, Google's dashboard is pretty eye opening. You can see where you were every minute of the day years ago.
  - danso 7y ago
    Yes, I know of these systems and have been downloading/analyzing my personal data for years. And the press has written on the implications and risks of this data for years. I guess I don't understand what you're getting at? The NYT is not entitled to my or anyone else's data unless I give it to them. Ostensibly, the story under discussion is interesting because it is personal data for millions of users who have consented (via agreeing to terms of services) to the collection, but haven't fully grasped what happens when that data can reveal to a third party.

DanielBMarkham 7y ago

I try to avoid sarcasm online. It can be taken the wrong way. But I would like to welcome the NYT to 20 years or so ago when Google realized that there was money in the data. Or ten years ago or so, as privacy advocates started seriously bouncing off the walls realizing that we were tagging and tracking people in a way dictators of the past could only dream of. I'm glad they might be catching up, but for a big news organization like that, it's sad to see it take so long. I wonder if, like so many of these blow ups in the past, there'll just be a spike of public interest and then it'll all die away. One of the most amazing things about the news in the last few years is how stories that used to have international, severe impact and political repercussions just drift off into the ether now. No follow-up, no continuing coverage. It's all about immediate spikes in shares, likes, tweets, and readers. They know people don't care about the follow-up that much; heck the data tells them that. So there's no follow-up, only the next sensation. I hope this amounts to something. I have my reservations.

BLKNSLVR 7y ago
> there'll just be a spike of public interest and then it'll all die away Panama Papers, Paradise Papers. Very little has come out of this and it's so disappointing. What this says to me is that enough of the people powerful enough to change any of it are in on it. Or, there just isn't the critical mass at the bottom, and this, where we find ourselves as a global population, is the stability between comfort and outrage. The "Or" above, maybe should be an "And". I wonder whether one of the reasons that seemingly illogical conservatism is as successful as it is, is because the bigger the world economy gets, and the larger the population, the harder it is to change anything meaningful without wiping out a pillar-sized part of the economy, the results of which are too unpredictable for anyone in power to want to take responsibility for. This position only leads to further conservatism, in that any changes 'we let pass' must be war-gamed to the nth degree to ensure they don't cause societal collapse. I'm not conservative, but the above is almost the only way I can process seemingly illogical conservatism that is actually anything other than "maintaining the status quo because I'm part of it". It's almost believing their own FUD. Hubbard-style. But it might not be entirely wrong.
- 7y ago

crashhacker 7y ago

This is going to get much more severe if proper checks specifically ethical checks which should be done. the GDPR is a good start but it needs a lot of work when information to track users can be done with a lot of sensors nowadays.

prolonge 7y ago

Think of the modern Truman Burbank. The next step is to assume everything is live at all times and behave as such. Stop trying to prevent everyone being aware of each other. Scheming is irrelevant now and if you are reversing the progress of the tribe then you should spend your days on your computer trying to come up with a new Tor and then you'll approach the end of your life knowing that all you did was try to avoid everyone's gaze so you could "get ahead."

jc01480 7y ago
Assuming everything is live presumes that we should have to care about what others think about any given conduct. Social justice is what this is plain and simple. Rule of law (or the absence thereof) is meaningless in modern society?
- prolonge 7y ago
  I've heard the "eye of Sauron" metaphor in a few podcasts that commentate on the ease of mass surveillance. This has less to do with individual smartphone tracking - individual smartphone users have the power to zero in on certain topics and ideas (viral) relatively instantly since news can travel along a global internet unhindered. Chinese Social Credit automated aggregation of all citizen smartphone activity feeds is the "rule of Law". We will be economically limited by our inefficient (bad) deeds.

onreact 7y ago

That's one of the reasons why I gave up smartphones. Radiation, addiction and 24/7 workweek were some of the others. When your phone is smarter than you something is wrong.

kleiba 7y ago
I've never seen any credible claim on negative implications through radiation when using smartphones. Do you know any?
- inimino 7y ago
  There is strong anecdotal evidence that some people are affected by it. However few, or however small the effect size, it is not strictly the same thing as known zero risk.
- onreact 7y ago
  The WHO says: "The electromagnetic fields produced by mobile phones are classified by the International Agency for Research on Cancer as possibly carcinogenic to humans" https://www.who.int/news-room/fact-sheets/detail/electromagnetic-fields-and-public-health-mobile-phones https://www.who.int/news-room/fact-sheets/detail/electromagn...

throwaway8291 7y ago

As a thought experiment: Imagine all that data was open and everybody could query and use it. Because my gut tells me, it will be in a decade or two.

deltron3030 7y ago

Nice graphics, powered by Svelte?

mmjaa 7y ago

I wish I had this data, myself. I mean, my own personal data - it would be so incredibly useful for me to be able to go back through the last years and see my location and tracking data. I could finally get those timesheets updated with correct details .. But, alas, no. Its not available to me. Only third parties can access it. This is a terrible situation.

worldsayshi 7y ago
You can download your google data at https://takeout.google.com/ https://takeout.google.com/ Not sure if this is only for EU citizens.
- mmjaa 7y ago
  Yeah, its better than nothing but that's still not quite as simple as just having a database I can copy off my own phone with all the details.
  - danso 7y ago
    If you have an iPhone, you can use a utility to extract the location database: https://reincubate.com/support/how-to/export-view-iphone-location-data/ https://reincubate.com/support/how-to/export-view-iphone-loc... If you have an Android, using Google Takeout would likely be the easiest route: https://takeout.google.com/settings/takeout https://takeout.google.com/settings/takeout

baybal2 7y ago

One more reason to fight for the right to anonymous SIM cards. No way to underestimate how important this is. Second to it, you guys need to push for removing tracking infrastructure that Google shoves into Android. Not a single application should be allowed access to anything amounting to a "Device ID" or fingerprinting method, implicit or explicit

Fnoord 7y ago
Isn't the IMEI still publicly available?
- baybal2 7y ago
  If you didn't know, Google even added a special API in Android for Apps to use to get device IDs, IMEI included. The very point of it is to allow tracking by Apps. In Android 6 they even made a special callback result to indicate that the user has refused to give his permission rather than indicating that modem/phone ID wasn't found. Clearly they are aware of this and do that deliberately.
  - ParanoidShroom 7y ago
    What special API is this ? Can you post a link, thanks.
    - baybal2 7y ago
      android.telephony.TelephonyManager.getDeviceId() android.os.Build.getSerial()
dopylitty 7y ago
One of the key points of the article is that location data itself is nearly impossible to anonymize. Even if person had an anonymous SIM it would be trivial to identify them by the locations where they spent most of their time.
- 7y ago

ENOTTY 7y ago

My questions for any company that collects location data or receives it from a third party would include: Do you associate the geo data with individualized identifiers? In other words, can individual data points be linked to one another (linkability)? (Obviously the answer is yes for whichever company this dataset came from) Do you resell the raw data to other third parties, and if so, what kind of vetting and data controls are levied upon them? Where are these customers located? Let us see one of your contracts. I generally think this story would have be more impactful if the Times tried to pose as a customer and bought the data from a company to expose flaws in that system. As it stands, the location companies are very willing to admit they sell this data, but they would claim that nothing bad will happen to you. Disprove that and now there’s a cause for action.

adam0c 7y ago

there's a very limited amount of people around the world that actually care about this those of us do our best to not allow this to happen but then there is the others, the people that don't read terms, that live for the gram etc these are the main demographic target because they're quite simply dumb. People constantly make jokes at me for wanting to be off the grid for trying to keep a low profile etc for complaining about having to accept cookies for any website you want to use these days. data mining has been big bucks for far too long and will remain that way until the masses join us which I sadly fear they never will along with the fact that these big data companies are all working with bigger government and political groups. its been this way for a long time as others have pointed out and its a sad fact that it will remain this way for the foreseeable future unless people educate themselves on these matters because the companies getting away with it will continue to and not educate the masses as that means a loss of profit.

sithadmin 7y ago

There was a pretty interesting talk presented at DefCon this year on tracking and other personal data being exfiltrated from mobile devices over Tor (in plaintext!!!). After noticing this activity on some end user devices, the presenters set up some exit nodes and started looking for similar traffic, and uncovered a shocking amount of data being moved about in this manner from a variety of mobile applications. Unfortunately, the presenters didn't name and shame (though they did imply some well-known brands were guilty), and it was presented at the SkyTalks venue, so no recording was allowed and the slides won't be published. But given the data that they were collecting and where the impacted users seemed to be located, it appeared like a majority of the tracking traffic they were intercepting was coming from users in China, Russia, and other states with civil liberties issues.

CuriousReader13 7y ago

This data seems highly valuable to hedge funds: if a fund could pin the devices of well-known bankers and executives of potential acquisition targets, it could see deals coming before announcements. Is this legal?

7373737373 7y ago
Hell, track their social relations, and the same for all of their employees, estimate their personal relations with social models, quantify and predict their mood on an organizational level. Then go long or short on the company. Rinse and repeat for everything on this planet.

K0nserv 7y ago

I encourage everyone to try routing your own device's traffic through mitmproxy and observing this in real time. It's eye opening. Apps like Deliveroo, which have legtimate reasons for high accuracy location access, send your data to marketing companies on every launch with very high precision. I've written a guide[0] about how to use mitmproxy to look at the data escaping your device. 0: https://hugotunius.se/2019/01/23/going-spelunking-with-mitmproxy.html https://hugotunius.se/2019/01/23/going-spelunking-with-mitmp...

colesdefectum 7y ago
While it may not catch everything, another way I've picked up on various tracking services is simply running pihole and customizing the lists based on permitted dns lookups. It's interesting and troubling just how much of my internet browsing is blocked at the DNS level on a day to day basis with no perceivable impact on what's being viewed. I do wonder how many services might start trying to hardcode IP addresses to get around such things in the future. I'll have to try mitmproxy and see what I might be missing.
- K0nserv 7y ago
  Yup I do this too and I agree with your observations, about one third of my home network's DNS request are rejected with nearly no impact on my internet browsing. I've also observed the same thing when browsing the web with uBlock Origin set to block third party scripts by default. On most sites whitelisting ~20% of scripts is enough to make the site functional, the other ~80% apparently being redundant for the purpose of the site's core functionality.
mobilemidget 7y ago
Am I understanding it correctly that the app on your mobile is directly sending the data to marketing companies? They don't even collect it and hand it to marketing companies through a separate channel?
- K0nserv 7y ago
  No they dont't usually collect the data and forward it to third parties. With most stuff like this apps will embed a binary SDK which is initialized when the app starts. Because the SDK runs in the app's process it has all the same permission and data access that the app itself has. The SDK communicates with the relevant APIs directly. On the web similar models are often used with third party scripts loaded in the main page context. For example here's Braze's developer integration guide https://www.braze.com/docs/developer_guide/platform_integration_guides/ios/initial_sdk_setup/cocoapods/#step-1-install-cocoapods https://www.braze.com/docs/developer_guide/platform_integrat...

34679 7y ago

The US government has agreed with the US government's argument that any information transmitted over a 3rd party server is not protected by the 4th Amendment. This is why the US government will not do anything to stop or slow the mass collection of private data. They have asserted and affirmed their right to Hoover that shit in tandem. The best way that I can see to force the government's hand on this issue is to use a dataset like the one the NYT obtained to expose a few politician's extramarital affairs. Once they realizes this information can be used against them, they'll suddenly consider it to be a very big issue.

bokbok8379 7y ago

Blah blah blah if you go to the strip club every day, someone's going to know.

ng7j5d9 7y ago

I'm waiting for instant decisions about my service worthiness based on algorithmic analysis of my data points. If the data know that I live in a nice neighborhood and commute every day to a office park job then Facebook will expend compute cycles on showing me things of interest to me. If an inner-city poor tries to get on Facebook, it can just show them a blank page. No money to be made there.

bytematic 7y ago

oh yeah, I'm suprised nobody is talking about Pilgrim. https://enterprise.foursquare.com/products/pilgrim https://enterprise.foursquare.com/products/pilgrim

adrianpike 7y ago
Wow, Foursquare. There's a company I haven't heard about in a hot minute.
- bytematic 7y ago
  They figured out that they can make a lot more doing enterprise-level tracking

chrisMyzel 7y ago

So can once and forever tell me someone why I can be tracked by a 3rd party app when I explicitly disable location services in my android phone? I'm not.talking about the device vendor or OS maker. Can it really be so many people are so god damn stupid to leave that service on all the time or is it me here being goddamn stupid and naive :)