
If You Have A Smartphone, Anyone Can Now Track Your Every Move - dhimes
http://www.technologyreview.com/blog/mimssbits/27784/
======
DanielBMarkham
Note that the tech is there to do this with the cell radio -- no WiFi
required. It's just a lot more expensive and hasn't been widely commercialized
yet.

The gap that's left open here, as with many semi-anonymized tracking systems,
is joining the data up with some other stream of data that identifies the
person. Once cell phones become wallets, that should be easy enough for
merchants to do. Just join up the purchase transaction data with the location
data. Of course the obvious way to do this would be to simply provide an open-
access WiFi spot that required a valid email to access. And don't forget that
such publicly-accessible data as your WiFi radio ID is easily put on a
database and traded. Over time, using several such matching systems, you could
probably build up a 95%+ accurate tracking system of people with their
identities attached.

Not trying to over-dramatize this story. No matter what your views of privacy
and anonymity, to me it's fascinating from simply a technology standpoint to
watch all the pieces slowly lining up. It's like watching a puzzle slowly
being fitted together.

~~~
JackC
Ooh, let me help you over-dramatize.

One great way to radio-fingerprint people is when they use a point-of-sale
device like a credit card checkout or an ATM or a pay-at-the-pump gas station.
Put a camera on it (if you don't have one already), and you get (1) a good
picture of someone's face; (2) their name and maybe address; (3) a unique way
to identify them (credit card number); and (4) a short list of their possible
radio IDs. Within a few encounters, you can be 99.9% sure which radio IDs
belong to them. Put this system in, oh, 7-11s, Shell gas stations, and pay
ATMs, and pretty soon you'll have a match for a good chunk of the population.
Plus of course it gets easier as you go along -- the more people you have
affirmatively identified in a location, the easier it is to narrow down the
rest.

The product is a subscription database that will show you a map of your
surroundings with a mug shot for each person nearby. Click the picture and you
can find out anything that can be learned from their name, address, magazine
subscriptions, purchase history etc -- their politics, income, education,
interests, relatives, etc. If you've managed to link their email yet, you can
also get all their recent online activity ...

OK, maybe banks and gas companies aren't that evil, or at least would quickly
be stopped. So let me ask this: what kind of radio-fingerprint database could
someone build with a botnet? You control a webcam, a wireless card, and
unencrypted access to the user's internet browsing. Where does that get you?

(Probably all of this is a bit silly, but it's fun to imagine what could be
done with existing technology ...)

~~~
phogster
Big Brother, where art thou?

------
recursive
> Most of us leave Wi-Fi on by default, in part because our phones chastise us
> when we don't.

I rarely ever have wifi turned on. I've never been chastised.

~~~
fennecfoxen
The iPhone begs for wi-fi regularly (especially if you're looking at, like,
maps, or downloading things), makes it easier to connect (popup captive portal
dialog technology, Wispr) and makes it more tedious to turn off. Android
phones make it easy to turn on and off (custom widgets on the home screen) but
do not make it quite as easy to connect. Therefore you see a lot more iPhones
hanging around on random free wifi than Android, in terms of installed-base
percentage.

AT&T's early iPhone monopoly and the (in)ability of their network to handle
the increase of traffic in those early days is probably a factor which
contributed to this state of technology.

~~~
X-Istence
Not only that, but iPhones will automatically connect to any open ATT wireless
nodes, they are configured that way when you go purchase a device from ATT.

------
Sukotto

      In addition, Navizon also has the ability to assign real
      identifying information to a device, but it's a process 
      that could hardly occur without your knowledge.
    

When the user buys something, you have their name and credit card information
and maybe an existing member/discount card. Connect to whatever dot is closest
to the cash register. Maybe make it more of a Bayes weighted connection
instead of a _certain_ connection to handle edge cases like "spouse using
other spouse's card", "member-card swap club", etc

Easy, effective, and transparent to you, the person being tracked. You're just
buying something right?

You can track people in meatspace using cell phones the way you track them
online using browser cookies. This just makes it affordable (especially
compared to the cost of tracking via cell tower)

~~~
X-Istence
The thing is that they can track this over time ... so even if they registered
all the dots in the area at the time, if they do this often enough a pattern
will emerge where you are the only one with that specific radio ID that makes
a certain purchase. So unless you can get your friends to come with you every
single time they only need to get data from 3 visits or so...

------
inoop
For those that are interested in how this works: it's basically a feature of
the 802.11 MAC. When a station STA1 transmits an RTS packet (request to send)
to some other STA2, STA2 has to respond with a CTS (clear to send) packet
(collision avoidance, hidden terminal problem). So basically if a detector
knows that a mobile station exists with some MAC address, it can 'ping' it by
sending RTS packets to it. It has to know a) the MAC address, which it can
learn by overhearing probe request sent by the mobile station when its
scanning for access points, and b) the channel the station is on. Of course,
you can ping repeatedly on different channels or use multiple Wi-Fi
transceivers.

Note that when the mobile station is associated with an access point that uses
PSM (power saving mode) this does not work because the mobile station is in
sleep mode 99% of the time and only wakes up periodically to catch a beacon
packet from the access point.

By pinging the mobile station and measuring the received signal strength of
the CTS response packet at various locations you can triangulate the location
of the mobile station (or better yet, use fingerprinting, MLE).

------
cpeterso
I'm working on a hobby project to create a crowdsourced, "open data"
alternative to proprietary geolocation services like Google or Skyhook. This
would enable desktop applications (like freedesktop.org's GeoClue library) to
geolocate (using a web API or by downloading data to use offline).

A possible player in this area is WiGLE (Wireless Geographic Logging Engine),
a Wi-Fi "wardriving" website with a database of 60M Wi-Fi network's MAC
addresses and lat/long positions. Unfortunately, they don't want to create a
free service because they sell the database to undisclosed partners. Even
though most of "their" data consists of 10 years of wardriving volunteers
uploading their personal logs, WiGLE locks the community's data behind a
crappy Java map application and doesn't make the crowdsourced data available
for download or from a web API.

<https://wigle.net/gps/gps/main/stats/>

~~~
biafra
Yeah, those WiGLE guys are really not helpful. I drove around several weeks
and mapped thousands of new APs for them. They didn't even answer my email
regarding offline use.

~~~
cpeterso
That's interesting. They talked around my questions about offline use and a
GeoClue developer's questions about web APIs for Free software.

I wonder what their deal is. The "cynical me" wonders if they are a front for
a company that quietly profits off wardrivers eagerness to share. :(

------
CodeMage
Sensationalist headline alert: They forgot to finish the sentence with "if you
leave Wi-Fi turned on".

~~~
andrewaylett
How many people actually bother to turn their WiFi off? I don't know of any
who do it manually (although I do have Juice Defender to do it for me, based
on location).

~~~
Fishkins
I do. I believe it saves battery, and it's really quick. In Touchwiz, the
WiFi/GPS/4G controls are built into the notification pulldown. I believe the
same is true of cyanogenmod.

Having it automated might be better, but it's never bothered me enough to look
into that.

~~~
tsotha
WiFi is a big battery hog on my phone. I can go three days on one charge
without it, but if I connect up to my home network with WiFi I get less than
two.

~~~
brlewis
Are you running an app that's configured to perform a particularly data-
intensive activity only on wifi? That's the only way I can reconcile your
experience with ryandvm's comment (sibling to yours).

~~~
tsotha
Nope. That's with virtually no data usage at all. Just turning it on and
connecting to my home network.

------
Symmetry
Wait, so this is only inside someone's building? They can already track my
every move with cameras.

~~~
ansgri
AFAIK, current machine vision technology can provide at most ~85% tracking
accuracy in crowded environments.

~~~
fennecfoxen
This technique may be relevant to your interests.

<http://www.google.com/patents?id=hXYEAgAAEBAJ>

------
sk5t
How about regularly changing one's wireless MAC? I'd be surprised if this is
extremely difficult, even on an iPhone.

~~~
cpeterso
I believe some Android phones (at least, the Galaxy Nexus and Droid X)
randomly select a new MAC address on reboot. Whether this is a bug or a
feature depends on your point of view:

* Android Issue 23330: Galaxy Nexus (VZW/LTE) wifi MAC address changes with every reboot <https://code.google.com/p/android/issues/detail?id=23330>

* Droid X WiFi MAC address changes when I power WiFi on and off. [http://rootzwiki.com/topic/1332-wifi-mac-address-changes-whe...](http://rootzwiki.com/topic/1332-wifi-mac-address-changes-when-i-power-wifi-on-and-off/)

------
SonicSoul
"most of us leave wifi on by default" I wonder if this is based on some real
evidence. I don't see any reason to leave wifi on by default, and most phones
i've owned don't enable it by default.

~~~
dhimes
Good question. When I purchased my first smart phone 18 months ago, I was
pretty compulsive about turning the wifi off if I was in a place where I
couldn't use it. I figured it would save battery. I lamented how the phone
(iphone 4) made it a little cumbersome to turn off the wifi (and bluetooth,
also) and asked others what they did (maybe 5 people). They said they just
left it on. Any lessening of battery life was outweighed by the convenience of
getting out the phone and going through the menus every time you leave the
house or office.

Now, I also don't turn off my wifi.

~~~
pyre
As of Gingerbread, the 'turn wifi on/off' button is in the top pull-down menu
in Android (that was previously reserved mostly for notifications). It's as
easy as swiping down and touching the button.

EDIT: After reading this[1], it's probably a Samsung-only thing. My wife's
Samsung phone is my only experience w/ Gingerbread. That said, I think that
this is an awesome addition based on my experience with Froyo.

[1] <http://news.ycombinator.com/item?id=3868005>

~~~
schiffern
For jailbroken iPhones, there is NCSettings, which adds SBSettings-like
settings options to iOS 5.0's Notification Center:
<http://www.idownloadblog.com/2012/03/26/ncsettings/>

------
jhspaybar
When is the quaint notion of privacy going to die? I don't get it. Any privacy
you have today is purely through obscurity. I decided a couple years ago to
just go fully public, my Facebook is open, and I assume at some day in the
future, every post I've ever made anywhere will eventually be linked directly
to me through some kind of smart algorithm. The reality today is if you want
it hidden, don't do it, or hope no one ever has a reason to care if you did
it.

~~~
jcbrand
That's an incredibly naive and short sighted view to take. What if one day,
some activity that you now openly partake in, is condemned or made illegal and
all people who partake in it are rounded up?

That might sound paranoid but history is replete with examples of oppressive
regimes who captured, tortured and/or killed people they deemed subversive,
immoral or unwanted.

One recent example that's perhaps not a cliche is Uganda, where very
oppressive anti-gay laws are being passed and people in power are agitating
for the death sentence for homosexuals.

What if gay Ugandan people followed your example and lived their whole lives
openly on the internet?

~~~
angersock
Come, come, surely this would never be a concern. Don't ruin the poor kid's
delusions.

------
andrewaylett
Something that's not entirely clear to me from the article: is this how
Google's new indoor maps stuff works? If so, can someone reconcile that what's
described is a way for the infrastructure to track the handsets, that the
handsets are still anonymous, and that the maps run on the handset (so unless
I'm missing a link, the system must be passing data to the handset).

~~~
fennecfoxen
Google's new indoor maps stuff is implemented at the map layer. They don't
have the infrastructure in place to track your wifi from a location's sensors
and then communicate that back to the phone. It's just whatever physical-
location technology is already built into your phone (typically some
combination of GPS, cellular, and a list of what wifi access points are
available), plus an indoor floorplan.

------
fennecfoxen
Listening nodes? Bah. <http://nearbuysystems.com> does it without listening
nodes - just an existing wireless infrastructure.

Privacy implications? Indeed. That's why it's implemented as an opt-in guest
wifi network. Can't do that with a listening node either.

------
yahelc
Another startup in this space is Euclid:
[http://www.popsci.com/technology/article/2011-11/euclid-
anal...](http://www.popsci.com/technology/article/2011-11/euclid-analytics-
tracks-shoppers-smartphones)

Founder started Urchin, which Google acquired and turned into Google
Analytics.

~~~
yread
also <http://www.viewsy.com/>

They are in startup bootcamp

------
mirkules
"Navizon's system can determine where you are, but not necessarily who you
are, since all it sees is a Wi-Fi radio."

Maybe they can't find out WHO you are, but they can certainly find out where
you live: wigle.net

Apple and Google may also have their own reverse SSID geolocation service, so
there's really nothing stopping Navizon from finding out where you live.

Furthermore, they can use Kismet (or any other such tool) to find the SSIDs
that your phone is searching for -- and if you, for example, enable WiFi at
work AND at home -- they can also deduce where you work.

I find the service to be pretty creepy, personally.

~~~
StavrosK
Your phone doesn't usually broadcast an SSID. Your home router does. What
you've linked to isn't the same thing as the article, unless you're carrying
your router along with you everywhere.

~~~
cjmauthor
Even if we believe that our data is anonymous in one way or another the
reality is that there are teams everyday working on de-anonymizing data. If
you look at dozens of posted articles online referencing the restructuring of
anonymous data you will realize that what appears to be anonymous on the
surface might not be.

------
aidenn0
I almost never have WiFi on with my current phone, it causes my battery to run
dry at about 5pm. With my previous phone, the wifi was almost always on
though, as the impact to battery life was minimal.

------
Rickasaurus
This would be great with an opt-in/synchronize step to help find your friends
at huge conferences.

Edit: Also, I just realized that this could be fantastic for meeting up with
someone (especially in NYC). You just pick some general area to meet up in and
when the other (perpetually late) person shows up they'll know right where to
find you. You could even mix in the google maps API and get an ETA for their
arrival!

This is something I would pay a monthly fee for.

------
kenneth_reitz
Only if you bring it with you.

------
fooandbarify
I built an almost identical system this past year as my EE capstone project.
The accuracy of these systems is limited by environmental factors (large metal
structural/aesthetic features of a building) which can be corrected to a
certain extent, but it would still be trivial to avoid being tracked by using
a directional antenna.

------
Gring
Doesn't the iPhone only look for wlan networks once you start using it? At
least, this has been my experience in the past: after returning to my base
station, when I unlock it (turn on the screen), it takes a few seconds until
the network indicator changes to wlan.

If true, this issue is quite overrated, at least on Apple devices.

------
com2kid
I have a fundamental problem with the phrase

"Most of us leave Wi-Fi on by default, in part because our phones chastise us
when we don't."

I enjoy having more than 8 or 9 hours of battery life, WiFi is carefully
turned on and off. Heck my phone came with a giant WiFi toggle switch on the
home screen.

------
jmah
One thing that's not clear: Must the target device be connected to a
particular wi-fi network, or can devices even be tracked while wi-fi is on,
but not connected (or connected to a different network)?

~~~
tachim
It's not the actual connection itself that matters. If your phone ever
transmits a packet, it can be detected and associated with your phone's radio
id.

------
ronnoch
How would one go about setting this up in their own house? Privacy concerns
aside, I can think a some cool uses for this (more finely-grained location
based reminders for instance).

~~~
biafra
Doing the reverse might be easier. In Android you can see several access
points and their strength. You can trilaterate or record fingerprints.

And it works anywhere where there is at least one or two visible wifis.

No special infrastructure needed.

------
gouranga
Get a Windows Phone - it will ask every time it does everything if you want.
It's "opt out" by default which is more than I can say for Android or iPhone.

------
Zash
If you have a GSM phone, anyone could already track your every move.

<http://youtu.be/ZrbatnnRxFc>

------
chrisbroadfoot
As far as I know, WiFi triangulation indoors is only good to an accuracy of
about 10m, depending on configuration of the building.

~~~
fennecfoxen
Technically, you don't usually do wifi "triangulation". With triangulation,
you measure direction - not something most wifi sensors and antennas are
capable of. You'll use trilateration, which involves distance (you have a
signal strength measurement) and turning that into circles.

<http://en.wikipedia.org/wiki/Trilateration>

------
moylan
i use llama on my android devices to turn on wifi only in places where it
knows and turn it off else where. saves power too that way.

[https://play.google.com/store/apps/details?id=com.kebab.Llam...](https://play.google.com/store/apps/details?id=com.kebab.Llama&hl=en)

------
Egregore
Can it track you when you're turning wifi off?

