26
May 18

Why Is Your Location Data No Longer Private?

The past month has seen one blockbuster revelation after another about how our mobile phone and broadband providers have been leaking highly sensitive customer information, including real-time location data and customer account details. In the wake of these consumer privacy debacles, many are left wondering who’s responsible for policing these industries? How exactly did we get to this point? What prospects are there for changes to address this national privacy crisis at the legislative and regulatory levels? These are some of the questions we’ll explore in this article.

In 2015, the Federal Communications Commission under the Obama Administration reclassified broadband Internet companies as telecommunications providers, which gave the agency authority to regulate broadband providers the same way as telephone companies.

The FCC also came up with so-called “net neutrality” rules designed to prohibit Internet providers from blocking or slowing down traffic, or from offering “fast lane” access to companies willing to pay extra for certain content or for higher quality service.

In mid-2016, the FCC adopted new privacy rules for all Internet providers that would have required providers to seek opt-in permission from customers before collecting, storing, sharing and selling anything that might be considered sensitive — including Web browsing, application usage and location information, as well as financial and health data.

But the Obama administration’s new FCC privacy rules didn’t become final until December 2016, a month after then President-elect Trump was welcomed into office by a Republican controlled House and Senate.

Congress still had 90 legislative days (when lawmakers are physically in session) to pass a resolution killing the privacy regulations, and on March 23, 2017 the Senate voted 50-48 to repeal them. Approval of the repeal in the House passed quickly thereafter, and President Trump officially signed it on April 3, 2017.

In an op-ed published in The Washington Post, Ajit Pai — a former Verizon lawyer and President Trump’s pick to lead the FCC — said “despite hyperventilating headlines, Internet service providers have never planned to sell your individual browsing history to third parties.”

FCC Commissioner Ajit Pai.

“That’s simply not how online advertising works,” Pai wrote. “And doing so would violate ISPs’ privacy promises. Second, Congress’s decision last week didn’t remove existing privacy protections; it simply cleared the way for us to work together to reinstate a rational and effective system for protecting consumer privacy.”

Sen. Bill Nelson (D-Fla.) came to a different conclusion, predicting that the repeal of the FCC privacy rules would allow broadband providers to collect and sell a “gold mine of data” about customers.

“Your mobile broadband provider knows how you move about your day through information about your geolocation and internet activity through your mobile device,” Nelson said. The Senate resolution “will take consumers out of this driver’s seat and place the collection and use of their information behind a veil of secrecy.”

Meanwhile, pressure was building on the now Republican-controlled FCC to repeal the previous administration’s net neutrality rules. The major ISPs and mobile providers claimed the new regulations put them at a disadvantage relative to competitors that were not regulated by the FCC, such as Amazon, Apple, Facebook and Google.

On Dec. 14, 2017, FCC Chairman Pai joined two other Republic FCC commissioners in a 3-2 vote to dismantle the net neutrality regulations.

As The New York Times observed after the net neutrality repeal, “the commission’s chairman, Ajit Pai, vigorously defended the repeal before the vote. He said the rollback of the rules would eventually benefit consumers because broadband providers like AT&T and Comcast could offer them a wider variety of service options.”

“We are helping consumers and promoting competition,” Mr. Pai said. “Broadband providers will have more incentive to build networks, especially to underserved areas.”

MORE OR LESS CHOICE?

Some might argue we’ve seen reduced competition and more industry consolidation since the FCC repealed the rules. Major broadband and mobile provider AT&T and cable/entertainment giant Time Warner are now fighting the Justice Department in a bid to merge. Two of the four-largest mobile telecom and broadband providers — T-Mobile and Sprint — have announced plans for a $26 billion merger.

The FCC privacy rules from 2016 that were overturned by Congress sought to give consumers more choice about how their data was to be used, stored and shared. But consumers now have less “choice” than ever about how their mobile provider shares their data and with whom. Worse, the mobile and broadband providers themselves are failing to secure their own customers’ data.

This month, it emerged that the major mobile providers have been giving commercial third-parties the ability to instantly look up the precise location of any mobile subscriber in real time. KrebsOnSecurity broke the news that one of these third parties — LocationSmartleaked this ability for years to anyone via a buggy component on its Web site.

LocationSmart’s demo page featured a buggy component which allowed anyone to look up anyone else’s mobile device location, in real time, and without consent.

We also learned that another California company — Securus Technologies — was selling real-time location lookups to a number of state and local law enforcement agencies, and that accounts for dozens of those law enforcement officers were obtained by hackers.  Securus, it turned out, was ultimately getting its data from LocationSmart.

This week, researchers discovered that a bug in T-Mobile’s Web site let anyone access the personal account details of any customer with just their cell phone number, including full name, address, account number and some cases tax ID numbers.

Not to be outdone, Comcast was revealed to have exposed sensitive information on customers through a buggy component of its Web site that could be tricked into displaying the home address where the company’s wireless router is located, as well as the router’s Wi-Fi name and password.

It’s not clear how FCC Chairman Pai intends to “reinstate a rational and effective system for protecting consumer privacy,” as he pledged after voting last year to overturn the 2015 privacy rules. The FCC reportedly has taken at least tentative steps to open an inquiry into the LocationSmart debacle, although Sen. Ron Wyden (D-Ore.) has called on Chairman Pai to recuse himself on the inquiry because Pai once represented Securus as an attorney. (Wyden also had some choice words for the wireless companies).

The major wireless carriers all say they do not share customer location data without customer consent or in response to a court order or subpoena. Consent. All of these carriers pointed me to their privacy policies. It could be the carriers believe these policies clearly explain that simply by using their wireless device customers have opted-in to having their real-time location data sold or given to third-party companies.

Michelle De Mooy, director of the privacy and data project at the Center for Democracy & Technology (CDT), said if the mobile giants are burying that disclosure in privacy policy legalese, that’s just not good enough.

“Even if they say, ‘Our privacy policy says we can do this,’ it violates peoples’ reasonable expectations of when and why their location data is being collected and how that’s going to be used. It’s not okay to simply point to your privacy policies and expect that to be enough.”

CHECKING THE FTC’S RECORD

When the FCC’s repeal of the net neutrality rules takes effect on June 11, 2018, broadband providers will once again be regulated by the Federal Trade Commission (FTC). That power was briefly shared with FCC when the agency under the Obama administration passed its net neutrality rules with the assumption that it could regulate broadband providers like telecommunications companies.

When it comes to investigating companies for privacy and security violations, the FTC’s primary weapon is The FTC Act, which “prohibits unfair and deceptive acts or practices in or affecting commerce.” According to the FTC Act, a “misrepresentation or omission is deceptive if it is material and is likely to mislead consumers acting reasonably under the circumstances.” It also finds that an act or practice “is unfair if it causes, or is likely to cause, substantial injury that is not reasonably avoidable by consumers, and not outweighed by countervailing benefits to consumers or competition.”

It’s difficult to think of a bigger violation of those principles than the current practice by the major mobile providers of sharing real-time location data on customers with third parties, without any opportunity for customers to opt-in or opt-out of such sharing.

But it’s unclear whether the FTC would take take any action against such activity, or indeed if it has any precedent to do so. The agency had the ability to go after mobile broadband providers for privacy and security violations between 2002 and 2015, and so KrebsOnSecurity asked the commission to share how many times during that period that it took enforcement actions against broadband providers.

The list I got back from them wasn’t exactly privacy or security focused. The FTC cited a case in 2003 in which it sued AOL and CompuServe over unfair billing practices. In 2009, it helped to take down 3FN, a small, shady ISP that was based in the United States but run by Russians and hosting a stupendous amount of malware, scams and illegal content (i.e. child pornography).

In 2014, the FTC alleged that AT&T Mobility deceptively advertised “unlimited” data while throttling mobile customers who used certain amounts of data (this case is still pending but a recent appeals court decision cleared the way for the FTC to continue its lawsuit).

In 2015, TracFone, the largest prepaid mobile provider in the United States, agreed to pay $40 million to the FTC for consumer refunds to settle charges that it deceived millions of consumers with regard to its “unlimited” data service.

The FTC also cited a scolding letter (PDF) that it sent to Verizon over issues related to the security of its customer routers. No action was taken by the FTC in that case.

How eager the FTC will be to police privacy practices of broadband providers may come down to the priorities of the agency’s new leaders. The Trump administration just tapped Andrew Smith as head of the FTC’s consumer protection office. Smith is a lawyer who used to represent many of the companies that the agency is already investigating.

Smith will need to recuse himself from multiple ongoing investigations his office would normally lead, including data breaches at Equifax and Facebook, thanks to his previous work on behalf of the companies. According to The Hill, Smith testified in October before the Senate Banking Committee on behalf of the credit reporting industry as the panel investigated an Equifax data breach that compromised more than 145 million people.

Gigi Sohn, a fellow at the Georgetown Law Institute for Technology Law and Policy and a former senior adviser to former FCC Chair Tom Wheeler in 2015, said the FTC doesn’t have a strong record on broadband privacy enforcement.

Sohn said the FTC’s legal framework does not require affirmative opt-in consent for browsing history and app usage, and that a provider would only have to let you opt-out — something that consumers rarely do and which companies routinely make it hard to do. More importantly, she said, while the FCC’s rules would have protected consumers before they were harmed, the FTC can only act after harm has already occurred.

“We passed privacy rules for broadband and mobile providers that would have required them to seek customer opt-in for anything that was considered sensitive,” Sohn said of her work at the FCC under the Obama administration. “The carrier had to give you clear and consistent opportunities to opt out. It was very broad, but the definition we set for personal information was far broader than what even the FTC considered sensitive.”

REPEALING THE REPEAL OF NET NEUTRALITY

So the carriers are already reneging on their promise to customers that they won’t share location data without customer consent or a court order. But where does that leave us on net neutrality? The answer is that the major wireless carriers are already doing what was expressly prohibited under the FCC’s net neutrality rules: Favoring their own content over competitors, and letting companies gain more favorable access by paying more.

Around the time of the FCC’s repeal of the net neutrality rules last year, The Wall Street Journal prognosticated about what might happen with the regulations out of the way. To do this, it looked at some of the offerings the mobile carriers pitched before the rules were drawn up.

“One example of how things could work is the mobile wireless market, where some providers already have used pricing tactics to favor certain websites and services over others,” wrote John D. McKinnon and Ryan Knutson for The Journal:

The 2015 Obama-era rules didn’t explicitly prohibit these tactics, which generally allow customers to access certain websites without having it count against their monthly data cap. Wireless carriers, which often subject their users to strict data limits, were aggressive in experimenting with such plans, also known as “zero rating.”

Deals began emerging several years ago for inexpensive plans that offer unlimited high-speed access to popular services such as Facebook or Twitter, but limited or even restricted access to the rest of the internet.

T-Mobile US Inc. in late 2013 announced that its GoSmart Mobile brand had “become the first wireless provider…to offer free access to Facebook and Facebook Messenger for all of its wireless customers, even those without monthly data service.” The GoSmart Mobile plans started at $25 a month for “unlimited talk” with no other data service. T-Mobile has since transferred the GoSmart brand to another wireless firm.

In 2014, Virgin Mobile USA, a unit of Sprint Corp. , offered a wireless plan that cost $12, but users were only allowed to access one website: either Facebook, Twitter, Instagram or Pinterest. If they wanted all four, it was $10 more a month. Another $5 and they could access any online music streaming service.

Big internet providers also used zero-rating plans to favor their own content. AT&T Inc. gave paying customers unlimited usage of its own online video service DirecTV Now, while other video sites counted against monthly data caps. Verizon Communications Inc. did the same for its mobile video app, called go90.”

AT&T Mobility offers a zero-rating plan called “Sponsored Data” that allows content providers to pay up front to have streaming of that content allowed without counting against the provider’s monthly data caps.

Sohn said the FCC under the Obama administration initiated an investigation into AT&T’s Sponsored Data plan and Verizon for its go90 service, but that the inquiry was abandoned by the current FCC leadership.

There are some prospects for a Congressional repeal of this administration’s gutting of the FCC’s net neutrality rules. On May 16, the Senate approved a resolution nullifying the FCC’s rollback of the net neutrality rules. But the measure faces an uphill battle in the House.

“Right now we’re probably 30 to 40 members short of being able to bring a vote in the House,” Sohn said. “About 20 Democrats haven’t gotten on board, and we have no Republicans so far. But I think that’s going to change. If Congress repeals the net neutrality repeal, the next step would be to craft stronger rules [either at the FCC or Congress]. We have until the end of this Congress to get it done.”

The CDT’s De Mooy gives the effort to repeal the repeal of net neutrality rules slim chances of passage this year. But she said the prospects for revisiting net neutrality and consumer privacy in the next Congress look good, particularly if Democrats pick up additional seats in the House.

“It seems to be something the Democrats are taking up more now,” Demooy said. “So much depends on what happens in November. But that’s true of so many tech policy issues.”

SHOCK AND YAWN

When I first saw a Carnegie Mellon University researcher show me last week that he could look up the near-exact location of any mobile number in the United States, I sincerely believed the public would be amazed and horrified at the idea that mobile providers are sharing this real-time data with third party companies, and at the fact that those third parties in turn weren’t doing anything to prevent the abuse of their own systems.

Instead, after a brief round of coverage in several publications, the story fell out of the news cycle. A story this week in Slate.com lamented how little coverage the mainstream press has given to the LocationSmart scandal, and marvels at how much more shocked people were over the Cambridge Analytic scandal with Facebook.

“Privacy abuses and slip-ups by major tech companies have become so numerous, and the prospect of containing them seems so hopeless, that the public and much of the media have become nearly numb to them,” writes Will Oremus for Slate. “My data was hacked? So it goes. It may have been used in unauthorized ways by unspecified parties? C’est la vie.”

Oremus argues that what the LocationSmart scandal lacks is not import, nor the potential for serious harm, “but a link to some divisive political issue or societal outrage sufficient enough to generate visceral anger from people who aren’t privacy wonks.”

If you’ve read this far (bless you), don’t let breach fatigue and incessant media exposure of how little privacy we have harden into resignation. Yes, the prospects of any public debate about consumer privacy protections in the United States at the legislative level seem dim in a high-stakes mid-term election year. But supporters of net neutrality ideals can start getting involved by tweeting, calling and emailing the House lawmakers listed in red at BattleForTheNet.com.

While you’re at it, tell your lawmakers what you think about mobile providers giving or selling third-parties real-time access to customer location information, and let them know that this is no longer okay.

This is the second article in a two-part series. The first is here: Mobile Giants, Please Don’t Share the Where.

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

82 comments

  1. The reason why Facebook is the focus of obsession, while this issue is relatively ignored, is that they are addicted to Facebook and have a love/hate relationship with it. We have to wonder also why papers like the NYT and WP don’t pay more attention. I would guess the answer to that is that those papers are monitoring clicks and order of reading, and any news personally related to Trump is likely to get clicked first. I guess his strategy is winning.

  2. We are in a day and age that we have so many redneck idoits out there voting Trump that NOFX is going to need dust off the mics…..

  3. Ajit Pai, Why not award your behind to these companies who you are a tout for. They never planned to penetrate it, or sell it.
    Shame on you for calling the headlines “hyperventilating”, which you would be doing once you follow my advice.

  4. My phone providers might know where my phones are or either of my girlfriends phones. What they don’t know is which one of us has which one when or where any particular one of us is unless we are all together.

    Even then they only have that much information if our phones are all switched on. Which they are not all day nor are they everyday.

    And often we go out individually or together without our phones.

    I really can’t see what information from or about my phone could be of any use to anyone.

    My phone browsing history for the last x years you can all have now… I don’t use my phone to access the net …not ever ..and never have…. net access is merely there for an emergency.

    • Unfettered access to location data is of interest to cops and advertisers. That’s obvious. You might not care about this.

      Here are reasons to worry about access to this information without a warrant:
      Location data is of enormous interest to criminals by revealing where competitors, cops, and jurors live.
      Location data reveals to thieves when homeowners will not be home.
      Location data could reveal to a monster when and where a child will be alone.
      Location data could reveal to a blackmailer who goes to a psychiatrist or a mistress.
      Location data could reveal to teens when parents are about to get home.
      Location data could be used by stalkers and domestic abusers to find victims again.

      The only way to limit this powerful data is to require that it only be disclosed upon presentation of a judge’s warrant to appropriate investigators.

      • Reader…Well said! Please discuss this important issue with your friends / family / local and national elected officials…. It is NOT OK to track us without prior consent and / or court orders signed by a judge.

        Brian – Is the real time location data from our motor vehicles being sold in the same way?
        #Please don’t share the where

    • With some sniff/snooping, knowing your peers have 3 phones you circulate, the on and off activity and GPS tower pings — it’s fair to say who ever is interested already has a profile on you plus you publicly stated your habits (if true.) A little bit more sniff/snooping and it wouldn’t be very hard to locate and keep a tap on those phones IMEI and cellular carrier w/phone number.

      #privacy vs #security vs #ZeroTrustModel

      😉

  5. @socair – do you use your phone to access Facebook or Twitter? How about email? Or texting? Truth be told, all of those access “the net”.

  6. Great article, really!

    >> “I sincerely believed the public would be amazed and horrified at the idea that mobile providers are sharing this real-time data with third party companies …”

    Some of us definitely are! I guess what defines the American people in this post-modern era is that we are not really United at all behind any one banner, eg. privacy, fair-play in business, etc.

  7. I just cancelled my cell phones and got a POTS installed.

    • KrebsReader6000000

      I agree with poster Fan. After using those radio blocking bags, which work but are troublesome, I have come to the conclusion these expensive cell phones, cell phone purchase contracts, phone insurance contracts and monthly bills are not worth the danger of being location tracked. That the very least why should I pay expensive cell phone bills only to get ads I don’t like and being location tracked daily by every Tom, Dick and Harry out to make a buck. I am junking the shinny things and using a an office phone.

  8. Location data not private just because Google access our location using google map. Our personal data also not save just because of identity theft.

  9. Just curious if a VPN for internet connections would be useful in protecting information? Cell phones have VPN apps. Home internet can go through a VPN provider – but how much can we trust them?

    • VPN does not change the fact that your data flows through a device connected to a particular cell phone tower or wifi router (which is then connected to a telephone pole or cable line). It’s that connection which is being monitored by your mobile and Internet companies for clues about your location.

  10. Well, google and its conglomerates already own the internet. Spam policies are so restrictive, if you try to send tweets to more than a handful of senators, you get blocked. And anonymity is no longer possible; so, for instance, whistle-blowers aren’t safe. (literally everyone is now tracked via their cell phones on all the usual services – and not just their locations; the normal blurb to justify this is to “avoid spam”)

  11. Pai has been wrong on all accounts in regard to broadband and net neutrality. In one instance, he argued that net neutrality has prevented broadband from increasing capacity which tech media noted that it was contradicted by actual cap spending by Verizon or other organizations compared to prior net neutrality.

  12. My comment didn’t get posted, so I am posting via a different email addy. Here is the comment from Tuesday:

    FAANG companies are accomplishing anti-trust violations two ways (1) perspective of exploiting taxpayer-funded internet and personal information without commensurate security investment, and (2) by sending their profits overseas to avoid US taxes, which weakens the agencies who regulate them from going after them!

    Don’t blame the US consumer who is not tech savvy! Public education trouble is another evidence of an under-funded government.

    The US should be way ahead, based on the success of FAANG giants who have made a killing off the US taxpayer-funded internet! And of the other major companies. Instead, the US has to chase tech giants with skeletal resources . . .

    *********Unquote*******************

    On the topic of, “exploiting personal information without commensurate security investment,” the FAANG companies should have their feet held to the fire, over their responsibility as large companies who have grown their wealth in the US, that the investment in their security of private data should be a percentage of their profits off that data, whatever that may be.

  13. Oh, the comment from Tuesday got published. Thanx.

    On the topic of, “The story fell out of the news cycle. A story this week in Slate.com lamented how little coverage the mainstream press has given to the LocationSmart scandal.”

    Google news is implicating itself with the slab of tabloid news it delivers on its homepage, news.google.com, instead of real news.

    Google is burying the news to limit damage to its partner, Facebook, and itself. The Wall Street Journal broke today that some in congress want to press Google on ITS ties to Huawei . . . Maybe it’s a matter of time until the discovery of deep data sharing between Google/Facebook?

    After Scrutinizing Facebook, Congress Turns to Google Deal With Huawei
    https://www.wsj.com/articles/after-scrutinizing-facebook-congress-turns-to-google-deal-with-huawei-1528378581

    The FB probe is off the main news page of Google news. It took a deep probe to discover the above-linked article.

    So if Google is not delivering news in a neutral fashion, which it also announced recently:

    Full Coverage drops the algorithmic sorting and opens your mind to opposing viewpoints. With the click of a button, Google displays dozens of competing takes, voices, and sources for the same story. For Google, it’s just doing what it does best: indexing everything. But whether intentional or not, Full Coverage is the antithesis to the way most of us consume news.
    – Google News has a new feature that may just pop your filter bubble
    https://thenextweb.com/google/2018/05/17/google-news-has-a-new-feature-that-may-just-pop-your-filter-bubble

    I thought Google news was bubbling content released by respected publications which got the most interest, top to bottom, then organized by category, maybe tweaked to favor sites displaying Google ads, but you could eyeball through the list to find your respected publications, or most quoted, etc.

    This curation of news – it has to come out! – is a collab with Facebook, and likely factored into the Analytica scandal!

    The bottom line: if you want neutral Google news, you have to click, Full Coverage, based on a topic you already have specifically in mind.

    Google news, in my view, is burying Facebook congressional inquiry news, just as it buried locationsmart news.

    (1) to protect FB stock
    (2) to delay public outcry over a previously undisclosed special partnership between Google/Facebook, which pits them not as the separate companies they appear as traded securities.

    On a sidenote, it is a scary ability if Google can manipulate stocks by manipulating its news.

    You don’t have to publish this!

  14. Why I am disturbed about a Facebook / Google secret collusion? It appears the two want to create an advertising juggernaut that applies AI, based on specific psychological paths users willing post to FB, combined with Google searches, which youtube videos you watch, etc. that target ads based precisely on user behavior. Advertising used to be more anonymous, based on aggregate data. That I don’t mind. The medical profession uses stats to determine trends and a course of treatment . . . All the specific info: mobile phone ID, IP address, location data, address, phone, credit score mean the data is not really anonymous. There are enough data points for anyone to apply a name. The NFC chip in the phone gives your location data, and so does the chip in recent model cars. The latter is more robust than just an NFC chip. That way, you can be helped if in an accident, and the car can be tracked if stolen, etc. And that Facebook/Google robthe coffers by not contributing taxes, based on their success.

  15. data should be made secure by all means.

  16. Honestly, it seems as though a person’s device information, like their location, is no longer sacred. I read about SS7 the other day and how intelligence agencies and criminals could use it to track cell phone location.

Leave a comment