PCFormat Forum Archive

This is a map of everywhere I've been for the last months. Everywhere. I didn't carry around a tracking device. The FBI isn't sending goons in unmarked vans to track me. All I did was use an iPhone. And if you have an iPhone, you're being tracked right now, too.

It turns out that your iPhone is keeping a record of everywhere you've been since June. This data is stored on your phone (or iPad) and computer, easily available to anyone who gets their hands on it. Why? Apple won't say. We're creeped out.

The enormous privacy startle, apparently enabled by this summer's iOS 4 release, was discovered by two security researchers, one of whom claims he was an Apple employee for five years. They're equally puzzled and disturbed by the location collection: "By passively logging your location without your permission, Apple have made it possible for anyone from a jealous spouse to a private investigator to get a detailed picture of your movements," they explain. All it would take to crack the information out of your iOS device is an easy jailbreak. On your computer, the information can be opened as easily as JPEG using the mapping software that the security experts have made for download—Try it yourself.

The data itself is jarringly accurate. Even though it appears to rely on tower triangulation rather than GPS pinpointing (meaning you're not safe with location services switched off), the map I was able to generate with mapping software the security duo released visualizes my life since the day I bought my iPhone 4 in July. Everywhere I've been. Bus trips home. Train trips to visit family. Vacations. Places I'd forgotten I'd even gone. Zoom in on that giant blotch over New York, and you can see my travels, block by block. My entire personal and professional life—documented by a phone I didn't know was also a tracking device. It's all accessible—where I've been, and when. I don't want this information bouncing around in my pocket with me.

For now, there is no fix. The only way to remove it from your computer is to wipe your back up files from your computer. But then you have no back ups to restore your phone in case you lose it. And every time you sync your computer, though, it'll create a new file. And if you do lose your phone, all your tracking data goes with it, right into the hands of whoever found it. And if you upgrade your phone to the next iPhone, the location tracking data goes with it.

Until Apple stops doing this, or explains why they are doing it, I don't feel safe. I feel weird having all this data that I don't want recorded on my iPhone. Maybe they're doing it for the government. Maybe they're doing it because they're forced to. Either way, all we have at this point are conspiracy theories. And a lot of information on our phones about where we've been, whether or not we want it.

Siemens wrote:Vodacom, MTN, Cell-C and Google are tracking your location?

Until Apple stops doing this, or explains why they are doing it, I don't feel safe.

I figure this thread is as good a place as any to brain dump on this. I went to WWDC last year where the new Core Location system was discussed in great detail. If you went as well, or have the videos, look at the video for session 115, "Using Core Location in iOS". Skip to around 13:45 for the discussion of "Course Cell Positioning" where they discuss the cache in detail.

The purpose of this is offline GPS. Normally, each cell tower has an identifier and Core Location sends that identifier to Apple and asks for the lat/lon for that tower. This requires a data connection, and the use of data. Since cell towers don't move, however, it's inefficient to keep going back to Apple for that information so they cache it. Now if a tower appears with the same ID as the cache, tada! you have a cache hit and a faster fix with no data use. Which also means you can get a "course location" (as in rough) if you are near known towers and don't have a data connection.

That's all this is. It's a cache of identifiers (cell and wifi), locations, and their age (it's a cache, after all). Someone made the decision to never clean it out so they would have more and more information about those GPS "assists" (you know, A-GPS) and so they'd use less and less power and data over time for the places you frequent. It's a great idea, technically.

Practically, yes, you can track location over time. The file is readable only by root and you're free to encrypt your backups for now. I'm sure Apple will either encrypt the file or truncate the data in a future update (I would prefer encryption as I think it's technically sound, but I know many will disagree). I'm also sure someone is considering a toggle for the feature or a button to clear the database. Both are great ideas.

This isn't nefarious, this isn't being sent anywhere, and this isn't as bad as everyone is making it. This is a real feature with a major oversight. That's it.

Siemens wrote:In that case it's perfectly a-okay for them to track the location of their customers

Siemens wrote:Does Vodacom, MTN etc. log your exact position or just the area where you are in?

IcePick88 wrote:Android also has this "feature". Just download a app and voila. It tells you your location based on the cell towers.

THE_STIG wrote:Or do they.....

CNET wrote:A lawsuit filed against Apple in Florida last week accuses the company of violating privacy laws, as well as the Computer Fraud and Abuse Act, by keeping a log of user locations without offering a way to disable the feature.

The suit, which was first reported by Bloomberg, was filed by Vikram Ajjampur and William Devito, both of whom own Apple products. In the suit, the pair, who seek punitive damages and injunctive relief, cite research from Alasdair Allen and Pete Warden about the tracking files found within iOS as the source for Apple's collection techniques.

"Users of Apple's iPhones and iPads, including Plaintiffs, were unaware of Apple's tracking their locations and did not consent to such tracking," the suit claims. "Apple collects the location information covertly, surreptitiously and in violations of law."

The suit faults Apple specifically for not disclosing that the iOS software records "comprehensive" location data in its iTunes Terms of Service, nor offering end users informed consent of the practice.

"If Apple wanted to track the whereabouts of each of its products' users, it should have obtained specific, particularized informed consent such that Apple consumers across America would not have been shocked and alarmed to learn of Apple's practices in recent days," the suit says.

The suit, which is seeking class action status, aims to have Apple completely disable the feature in the "next-released" version of the operating system. Until that happens, the suit claims Apple is in violation of the Computer Fraud and Abuse Act, state laws comparable to the Federal Trade Commission Act, and "common law rights in uniform ways" of the plaintiffs and class members.

Apple, which did not immediately respond to a request for comment on the suit, has not officially commented on the location tracking file since it came to light last week. An alleged e-mail exchange between Apple CEO Steve Jobs and a reader of MacRumors surfaced this morning. In it, Jobs purportedly says, "we don't track anyone," and "the info circulating around is false." Apple has not confirmed or commented on the legitimacy of that correspondence.

In addition, Apple and Google were targeted today by Illinois Attorney General Lisa Madigan over location tracking. Madigan seeks a meeting with executives from both companies, as well as answers to her questions about disclosure and purpose of the tracking, and a way to turn the feature off. Madigan's efforts join those of other politicians and government groups who seek to know more about what the companies are doing with the information.

Like Apple and Google, Microsoft collects records of the physical locations of customers who use its mobile operating system.

Windows Phone 7, supported by manufacturers including Dell, HTC, LG, Nokia, and Samsung, transmits to Microsoft a miniature data dump including a unique device ID, details about nearby Wi-Fi networks, and the phone's GPS-derived exact latitude and longitude.

Read more: http://news.cnet.com/8301-31921_3-20057 ... z1Kcq6newQ