Investigation Finds Google Collected Location Data Even With Location Services Turned Off
from the questionable-practice-raises-Fourth-Amendment-questions dept
What if you take every precaution you can possibly take to avoid leaving a digital trail of your movements… and it still doesn't matter?
Many people realize that smartphones track their locations. But what if you actively turn off location services, haven't used any apps, and haven't even inserted a carrier SIM card?
Even if you take all of those precautions, phones running Android software gather data about your location and send it back to Google when they're connected to the internet, a Quartz investigation has revealed.
Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers—even when location services are disabled—and sending that data back to Google.
So much for going off the grid. There are some caveats to Google's permissionless collection of cell site location data, with the most significant being the fact Google didn't store the auto-collected cell tower info. That doesn't excuse the practice, but it at least keeps it from becoming tracking data the government can access without a warrant.
Google's collection of cell tower data occurred when notifications were pushed or phone users utilized the phone's built-in messaging service. In both cases, it's reasonable to assume users weren't expecting Google to be collecting this data. (It wouldn't be necessarily reasonable to assume cell providers weren't, as that's what's needed to deliver messages and notifications if the user isn't using a WiFi connection.) But no one would reasonably assume the operating system would still send cell tower info to Google with the SIM card pulled.
This is a troubling practice to be engaged in, no matter how temporary the storage of cell site data. It flies directly in the face of what phone users expect when they shut off location services or undertake other affirmative actions to minimize their digital footprint.
SIDEBAR:
This does raise some interesting Fourth Amendment questions, even if the circumstances under which the collection occurred make it unlikely these factors will ever be the centerpiece of a motion to suppress evidence. US courts have made it clear on multiple occasions there's no expectation of privacy in cell site location records. Judges have stated cell phone users should know cell companies collect tower location data to provide service to their phones. According to this line of thinking, the third party location records have no expectation of privacy because phone users are aware of the realities of cell phone usage: phones connect to towers and create records of the tower's location.
The question in this case would be whether the expectation of privacy is still nonexistent when phone users undertake deliberate efforts to disable the collection of location records. It would seem these efforts would restore an expectation of privacy -- at least if judges are going to be consistent and intellectually honest. As some judges have pointed out, defendants who don't like being tracked by their cell phones can just not use them. (This is still a somewhat ridiculous assertion -- roughly comparable to the TSA suggesting people who don't like invasive searches/biometric data gathering can just choose to not fly. Both ignore the realities of the modern world.)
If a person makes efforts to prevent collection of location info and a company does it anyway, should law enforcement still have warrantless access to these records? This remains a hypothetical question, but given the amount of surreptitious tracking performed by a number of tech companies (providers, ad networks, etc.), it won't remain hypothetical forever.
Phones generate a wealth of third party records just a subpoena away from being in the government's possession. Users cannot possibly be aware of all the information gathered by multiple companies each time they use their smartphone, but they do "reasonably expect" shutting off location services means no one (outside of their service provider) will be gathering location data. Would someone, in performing these actions, be granted a higher expectation of privacy as a result of their actions? Or would a court treat savvier digital natives the way it treats the unwashed masses who make zero effort to limit collection of location info?
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 4th amendment, android, location, privacy, tracking
Companies: google
Reader Comments
Subscribe: RSS
View by: Time | Thread
Google can't be trusted? Shocker.
Snowden says Google gives NSA "direct access".
Sheesh. It's your shocked gasps when re-write small items that convince me you actually do believe that you (and Google) are putting over the big lies.
[ link to this | view in chronology ]
Re: Google can't be trusted? Shocker.
[ link to this | view in chronology ]
Re: Re: Google can't be trusted? Shocker.
[ link to this | view in chronology ]
Re: Re: Re: Google can't be trusted? Shocker.
Just as I'm sure you're a troll and we can expect Mike to do no such thing.
[ link to this | view in chronology ]
Re: Re: Re: Re: Google can't be trusted? Shocker.
[ link to this | view in chronology ]
Who's Data is it?
[ link to this | view in chronology ]
It is still possible to not use a cell phone
[ link to this | view in chronology ]
Re: It is still possible to not use a cell phone
[ link to this | view in chronology ]
Re: Re: It is still possible to not use a cell phone
[ link to this | view in chronology ]
Re: Re: Re: It is still possible to not use a cell phone
[ link to this | view in chronology ]
Re: It is still possible to not use a cell phone
I was about to say "sure I could go work for a farmer and not have one" but then I realized even most farmers would expect you to have a cell phone so they could reach you.
So I guess maybe there are some of these almost mythical jobs where you can get by without them. I am betting they are not that great though. I sure can't think of any good paying job that wouldn't expect you to have a cell.
[ link to this | view in chronology ]
Re: Re: It is still possible to not use a cell phone
[ link to this | view in chronology ]
Re: Re: Re: It is still possible to not use a cell phone
Follow ing is the relevant excerpt:
Cell phones
by Anonymous Coward [not me, certainly]
I read a little on your website about your take on technology that uses non-free software. Do you still not own a cell phone?
RMS: I certainly do not! A cell phone is Stalin's dream: its movements are tracked, and it can be converted (through the universal back door) into a listening device.
AC: If not, I'd love to hear your perspective on life without one these days, where its just assumed that people own one.
RMS: Please help teach everyone that this assumption is false!
There is a way to make a cell phone acceptable _for occasional communication only_: put a one-way pager in the phone, so people can page you if they are trying to reach you. That way, you can keep its radio connection off most of the time. When you get the page, you can decide when and where to reveal your location by connecting the phone to the network.
Of course, the software in the phone's main computer should also be free, but that is a separate issue. In other words, nonfree software in that computer is one assault on your freedom, and the phone system's location tracking is another.
The software in the baseband (phone radio modem) processor can't be free, at least not as things stand now. So the phone needs to be designed so the baseband processor can't talk to anything (peripherals, antenna, etc) unless the main processor permits it, and so that the baseband processor can't change the software in the main processor. Ideally the software in the baseband processor should be immutable, so we can treat it as a circuit.
[ link to this | view in chronology ]
Welcome out overlords
[ link to this | view in chronology ]
Re: Welcome out overlords
[ link to this | view in chronology ]
Re: Re: Welcome out overlords
it is.
[ link to this | view in chronology ]
big, powerful centralized government...
Is necessary to sustain that big honkin' military that the US loves to throw around. It also helps a great deal with large scale services like water and power.
And then, if we downsize our government, expect the military or corporations to take over, and they'll run things, only they won't even pretend to have public interest at heart.
You know, you could go to Namibia and join the San. They have about the size of government you might find suitable.
[ link to this | view in chronology ]
Re: big, powerful centralized government...
[ link to this | view in chronology ]
Re: Re: big, powerful centralized government...
[ link to this | view in chronology ]
Re: Re: Re: big, powerful centralized government...
Smart people keep a level head and weigh policies on their own merits based on the results when they're enacted in real life. It's what conservatives used to do, and they need to get back to it, stat.
[ link to this | view in chronology ]
Re: Re: big, powerful centralized government...
Anonymous Coward, you sound like the officers from the Nazi party who argue how dull and primitive the Jews are. I'd advise that you stop going to your rally meetings and do some actual studying of who believes what.
Hitler was a fascist, and based his rule off Mussolini's fascism and culture-of-personality. The same devices Stalin used, but I'm getting ahead of myself.
The USSR never became a true Communist state, but was started as a temporary authoritarian regime. Eventually (hypothetically) the politburo would have been disbanded and the people would have decided everything. Of course, that never happened. But Lennin and Stalin were both authoritarians not above purging dissenters.
2017 Democrats are like 2017 Republicans, corporatist. The difference is in their method: Democrats appeal to the people, preaching equality, and occasionally throwing the people a bone, where the Republican party looks for ways to exploit the system to reduce the power of the vot. Among their current tactics, they engage in nationwide gerrymandering, voter suppression, and demagogy in order to secure elections.
GOP tactics belie the pretense that they could not win elections by the merits of their actual policies (when they have policies, nowadays they want to just undo what the last guy did), so they have to rely on subterfuge to secure their power. This suggests it's the Republicans who are more authoritarian than the Democrats.
The DNC, granted, is still corporatist. And it's still awful and subject to what its campaign contributors want, but it takes profound skill to be even worse then them. The RNC has managed to do just that.
Getting back to big government, we like clean meat. We like well-paved roads. We like working mail. We like a robust military. We like power and water and internet we can rely on. We like benefit programs for our infirm and disabled and those who've been too injured to work. All these things require big government. The only argument for small government, really is to eliminate those parts a given citizen doesn't personally benefit from. But that's ridiculous.
And no, it doesn't lead to authoritarianism. In fact, our government is bigger for having parliaments and committees making decisions rather than a unilateral heirarchy, which serves as a defense mechanism against corruption.
Anonymous Coward, Maybe you should consider a political science course?
[ link to this | view in chronology ]
---
Sure. Unless Google was just passing the data straight through to the Fed or some third party.
[ link to this | view in chronology ]
But if it's your phone itself sending your tower data to Google, then shouldn't it be possible to write software (a firmware patch if necessary) to send randomized or faked tower data?
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
The truly paranoid just shouldn't use a phone I suppose.
Interesting that they used their GCM push notification service to send this data - 'secure' messaging app Signal requires this to be installed to work and loads of people were up in arms about it. I guess they were right - don't trust google!
[ link to this | view in chronology ]
Re:
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja &uact=8&ved=0ahUKEwjJs8v44dDXAhVIQyYKHYHpAigQFggwMAE&url=https%3A%2F%2Fwww.nytimes.com%2 F2014%2F06%2F30%2Ftechnology%2Ffacebook-tinkers-with-users-emotions-in-news-feed-experiment-stirring -outcry.html&usg=AOvVaw34aITzOhC_D9512BDX-DBd
[ link to this | view in chronology ]
Re:
On my phone I don't have the Google blob installed, and I'm rather content with the situation. F-Droid just recently gained automated updates and a new slick user interface. It's harder to get certain free applications: the Signal developers insist to be the only one to build the apk. VLC is constantly in the F-Droid archive because of unresolved packaging issues. Overall choice is much more limited compared to Play Store, though I consider most apps (in both stores) to be rubble. Nothing more than noise in the universe.
Push notifications are of course a pain point - for those who need it. Somehow I always could do without it even though I'm runnning three apps which could fare batter on my battery with push notifications. Only one is a SaaS app however. I'm really excited about the great new solid battery technology which will vastly improve all aspects of old and tried Lithium batteries. That will render push notifications useless.
[ link to this | view in chronology ]
Like clockwork, TechDirt attempts to minimize and whitewash THE insidious things their GoogleGod did YET AGAIN.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
About 88% of the smartphone market in 2016, apparently.
[ link to this | view in chronology ]
Indirect collections
What is to stop the two seeking to a 3rd party?
A local aussie telco recently updated their Privacy Policy (to allow them to sell your info) and you had to follow their email to opt out.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
We also can't kid ourselves about how deeply rooted in modern society and culture mobile devices have become. Yeah, sure,... we could all live without one (if we were hard-pressed; or, in the aftermath of a zombie apocalypse or whatever), but unless you're one of locust-eating RMS’ ilk, this is still impractical and doesn't address the problem. It merely remands the issue to the pedantic excuses of neo-luddism.
While I see many apt statements and arguments on either side of this issue, what I’m not seeing are solutions. At least, solutions beyond the KILL IT ALL WITH FIRE mentality.
We, as a community, as a society; as users, and, as citizens, must assert our rights and demand that they be honored as promised by our respective Constitutional protections. We must hold those who violate those protections accountable, even billion dollar corporations. Just because we use their product or service, doesn’t mean we relinquish our rights, despite the frivolous and exhaustive assertions of their Terms of Service.
Contrary to the myopic opinions of many judges who have ruled on the 4A application-mobile device issue, I hold that merely using a mobile device doesn’t mean we relinquish our rights, it means we are adopting modern technology. Nothing more. Nothing less. And the very idea that certain rights apply to this domain (First Amendment) and others do not (Fourth Amendment) does not hold water. Furthermore, our rights and protections apply to the citizen, regardless of domain or method.
In the end, it is our responsibility to protect our rights from corporate giants and data gluttons, even if that means putting our money where our mouth is by not financially supporting them. This, of course, denies us access to the very technology we choose to pursue; thereby limiting our freedom to forge our own path, or to pursue our own happiness. And until these very real problems are addressed, we continue the vicious circle.
[ link to this | view in chronology ]
[ link to this | view in chronology ]