Reporters' Roundtable 74: The location tracking dilemma

-- and don't. Hi everyone welcome to reporters' roundtable -- weekly show we talk about a single tech topic each time. And that they were talking that ranged in topic which is the fallout from the April 20 report at the where to -- -- conference that the iPhone. Records. Over time. Where it has been in. And maybe sends that data back to Apple. To be used by Apple itself. Advertisers the police hackers or other assorted nefarious people. Since the story broke of course -- been revealed that not only Apple does this but Google phones do it Microsoft Windows 7 phones do it. And in a related development that's just much newer GPS maker TomTom has it was revealed to be sending location and speed data from its dash -- -- navigation device. Devices to the police which -- then using that data to figure out where to put in red light cameras. It wouldn't necessarily be such bad things that TomTom also -- sells a database of -- the red light cameras are. Back to users of the TomTom devices the CEO has since apologized for events in meaning -- Circular and -- Slimy system com. So location and data and recording is in the news. And that is what we're talking about today. Who -- recording your data. Why they're recording your data how they're getting that -- what they're doing with it should you care. Why and what you can do about it if you do that to very good guests talk about the state a first of all. Here in the studio with me. That when a caller who's been covering this for CNET news thanks an indictment it it's been a long walk while about fifty -- -- my pleasure I know we've been watching your every move on are connected devices but we knew we -- deputy to the break room. You can't lesson -- I I did that I I iPhone has very good tracking accuracy that's right. Also joining -- styling and via Skype from Boston Ted Morgan who's -- CE -- the little company may have heard of called sky hook wireless. Now Ted thanks to dialing in. That's -- looks a very interesting company sky hook which I first started covering -- back in 2006. Is in the business. Of correlating Wi-Fi data with location it is the technology company. That at various times has been in has an -- called -- -- clients Apple Google and and many other companies what it does is the it's the company that gets that data now other companies are doing it as well. So Ted knows all about location tracking. Location discovery and -- privacy issues and we're gonna start actually buy. Ted I want I want you to explain little bit what -- -- does. Howell works and dumb and we're agree have to start the show with public disclosures I think. Talk about the clients -- you've had in the past -- may have had impassively you have now so we kind of know where you're coming from as we dive into this really interesting discussion. Short -- so -- power -- location on some hundred million devices today. Our customers range from Apple's -- -- Motorola. Two Sony need gel and a whole host of -- app developers. The the background -- company is about eight years ago we edited -- trying to solve. Issues that have -- GPS for decades GPS just doesn't work well indoors and urban environments. And so we developed this concept. Augmenting GPS -- other signals that are in the air. And -- knows our -- bicycles and and we found that wherever you go fares. And corny. Access points in the -- windows that he take advantage of so we literally drove the planet we drove down industry in the US and many other countries around the world. And we map these signals so that we can use those signals to figure out where you are -- GPS signals are not available. Now one point just be clear here I'm. You called Google a customer and since then they are now a defendant of yours is that correct. Well no we've never had. Is this relationship -- Google though indirectly. We have signed with Android device makers to ship on their platform. We -- -- for many years to work with Google but were never able to works. Okay and but it just be clear and you are suing -- for some contract dispute innovate. -- Yeah we are so about it a year ago and now he's in appointments with Motorola and -- -- to -- -- engine on all their Android devices. -- god didn't like that and not force those device makers to remove -- that we felt that was. Stepping over the line so we ask that courts that it and it still on. That's the -- all right. And -- -- also there's a small disclaimer disclosure from your family as well. Right now my spouse is an attorney and Google though she is not involved in this topic in actually if she were involved in this topic. -- and I would not be on the show or -- top ministries he does that work and a -- location aren't. Great well it we have to get that's about a -- disclosure and disclaimers -- in the in the news in the -- to a space today. And other stuff but so let's get into this really think discussion. First of all in a nutshell. What was discovered. What was revealed on at the where conference last week with regards to Apple definitely not gonna give us the the primer on what's going on here. Sure there -- there are kind of two issues as better. And that have the com. A hot button privacy -- topics in the last weaker so the first is what a device that stored data in a second is what devices transmit data and a phone home to the mother ship. We found out last week. But that Apple. I -- -- store location and data and it's not your exactly PS coordinates its. A rougher -- approximation of your location based on what the cell towers are nearby we found out more about that the storage which -- is in my case at least over one year. Of location information Apple released a fact earlier this week that. -- finally that it says it's -- a bit more but that didn't comment at canceled the tales you'd want to have answered -- -- we also know that they transmit data. Now back it to the mother ship Apple said that some of the storage and sent on the extent of the storage in some of the -- location transmitting. -- bugs that will be fixed at Google stores a limited amount of data. Of migrant in my memory it's about the last fifty. I cell tower locations on the device and they also that transmit that data applications services turned on back to. Them back to Google into -- devices do and Microsoft says it it does not store and data. On the phone but in some cases they do it and a Microsoft. Windows 7 devices that do that transmit data back to. Microsoft including a unique device IDD fills up your right Wi-Fi networks in the phone's GPS strived exact. Latitude and longitude so in other words storr vs transmit two different things -- both of become. -- pretty. Hot in the last week so every mobile device it's great that every Smartphone device. Knows where it is and is keeping some. Version of that log in -- in the device that's on -- is transmitting it back to points unknown event hosted nowhere is that when you say give me directions or local pizzeria. As -- and so. And all three. That Google Apple Microsoft those devices. -- phone home as at least some -- and I'm including. In some cases a unique ID. And but IM windows devices that as far as we know windows mobile's the devices do not store the other ones -- at least in some. A connect head you saw how important this data is going to be for business early on which is why you started this a company started a wireless they explain to us why -- -- information is so valuable to companies like the Google. Apple Microsoft and so on and by nature are by extension to your company. Short -- -- that the underlying reference data out where cell towers are where. Like bicycles are are initially. Very important for just providing location capabilities -- all it's actually -- very hard thing to do. Took -- eight years to -- to fine tune this whole system and so it's just a tremendous amount of data that you have to manage and Hewlett. The data is changing all the time 1020% of access points -- every. And that's -- just moved. Which is which is why -- can put so -- work and this is why everyone's trying to scramble to -- the data but. Once you have that data -- providing location services all these apps. And you're getting a sense in Q where all these devices and by proxy people are moving throughout the day and that really is gold to the future of mobile advertising and advertising in general. The -- get a sense who's standing on the street corner what type of people they are where they're buying densities. And that's really what everybody's fighting about here -- how can we control this data so that we can then generate entirely new business -- here. Okay so the data is valuable for them from an advertising perspective. And I guess from -- perspective -- -- the better the data is the the more interesting apps you can make with it. -- so why is it a surprise all the sudden that we discover that. A company like Apple or even Google for that matter. Are -- the -- on the phone and somehow making it available to companies like Google Apple etc. are should we be surprised at all about that's. Well I don't think we should be surprised that. Companies are using reference -- pocketbook issue. But we do have to be careful that we're and you track anything about user you know location data is very very sensitive -- it's not just. Fear mongering. -- if you have that Trace. The user's location history basically the bread crumbs of where they've -- In this case throughout a whole year that is a signature of your life and even if you're names. It can be very easily used to figure out you war. And -- that's why everybody's -- sensor about it now you can do all these services and techniques while protecting privacy. But some folks have made mistakes along the way and that's what causes all. I think that's exactly at the point in fact I think Apple did downplay. A bit of privacy implications here in their back earlier this week. -- because in reality if you know where someone is today you know kind of what they're doing. And -- -- but -- -- but in some cases and so that that's the location. Privacy issue now there are benefits to keeping this information I mean Apple says he uses it to speed up location fixes. So does Microsoft -- -- noting explicitly and avoid draining the battery. -- Google the seems to users' location data from Android phones that offer -- like traffic data on city streets that would not otherwise have the traffic sensors. And so this is really it's it's it's a wonderful thing them of the problem is that when you of a unique identifiers that are fixed for the life of the device. When you have them and misinformation being. You are stored locally or transmitted remotely without them had -- notice and consent and a way to opt out -- and then you start raising. Some of these privacy issues and the weird thing is that that -- you just yesterday AT&T and Verizon. And -- some of the other wireless a wireless providers responded. -- an unrelated request from the congresses and an -- with the iPhone except her -- but they said oh yeah we absolutely think location data sensitive. At and we have Apple saying well now it's really just crowd sourced database don't worry about. Let me drill into little to Apple's responses as people may have heard about a week after this story broke. Apple. This is an editorial comment here finally released a fact a response saying. What they are recording why calling there -- the keeping that data in in memory for such a long time bug. Steve Jobs said. I think in an interview with all things the said the -- is only two megabytes that's that's half of a song well. In fact two megabytes is I believe two volumes of war and peace and talking about you know textual data. So that's a lot of data that he's recording so it. -- do we believe that this is a bug or that is Apple. At work to do more here is there -- value to Apple in a vast trove of individual location data -- say a week's worth. I I think I don't think they downplayed at all they said it was a -- to maintain this history and they have no intent. Core I capturing this bread crumbs of your location history. So I think they were in us spinning it but saying we didn't mean to do this we don't want to -- that we know process to that is. Now there is a way to get. That location data that's very valuable for advertising and marketing without associating it with users and devices and that's their right way to do it. And I think everything Apple's that is their intent is to do it that way they're gonna fix some issues to make sure. But Ted what what -- and said here is that -- and and it tequila for use that where your phone has been is a fingerprint of your life. Is it possible to disassociate a location traits that last more than a week actually disassociated from a person wouldn't isn't it. Not difficult at all especially when you have collections of people's phones to put together whose phone that is from a from a location Trace. Only if -- associate. Only if you do is appreciate each location point. With a particular IDC. Now it's on the forum on Apple but they're saying when it goes in the server they are not associating it with an ID. That's the way read your we have. 400 million location requests every single day they'll look independent I don't know whether that's ordered -- users are -- user tracking his location or -- -- -- all into. You keep track of IP addresses the look of the someone's a has a fixed IP address -- adamant that that might be the same request for -- -- that that may be essentially unique identifier over many years. It could be but it -- the IP addresses are incredibly unreliable for any sort of maintaining -- a single user or device in fact on the wireless side they're absolutely. Useless for figuring that out because the carriers are switching those things around all the time you move around now. So potentially but its IP -- is terrible for any sort of maintenance of -- do. The reason I want to drill into it to what I've. Believe may be a bit of pasting over the truth on Apple's part here is because one of the things that it that Apple did say in an interview -- -- -- whose jobs are one of the people at Apple is that Apple is building -- traffic data system and in order to get. To figure out traffic routing and and how fast cars going you need to know not just what. Devices are requesting information a location information are aware they were a minute ago so you can get the speed between two locations -- -- that is part of this. Process very -- and -- it and they said memory from the -- from the statement this is the fact. -- collecting anonymous traffic data to build a crowd sourced navigator is for the gulf writing happens uses an improved their traffic service. In the next couple of years so you do though I'm -- this is this is why Android transmits back to it to the mother ship. The last few locations it was and cinemanow where the phone was say five minutes ago or ten minutes ago to do this traffic analysis properly we don't need to know where it was last year. I you don't even know where it was even a day or two of them and so -- and so if if you. I'm it's even if you had unique identifiers in randomized and every thirty minutes which -- which is -- -- suggested. I would be up a privacy the protective approach. Then I hinted -- that a kind of solves a problem. At. Now and he -- when you get you're getting speed from these devices as well so you don't need to see. 1020 minutes or an hour work that history to -- traffic there's there's lots of ways to do that still protect Mars. In the news. There is congressional action pending on this what what's the status here -- the members of congress are up in arms about this do they fully understand what's going on and is -- congressional investigation that's what you think. -- echlin re -- EUR. A veteran in this industry you heard it. As the congressional hearings about encryption and export controls in the 1990s and we have realized met that no they don't know what they're talking about. And this hasn't changed but nevertheless they they season -- they they see this as an opportunity to app pressed the government companies rightly or wrongly on on this topic and -- -- and maybe get the their own names in the news so we have to the two senate hearing so wonderful -- Senate Commerce Committee hearing. And that hasn't been that date has been released yet and -- also lets senate subcommittee hearing of of that commerce committee. We've probably a house hearing it in the works -- -- told me yesterday that they that nothing's been scheduled but the language they're using makes me think it's probably inevitable. And then you also have some requests. Formal requests though not legally enforceable request but them -- the companies will respond to them out from the house's saying basically -- -- Apple. It's not it's it's it's really anyone making these non operating systems what -- -- doing that these. Respond in a few weeks and so that that's the current state of affairs that one thing to look for is whether the via Federal Trade Commission investigation into this. Now. I wanna go back to something -- when that we touched on earlier you said that there are differences between the ways that Apple Google Microsoft collect. Store and transmit this data and so could this discussed how that the companies are different they're and then -- it's I have asked you to. Describe you do for your customers -- -- first what's the difference is here between that. -- phone OS manufacturers. Okay we also have been asking Nokia and rim and a furor over a week to answer questions may have not which is disappointing. And so some in some cases the only way you can find out is by reverse engineering the protocol -- and if it's encrypted and it becomes that I'm much more difficult to like Apple. For -- -- to sell the but it would actually answer your question storing data Microsoft does not -- -- at least that's what they say there's been no evidence says that they do story. That's sort locally and Google -- a limited amount of data -- probably is reasonably all the cash and -- -- I -- if -- -- the last fifty cellphone towers that's that's. Not in most cases are really privacy -- invasive. The problem maybe they did this is for the last five but did that but unlike applicants at its wares over here. Apple currently store is an unlimited amount them or at least appear in the two megabits -- -- range them. There is a -- elements of the amount of actual fixes -- -- better store depend on how much you move around. Terms of transmit them Apple Google and Microsoft all transmitters differences in that and -- -- is changing that. But I mean all these companies are meant scrambling I I suspect right now to. A deal with potential lawsuits congressional investigations FTC investigations and so they. Haven't to have been a very forthcoming with us and I really guess -- -- -- the -- much. Org and Ted -- sky -- how discard hooks. Procedure differ or if -- -- -- is the same too well what phones are doing. So the. Is a couple of points of distinction between where our system works and a couple others out there. -- -- comment on the cash side that we re -- you cash is actually very valuable dirt right. I instead of having to go over the server and and get this information every time you wanna look up where you war. We story a small section of the city where you are locally while you're there and -- speeds up the process they used the batteries is networked car. And when you move that that area we deleted or golden. The same -- and -- it works but not until they're -- -- -- some way I think Apple's probably. I extended more than they wanted and -- and encoder cryptic but that's the right way to do it -- a lot of folks doing that the other thing is we only eat calculate your location. When a user requests it so I want to check in of foursquare want to find directions to -- next meeting. That's the only time our system gets a vote if you don't every user's location it never wakes up. Other companies like Google and Microsoft are actually probing the device they will figure out -- -- through the day. Check the location scanned for signals. And send that back to you their servers and that's war data collection to build up Wi-Fi and cell Tower Bridge to trying catch up to our database. And then the last piece is on. The -- inside and this is where it's important that folks are talking -- -- they don't maintain -- history on the device but they are maintaining history on this server. If you associating any idea what someone's location history that's we talked about earlier it's kind of fingerprint that your life. We don't connect any two locations or us together and so that even if I -- -- try and on somebody to our tracked them I don't have the -- -- you -- we decided that -- on purpose. Now one of the the one of the players we have not discussed yet in this argument over location it is the carrier's. What -- the carriers doing with regards to the collection of all this location data even -- it's coming from Wi-Fi geo location. Going over the cellular network and somehow being stored transmitted. Used by Verizon AT&T T-Mobile etc. We know -- that. -- -- -- Dot -- I'll answer but I don't they're not readily. All this is pretty much happen. Outside the purview of the carriers which is surprising given how much time the carriers put in a vocational us spectators -- But all these things are happening directly from the device makers of the platform makers to carriers. Have not launched -- -- -- they obviously have. There's cell -- and so but none of those systems are being used for these smart phone applications at all. Nonetheless. This just this just -- from Verizon Verizon displace that it will put location warning labels on phones. This -- phone scoop this morning a letter sent congress concerning customer privacy etc. Verizon revealed that plans to soon put removable sticker. On the display of new handsets that warns that looked at the device may be used to track their location that there is I -- that does this one point worth making them that is that and that is -- -- the inverse. A year or two ago and we had that. -- around the form controversy in whether. I carriers content -- eavesdrop what the customers are doing in throw relevant ads and I can AT&T was more limited and then at Comcast. But now I'm the Vietnam. There in the letters said that AT&T except trance sent to congress this is the on related. Queries that a former -- -- -- tetra. They said. As that that's section. 222 of the communications act that is where he's having USC to to to say at that. As -- hand to disclose. Or even really use that -- location information and I'm. For commercial purposes and so that requires -- if they they can't they get express prior authorization but the point is. This is more regulated. Then say app developers or OS developers. So at that that's maybe one reason they've been a little wary but as their amounted at a wanna get on the wrong side of the FCC -- -- really -- him. Now. Commercial -- is one thing what about legal or judicial use of or police use of this -- have there been any cases of these this information or. Somebody. Is grabbing data off of the phone the location -- -- phone and using it in a police or illegal investigation. It's a commonplace. In the computer forensics -- community. It to sell software that can do -- and -- they've known about this since at least last here but everywhere else kind of found out last week. There am I mean that there's of that from the telecommunications services -- in the UK ever has X. Any MI XAM -- able to put extract GPS location fixes from an iPhone 3GS. Either their I've done them and that doesn't -- there are numerous other examples I'm. And but. Generally find out when cases encoded go to trial -- -- -- -- this least reported decision. And -- the -- this is only about a year old. It's gonna take -- probably two years for cases to get to this point so -- I don't know of any offhand. So aspect question next -- and I'll have as them some more answers but it takes time -- these cases the bubble. But through the system and we'll find out more information -- we know plenty of -- at times when it cell phone I'm or location coordinates were extracted from. Via legal process from AT&T Verizon except try this is obsolete commonplace and -- are probably hundreds of cases now and we also plenty of cases where. Out photos and sell records have been extracted from. The iPhone or other Smartphones via friends it's but I am location info extracted from my of the iPhone now wait until next year. Now we talk that in my intro I mentioned briefly TomTom the personal navigation device company. We're taking it stayed somehow. Getting that data off of the dash top the -- -- devices. Probably when users synch that data get new maps on their PCs and then sending that data and optimize granted you know not personally identifiable. Back to at least they can figure out where to put the red light cameras. Com and of course cars have GPS devices in them to. Are we had a point now where because the devices -- is -- -- -- just driving from point a to point B in a car built after 2008. That. Where we go and buy that -- by that by extension who we associate with the just kind of out their information we should assume the police or hackers have access to and what we do about that. -- -- -- I have -- act -- all I got all the hard questions there's. It. There -- location data is is a huge issue on if it's just granular I'm showing that year in northern California. It's probably not that big of a deal unless. That unless you're planning to use of the fact the urine or of the alleged -- -- -- in New Orleans or New Orleans as an alibi. And the but the more Graham with a more -- -- it gets. The more -- potentially privacy. Intrusive it is samba has it it does really show what you're doing them and even -- who -- who you're doing it wet or you're talking to. -- tetris is so. I -- and of the law hasn't caught up on this there is a right now police they can access. Location history prior primarily from carriers -- -- be very surprised if they weren't going to. I -- Google Apple Microsoft except for at least as of as of this week. -- starting this week to get that information can access location histories and even tram tracks through and we're real time it's not clear that the search warrants are required. And it courts have split on whether or search warrants required treatment for historical. -- there's a coalition unfortunately Apple's not a member of Google and Microsoft are. That's trying to convince congress set to require search warrants I did a Q&A and CNET. A month or two ago senator Ron Wyden is planning to introduce legislation but the point is that this is an area where technology's -- Islam -- the law has not yet caught -- ports are still grappling. But what to do but it's evident it's going to become just a more and more -- important issue -- Ted you must be tracked this is both this relates to your business how's this affecting the business -- -- I think this all shows how important location to cover the whole mobile ecosystem and -- it's fantastic for us to see. What's happened over the last couple years with the adoption of tens of thousands of location based apps -- we. -- this company there is your two or three in the world. And so here we love this you're mass adoption of location based apps and we just wanna make sure -- -- cautious about how they deploy these systems so that we don't create a backlash. Where policy makers come in and go too far the other way and we -- all the great. -- mention that we happier we we think you can get all the great value out of this without. Interrupting peoples progress. Two to close or that -- yet Obama got a quick I think that's right I mean. It's -- -- I think Apple. And debit maybe to -- -- and Google and Microsoft have not been as forthcoming. As they could've been but I'm end it now you're ready seeing a class action lawsuits in senate hearings and in and the possibility of regulation and and that's just not that the right answer. -- -- I mean that the right answer is probably more of consumer pressure as opposed to. Pressure from politicians because -- Republicans don't really understand technology and so you can you could have. That EU cookie rules are here to remember a few years ago that European -- -- trying to ban cookies can be that -- web browser cookies and mrs. Just it -- kind of -- frankly idiotic and we could have an overreaction. Like that's what's important to keep the benefits in mind. So that's a from the consumer's perspective and intent from the business perspective what do you think consumers should rightfully expect with regards to location privacy and where you think will be say -- from our first step on the consumer -- content from the from the business sure on the consumer side I think it's reasonable to have -- -- back -- -- -- I'm not saying this needs to be. Regulated by law but as it's reasonable to expect the responsible companies will have -- that will treat location data and -- as. This as sensitive as they treats a home addresses and billing information and credit card information. IL I'm also some sort of and and noticed what's going on. An agreement that animate that yes -- -- you're saying you're when you're giving permission. And third a way to turn this off even if it means says may may -- Definitely before -- before we get human who point out here that -- my iPhone here I I play with a lot of apps obviously. I went into the location services tab in the control panel to see which apps have access to my location data. Its pages. I mean these are all apps that I location data turned on on by default. Should I be worried about all these things having access my location data and by extension I guess to the logs that might be on my phone. -- -- -- -- -- -- -- -- -- -- -- -- So folks like us that's we've wanted to happen is you use tons and tons location -- I think. You're you're in the future you're gonna buy it evolved from a company that you trust that is very explicitly knew how they're using your information and -- -- -- yesterday was a great example that this week -- and CEO of Apple got out there himself and describe what he wants this to be for his company. In -- he knows that how people view them on a topic like this is gonna have a bigger act. Of the trust they have. His company I think everyone should take the same sense that this is very much gonna affect your brand positively or negatively. The want to do it right of consumers are gonna flock to I think. There -- market mobile or fixed well. -- tell you you were educating the airport disclosure for the businesses to disclose to the consumer -- to be able to understand if they get with the beauty. By extension the big part of it. That's right any kind -- trust there are programs aren't any final words that -- -- Aren't completely cover the high -- thanks to your expert guidance -- that -- always great to have you on the show. Just to feed my own -- Ted thank you so much for dialing in as well good -- with sky hook it's good to hear from you can see you. -- and thanks again Steve and thank you for producing everyone thank you for watching and listening to reporters' roundtable we back next week -- another great show. Go to reporters' roundtable. One. Reporters' roundtable dot cnet.com for the show notes and links to all the great stuff we discussed and if you wanna send comment. Denise senator roundtable at cnet.com if you an idea for a future show thanks for watching -- you all next week by.