Blog

Welcome to Oceania

By David J. Meier

At lunch last week, location-based privacy came up. I actively opt in to a monitoring service, which gets me a discount on insurance for a vehicle I own. My counterpart stated that they would never agree to anything of the sort because of the inherent breach of personal privacy and security. I responded that the privacy statement explicitly reads that the device does not contain GPS, nor does the company track the vehicle’s location. But even if the privacy statement said the opposite – should I care? Is location directly tied to some aspect of my life that might negatively impact me? And ultimately is security really tied to privacy in this context?

In a paper by Janice Tsai, Who’s Viewed You? The Impact of Feedback in a Mobile Location-Sharing Application (PDF) the abstract’s last line states, “…our study suggests that peer opinion and technical savviness contribute most to whether or not participants thought they would continue to use a mobile location technology.” This makes sense as I would self-qualify my ability to understand the technology enough to be able to control and measure the level of exposure I may create. Although the paper’s focus is ultimately on the feedback (or lack thereof) that these location-based services provide, it still contains interesting information. The thing that most intrigued me is that it never actually correlated privacy to security. I expected there to be a definitive point where users complained about being less secure somehow because they were being tracked. But nothing like that appeared.

I continued on my journey, looking to tie location-based privacy to security, and ran across another paper with a more promising title: “Location-Based Services and the Privacy-Security Dichotomy” by K. Michael, L. Perusco, and M. G. Michael. The paper provides much more warning of “security compromise” and “privacy risk”, but the problem remains – again, this paper doesn’t provide any hard evidence of how these location-based services actually create a security risk. In fact it’s more the opposite – they state that if we are willing to give up privacy, then our personal security may be increased. The authors mention the obvious risks, including lack of control and data leakage, but at this point, I’m still unsatisfied and have yet to find a clear understanding of how or why using a location-based service might ultimately make me less secure. So maybe it’s simply not so, and perhaps the real problem is outlined in section 3.2 of the paper: “The Human Need for Autonomy”.

Let’s be honest – it’s more psychological than anything with a placeholder for obvious exceptions, the most notable being stalker scenarios that are linked to domestic abuse of sorts. Even in this scenario it may be a stretch to say that location-based services are really the root cause of decreased personal security. Sure an angry ex may guess or even know a password to a webmail account and skim location data from communications, but the same could be done by lock picking a place of residence and stealing a daily planner. It’s a particular area that can easily be argued from either side because of different interpretations of what it is in the end.

We’d like to think that nobody is tracking us, but we all carry mobile phones, we’re all recorded daily by countless cameras, we all badge in at work using RFID, we all swipe payment cards, and we all use the Internet (I’m generalizing “we” based on content distribution here, but flame if you must). The addition of things like Google Latitude, Skyhook Wireless, and Yahoo! Fire Eagle are adding a level of usability but in the grand scheme of things do they really impact your personal security? Probably not. In the meantime, my fellow netizens, we can at least make light of the situation while we discuss what it is and isn’t. It’s a place, no matter where we are, that can mockingly be referred to as: Oceania – because try as you might, someone is watching.

No Related Posts
Comments

Adam,

This one bugged me at first, but I had to give it to Dave that he caught something that went against my instincts.

I’m a bit of a privacy freak myself, and am very restrictive in my use of LBS. But I couldn’t find too many scenarios where giving up my physical location affected my security/personal safety as opposed to my privacy. One of our other analysts pointed out he worries about people knowing his family is home alone when he’s gone, but in my case it is easy to find out when I’m not around through event announcements and such I can’t really restrict.

I did think Dave missed that there are demographics where these concerns are very real, and had him add that to the post. Basically, if you are a specific target for physical crime (abuse, or some other reason) then LBS is a huge risk. I think more of a risk than Dave does, but I don’t want to overly restrict what he writes.

Anyway, this one forced me to think about the issue from a different perspective, so I thought it would be good to post.

By Rich


@Adam
I think you’re (still) missing the point -  that being privacy may not be directly tied to security from an LBS perspective except in certain and specific demographics of which are very small in comparison.  I’m sorry I don’t meet your expectations but all of my posts are reviewed by the Securosis crew.

By David J. Meier


My point is that you’re being incredibly dismissive of privacy concerns on what is usually a high quality security analysis blog.  If you don’t want to do high quality analysis on this blog, you should set up a separate one that we can give the attention it deserves.

By Adam


@Tim
Good point - I still see that perspective as the stalker scenario, just in a somewhat flipped viewpoint.  What if *something* knowing your away would increase home intrusion sensitivity?

@Adam
Thanks for sharing.  It wasn’t stated as in depth analysis and your point is rather unclear or I’d comment further.

By David J. Meier


I find your lack of data disturbing.

If you’d gone and gathered data on the breadth of groups that have worked to protect their personal address in (for example) debates around REAL ID, you might have been less dismissive.

At least, when you said “probably not,” we’d know that that was analysis, not punditry.

By Adam


It would seem one aspect of location based security risk would be the potential to track where you are NOT. While I agree that there are ways for you to infer where someone is (the daily planner example) it is more likely if you know where someone is with relative accuracy you also know where they are not. For example you may know that someone is NOT at home and therefore be able to be more confident you can break into their house. Perhaps to steal more than their daily planner…

By Timothy Chambers


If you like to leave comments, and aren’t a spammer, register for the site and email us at info@securosis.com and we’ll turn off moderation for your account.