Australian regulator investigates Google data harvesting from Android phones
theguardian.com
theguardian.com
A quote contained within both stories: > The software company Oracle revealed Google could be harvesting a gigabyte of data from Android devices each month
Given that my data plan is 1.5 GB/month, I would notice if a gigabyte magically disappeared every month (it doesn't). Hopefully the ACCC has enough skepticism and technical knowledge to see through Oracle's FUD. OTOH what's in it for Oracle here? Purely trying to damage Google's brand? I suppose the media have run with it and it's working.
So quite a lot I'd assume would be buffered and sent back while you're on a wifi connection.
> The experts, from computer and software corporation Oracle, claim Google is draining roughly one gigabyte of mobile data monthly from Android phone users’ accounts as it snoops in the background, collecting information to help advertisers.
Then goes on to give a cost breakdown of how much this hypothetical data download is costing Australian's via their mobile data connections.
I'm not saying that's what they do, but you can have many scenarios when you get 1gb of information without transferring 1gb of data.
> could be harvesting a gigabyte of data from devices each month
Which is unlikely to be true in the literal sense of pure bytes transferred simply because: a) people would notice that very soon, b) people consume gigabytes but don't produce nearly as much - all of my monthly activity would likely fit in a few MB, c) processing that much is a pain - at the scale of millions of users they'd optimise that.
The experiment, the real, controlled (replicable!) one, isn't hard to do. You just need a couple of spare phones.
In Sao Paulo Brazil, the mexican-based operator Claro offers free bandwidth for facebook and whatsapp access.
I imagine it would be possible to process media locally into actionable and highly compressed data. For instance use the google text-to-speech toolset on media while the phone is on sleep and even run it though a sentiment analyzer and wordlist. eye tracking and activity correlates are even more compressible.
Earlier in the year the police were monitoring activity on public wifi hotspots and using the info to target people labelled as undesirable in the quickly gentrifying city center.
Since I am a a)foreigner that b)transverses a diverse array of classes, groups, and political affiliations on a daily basis, i go ahead and always assume that i'm being constantly monitored.
Siri and other voice rec is able to get words from my audio without appearing to affect my phone function or slow it down. There are plenty of times my phone is idle that it could be doing that.
Same with photos. When you give many apps access to your photos, as we know, they will analyze and/or transit the metadata of all photos on the device. It’s not hard to imagine going farther than that, and as noted, processing or data transfer could be deferred.
Not without making a noticeable drain on the user's battery.
I've just checked my monthly Discord traffic and it's mere 251MiB in/73MiB out. For roughly an 1-2 hours of gaming every other evening, and some longer weekend sessions.
Power usage, on the other hand, is a different story. When I've experimented with an app that'd continuously record everything around me, battery ran out in just a few hours.
Is that so? We're already used to updates, videos and even simple websites needing an enormous amount of data. I could easily imagine a gigabyte vanishing that you'd attribute to other things.
Also note that this is probably an average value, not an absolute.
What would bother me, though, is if they were purposefully not exposing that data transfer in the data metering on the device. That seems shady.
That's way beyond unrealistic.
Like photos we saved from internet, or search history, google drive backups, watched videos, liked photos, location maps. Even though you have 1.5gb/month plan, you are creating enough meta data that google can use for profiling.
They legit even store how you download a picture, via sharing, saving or dragging on desktop.
If i were still at Google, and given this project, it would be obvious to tap into mobile brands feed and only use mobile data plans of those who wouldnt notice that 79% of their data disappear. Google knows precisely what plan you have and what data use and still have for the month period through reading your IMEI and many other tricks.
I scoffed, but this is actually a thing: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4431287/
(It's also useful for weather observations, see the old PressureNET.io site for an opt-in version.)
Anyway, my monthly mobile data usage for Google services is 110 MB and that's including the map tiles, Google Play services and Play Store (I have location history disabled). I'd be interested in whether anyone is having a gig of their data used.
From personal experience, it breaks a ton of stuff, including my patience with the endless "turn on location services" prompts.
Like that's a small thing. I would love to move to Eastern Europe or Czechia, but alas
- after stopped using Google Play services/framework and replaced it with microg, battery life improved for 30% with same programs beeing run and same settings without losing any functionality, this is the most obvious part that something is going on and it is hard to deny. I never used (while on google play) any syncing, gps fix and so on. Meaning exactly same settings, same programs, no google applicatios (maps,...) same AOSP rom, not even factory resetted in between, just no Google Play presence on same phone. I switched to microg as I have figured out that whatever I do can't stop the Google Play services/framework communicating with google (firewall, xprivacy,...)
- there are hidden sync in Google Play that can't be disabled and are syncing regardless of your settings (https://www.reddit.com/r/Nexus5/comments/270axz/enabled_reve...), like Location reporting (not the one visible, there is second one, you will need root to see it, you can disable it but it will automatically turn back on after a while).
- DNS is defaulting to google dns 8.8.8.8, it is overriden in most cases by router settings but still.
It is up to each person to decide what this means but I would seriously suggest looking at https://lineage.microg.org/
Not if you delete the apk from /system/apps (?and correponding /data/data folder?).
Instability follows if you click settings>location or when apps still allowed location access call for it, however.
Am so tired of this ctap, I don't use G services(runninh AICP w/ many apks removed). The real challenge is removing Webview, most apps crash despite having no need for web access/functionality.
> The experts, from computer and software corporation Oracle, claim Google is draining roughly one gigabyte of mobile data monthly from Android phone users’ accounts as it snoops in the background, collecting information to help advertisers.
Then goes on to give a cost breakdown of how much this hypothetical data download is costing Australian's via their mobile data connections.
Even the fitbit in my pocket has a barometric sensor, to be able to count stairs.
GPS _is_ less accurate vertically in certain circumstances
When you move x distance horizontally, unless you have a very poor view of the sky some satellites will get closer and others further away. When you move the same distance vertically, all satellites will get closer but by differing amounts [2]. As vertical moves produce a smaller change in the measured data, noise in the measured data has greater impact on the vertical measurement.
just figure you're on the Earth's surface, and cross-reference
map data for the altitude
But the GPS reception module itself doesn't contain a detailed elevation map of the earth; there isn't enough memory to store a detailed map, or any way to push out map updates.
usually this doesn't matter unless you're flying
Things like drone altitude control also like having height data, obviously.
[1] http://www2.unb.ca/gge/Resources/gpsworld.may99.pdf [2] Because you can only see satellites above you, never below. Unless you're high enough that the planet stops getting in the way. [3] https://www.strava.com/challenges
> ACCC investigating Oracle research showing Google users Android phone plan data to spy
(typo is theirs)
And by "investigating" it means Oracle did a presentation stating that if you have location history on it uses data and the commission chairman told News Corp Australia, "my people are looking into it."
> That Oracle had come to Australia to do the presentation showed the value of the ACCC inquiry, he said.
lol
And of course, this appears to be another front in which Oracle is helping point out the many ways Android is screwing everyone else over, mostly because they're upset about Android screwing them over.
If someday someone's writing the "why we failed" article for Google, I suspect bullet one will be "we should've paid for our Java license". Whether or not what Google did was technically legal, the amount of scrutiny they've faced thanks to Oracle being ticked at them alone is monumental.
It will be more like "We should have bought Sun when we had the chance."
1. You can opt out
2. You can see all your data
3. You can export all your data
4. You can delete all your data
Also, they have very little evidence for their claims that it's actually using that much data. From my experience, Google only syncs on wifi and rarely wastes your mobile data.
This particular story/investigation appears to be in Australia. Google's only required to limit their tendency to stalk your every waking moment in the EU. While some of the improvements made will probably end up being available globally just because, for instance, improvements to Google Takeout-like work, I doubt Google's going to stop tracking you where it's still legally permissible.
So the moment you visit the EEU, GDPR applies; irrespective of residency status. The moment you leave the EEU, GDPR no longer applies, even if you are an EU resident.
from your link:
> It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.
its amazing how much misinformation is floating around... i recently read on HN that it also applies to eu citizens living abroad, but thats wrong.
https://www.compliancejunction.com/does-gdpr-apply-to-eu-cit...
> This Regulation applies to the processing of personal data of data subjects who are in the Union
But if you multiply by the number of android users, Google is allegedly collecting an exabyte per month.
That's about 1/10 the size of the entire web. More data than the big 5 combined can store. Per month.
Yeah, sure, whatever you say, Oracle. Shouldn't you be out arguing to a judge that you've copyrighted the idea of lists? Or was that last year's money-grubbing bullshit?
google employees revert community features (e.g. hiding/limiting referrer header, essential for adwords revenue) silently with big unrelated commits (the referrer one at least 3 times)
https://cs.chromium.org/chromium/src/services/network/loader...
Example: my phone has both a Wifi and GPS chip. I open Maps and it tells me it can't give me navigation unless I turn on Location Services or whatever, which allows them to use the Wifi to scan for APs or whatever else they do.
It's 100% a lie, because any other GPS based navigation system (such as TomTom, Magellan GPS devices) can in fact do this; and they have far less CPU power than my phone does.
https://en.wikipedia.org/wiki/Time_to_first_fix
A relevant patent https://patents.google.com/patent/US20020142783
https://electronics.stackexchange.com/questions/230305/warm-...
the maps app will show that warning every damn time gps is enabled. every. single. time.
But if you only want it to use GPS, then change Location Services from High Accuracy to GPS only.
https://jacquesmattheij.com/dark-patterns-the-ratchet
There are many more like it but this one is particularly annoying because of the asymmetry between the work they do to get you to consent to something that isn't in your advantage compared to the work you have to do to reverse your decision (which sometimes isn't possible at all!).
For a while I could still click no, but then they forbade that. So I gave up and clicked yes, and now they've got all my photos
instead of all apps with access to your sd card (virtual internal shared storage) having access to your photos, they created a secure photo storage, and apps can subscribe to it. they just happen to conveniently offer a bloatware photo app, shipped with every device just like internet explorer, that also happens to upload all your pictures to google servers.
gphotos is the first thing I disable on every phone (because you can't uninstall bloatware system apps). chrome is the second, because I must use it to download f-droid and firefox.
https://www.oracle.com/corporate/acquisitions/bluekai/index....
> BlueKai also runs the world's largest 3rd party data marketplace to augment a customer's proprietary data with actionable information on more than 700 million profiles.
Do you expect Apple to listen to your conversations just because you use a mac and it has a microphone? Do you expect Toyota to track you everywhere you go because your car came with a GPS system?
Building the system, let alone just making the software, doesn't give you the rights to all the data it produces after you sell it.
Maybe the phone, but not the software running on it.
Most consumers don't realise how little of their phone is purchased and how much of it is licensed, rented or reliant on corporate existence. Imagine if Apple and Google magically disappeared from the universe—the value and utility of your phone will plummet.
Well in germany there is a good sentence about that. 'Ignorance of the law is no excuse'. So basically no matter what you know of anything you won't be guarded by laziness (at least if you are under normal conditions of course).
The question here is what basic privacies can someone expect when they purchase a phone, and how transparent do companies need to be about what information they are collecting.
Yeah but that doesn't mean that they should snap a photo or turn on the mic in my bedroom. The point is that there are limits. Legal and ethical.
Is there a project to replace all of play services with FOSS/encrypted ones?
You can make do (as I do) with LineageOS, F-Droid, and APKMirror. The last is run by the AndroidPolice folks and is therefore trustworthy.
Google must be laughing their asses off with all the Facebook scrutiny - I am pretty sure that the profile FB has on users and non-users alike is but a vague precis when compared with the profile Google has on all of us.
Microsoft has now started claiming that "Windows is a service" and they can fuck right off. I have lost count on the amount of times my machine rebooted in the middle of the night, despite implementing hack after hack to stop this disgusting behaviour.
I paid for my hardware, and I paid for my software - none of these bastards get to decide what part of my data they get to siphon off.
They are all at it, like pigs on the trough. I bought a OnePlus 2 years ago, due to the promise that it is lightweight, has no crap pre-installed like an unremovable facebook, or whatever else these fuckers come up with next. Turns out OnePlus is just as happy grabbing your data and silently siphoning this off to some hidden database.
I have a new PC on the way, which will be the first time in about 10 years that I'll be going back to a Linux desktop as my main daily driver. My phone is next, I'm looking for a nice feature phone that doesn't send my private information back to these fuckers.
Stallman was right.
They can't deliver everything that RMS would look for in a laptop or phone yet but they are actively working to remove all binary blobs from their CoreBoot BIOS and to disable the Intel Management Engine.
Their OS is already FSF compliant.
Just because you paid for a software license doesn't mean you can do whatever you want with said software.
I understand why people don't like this but I don't understand what principles people use to decide that it is immoral or should be illegal.
Just because I bought their software doesn't mean they get to do what they like with my data, or my systems. The only right these companies get is that they can give me their software to use.
I also do not see why you think they have no right to your data. If you send them the data, they should be able to use it for whatever purpose they want that you agree to in the license. Assuming it's not illegal for some other reason, like credit card fraud.
I don't understand what principles people use to decide that they own all of their data and all data about themselves. It doesn't make sense to me.
The second is, that if there is some private leveraged advantage Google gets, over other people, which dis-equilibriates in the commons, This is not good, and I should be told quite clearly thats the case, and how it works.
This could be achieved using an approach like differential privacy[0] which Apple use.
[0] https://images.apple.com/privacy/docs/Differential_Privacy_O...
Furthermore, Facebook and Google control close to 85% of the digital ad market. The rest 15% goes to the content creators and to the journalism. If Google and FB were not able to invade everyone's privacy, that would have created a level playing field for national, regional, and specialized media to prosper. But because they know who you are, they can display an ad for you on any platform. If you are from Denver, here's an ad for a Denver event on your mobile game. So who needs journalism if an article in Denver Post is on par to a Candy Crush screen? Who needs quality content on the internet? There is a reason why there is no VC investment in the content whatsoever.
Sometimes you need to take off the gloves and get your hands dirty. Google really needs to take Oracle to task for their public smear campaign.
also, most of the claim seems to be for code in the very closed source google play services (wildly guessing from the features involved)
It's obvious that Oracle and Google don't get along. To be generous. So it's brilliant for Oracle to have the state(s) or attorneys do their work for them. Now EU will get involved and (at the least) class action lawyers in USA.
"One of the reasons I left Google was because "don't be evil" got replaced by "collect and monetize information""
Notice I asked them for more info to help trace back the problems, but received little response. I wonder how for example Larry and Sergey are involved.
I find this claim doubtful...
> "The Oracle experts say phone owners’ data ends up being consumed even if Google Maps is not in use or aeroplane mode is switched on."
It's called "flight mode" on my android, and I highly doubt my data is being used when flight mode is activated.
With that said, Google does get pushy and invasive. Maps is annoying how it bugs you to go online and turn location settings on just to see a map. If I already know where I am, and only need to see a map, I shouldn't need to go online. Google have reluctantly allowed "offline maps" in recent times, but in typical Google fashion, the offline maps "expire" after only 30 days.
When Google location services is switched off, and your account is set to not track you or record history, there is absolutely not a "gig" of "secret spying" going on in the background.
Nobody forces you to leave wi-fi and mobile data on by default and everything set to default. Don't want to be tracked by Google? Then open settings and switch things off, it's not hard.
Like I said, grain of salt for News Limited articles. They hate Google, as do Oracle. The Daily Tele can't even write an article title without errors... "research showing Google users Android", bunch of amateurs.
Sorry, no. Turning on WiFi is not the same as consenting to be tracked everywhere. Your whole comment is all mixed up. First, you cannot disable Google Location Services. Period. You can turn off location, but you cannot, e.g. use GPS directly without going through Google Play Services. Second, you say the parent's comment was hypothetical, and yet, then you assume it is true and then suggest that using WiFi is consent to some hypothetical practice.
> Like I said, grain of salt for News Limited articles. They hate Google, as do Oracle.
And then you attack the source! Geesh.
Like I said, you can uncheck a lot of stuff and still use the app.
I don't want to be tracked when I asked not to, but I'm not convinced that's happening from a clickbait tabloid article with spelling errors in headline, and vague details.
I also would like to use GPS without anything else for maps, so I tried Maps.Me for awhile, but as most people know it can take a long time to lock on when only using GPS. sometimes several minutes depending where you are, or whether moving etc.
> And then you attack the source! Geesh.
If you're implying the Daily Telegraph source is worth defending against ridicule, perhaps spend a bit of time on that site and see if you come away with any respect for their journalism. The Mod has changed the link anyway now to the Guardian, since the "source" prior to that was clickbait rubbish.
They track even when wifi is turned off, they still wake the radio to receive access point ssid broadcasts, they just don't send anything via wifi when it is off.
If you opt out of Google location services entirely then it won't do it.