Hacker News Reader

Comment by gcbw2 | Hacker News Reader

What honest purposed TelCos would have to even sell this data?

all of them replied saying "we will cut clients not following the program guidelines"... what are those guidelines?! and why is that arbitrary for the companies to decide, and not mentioned anywhere on the consumer agreements other than some vague "we may share your data with whoever"?

This sounds like Cambridge Analytic for TelCos.

View on HN

Providers who uses these services need to agree to follow guidelines such as obtaining opt-in, sending notifications to devices being tracked with option to opt-out by replying with STOP, etc.

The guidelines are not enforced or audited.

I wonder why the opt-in wasn't performed by the telco itself!!!

I'm just learning about this whole thing now and I'm very upset.

Right, if the cell company says user consent is required it ought to text them "X is requesting permission to track your location, reply YES to allow"

And provide a straightforward mechanism of checking what has had access, what still has access, and a way to revoke it.

Well, most of the clients of this service are law enforcement. "The FBI is requesting permission to track your location, reply YES to allow"? Yeah, that's not going to happen.

But as I read the article, the location data is only at the resolution of which cell tower they're connected to. Doesn't 911 get better location info than that?

I'm not certain what the actual product uses, but the LocationSmart demo posted here last week had three data sourcing options: "[Cell Tower], AGPS, Best Available"

What if law enforcement knew? What if this was an intentional backdoor for law enforcement to abuse? I know, you can apply that on any vulnerability (what if X knew), "don't assume malice [...]", merely hypothetical but still.

I worked for a "household name" towing insurance company years ago. Often times people calling in don't actually know where they are, because it's on a highway somewhere unfamiliar. We integrated with a service provider to be able to get the GPS through the phone. It worked largely like you suggest, we hit an API, it asks them permission, they grant it, we get GPS.

Would that be Geico? They were mentioned doing that in the comment here¹:

“It's funny that this is coming up now. The other day I was on the phone with Geico's roadside assistance and they wanted to know my location. I told them I didn't have their app downloaded, they said it wasn't a problem and they could get it without it. Sure enough they could. I checked their disclaimers [1] and they purchase the data from my cell carrier. They didn't even have to know which one.

[1] https://www.geico.com/web-and-mobile/mobile-apps/roadside-as... (see disclaimers at the bottom)”

――――――

¹ — https://news.ycombinator.com/item?id=17082583

One I called 911 to report someone driving on the wrong side of a freeway. I was half sleep in the passenger seat and didn't notice we were on another interstate already. When i said "on highway A" the operator corrected me "don't you mean highway B?" and she was right. I did not get any GPS alert on my phone or confirmation, which given the service I was calling I think it was fine.

It is definitely based entirely on inferred data from cell tower usage. No gps involved whatsoever.

Maybe they even don't sell the data, it's a vulnerability of SS7 protocol.

https://www.ptsecurity.com/upload/iblock/8c0/8c065c70984c93d...

The telcos are almost certainly selling it. Verizon used to have a page noting that LocationSmart was a "Network API Partner": https://archive.li/tCLrd

To do this you need access to the SS7 network. I don't believe this is the issue in question, as the providers have APIs for partners doing location services.

Source: I used to have direct access to such an API

Don't worry though, they really support NN even though they want the NN rules gone...

Reply on news.ycombinator.com