Verizon, AT&T and Sprint to Limit Sales of Cellphone Location Data | Hacker News Reader

Verizon, AT&T and Sprint to Limit Sales of Cellphone Location Data

nytimes.com

108 pointsmcenedella54 comments

In Switzerland there is a concept of the "private sphere" [1] and it basically implies that others do not have the right to pry into nor track that sphere. Each individual and family has their own sense of that sphere and of how large it is. Under this concept I cannot conceive of corporations monitoring and tracking people, then selling that information, as is currently done in the US. For instance, in Switzerland it is illegal to create a database on other people without their knowledge and consent.

It is stronger than the idea of "privacy" -- its intent is to completely isolate and protect parts of your life from both the political and the public, which includes the commercial. The right to property is part of it. Note that the Wikipedia description of French "vie privée" ("private life") [2] has deeper and more distinct grounding than the one on "privacy" [3] -- the latter claims that this is mainly a US/British legal conceptualization, but the idea of a private life that should be protected has strong historical and a different effective presence in several European legal systems.

[1] http://www.hls-dhs-dss.ch/textes/f/F16104.php

[2] https://fr.wikipedia.org/wiki/Vie_privée

[3] https://en.wikipedia.org/wiki/Privacy

Home network security never took root in America because so many see themselves not as an exploited nation, but as temporarily embarrassed porn stars and reality TV stars. - Adapted from Ronald Wright

Where did home network security take root?

Yet even in Switzerland, there are companies having access to cell provider data and therefore location data "behind the carrier firewall".

https://techcrunch.com/2017/09/07/teralytics-wants-to-tap-te...

"Polzer says it’s using a variety of proprietary techniques to handle the data in a way that preserves user privacy — although he won’t go into too much detail, claiming commercial sensitivity"

Folks also call this "Security by obscurity".

I don't have a whole lot to support my ideas here, other than a collection of my own ideas etc.

When your whole country is about 8.5 million people it must be difficult to ever go anywhere and be a complete stranger.

The USA seems to be such a huge land, both geographically and demographically, that I think it lends itself to a variety of groups exploiting others. I don't think The USA is a homogeneous whole.

Or, if there were a scale on which various countries could be placed to describe homogeneity The USA would be at the far end of one extreme of that scale.

I think that's why The USA seems to be such a hodgepodge of poor planning and action.

> When your whole country is about 8.5 million people it must be difficult to ever go anywhere and be a complete stranger.

I know it's not HackerNews material, but: LOL.

In a country with 8.5 million people it's not like you're living in a village with 5000 people where you know everyone. I think that once you have more than about 1 million people it's quite feasible to have perfect anonymity.

More than that, in Switzerland they speak 4 different languages (German, French, Italian and the Romance language Romansch). The communities are quite separate, it's entirely possible for your average French Swiss to not have much to do with his fellow German Swiss countrymen.

I don’t think the OP was being completely literal, and your point about language barriers is well taken, but in the context of America, Switzerland is the state of Virginia in terms of population (and about 40% of Virginia’s land area).

In that context, Swiss national politics is more akin U.S. state level politics, where there tends to be much more cohesion.

Actually, as a fiercly federalist country politics are very much comparable to a lesser corrupt US. In fact parts of the US system were implemented with the founding of the Swiss Confederation. Namely the two houses.

The principle of governance is to push as much power as possible as locally as possible. Communities and cities as well as cantons (states) in Switzerland have a lot of leeway in handling their affairs. As long there's no violation of higher principles. For example a violation of the federal constitution.

> parts of the US system were implemented with the founding of the Swiss Confederation

Specifically, on the California constitution. (The Swiss system improves on California’s referendum process by making the referenda texts non-binding as law, but binding as instructions on the legislature.)

You're inventing a past influence of California as a model for other parts of the world.

The Swiss constitution of 1848 is modeled after the US Constitution [1], not after such a thing as a Californian political model -- especially since California was not admitted to the Union until 1850... popular initiatives (not just referenda) were adopted in Zurich before spreading to other Swiss cantons and then being also adopted at the Federal level.

[1] http://history-switzerland.geschichte-schweiz.ch/switzerland...

Not to mention that in the U.S. there is Federal, State, and typically multiple leveles of municipal bureaucracy to contend with.

However, you also have to remember that in the typical American’s most of the services that they consume are at the local/municipal level

Come on. Switzerland has the same Federal structure, with 26 States, and municipal governments. Even the educational system is split at the State level, with barely any Federal intervention!

Maybe you should learn about other countries before claiming that your personal experience in the US is absolutely unique or completely distinct.

In switzerland .. ..it is legal to track anyone with a gps tracker on a car. https://steigerlegal.ch/2018/02/02/gps-tracker-urteil/

..it is legal for cellphone provider to sell customer position data. Swisscom for sure does it. You have to op-out by yourself.

Oh, wow. Thanks for the link. [for those who don't grok German] That was a court decision at the State level (Bern) which claims incredibly that since the GPS tracker shows only where a vehicle is located it does not violate the protection of personal data since a person can walk away from the vehicle and no longer be tracked... I expect it will be either fixed by additional legislation or appealed to the (Federal) Supreme Court.

Verizon has a section of their site to turn off marketing and adjust privacy settings. Notably absent is the ability to turn off location sharing. I emailed the privacy department and they totally dodged my question. I still would like, and think it's important to have, an option to opt out of all location sharing. I don't care if it's for fraud prevention since that is easily abused by companies.

For those curious, here is where/how to do this with Verizon:

https://nbillpay.verizonwireless.com/vzw/secure/setPrivacy.a...

"Customer Proprietary Network Information Settings" was enabled. "Business & Marketing Insights" was disabled. "Relevant Mobile Advertising " was enabled.

Note, I had to disable Customer Proprietary Network Information Settings twice after I found it was still enabled after my first attempt.

Does anyone know of a way to simply fake location data? I genuinely don't care if it is technically illegal. Data collection has jumped the shark at this point

As far as I know some custom ROMs support GPS spoofing, either with fake data or blocking it. But instead you usually get worse camera drivers and some security features may stop working.

All of this doesn't matter for network providers since they will always have your location data, by design of GSM network.

Have your calls forwarded to a service you can answer from your computer. Securely strap your phone to the back of an outdoor cat. Be sure to set a strong passcode so the cat can't use the phone. To keep the phone charged, invent a charger that can convert the kinetic energy of the cat's attempts at walking away from the phone. Use the money earned from your invention to buy more phones.

You could harvest the energy to charge the phone from a perpetually rotating cat by strapping a piece of buttered toast to its back.

I believe this method is patented and isn’t due to expire for another 12 years.

I doubt that there's any way to fake location based on cell towers. That's all done in the baseband radio, which is not readily user accessible. And even if you could mess with it, it's probably very illegal. It's certainly illegal to spoof mobile subscriber identity (IMSI) because that allows theft of service.

It's much easier to disable GPS location capability. But even that's not very reliable, because there are multiple software levels, most of which aren't user controllable.

The best option that I know is turning devices off, and keeping them in Faraday bags, except when in use. So you get to pick which locations get reported. You're less reachable, but that's a necessary tradeoff. For long-term storage in Faraday bags, it's important to remove the battery, because otherwise the device may drain it, trying to ping towers, even though "turned off".

> I doubt that there's any way to fake location based on cell towers. That's all done in the baseband radio, which is not readily user accessible. And even if you could mess with it, it's probably very illegal.

Also, it would probably cause your phone to simply stop working as a phone - cell towers need this location data for their fundamental operations as a cellular system.

Yes, good point. So if you care about cell towers, you can just nuke the radio, and use only VoIP via WiFi. But even that's iffy, I think, given difficulty controlling apps. And finally, even if all that works, you don't really have a "phone" anymore.

Is having your phone on airplane mode the same as it being turned off? (still trying to ping towers regardless?)

Also, if a phone has no antenna/no data connectivity/no GPS, but has wifi functionality. What is tracking situation there? I assume one could forward calls to the phone through wifi or is that a terrible idea?

About airplane mode, I'm not sure.

About the wifi-only phone, I recall an old guide from Mike Perry about configuring Android devices to use only wifi.[0] But Copperhead is gone, so ???

0) https://blog.torproject.org/mission-improbable-hardening-and...

Wifi only won't help because other peoples phones have precisely geotagged the location of wifi hotspots, and your phone is likely reporting wifi signal strength to the mothership.

Ah, yes. So basically, you can't use your main phone anywhere and for anything that you don't want linked to you. You need one or more secondary phones, purchased as anonymously as possible. Each of those must only be used in specific locations for specific purposes, and otherwise stored in a Faraday bag or box. Perhaps only once, as a "burner phone". In other words, phone use must be compartmentalized. If it matters to you, anyway.

For this case you are out of luck since the network provider tracks you through their cell towers.

For spoofing data for apps, if you are on android and have a rooted device there is xposed with xprivacy

https://forum.xda-developers.com/showthread.php?t=3034811

https://github.com/M66B/XPrivacyLua

Root won't help, the modem has its own OS.

Of course it won't. even if you could it would not matter because the cell towers know where you are.

My mentioning of xprivacy was only to further knowledge that you can at least spoof data for the software side (apps installed on the device)

This may have changed with android P but AFAIK you don't need root to spoof location data.

https://play.google.com/store/apps/details?id=com.lexa.fakeg...

I personally have used this app to fool certain retail apps to check in-store prices of items.

i think these solutions use the debug api, not sure.

xprivacy allows for spoofing all kinds of data like phonebook, calendar, even allows to not expose the clipboard.

if only gps data is relevant, this non rooted solution is of course easier to set up.

To anonymize at least buy a burner Sim and run a voip client on your handset over 4g

The best way to avoid location tracking is to have your primary number be google voice that forwards to your cellphone and never give out your primary number for any reason. If whoever is stalking you doesn't know your real number, they can't pull your location data.

1. I’m not sure most people’s primary concern is stalking - though this would seem to be a solution

2. From a privacy perspective adding google into the loop seems counter productive

3. The cell phone company can still sell you location data to data brokers based on your name, address, social etc....

The person I know who had this problem was getting stalked and fixed it via the Google voice trick. Sure the government might know where you are, but what does a person with a private detective level of sophistication have access to? I guess one way to find out would be to hire a red team to see if they could find the person using data brokers.

The cell phone operator knows exactly to which base station your phone is connected to. You can't spoof that because then your cellular network stops working.

You can fix your GPS coordinates on certain phones. See this presentation for more information https://www.youtube.com/watch?v=F1VttfQFTWE

He talks about being able to fix your GPS coordinates to static values. Also being able to fix your list of cell phone towers so you never end up on someone's femtocell. There's also a really cool cell proxy setup for fully anonymous calling via a proxy cellphone

Good information, but useless for what we're talking about here.

The location data that the cell phone companies are selling is gathered by the cell towers for the fundamental operation of the system. It doesn't come from GPS.

Rule of thumb: If you're emitting a signal (wifi, cell, bluetooth, smoke, etc...) you can be tracked. How accurately only depends on the number of receivers.

What about T-Mobile?

https://twitter.com/JohnLegere/status/1009168217586061313 From earlier today.

Great, so now I have to count on Mr. Legere's judgment of whether a given middleman is "shady".

Why is it legal for these companies to sell our data to anyone? This is nuts.

The FCC in 2016 voted to require that ISPs and mobile providers must get opt-in consent to share or sell customer data.

Then in 2017 Congress voted to overturn those rules and prevent the FCC from implementing them in the future in a party-line vote in the House and Senate.

Adding further insult to injury, the current FCC chairman, Ajit Pai, represented Securus (the company that sparked this revelation) in 2012 as an attorney.

https://arstechnica.com/tech-policy/2017/03/for-sale-your-pr...

https://arstechnica.com/tech-policy/2018/06/verizon-and-att-...

Well, credit card fraud prevention relies on data like this. I don't really have a problem with the credit card fraud service being able to find my location around the time of a swipe.

Beyond that? It all looks pretty shady, and I'm afraid this is one case where the slippery slope concept applies very strongly.

It will now be leased.

Or bartered, just like Facebook didn't "sell" your data to data brokers, the company just exchanged it for the brokers' own data on you (or others).

I was dumb enough to think that anyone would need a warrant to be able to get that information...

“Verizon, AT&T, and Sprint decide to cut out middlemen and sell directly to location data consumers.”

Please don't use quotation marks to make it look like quoting someone when you aren't. And could you please not break the site guidelines by posting shallow dismissals? If you have a substantive point, make it thoughtfully instead.

https://news.ycombinator.com/newsguidelines.html

That’s fair, thanks dang!

Don’t worry, the (federal) government will still have no problems getting their hands on it.

Any progress on privacy is great, but it doesn’t buy much as long as underlying issues aren’t solved. We still have a legal system that has no issue with nearly unlimited surveillance by the federal government which is set up by what is essentially secret law.

Yes, but they have been bypassing due process by using 3rd parties instead of going directly to telecoms. And the friendly folks at Palantir et al are only too happy to share.

The due process is basically just a rubber stamped sham anyways — the only downside is that there’s a paper trail. But it seems that as a government agency you can just lie to the FISA courts to get your warrants and there won’t be any consequences later.

Reply on news.ycombinator.com