My Phone Was Spying on Me, So I Tracked Down the Surveillants | Hacker News Reader

My Phone Was Spying on Me, So I Tracked Down the Surveillants

twitter.com

493 pointsingve169 comments

The thread also mentions https://nrkbeta.no/2020/12/03/my-phone-was-spying-on-me-so-i... which would be a better link than twitter.

> For the sum of 35,000 NOK (3,300 EUR / 4,000 USD), we got access to location data showing where tens of thousands of Norwegians had travelled in 2019.

> One of them was 31-year-old Karl Bjarne Bernhardsen from Stavanger. The information made it easy for us to identify him in the data that – according to the data provider – had been anonymised.

Here’s that article:

https://translate.googleusercontent.com/translate_c?tl=en&u=...

And the HN thread:

https://news.ycombinator.com/item?id=23136612

What causes me the most irritation (to put it mildly) is that I bought the Sygic navigator that seems to be the source of this data. And still they sell my data? Just last week they forced me to agree to some new rules to be able to use the app but I already bought it 7 years ago. I will be requesting my money back as stated by that agreement, and request a GDPR data dump for moving my data to another provider.

Link for anyone else wanting their money back:

https://www.sygic.com/company/eula-gps-navigation-google-pla...

Unsurprisingly, they're refusing my request.

So, essentially, I'm now locked into this agreement with Sygic for the duration of my "lifetime" license.

This is one of those situations where I'd wish I had some "fuck you" money to throw at an expensive law firm.

Sygic don't even have a Privacy Policy link on their homepage, you have to dig for it a buried legal documents page.

Your privacy is not something they care about except as something to sell to others.

Thanks, I don't like Twitter for long form content. It's not designed for this.

There's also nitter, it's slightly better than the twitter interface

https://nitter.net/martingund

Thanks.

I agree with you, but a hacky workaround is @mythreadreader

Yeah, hacky and annoying af when fifty people use it on the same thread, as is usually the case. Makes Twitter’s long-form readability and usability even worse.

Thanks.

That is a fantastic but very unsettling article. It's a somewhat dystopian present we live in

There are way to fight back. If you choose to. Convenience usually comes first it seems.

How? What are the best ways to fight back?

I don't have a smartphone. That alone will prevent browsing habits being picked up by parasitic apps etc on a phone. What I browse at home I have more control over with blocklists etc and disabling js.

I rarely carry my dumphone around, if someone needs me they can leave a message. That takes care of tracking by cell station.

There are times I'd like to have a dumphone on me, eg. when meeting people, so at some point I'll get dumphone #2 not linked to me.

If possible, pay cash rather than a credit card. I have done this before but in the uk this was getting more difficult and may not be possible, I don't know. There are always ways around that with grey areas.

At higher levels pressure your government or use the local regulations to push back when a company seems to be behaving unethically.

I'm sure there's more.

But convenience triumphs and all you can see is "I need smartphone". You won't do any of this. People who ask how will never do, or they wouldn't be asking the question to which the answer(s) are obvious.

GPS chip in the car? License plate readers all around you? Face recognition cameras? Chip in the credit card that you are not using? Friends with a iphone that have your number? ID cards that swipe you into places?

I'll try and answer your questions but please answer me this, what is the psychology of people like you who see failure not as an option but as a destination?

You seem absolutely determined to be both resentful of society and completely powerless against it, and not willing to actually do anything to change anything?

Well, I was talking about smartphones so you seem to have moved the goalposts with your questions so that my answers don't apply -- deliberately, to emphasise helplessness?

But okay, let's try

> GPS chip in car

I don't know anything about this so, don't buy such a car. If you do, is the chip enabled without drivers control? I'd be surprised at that.

> License plate readers?

To some extent I guess these are necessary, but they are a usable so you have to deal with this at the level of government rather than directly.

> Face recognition cameras

This has to be tackled at the legal level, and yes, it does concern me. Fortunately in a democracy you have some say. Unfortunately I don't think you will make the effort.

> Chip in the credit card...

Oh for heaven's sake, it's not broadcasting your location it's RFID, and if you want to disable it you can find instructions online. You basically make a small cut into the side of the card which breaks the antenna loop (or whatever it's called). I literally have done that and it took me a few minutes.

> Friends with my phone that have your number

Is this a serious objection? They can't track you via somebody else's phone -- did you even think about this before writing it?

> ID cards that swept into places

This really is scraping the bottom of the barrel. I've had worked cards like this, they simply let you in and out little more than an old-fashioned metal key, with a record being made. You can't be tracked by them other than when swiped.

You seem to have embraced failure while resenting it but it's clearly what you want.

I typically give the following link to such people: https://en.wikipedia.org/wiki/Security-in-depth and say that perfection is not achievable, but it does not mean you should give up absolutely everything.

Thanks for that.

The problem isn't DID or anything like that but a strange attitude that they want nice things but will put in zero effort to achieve that even if shown basic steps, and have a mindset that they're totally fucked, everything's against them, they can't win. It's a kind of learned helplessness.

This is a great illustration of why the GDPR - and enforcement of it - is so important. The average user has absolutely no chance of navigating the digital advertising sewer without all of their data eventually being sold to the US military.

Much more readable in Thread reader form:

https://threadreaderapp.com/thread/1334465877153095680.html

So we have a very successful short messages app, that now resulted in another service to be successful, which combines the short messages into a long format. Innovation and evolution aren't always straightforward I guess!

Or you can just read the article on the website https://nrkbeta.no/2020/12/03/my-phone-was-spying-on-me-so-i...

I hacked the tweet thread together in 15 min so I think the article might be a better (although longer) read.

> “I agree,” I pressed. We had now made a binding agreement, the app and I.

I hate this whole premise. We have to agree to an incomprehensible text wall of vague legal nonsense, that very often violate our own laws (as in this case), in order to install an app.

These illegal contracts are completely void of any meaning, and it should not matter that you "agreed" to be screwed over like that. Being screwed over like this is illegal, so those who do this, should not stay safe just because you clicked "I agree".

> Being screwed over like this is illegal

More precisely, these agreements generally aren't legally binding in Europe, but generally are legally binding in the US.

Usually there is a few lines at the end stating that wherever this is illegal, these parts are not binding. (Or something more legalese ofcourse)

> Usually there is a few lines at the end stating that wherever this is illegal, these parts are not binding

Personally, this is what I detest the most. There's always a bit in the boilerplate that's akin to "you agree to everything here, even the unenforceable bits. If we're ever challenged on the unenforceable parts after the fact, you still agree to be bound by everything else here."

IA[very_much]NAL, but to me this always sounds like "We can and will stick whatever nonsense we want in this contract, whether the terms are illegal or not, and you will be bound by them for as long as we can get away with it. If you do ever discover the illegal bits, that doesn't void anything else (including any other illegal bits you haven't found yet!) and you can't sue us- you've given up that right and can only use a mediator from our approved list. May the odds be ever in your favor."

severability is actually a really important and broad legal concept (IANAL). I can where you get to [the view you espouse above] but if you think a bit about it you'll realize that contract law would become pretty unworkable without it. If every clause and statement has to be perfect or the whole thing evaporates, it would be hard to get anything done. And even if it were ok today, legislative changes tomorrow could inadvertently nuke a bunch of contracts.

This is separable from the abusive nature of ToS of course.

> legislative changes tomorrow could inadvertently nuke a bunch of contracts

That sounds like a good thing? Why should abusive illegal contracts be allowed to continue after the law has found them to be unacceptable?

I think you missed "inadvertently".

It's one thing if the legislation is specifically targeting those contracts, quite another if the unintended consequence is much broader than you intend. It's easy enough to imagine legislators unintentionally invalidating basically all of a states employment contracts this way, for example.

This is a fair point; it makes good sense and I'm glad you delineated ToS abuse and the spirit of the law!

That's kind of the thing though.

> Signer agrees to become contract murderer unless pre-empted by local laws and regulations.

I'm over-exaggerating, and I get the value when it's prohibitively expensive to write a TOS when it's essentially impossible to pre-emptively vet the legality of all possible clauses internationally as laws constantly change. But if the clause I wrote is technically valid, then what's the point? Just write a short phrase saying "We're going to do whatever we like, unless it's prohibited by law. Accept? Y/N"

The TOS is about what you can do, not what the company can do.

"We'll do whatever we like, and you're not allowed to do anything, except as required by applicable law".

This is pedantically true, but the TOS are usually bundled with other agreements that purport to give the company permission to do things.

True; although who knows what would hold up in court if anyone was to file a lawsuit based on some of these "digital contracts" we agree to every time we click "I agree".

I have a feeling that a judge would want to find them invalid, but what happens if he/she rules that they are non-binding? The chaos it would cause for US B2C businesses would be large. This alone may sway the courts to make them binding.

Customers should have the legal footing to negotiate every line in every contract with someone holding the status to negotiate on behalf of the company. If I can't negotiate my cell phone contact I'm placed in an impossible scenario where I either agree under duress or endure the impossible life of someone that refuses to sign contracts. Essentially, there are 4-6 contracts I'm capable of negotiating in my life out of tens of thousands I've agreed to under duress. Those 4-6 are: apartment lease (keep the Wi-Fi take off $50), groundskeeping (days, times, work to be done, breachs), trash (when, where). These negotiations are only possible because these companies have sole proprietors who will get on the phone to keep a customer. Let's move every company closer to this model by requiring every contract to be negotiable or, if online, optout no guarantees, no warranty, no liability, no tracking except for carefully and explicitly outlined exceptions.

> The chaos it would cause for US B2C businesses would be large.

Literally who cares? Let them deal with it. It doesn't matter how much money they lose. They should have considered the consequences of abusing people's trust and violating their privacy under questionable consent.

Corporations are vastly more powerful compared to individuals. Courts obviously need to favor the latter in the vast majority of cases. To do otherwise is injustice.

It was not a value judgement, just a prediction. Some judges do look at the impact of a ruling. I personally don't think they should be legally binding (as I suspect most HN readers do).

"doesn't matter how much money they lose" -- of course it does, these companies employ people and generate lots of government revenue (even if they skirt corporate taxes).

> these companies employ people and generate lots of government revenue (even if they skirt corporate taxes).

There are political and economic concerns, not judicial. The fact the company is important does nothing to remedy the fact that it exfiltrated private information to foreign intelligence agencies.

And if they fold due to privacy violations, another company will usually take their place.

> This alone may sway the courts to make them binding.

I'm afraid you are correct, but hasn't the whole system collapsed if:

- Is this good for our businesses?

is is part of your consideration when you are trying to find out if something is illegal or not?

The often are non-binding. Read up on "contracts of adhesion". Business doesn't fall apart because at the end of the day it mostly doesn't matter if you obey TOS. This has nothing to do with privacy though, since there's (in most cases) no law against what the companies are doing with the day.

The TOS of any European company cannot supersede the law of the European Union.

Example; how one individual singlehandedy forced the hands of Spotify to reverse an API decision they made blocking the export of your playlists. Note how Spotify thinks their TOS supersedes the GDPR. It does not. Otherwise, we would have corporations directly creating laws.

[1] https://news.ycombinator.com/item?id=24764371

The trouble with the GDPR seems to be that it relies on government enforcement.

For example the UK's enforcement arm, the ICO, recently found that the adtech industry was in violation of the GDPR, then did nothing:

https://www.openrightsgroup.org/blog/the-ico-must-fix-the-ad...

As far as I know, I can't personally sue these companies for this, and if the ICO does nothing then what's the law is meaningless.

The follow up from the Open Rights Group is here:

https://www.openrightsgroup.org/blog/parliament-must-hold-th...

If you care about privacy in the UK, please donate to ORG, I started a direct debit years ago and have always been impressed with their work and focus:

https://www.openrightsgroup.org/join/

> As far as I know, I can't personally sue these companies for this, and if the ICO does nothing then what's the law is meaningless.

Couldn't you sue ICO then?

Yes. That's what the Open Rights Group are doing, and they want donations to help with it.

https://action.openrightsgroup.org/help-us-protect-your-data...

As people, we like to think categorically... especially "contracting" in the philosophical and legal sense. Whether its a medieval oath or a standard employment contract, the concept of "binding agreement" sorts out moral issues of consent and creates a platform for further relations.

Reality is generally less fussy about categorical boundaries. It likes spectrum. Linnaean classification is an approximation. Biology isn't strict about species, or even organism barriers. It's the same with a lot of cultural stuff.

On one end of the spectrum, we can have a business agreement negotiated diligently and in good faith between equal partners. On the other end, we have take-it-or-leave it agreements: The T&Cs stack a bank hands you when you take a loan. The wall of incomprehensible legalese we consent to when we use an app or website. An employment contract is somewhere on that spectrum. Employees may be able to submit "red line corrections" depending on their seniority and confidence, but generally its written by employers and treated as under their control.

In philosophy, contracts (including rhetorical ones like "moral contracts) are a popular mechanism for problem solving. They certainly are in law. In normal human life, norms are much more common.

I have thought in a similar vein about capitalism and markets. Why, if everyone is clamoring for fair contracts, are not businesses offering them?

Partly it's because consumers cannot tell a good from a bad contract.

And partly I think it's that a lot of people say the right signals ('I care deeply about privacy!') As it's the cause de celebre, but don't actually care.

Sometimes they just want to watch Hulu without going on a stallman esque campaign.

You as a user can choose to uninstall it immediately and try alternatives until successful.

Most people of course, akin to how paying with card makes you overspend because you don't see the money, agree to anything because it's just a button on the screen not a potentially predatory human person.

Those two things are not equivalent.

In the case of overly vague terms of service, people agree to them because there are essentially no options or alternatives.

Sure, it does not help that people agree to them without thinking about it. Which is somewhat similar to people spending money without thinking about how much they have.

You know full well there are plenty of situations where that's not an option and that almost no one fully appreciates what happens when they press agree.

The whole culture around closed smart phone apps is completely rotten.

> We have to agree

When you install an iphone it's even worse

They have a screen describing privacy.

You can click and see the privacy policy.

And then the privacy policy is actually pages and pages and pages of pointers to individual sub-privacy policies.

and there is no "I agree", they just show you all this.

You can opt out of some things later, but already they're a token gesture.

> When you install an iphone it's even worse

It can always get worse...

> .. pages of pointers to individual sub-privacy policies.

At this point expecting someone to have read them is just nuts. The "lawsuit culture" in the US, where you have to guard yourself from possible lawsuits all the time, have made these legal contracts comically bad. They have always been strange, since you typically get to read them after you unpack the phone/computer etc.

In the past I've used a text or html editor to change that text before clicking "I Agree," and then saving off a local copy.

Seems as reasonable a way to negotiate the contact as the way it was presented to me in the first place.

I wouldn't over worry about such things. If it was that big of a deal, the government would be "on it".

After all, is Democracy not the best mechanism possible for executing the aggregate will of the people? And would the will of the people not be to not be tracked in this manner?

I predict this undesirable situation will be eliminated in less than one year - or, in case it is more complicated than it seems (and therefore takes more time to resolve), will at least have significant attention from both the government and the media until it is resolved to the satisfaction of voters.

I will keep my eyes open for an upcoming entry for this matter on the "Top 10,000 Concerns of the General Public" KPI tracker where we monitor matters of public concern like this, and I will use 10 of my monthly allocated voting units to express my level of concern.

This has been going on and known for a few years now, why would it change in the upcoming year?

Well if it was important, wouldn't an initiative to rectify it be underway then? Or, might there be a flaw in one of my premises? I only hold these because they seem to be the same premises advertised by other people.

I do hope that you're being sarcastic.

The United States Customs and Border Protection (CBP) states that they they have limited access to commercially available data, and that they are used in line with relevant rules and regulations

Well sure, relevant being the operative word here. For the US CBP the only relevance is US law, since the USA has no concept of data subject ownership -- in the US, all data is owned by whoever holds it, not who it is about.

Not sure why you're being downvoted. This seems like an accurate description of what's the status quo (and what is the problem with it, IMO)

FYI, Sen. Ron Wyden is pretty much the only US congressperson actually -doing- anything about this. He is relentless in his attacks on the industry and understands the technology. I saw him at DefCon and yes, he sounds like a politician, but he's fighting the good fight.

FTA:

In a statement, Senator Ron Wyden said “Venntel has stonewalled Congress for months and refused to identify the sources of the data it is selling to Customs and Border Protection and other government agencies. The U.S. needs far stronger laws to protect Americans’ privacy, and ensure transparency about where our data is going."

And most of the rest of congress aren't just not doing anything about it, they consistently support the American surveillance state and voted on its expansion. It's incredibly rare for privacy to even be on the ticket.

It seems like this issue can be largely circumvented by the fact that at least on iOS, giving location data now requires much more interaction from the user? Every time a new app asks for your location, you can select whether you want to give it that information all the time, or only while using the app.

Another thing that I've started using recently is NextDNS[1], and it's amazing the amount of tracker garbage that's leaking out, and being blocked on a DNS level, out of almost any mobile application.

[1]: https://nextdns.io/

I'm sure someone has a database of frameworks that iOS apps turn to for user linking / monetization?

I didn't readily find a list last time I looked, so I'm not sure how single person dev shops are getting hooked up with these privacy bypassing hydras.

From DNS logs in Nov 2019, I had found some of the more common on iOS a year ago included:

iOS “User Linking” Trackers

[business].app.link

[business].onelink.me

[hash].ulink.adjust.com

[business].bttn.io

bnc.lt

branch.io

Some of these you can see who uses them, thanks to subdomains:

https://securitytrails.com/list/apex_domain/app.link (2962)

https://securitytrails.com/list/apex_domain/onelink.me (998)

https://securitytrails.com/list/apex_domain/bttn.io (60)

These are different from iOS Measurement Trackers such as:

events.appsflyer.com

reports.crashlytics.com

api.mixpanel.com

app-measurement.com

But it's gotten enough worse I almost want Apple to implement Little Snitch style blocking at the network layer, and offer a measurement anonymizing API that devs can use and is whitelisted by default. Ensure legit usage/debugging info is anonymously available, while use of other trackers would then suggest other motivations at play.

> Every time a new app asks for your location, you can select whether you want to give it that information all the time, or only while using the app.

This is exactly how it works on Android as well (since version 10, IIRC).

Interesting article.

Is there any way to mitigate the amount of data collected?

If I turn GPS off can they still track my steps?

One thing that I notice frequently is discussing some topic with my wife and then finding an AD related to the topic on Instagram, LinkedIn, and whatnot. Could be a coincidence but I not sure any more.

The tracking is extremly intrusive. With GPS turned off, accuracy is diminished, but locating the device is still possible via WiFi SSIDs and cell towers the phone is logged into. Maybe Bluetooth also plays a role.

In the background, the phone uses its gyro sensors so it can tell what you are doing: walking, running, getting into a car/sitting down, getting out/up, ...

The unsettling part is that location logging continues to work with the phone off (saw an admittedtly obscure YouTube video on that which I can't seem to dig up again).

Like the Kindle, airplane mode also doesn't stop data from being transmitted to the overlords. It merely delays it from somewhat real-time to whenever you go online again.

> The unsettling part is that location logging continues to work with the phone off

There are specific bits of malware that make the phone appear to be off when it is in fact powered on. Such malware typically requires root access or an exploit, and is the realm of shady governments not advertiser's. But if you don't have that malware, you can't be tracked when the phone is off.

I'm sure there's plenty of RF energy to make a passive phone case that lights up when your phone is transmitting, which would detect this case if you were looking at your phone. Maybe having it emit a tone would be better.

It would be fun to see if you could get a modern phone to shut up for even five seconds when powered on.

> location logging continues to work with the phone off

I’m very skeptical about this. I’d be interested to know how a phone could track location info while powered off.

If you actually turn off location services in the OS none of this tracking occurs. About the only remaining source would be the mag of apps implement their own harvesting of the Earth’s magnetic field. Such things are extremely technically difficult to do well (you’d need to map the mag signals across the world) and the accuracy isn’t great (somewhere between wifi and coarse cellular if I recall correctly).

If at any point this actually became a reality the OS would start treating mag access as needing location permissions.

> If you actually turn off location services in the OS none of this tracking occurs.

Location services doesn't disable bluetooth. If you're in a dense area, your local stores may have bluetooth beacons which will report location hits against your bluetooth ID, which may be tied to you through applications you install.

https://www.nytimes.com/interactive/2019/06/14/opinion/bluet...

You also need to turn off the Bluetooth, cell, and wifi modems, and keep them off.

https://www.zdnet.com/article/us-cell-carriers-selling-acces...

It wouldn’t surprise me at all if baseband processors eventually start logging and asynchronously sending gps data to the cell carriers behind the operating system’s back, so you should also keep it in a mylar sack.

Similarly the accelerometer can gather all sorts of information (passwords, text typed on the keyboard, are you driving, flying, walking, etc), so you’ll probably eventually need to keep the phone in a drawer to avoid leaking that information. Similarly for the microphone (some surveillance libraries already snoop sounds in various primitive ways).

To recap: keep it off the network in a stationary, electromagnetically shielded, sound proof box. That’s simple enough, and from there you can use it as normal.

Most likely a coincidence: https://www.avg.com/en/signal/facebook-listening-private-con...

If it were true I feel confident that information would have leaked by now.

>If it were true I feel confident that information would have leaked by now.

Yeah, there's no way for Facebook to be actively listening to conversations on millions of phones connected to private home networks without someone noticing. And that's not even addressing that someone currently or formerly working at Facebook would just blow the whistle at some point.

The problem with this conspiracy theory is that people just don't care about numbers and facts. They usually have an anecdote ("I was talking about cheese and hour later I got an ad for cheese") and that removes any need for hard evidence. Hard evidence that shouldn't be that hard to collect considering you own both the device and the network on which this supposed listening is happening on.

But this definitely _does_ happen, and most people, even non-tech people are aware of it. There's just some people who refuse to believe it.

If you mean the conspiracy theory, then some proof would be in order. That happening, and most people believing that to happen, are both outlandish claims.

Spoiler: it actually does not happen. As the other person commented, snooping like this in scale would leak.

I don't understand this "argument from incredulity". It has leaked - you found out about it. Do you want them to publish an article in NY Times saying "yes, we spy on you all the time"? Do you want a personalized letter? What, exactly, is the form of this "leak" you expect would happen if this were true?

Just in case you are serious here: a random anecdote on a forum discussion doesn't count for anything, definitely not for a "leak". That parent message had a wild claim which of course requires serious proof.

Edit: since you're asking, proof could be multiple testimonials from ex-engineers working on the project or a peer-reviewed article in a serious journal. Until that this is in the same bin with healing crystals and chemtrails.

Right. Testimonials in violation of their NDAs.

Whistleblowers never prosper, at least in the US. Too many examples, take Stingray for a less controversial one. What was the result? Crickets. Exactly what would be the incentive for those engineers?

Myself, I'm a Bayesian and I grew up in a communist country, which means I start from "of course everyone is spying on me, all the time" and require strong evidence to change my mind.

>Right. Testimonials in violation of their NDAs.

You're expecting 100% of the engineers at Facebook (or previously at Facebook) that know about this to comply with the NDA. And history shows that 100% of Facebook employees will not keep quiet about Facebook doing bad/illegal things.

I don't need to change your mind, so I won't try. I'll just say that it must be very tiring to believe every conspiracy theory by default. To me it seems like a sad way to live.

>It has leaked - you found out about it.

Where?

Really? In the parent message.

Yeah, really. Because I ain't seeing anything.

You mean that Facebook is definitely tapping your phone's microphone 24/7?

Couldn't the facebook app just listen for signal fingerprints? For example, Nielsen embeds digital fingerprints into songs so that it can tell what you listen to without listening to the full audio stream. They simply listen for a certain pattern, and make note when they detect the pattern. You could do the same with with "coffee" or "jogging" or "yoga mat". You don't listen to the conversation audio, you detect audio fingerprints.

They would still need to enable the Audio hardware. That would be noticed.

Nice, thanks for linking the article!

As far as I know the largest offenders are still the cellular companies since they can and are selling location data that works without any software on the phone. It's technically less precise than GPS/wifi location data but since it's always active it's pretty easy to use weeks of data to improve the resolution.

Besides that just don't install any apps you don't need. Stick to open source software, install a custom ROM on your phone, don't use Google location services, etc.

On iOS at least you can allow an app access to location data only while the app is in use (or not at all). Not sure what the situation is on Android.

And, in iOS 14, you can also grant an app access to “imprecise” location data, which reduces its accuracy from about 20 feet to 2 miles.

It's the same since at least Android 10, also you can allow one-off permissions as well.

Same on Android 11. There's also an "Only this time" option.

That’s different. That would just ask you to confirm again if the app prompts.

The iOS counterpart blocks location requests quietly when the app is in the background and allows them when the app is in the foreground.

Turning off ad id in the OS and checking which apps have access to location would do wonders. Would also recommend checking which apps have access to the contact list.

Same I noticed.

One particular day I remember specifically because had a long call with friend who lives in some other city. We talked about meeting sometime in future, dating, job situation and travelling to Canada/Europe.

With in hours I received promotional email about "travelling to the city my friend lives in". Dating site AD. Looking for Job and article about how to travel move to Canada/Europe.

Fun day.

People only think about Facebook, but there are other AdTech companies as well which do not get scrutinised as much.

The writer doesn't mention which apps he installed, nor which phone. I'd be interested in the details, does anyone know this underlying data?

Writer: Samsung Galaxy S7. I guess over 70 apps in navigation, weather, games, prayer apps, or relevant due to listing location companies in privacy policy.

I have not named apps / companies I that were not relevant to this feature. I found other things, but I had to focus on a clear story.

Thank you.

A good advice: disable background app refreshes if you use an iPhone.

Can you explain why? I'm not clear on the implications but am definitely interested.

Battery life, but mostly the topic of the article: apps use it to track you [1]. I always ask myself: why does this app need to communicate with a server if I didn't open the app? For the majority of apps there is no need to do anything while they're asleep.

[1] https://www.macobserver.com/news/background-app-refresh-data...

Thank you! I had no idea.

After I disabled background app refresh I installed a firewall (https://www.lifewire.com/why-you-need-a-firewall-app-for-you...) - in my case the open source, security audited, on-device-only firewall "Lockdown" see https://lockdownprivacy.com/

Do iPhones do this if I enable location with "when I use the app" as opposed to "always"?

tbh, I don't think it's related to the location settings. I believe apps don't even need to ask for permission to do this. That's why you need to turn it off manually.

I stopped to use smartphones in 2018. Since then I have a Nokia 3310 new model, with Facebook installed. However the wi-fi is turned on around 10 minutes per month, in best case.

What I've immediately observed after switching to the new phone that I'm receiving more precisely targeted ads. Before, on smartphone no adds were relevant, after the smartphone new adds were all relevant.

My guess was the phone / the cellular service company is listening me all the time, not just when talking on the phone.

To test it we've started playing games. Sitting with friends, we've used a predefined brand name very often in a conversation. Next day I've got the ads on the social media, on my laptop, I have no other internet device.

What I'm doing now? Not using the phone at all. Which means 1-2 daily quick conversation to set up places to meet. For long conversations I use email or messengers.

How do I feel? It doesn't bother me at all. I'm not paranoid. I know we are all sold since the blogging era begun. Right now what I can do is to make the lives who exploit data harder in this particular case.

Edit: My phone is Nokia 8110 4G, with KaiOs.

Even if your use a dumb phone with no real operating system or applications if you carry an operating cell phone your location is tracked and stored. In the US this data is stored for 2-5 years minimum depending on which Telco you use. It is used and sold just like in this article.

Tracking is how cell phones and cell basestations work. You cannot have one without the other. The better the clocks in the base stations the better the multilateration accuracy. It's already well under <100m. That you turn off GPS positioning does not matter in the slightest.

As for listening to you to provide context for what ads to show, I find that supremely unlikely. Probably other aspects of your digital life are also monitored to inform this kind of thing.

The test was repeated many times, screenshots with the next day social media ads were registered. My carrier is Orange in Romania.

Just in case somebody wants to reproduce the experiment.

If you have full confidence in your theory, you should perform a controlled experiment for statistical significance.

Say the name of 20 places on a call (but never you nor any facebook contacts go there) [and have 20 controls you never mention]. Then count ads over the next month.

You can conclude something to a certain confidence level if the results show you were right.

That might be the right approach, thanks for the tip. Maybe somebody else will do a better testing. I just wanted to draw attention to the fact non-smartphones / carriers might / perhaps spy in the same way than apps.

Are you sure that none of your friends are looking up the predefined brand names? Do any of your friends go home and immediately google the predefined brand name?

The first time I was realizing the phone listens to the conversations was Christmas eve, when talking about gifts. One gift came from a global brand. Next day I saw the ads. I didn't googled for sure for that brand on my end nor posted anything on social media. And on my parents' end, who received the gift, I'm pretty sure their internet skills are not enough for a brand search.

Anyway, I don't want to convince anybody here, I might be pretty wrong. Just helping others who might have the job to verify all these findings.

Listening all the time would drain your phone's battery in no time. Transferring those recordings to wherever they're transcribed would definitely show up on your data usage. Transcribing them on your phone before transmitting them would drain your battery even faster.

This is more likely plain simple confirmation bias. The ads were there before, you just never noticed them.

https://nitter.net/martingund/status/1334465877153095680

I would highly recommend NetGuard to block individual app's network access and to enable them only as and when needed.

[1]https://f-droid.org/en/packages/eu.faircode.netguard/

If you have a newer version of android (9+), you can do it without 3d app.

https://www.digitalcitizen.life/how-block-internet-access-sp...

True, but Netguard provides many more features such as alert on new app, access logs, whitelist/blacklist capabilities etc.

This is essential work, using the GDPR as a tool for data privacy journalism. Unfortunately, GDPR is only the beginning and lots of work like this needs to be done to uncover the breadth of the damage that is being done daily. Also, as the article states this shows that stronger laws need to be in place all over the globe.

(Journalist behind article.) Thank you! I can say that it is not easy to use subject access requests to get information. Without the help of Michael Veale’s template and a lot of grit, I don’t think I would have made it.

Transparency is just a first step, but it is a powerful tool.

For those interested, Michael Veale’s template : https://michae.lv/access-template/

(From the "Method" part at the end of the full article : https://nrkbeta.no/2020/12/03/my-phone-was-spying-on-me-so-i... )

You wrote: "It is uncanny to follow my own steps, even though they do not divulge any romantic affair, secret meetings, or embarrassing health issues."

Contact tracing addresses that shortcoming of the current surveillance tech. Today, finding out that 2 cell phones have been in proximity requires computationally expensive analytics on the server side. With the apparently mandated requirement for contact tracing, edge devices ("your" phone) will simply detect proximate "ids" and send that to the servers and that trivializes the task of determining your "romantic affair, secret meetings, or embarrassing health issues".

> Today, finding out that 2 cell phones have been in proximity requires computationally expensive analytics on the server side.

No, you just have to use the right data structures. Quadtree is the obvious one if you have lat/long, or if you have cell history you can observe that e.g. the UK only has ~25,000 base stations, so you can just use them as buckets. It's probably too expensive to run on every ad load, but for targeted surveillance it's easy.

Contact tracing will go away middle of next year with the end of the pandemic. Although I wouldn't rule out its reactivation next time there's a SARS or bird flu breakout.

I think OP is saying he didn’t have any affairs or other secrets to divulge.

Twitter thread links to https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-...

It finally appears that we built the wrong monetization strategy for the Internet.

Ideally users would have the option of having some sort of digital bank associated with their web browsing. Micro transactions could pay to support the websites instead of advertisements.

One downside to the security model in popular mobile OSes is that once someone does gain superuser access there's really nothing the user can do short of rebuilding the device since they often don't have it themselves.

Let’s not beat around the bush here: this is a uniquely Android problem. Sure, there are some iOS jailbreaks out in the wild, but these are very few and far between. There was one for then-recent iOS versions earlier this year, but it came many years after the previous jailbreak of that kind. Superuser access to my iOS device isn’t something I need to worry about. But if I ran Android? It would be a real threat.

This isn't really true. Jailbreaks are not the main concern here, privilege escalation vulnerabilities are. Those are discovered somewhat regularly in both Android and iOS. Jailbreaks on iOS make use of such vulnerabilities when they discover them, but most vulnerabilities are not discovered by jailbreakers. These sorts of vulnerabilities are also inherent to any complex operating system, not unique to Android.

Users "rooting" their Android phones also usually doesn't involve any sort of real exploit either. Android devices don't come with the ability for apps to run as root by default, and can have their firmware flashed to add a means of doing so. Doing this requires that the user unlock their bootloader, which wipes the device and often requires manufacturer authorization. Rooted devices have weakened security by being rooted, but this doesn't affect ordinary non-rooted devices.

He consented to the collection and Apple would have exactly the same issues.

Also Android is marginally more useful than an iOS device. I know that it is fancy as a music player and social media apps, but it isn't really what it could be.

He consented to the collection only for marketing purposes, but explicitly not to be forwarded to/bought by criminal US government agencies.

> He consented to the collection and Apple would have exactly the same issues.

Would it? In iOS you can selectively forbid applications from using locations services.

My grandma uses an iPhone and it leaks far more data than her PC. Yes, the handling is the issue and here iOS is as bad as Android.

That is the metric I use to determine that the app store security model is bad.

> In iOS you can selectively forbid applications from using locations services.

The same is true on Android. I have location services denied on the browser I'm typing this from.

so can you in Android... well guess what, it doesn't add any feeling of security on my chinese phone (and for any non-US person, chinese or american are the same - foreign powers gathering all data possible, which may or may not be used against you in the future).

After having read the responses to my parent comment I'm confused. Why would disabling location services on his phone not have solved the problem?

I think without said "security" model, we wouldn't have so much malware.

Because getting your exact location extracted and send to marketing firms and government contractors is worse than quite a few trojans you could get on your local computer by executing random and even malicious code.

It is time that security experts get honest about this and that "experts" lower their voice a bit.

Are the experts experts or are the experts "experts"?

In my experience, security expert generally are honest about this and should, if anything, raise their voices more.

A lot of "experts" are marketeers or work in the industry and have financial ambitions.

There is a technically correct argument that a locked down environment hinders the execution of malicious code, but for overall security, especially privacy and illegal data access, the current "security" solutions for smartphones perform very badly.

> Kacanova claims that my consent had been lawfully obtained according to GDPR, and that their partners were contractually obliged to only use my data for marketing purposes.

Does anyone actually believe these companies are segregating their data based on what they are legally allowed to do with it? And that those permissions somehow get propagated along with the data to third parties, who then also diligently segregate their data based on legal permissions?

It's difficult to hold these companies accountable and even if you could prove they were misusing the data as an individual, it's difficult to take legal action against them. And even if you do manage to beat them in court, the compensation will almost certainly be a pittance - especially if you're not covered under the GDPR.

Of course they're not doing managing users' personal data responsibly! Even with the GDPR, it's still more lucrative to just not bother.

Even if you can sue them into oblivion, there will be a different company under a different name doing the same. It's just too lucrative.

Is there a list of safe phones and safe apps? Or are we supposed to use Pine/Librem/Jolla phones only to have anything resembling privacy?

There’s a reason they get called “privacy rapists”.

Why is "track and trace" a challenge when this exists?

Because there would (rightly) be an uproar if this were made more public, and “track and trace” is one of the most public things you can do with the data. Instead, we've got an almost completely private Bluetooth-based protocol… with implementations that go ahead and phone home anyway, without even using that phoned-home data for the track & trace system.

using the tech still takes effort, which is preferred to be spent on incarceration than public health.

But isn't the user international? Seems within provider's rights?

If you're targeting European users, you need to comply with the GDPR.

In this case the user is in Norway which is not a member of the EU.

The comment you’re replying to doesn’t mention EU, so this nitpick doesn’t make much sense.

Norway integrated GDPR into its own legal system: https://lovdata.no/dokument/NL/lov/2018-06-15-38

Didn't mention EU, but to be specific: members of the EU or the EEA.

GDPR was implemented in the EU and in the EEA, of which Norway is a member of.

The problem we are beginning to see is the unwillingness, chaos, and confusion on how exactly to enforce GDPR. This is concerning; no repercussions will eventually lead to where we were before.

I thought the GDPR is only valid in the EU. But the author is from Norway, which is not member of the EU. So how does the GDPR apply for him?

GDPR applies to the EEA, which Norway is part of https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

Related big data landscape 2020: https://mattturck.com/data2020/

> Venntel told me in a subject access request that my data was shared, but they did not provide to whom. When contacted later - they told me in a short statement that the data was not shared with ICE or CBP.

I think this is an extremely clever technique for generating mainstream interest in a topic that would probably otherwise be considered boring for the typical person: associate it with something that people have very strong emotional feelings about. 10/10

Reply on news.ycombinator.com