Hacker News Reader

Comment by superkuh | Hacker News Reader

If your phone is transmitting radio signals it is identifiable and trackable. A smart phones' primary feature and defining feature is transmitting radio signals. I don't think anyone is surprised at these "anonymous" bluetooth functions being deanonymized. But at least bluetooth beacons aren't going to go very far.

Multi-lateration of cell phone radio transmission via precise shared clocks at the base stations gives telcos a ~100m (these days) position that is updated very frequently. In the USA this stored by telcos for 2-5 years and is often sold to both private and government purchasers.

And anyone moderately skilled in SDR with a few thousand dollars can do the same for a small area (much larger than a bluetooth area though).

View on HN

> In the USA this stored by telcos for 2-5 years and is often sold to both private and government purchasers.

To private purchasers?

For 2-5 years?

No need for a judge issued warrant?

Just sold?

One of those services even used to have a demo site where you could put in any mobile phone number and it would show where it was. It got quickly shut down when it made the news.

I can't find the article because Google search terms for stuff like "locating any phone by number" are SEOed to death by scammers trying to exploit would-be stalkers

edit: found it https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...

Triangulation of mobile phones was developed by Cambridge Positioning Systems, back in 1993. It's been part of mobile networks for a long time so telcos have had a lot of time to figure out ways to extract money from location data.

https://www.mrao.cam.ac.uk/~pjds/temp/index.htm

https://www.theguardian.com/technology/2000/aug/17/efinance....

It was true for most of my life in the USA. I looked up the information again, now, and it seems in 2018 there was a supreme court decision that made it illegal for cops (but not the NSA, etc) to acquire individual location data without a warrant, https://www.npr.org/2018/06/22/605007387/supreme-court-rules... .

But this doesn't apply to selling to private companies who then sell their services to the government. And it also doesn't apply to the "anonymized" aggregate data of all locations of all cell users. This is still available and sold to both private and direct government purchasers. And with 2-5 years of high cadence 100m data it's very easy to see where someone lives, works, etc and de-anonymize their paths. The commercial sale of this is big business and has been covered innumberable times on HN over the years.

https://news.ycombinator.com/item?id=17094213 , https://news.ycombinator.com/item?id=17081684 , https://news.ycombinator.com/item?id=17069459

yes, a private company that has bought the information can just chose to share it for a fee with anybody it likes. Why would a judge be involved in that?

Because it's not theirs to sell, data about a person should belong to that person. They should control who it's being shared with.

I'd be shocked if my cell phone contract said they couldn't sell my data. Why would they do that?

I have plenty of options besides cell phones. I could have a landline, or get my ham license, or pen a letter!

I'm just a subscriber to a private service, after all.

Yeah I think this is the difference in view between EU and US in general :)

As an american, I personally find it disgusting

The potential for abuse of personal private data like location, movement profile, corelation with other movement profiles, etc, is so ginormous it blows my mind it's legal to keep the data for years, let alone to sell it to private companies.

If that is true then that means there is no data privacy protection in the US?

> If that is true then that means there is no data privacy protection in the US?

There may be some very specific data privacy laws (like two-party consent states), but yeah, you should assume no data privacy protection in the US.

The GDPR type laws seem to imply that information can't ever really be sold, since consent is always revokable, and can't be required as a condition of using the service.

I have a bit of an issue with that, since one generally expects that they can license any data they own, and it makes things like model releases confusing.

And the laws seem to define new private spaces that formerly didn't have expectation of privacy for most people.

But perhaps it's necessary anyway to prevent even bigger issues.

I can definitely see the problem with a cell company being able to sell data to someone's abusive stalker, even though in general I don't like censorship of observation, for the same reason I don't like ag-gag.

Well that's the idea that data that pertains to you, personally as individual human being, is and remind yours, to protect you from any intrusion.

Cambridge Analytica Style desinformation targeting is just one option. Personal location and contact info can easily be used for criminal or political abuse.

Reply on news.ycombinator.com