Hacker News Reader

Comment by choeger | Hacker News Reader

So how does that work? I install some app that "needs" location data to function and in the EULA I "consent" to that data being sold. Police then buys this data via several proxies. So far so "told you so years ago". But how does police use that data? How do they associate account IDs from all these apps to real persons? Is that data collected and sold as well, e.g., via the payment processing? Do they use the email address as key?

View on HN

When you power up a mobile/cell phone, the handset transmits a handshake to all mobile/cell bases it can hit.

Handshaking between mobile/cell phone and mobile/cell bases continues somewhere between every 10 to 20 minutes.

Data exchanged include; IMEI [1], IMSI [2], and both handset transmit power level, receiver power level to each mobile/cell bases databases.

Coupling both the mobile/cell bases databases and the locations topographical data allows RDF [3].

So even if you have location data turned off, you can still be tracked.

[1] International Mobile Equipment Identity (IMEI) : https://en.m.wikipedia.org/wiki/IMEI

[2] International Mobile Subscriber Identity (IMSI) : https://en.m.wikipedia.org/wiki/International_mobile_subscri...

[3] Direction Finding (DF) (aka) Radio Direction Finding (RDF) : https://en.m.wikipedia.org/wiki/Radio_direction_finder

Yes, but this data is held by the cell phone companies. Based on the article, this is using "data from apps in accordance with their legal agreements" so that doesn't seem to be the source.

I hope cell phone companies require warrants for the data (they should per Carpenter v. United States) although I don't really trust them.

In addition to the boring “99% of people are uniquely identified by where they spend the most time at 2am and 2pm,” the linked EFF dive [1] says that they let federal agencies look up each device’s advertiser ID and other device info that makes it easy to look up a specific phone they have or have had physical access to. And if they still have no clue, they can use the cellular IP address to get the cell companies to identify the person paying the bills.

(Anyway, you have an address the phone lives at. Finding out who lives at an address is some of the basics of investigating, starting with a query of DMV databases, followed by credit reporting databases.)

[1] https://www.eff.org/deeplinks/2022/08/fog-revealed-guided-to...

https://en.wikipedia.org/wiki/K-anonymity

Basically, it only takes a few pointed datapoints to deanonymize a person. They are weaponizing this concept.

"We Kill People Based on Metadata"

-- former head of the National Security Agency Gen. Michael Hayden, 2014

"We Kill People Based on Metadata"

-- local cop with a beef with you, 2025

Location is account id. If you have the locations a person has visited, you have their home and their work/education/etc place.

This is why any and all claims of anonymization are gaslighting. You can't know something and not know it. The entire concept is incoherent and anyone who claims ad tracking and privacy are in any way compatible is lying to your face.

You try to match people in the db with known locations of a target and very quickly there will be only one match.

Gas buddy is one app that wholesales this data out. I wouldn’t doubt it if the carriers themselves sell it.

Reply on news.ycombinator.com