This is an important story, but a little difficult to summarize. Here's my attempt at an overview:
1. Google stores location history data for more of its mobile users than you might expect. The precision is greatest when GPS is on, but less precise data from cell towers and WiFi sources is used almost any time a Google app is being used on an Android or non-Android phone. There have been cases in the past where Google has recorded such information even when the user has explicitly turned off all location services, but Google says they have stopped this practice.
2. On multiple recent occasions, police in North Carolina have quietly been successful in obtaining search warrants that force Google to turn over these records. Rather than "standard" search warrants asking for the location of a particular suspect in a crime, these "reverse" or "area based" warrants ask for time and location data for all users who have entered a geographical area during a time of interest. The records returned are initially anonymous account numbers, and the police then make followup requests for identifying information of the subset of accounts that they think are of interest to the case.
3. This open-ended "drag net" approach scares some people. Typically, at least in the US, suspects are identified first, and then further information is gathered that confirms or removes the suspicion. The express fear seems to be that innocent people will be falsely accused due to coincidence, but there is also a more general fear that once mechanisms are in place that allow the police to have easy access to location tracking information, this information will end up being abused.
You live in Los Angeles (according to Google). How will GDPR help you? Companies such as Google and Facebook aren't going to implement European laws for their American customers!
Google and Facebook may choose not to, but plenty of others will. Consider the technical challenges of implementing one set of compliance rules in one place, and one set elsewhere. The profit gain from not following GDPR in an area must exceed the cost of maintaining separate rulesets.
LinkedIn's new policy that goes into effect in May appears to grant GDPR-like permissions across all users, for instance, though it does specify that EEA countries may have additional rights under the law. I suspect the majority of companies will end up complying with GDPR globally.
Under a hypothetical US version of the GDPR, Google might be prohibited from sharing that data with non-governmental third parties. But it wouldn't be prohibited from collecting and storing that data, as showing someone their location history (with clear opt-out language) is actually in the legitimate interest of providing better mapping services for that individual. And law enforcement wouldn't be subject to those third-party restrictions.
There are additional laws that could protect citizens against overreach. But something like the GDPR alone would not do the trick.
This is especially dangerous given that there is already overreach in which data on the correlation of travel and behavior with crime, is being used to unlawfully detain people: https://www.npr.org/2017/12/05/568351544/teens-arrested-on-g... This data would only serve to multiply that problem. It's not an easy problem to solve.
How is remembering where I have been useful to me at all? Hopefully something like a us GDPR would make them excplicitly ask my permission before stalking me.
'“When you first get to Facebook you are shocked at the level of transparency. You are trusted with a lot of stuff you don’t need access to,” said Evans, adding that during his induction he was warned not to look at ex-partners’ Facebook accounts.'
I'm not the original commenter, but I could find it by getting your name from Github, then googling it. Your LinkedIn was the first result, and there was LA.
> It’s pretty hard to imagine those laws coming to the US in our lifetimes with all the corporate interests that would oppose them
...or with the large number of ordinary citizens who would oppose them or be indifferent to them. People here tend to have their privacy/safety balance set quite a bit more toward the "privacy" side than do most people.
Where most people draw the line, I think, is when surveillance is looking into their homes. Being surveilled when they are out and about in public does not bother them much.
Not really, the GDPR is applicable to persons in the EU (not just in Europe) and not to persons using a VPN server in the EU.
Anyway, the GSPR does not ban American-style surveillance in Europe. Most European countries have used the Snowden leaks as a blueprint to increase surveillance in almost every aspect, especially online and with many related obligations for Internet companies.
I’m not sure how other companies will implement it but I certainly expect most to bluntly use geo-IP to locate customers and apply GDPR-compliant practices without digging too much whether that particular customer is likely to lawyer-up. European services probably will blanket apply it to all their customers.
It’s possible (if unlikely) that after a militant based in Europe but geo-IP located elsewhere by accident notices something unsavoury and complaints, that companies implements an “Are you based within the EU?” toggle in account settings to avoid headaches.
For social services, I’m curious on how processes based on your friends’ will be implemented when your friends are partially in the EU and elsewhere. But I don’t expect this will be much harder than it currently is to circumvent, say, Netflix geo-blocks.
Every time this happens, the same people magically transform from saying “What, are you paranoid?” to “What, are you naive?”
The NSA’s surveillance dragnet is a very different situation because they are a government agency, but you could see the same exact phenomenon happened when the Snowden revelations came out.
“Do you really think the government cares enough to log all your phone calls? You must be paranoid.” became “Well, obviously the government does this. How could you not expect this?” in the blink of an eye.
I think both reactions are for psychological comfort. It is that it's comforting if someone else is in charge, in control in the face of chaos, and it's comforting to place trust in those above you and thus happily mock conspiracy theories.
Just be aware that deletion isn't instant though. From the TOS:
>We aim to maintain our services in a manner that protects information from accidental or malicious destruction. Because of this, after you delete information from our services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems.
Replying to cbr/muro - those are emails about specific people that you have allowed to see your location data. The NC police are getting warrants for everyone in an area's location data. It doesn't matter if you've shared it - GPS, cell-tower data is passively collected by Google and then provided en masse to the police when subpoenaed. Nobody receives periodic emails from Google saying "you have your location services turned on [which we will nag the shit out of you about if you don't] and thus Google has a running log of everywhere you go [and if you happen to be in a jurisdiction that wipes it ass with the Fourth Amendment we'll also turn over all the data we've collected to the police]."
You can go into your account settings under Personal Info and Privacy\Manage Your Google Activity and toggle your location history if you want to turn it off, but I've never had them update me via email. Given how much information is in that, I'd be surprised if they prompted anyone to go review it since most folks would likely feel like it's creepy to see a map of everywhere they went.
Subject: You are using Google Location Sharing to share your real-time location.
Hi Jeff,
To protect your privacy, we would like to remind you that you are sharing your real-time location using Google Location Sharing with [wife] and [close friend and housemate].
If you didn't enable this or want to stop sharing your location at any time, please go to your Google Location Sharing settings.
Sounds like this is a reminder that you're sharing your location history. People who just have it on (which means, "just" sharing with Google), do not get these notices.
Law enforcement can triangulate location from a mobile phone signal via your celluar network provider with or without Google's help, and has been able to do so since the very beginning.
"On May 28th, Lisa Marie Roberts, of Portland, Oregon, was released from prison after serving nine and a half years for a murder she didn’t commit. A key piece of overturned evidence was cell-phone records that allegedly put her at the scene."
If it's as accurate and straight forward as law enforcement tell us - how did _that_ happen?
Bingo, knowing the location of each phone at all times is intrinsic to how the cellular network works.
The interesting question here is why law enforcement is going to Google instead of the cellular network providers directly? By definition, they're missing out on data from all non-Android phones.
From the top comment here: The precision is greatest when GPS is on, but less precise data from cell towers and WiFi sources is used almost any time a Google app is being used on an Android or non-Android phone.
I haven't read the original article since the website doesn't work without off-domain scripts running, but I assume that's why - they do have data for iOS users running Google apps, and that data is often higher resolution than cell tower triangulation. I'd also assume they're getting the cell information as well and correlating the two.
Why don't you want the police to be able to find your when there's a crime? What if you're the victim of a kidnapping? Or murder that goes unsolved because Google wouldn't tell them who did it?
The incident rate of kidnappings is so low that it's not anywhere close to ranking in the first volume of "List of Things I Worry About".
The government abusing data it collected on its citizens to silence dissenters, however, is something I've seen on a daily basis. And so, we set priorities.
My main concerns are how such tools may facilitate automated injustice, as well as providing the means for heavy-handed political/intellectual influence and control.
Innocent people are commonly investigated because they were nearby when crimes were committed. Or because they somewhat match a victim's description of the attacker. Or because they're driving a vehicle that somewhat matches a description.
But this is taking it to another level. Here, location and time are the only identifiers. Once you've identified someone who was at the location of the crime when it was committed, they were either a perpetrator or a witness. Or maybe neither, because they weren't close enough in space and time.
But anyway, what happens next? Police hope to get a confession? Maybe some physical evidence. Or witnesses. But then, people often lie. And there's less opportunity for an alibi, except maybe a friend who says he was there with you. But his phone had better agree with yours.
And really, it's hard to imagine that someone doing serious crime would be carrying a smartphone. At least, one that's not turned off, and in a Faraday bag. But then, some criminals are just plain stupid, I guess.
Police can lie with impunity when interrogating and it is all legal and protected mostly. They can get innocent people to plead guilty to all kind of crimes the didn't commit simply by threatening them.
I once used an app to record my location, which I'm sure was in my Google account. It mis-recorded my location to be in the centre of a park in the town I was in the middle of the night, but I was actually at home asleep. Needless to say, it crossed my mind if this data could be used as a false positive in any investigation if they got hold of all people recorded as being in that area.
In addition to all the other, very serious concerns, I'll also ask this:
How long until these records are available for subpoena, e.g. in a divorce case? (Maybe -- hopefully! -- not in area sweeps, but nonetheless, where was the other party and who was in proximity. As I'm writing this, well, maybe they will ask for all connections in proximity, that list then to be whittled down to a list of candidates (per the police's approach in the OP's story)).
When are police going to start sweeping such data up en masse, looking for e.g. parole violations?
When will every "free association" be a tracked association?
> How long until these records are available for subpoena, e.g. in a divorce case?
I see nothing preventing this information being sought in U.S. discovery right now--at least in Federal litigation[0]. That isn't to say that the subpoena won't be squashed by a court for one of the traditional rationales under FRCP 26(b).[1]
>When are police going to start sweeping such data up en masse, looking for e.g. parole violations?
Arguably runs afoul of the particularity requirement of the fourth amendment, although I do not pretend to be an expert on criminal law. That said, I understand the fourth amendment to be a low bar these days.
> When will every "free association" be a tracked association?
Rhetorical question?
[0] Your specific example, divorces, are state law in the US. I don't do that, and the relevant laws / cases can change on a state-by-state basis.
Yes, the last part could be considered rhetorical. Except, I think that is the very real direction some -- including especially some already in authority, in the U.S. as well as around the world -- want to take things.
On the other hand, maybe my question is rhetorical, in that the tracking is already in place.
The use of this information in the hands of the statistically incompetent will lead to miscarriages of justice and disaster. This basically institutionalizes the prosecutor's fallacy.
Much less afraid of false accusation and more concerned with incidental data being used against me later, or being used to build a profile the police can use in some other way.
Is this actually a real problem for normal non-criminal people? Murders happen every day and this would help deter or prevent repeat offenses. But having information about you that's correct, and can't be used in court because it was obtained without the correct warrant, when is that ever a problem? I'm not talking about high profile journalists or terrorist suspects. Just normal people like you.
I live in a continent with a lot of fresh memories about uncomfortable answers to your questions. No need to go as far back as WW II: take a look at https://en.m.wikipedia.org/wiki/Stasi for a painfully contemporary read.
It’s astonishing how quickly we forget. It’s astonishing and painful, to the memories of those whose pain and sacrifice was, in the end, wasted on us :(
We have such an astonishing amount of laws and codes that everybody is guilty of something. And the more data is available on you, the more you enable the government to go on a fishing expedition, should they ever dislike you.
But that's only the selfish motivation.
The wider reason is that mass surveillance can easily be used to silence dissent. And if you think that's far-fetched for the US, I invite you to read up on e.g. COINTELPRO.
That's a slippery-slope argument. Guns can be used to silence dissent. Violence can be used to silence dissent. Targeted facebook ads and social-media emotional warfare can be used to target dissent. Skilled orators can be used to silence dissent. So can political distractions, wars, etc. All of it can and does, so I wouldn't quite call that an effective measure of whether something should exist in our political sphere or not.
Those laws/codes that you mention are there for a reason. We shouldn't be breaking them, is what we're told. If the whole thing was built on the predicate that only a fraction of people would be charged with them, what sort of criteria do you think those lawmakers had in mind as to when to apply that charge? Well, silencing dissent, for one.
But more to the point, either they're valid crimes and we need to do everything that is reasonable and cost-effective to enforce them. Or, we don't really consider them a crime, but we work on some funky as yet-undefined honor system about when to apply those laws. I.e. Let's use them to stick it to the bad-guy™. Usually, it's at the whim of whoever is deciding on whether to charge someone.
You are absolutely right that government can use these laws against you if they dislike you. But they can do that with a whole host of other things that we consider pretty benign. Being a white minority and a foreigner in an majority black country, I am constantly singled-out and harassed and at the whims of whatever government official I interact with. Usually police, but desk-clerks and the like also have their fair share of it. Government, and their agents can ruin your life on whim, even with existing non-surveillance-like laws.
We need to get past the point where vagueness and subjective criteria are used to enforce whatever laws we deem as a society to want to have. The vagueness and subjectiveness is the problem, not the laws.
It's not a slippery slope if the government already does it, no?
And mass surveillance can be used to silence on a large scale - that's the whole point of objecting to it. It's not about you. Or me. It's about the effect on society as a whole
You don't have to be using Maps or an app that obviously uses location for Google to be collecting location related information. I have no idea when they do or don't but I'd bet people would be surprised if they found that the gmail app was relaying their location to Google. On the other hand few wouuld be surprised at all if you told them the maps app was sending their location.
If you have all location services turned on then your phone tracks your location constantly in real time. Go to My Timeline on Google Maps and it can show you a full map of everywhere you went on any particular day.
No, only if you allow to track you even when you’re not using it.
Unless you are speaking about android and in that case it may well be like this, no idea honestly.
Most people have Android, it has an 85% global market share. And yes, this is how Android works. Play Services, which includes "Google Location Services" is preinstalled on essentially every phone that isn't an iPhone, and runs in the background by default. Doesn't matter if you have any apps open or not, Google's collecting location unless you explicitly go in and shut it off.
> No, only if you allow to track you even when you’re not using it.
I possibly wasn't clear enough. That's what I meant when I wrote "If you have all location services turned on". Location tracking is part of location services.
1. Google stores location history data for more of its mobile users than you might expect. The precision is greatest when GPS is on, but less precise data from cell towers and WiFi sources is used almost any time a Google app is being used on an Android or non-Android phone. There have been cases in the past where Google has recorded such information even when the user has explicitly turned off all location services, but Google says they have stopped this practice.
2. On multiple recent occasions, police in North Carolina have quietly been successful in obtaining search warrants that force Google to turn over these records. Rather than "standard" search warrants asking for the location of a particular suspect in a crime, these "reverse" or "area based" warrants ask for time and location data for all users who have entered a geographical area during a time of interest. The records returned are initially anonymous account numbers, and the police then make followup requests for identifying information of the subset of accounts that they think are of interest to the case.
3. This open-ended "drag net" approach scares some people. Typically, at least in the US, suspects are identified first, and then further information is gathered that confirms or removes the suspicion. The express fear seems to be that innocent people will be falsely accused due to coincidence, but there is also a more general fear that once mechanisms are in place that allow the police to have easy access to location tracking information, this information will end up being abused.