Apple Raises Hackles With iPhone Tracking

The news this week that Apple's iPhones and 3G iPads are storing user data and tracking owners' movements has prompted US lawmakers (including Mr. Satellite dish-head himself, Al Franken) to look into the issue, following the above presentation by data scientists and security experts Pete Warden and Alasdair Allan.

The file they discovered, "consolidated.db," includes longitude and latitude data, records the phone's coordinates with a timestamp, and triangulates the user's location via cell-towers.

Cellphones tracking users' location is not new — New York Times tech reviewer David Pogue's reaction was "so what?" — but users, already wary of privacy, likely assumed that their data was private, even from the maker of their mobile device.

Warden and Allan created an iPhone tracker app to visualize what that data capture looks like and the implications. The user's whereabouts would be available to anyone with access to your phone or back-up files, which Apple's iOS 4 equates to hundreds of thousands of tracked and stored data points.

The kerfuffle isn't that the iPhone offers location data — that's one of the advertised features of the device, after all; it's that it's being stored in an unencrypted file, and Apple (the only one doing this so far) isn't proactively informing customers what they're doing, or how it works. Google's Latitude, in comparison, tracks location on an opt-in basis.

"There are numerous ways in which this information could be abused by criminals and bad actors," Franken's letter to Apple states. "Furthermore, there is no indication that this file is any different for underage iPhone or iPad users, meaning that the millions of children and teenagers who use iPhone or iPad devices also risk having their location collected and compromised."

The inherent opportunities for location-based features and targeted mobile advertising are amplified to the nth degree, and you have to dig into Apple’s iTunes terms of use to get their version of what they're up to:

"We may (italics ours) collect information such as occupation, language, zip code, area code, unique device identifier, location, and the time zone where an Apple product is used so that we can better understand customer behaviour and improve our products, services, and advertising."  

"I think there are some legitimate privacy concerns and people will probably look for a way of obscuring that data," says tech security expert Graham Cluley to the BBC. "But it is an object lesson about reading the terms and conditions."

Simon Davies, director of the pressure group Privacy International commented to The Guardian, "This is a worrying discovery. Location is one of the most sensitive elements in anyone's life – just think where people go in the evening. The existence of that data creates a real threat to privacy. The absence of notice to users or any control option can only stem from an ignorance about privacy at the design stage."

Cluley also told the Guardian, "If the data isn't required for anything, then it shouldn't store the location… And it doesn't need to keep an archive on your machine of where you've been,” but, "I tend to subscribe to cockup rather than conspiracy on things like this – I don't think Apple is really trying to monitor where users are."

Location tracking, of course, would be a boon to (for instance) police track missing individuals, but it also worries people not wanting to be tracked, ever, without their permission. Either way, the argument goes, buyers of their mobile devices deserve to be clearly informed.

Other observers feel that the whole thing may be a "mistake," and that Apple isn't intentionally storing data that records its customers' movements. Apple (so far) isn't saying.