Abstract
Thisarticleaimstoraiseawarenessofarapidlyemerging privacythreatthatweterm cybercasing:usinggeo-taggedinformationavailableonlinetomountreal-worldattacks.While userstypicallyrealizethatsharinglocationshassomeimplicationsfortheirprivacy,weprovideevidencethatmany (i) are unawareofthefullscopeofthethreattheyfacewhendoing so,and (ii) oftendonotevenrealize when theypublishsuch information.Thethreatiselevatedbyrecentdevelopments thatmakesystematicsearchforspecificgeo-locateddataand inferencefrommultiplesourceseasierthaneverbefore.In thispaper,wesummarizethestateofgeo-tagging;estimate the amountofgeo-informationavailableonseveralmajorsites,includingYouTube,Twitter,andCraigslist;andexamineitsprogrammaticaccessibilitythroughpublicAPIs.Wethenpresent asetofscenariosdemonstratinghoweasyitistocorrelategeotaggeddatawithcorrespondingpublicly-availableinformation forcompromisingavictim’sprivacy.Wewere,e.g.,abletofind privateaddressesofcelebritiesaswellastheoriginsofotherwiseanonymizedCraigslistpostings.Wearguethatthesecurityandprivacycommunityneedstoshapethefurtherdevelopmentofgeo-locationtechnologyforbetterprotectingusers fromsuchconsequences.
1Introduction
Location-basedservicesarerapidlygainingtractionin theonlineworld.WithbigplayerssuchasGoogleand Yahoo!alreadyheavilyinvestedinthespace,itisnot surprisingthatGPSandWIFItriangulationarebecomingstandardfunctionalityformobiledevices:starting withApple’siPhone,allthemajorsmartphonemakers arenowofferingmodelsallowinginstantaneouslyupload of geo-tagged photos,videos,andeventextmessagesto sitessuchasFlickr,YouTube,andTwitter.Likewise,numerousstart-upsarebasingtheirbusinessmodelsonthe expectationthatuserswillinstallapplicationsontheir mobiledevicescontinuouslyreportingtheircurrentlocationtocompanyservers.
Clearly,manyusersrealizethatsharinglocationinformationhasimplicationsfortheirprivacy,andthusdevicemakersandonlineservicestypicallyofferdifferent levelsofprotectionforcontrollingwhether,andsometimeswithwhom,onewantstosharethisknowledge.
Siteslike pleaserobme.com (see § 2)havestartedcampaignstoraisetheawarenessofprivacyissuescaused byintentionallypublishinglocationdata.Often,however,usersdonoteven realize thattheirfilescontainlocationinformation.Forexample,Apple’siPhone3Gembedshigh-precisiongeo-coordinateswithallphotosand videostakenwiththeinternalcameraunlessexplicitly switchedoffintheglobalsettings.Theiraccuracyeven exceedsthatofGPSasthedevicedeterminesitsposition incombinationwithcell-towertriangulation.Itthusregularlyreachesresolutionsof+/-1mingoodconditions andevenindoorsitoftenhaspostal-addressaccuracy.
Morecrucial,however,istorealizethatpublishing geo-location(knowinglyornot)isonly one partofthe problem.Thethreatiselevatedtoanewlevelbythe combination ofthreerelatedrecentdevelopments: (i) the sheeramountofimagesandvideosonlinethatmakeeven asmallrelativepercentageoflocationdatasufficientfor mountingsystematicprivacyattacks; (ii) theavailability oflarge-scaleeasy-to-use location-basedsearch capabilities,enablingeveryonetosiftthroughlargevolumesof geo-taggeddatawithoutmucheffort;and (iii) theavailabilityofsomany other location-basedservicesandannotatedmaps,includingGoogle’sStreetView,allowingcorrelationoffindingsacrossdiverseindependent sources.
Inthisarticle,wepresentseveralscenariosdemonstratingthesurprisingpowerofcombiningpublicly availablegeo-informationresourcesforwhatweterm cybercasing:usingonlinetoolstocheckoutdetails,make inferencesfromrelateddata,andspeculateaboutalocationintherealworldforquestionablepurposes.The primaryobjectiveofthispaperistoraiseourcommunity’sawarenessastothescopeoftheproblematatime whenwestillhaveanopportunitytoshapefurtherdevelopment.Whilegeo-taggingclearlyhasthepotential forenablinganewgenerationofhighlyusefulpersonalizedservices,wedeemitcrucialtodiscussanappropriatetrade-offbetweenthebenefitsthatlocation-awareness offersandtheprotectionofeverybody’sprivacy.
Westructureourdiscussionasfollows.Webegin withbrieflyreviewinggeo-locationtechnologyandrelatedworkin § 2.In § 3weexaminethedegreetowhich
wealreadyfindgeo-taggeddata“inthewild”.In § 4we demonstratetheprivacyimplicationsofcombininggeotagswithotherservicesusingasetofexamplecybercasingscenarios.Wediscusspreliminarythoughtsonmitigatingprivacyimplicationsin § 5andconcludein § 6.
2Geo-TaggingToday
Webeginourdiscussionwithanoverviewofgeotagging’stechnologicalbackground,alongwithrelated workinlocationalprivacy.
Geo-locationServices.Anextensiveandrapidly growingsetofonlineservicesiscollecting,providing, andanalyzinggeo-information.Besidesthemajorplayers,therearemanysmallerstart-upsinthespaceaswell. Foursquare,forexample,encouragesitsuserstoconstantly“check-in”theircurrentposition,whichtheythen propagateontofriends;Yowza!!providesaniPhoneapplicationthatautomaticallylocatesdiscountcouponsfor storesintheuser’scurrentgeographicalarea;andSimpleGeoaimsatbeingaone-stopaggregatorforlocation data,makingitparticularlyeasyforotherstofindand combineinformationfromdifferentsources.
Inaparalleldevelopment,agrowingnumberofsites nowprovidepublicAPIsforstructuredaccesstotheir content,andmanyofthesealreadycomewithgeolocationfunctionality.Flickr,YouTube,andTwitterall allowqueriesforresultsoriginatingatacertainlocation Manythird-partiesprovideservicesontopoftheseAPIs. PicFog,forexample,providesreal-timelocation-based searchofimagespostedonTwitter.SuchAPIshavealso alreadybeenusedforresearchpurposes,inparticularfor automatedcontentanalysissuchasworkbyCrandallet al.[2],whocrawledFlickrforautomaticallyidentifying landmarks.
LocationalPrivacy.Location-basedservicestake differentapproachestoprivacy.Whileitiscommonto provideuserswithachoiceofprivacysettings,thesetof optionsaswellastheirdefaultstendtodiffer.YouTube, forexample,usesgeo-informationfromuploadedvideos perdefault,whileFlickrrequiresexplicitopt-in.Likewise,defaultsdifferacrossdevices:Apple’siPhonegeotagsallphotos/videostakenwiththeinternalcameraunlessspecificallydisabled;withAndroid-basedphones, theuserneedstoturnthatfunctionalityon.
Theprivacyimplicationsofrecordinglocationshave seenattentionparticularlyintheblogosphere.However, thesediscussionsaremostlyanecdotalandrarelyconsiderhowtheeaseofsearchingandcorrelatinginformationelevatestherisk.Fromamoregeneralperspective,theEFFpublishedathoughtfulwhite-paperon LocationalPrivacy [3],discussingimplicationsofsecretly recordingpeoples’activityinpublicspaces.
Pleaserobme.com [9]wasprobablythefirsteffortthatdemonstratedthemaliciouspotentialofsys-
tematiclocation-basedsearch:theauthorsleveraged Foursquare’s“check-ins”toidentifyuserswhoarecurrentlynotattheirhomes.However,inthiscaselocationsweredeliberatelyprovidedbythepotentialvictims, ratherthanbeingimplicitlyattachedtofilestheyupload. Also,geo-taggingisahazardtoamuchwideraudience, asevenpeoplewhoconsciouslyopt-outofreportingany informationmightstillseetheirlocationbecomepublic throughathirdpartypublishingphotosorvideos,e.g., fromaprivateparty.BesmerandLipford[1]examinea relatedriskinthecontextofsocialnetworksthatallow userstoaddidentifyingtagstophotospublishedontheir profilepages.Theauthorsconductauserstudythatrevealsconcernsaboutbeinginvoluntarilytaggedonphotosoutsideofauser’sowncontrol.Theyalsopresenta toolfornegotiatingphotosharingpermissions.
Tomitigatetheprivacyimplications,researchers havestartedtoapplyprivacy-preservingapproaches fromthecryptographiccommunitytogeo-information. Zhongetal.[4]presentprotocolsforsecurelylearning afriend’spositionifandonlyifthatpersonisactually nearby,andwithoutanyserviceproviderneedingtobe awareoftheusers’locations.Olumofinetal.[7]discuss atechniquethatallowsausertoretrievepoint-of-interest informationfromadatabaseserverwithoutneedingto disclosetheexactlocation.Poolsappasitetal.[8]present asystemforlocation-basedservicesthatallowsspecificationandenforcementofspecificprivacypreferences. Fromadifferentperspective,Krumm[5]offersasurvey ofwaysthatcomputationcanbeusedtobothprotectand compromisegeometricallocationdata.
GPSandWIFITriangulation.Currently,itismostly high-endcamerasthateithercomewithGPSfunctionalityorallowseparateGPSreceiverstobeinsertedinto theirFlashconnectorortheso-called“hotshoe”.Likewise,itismostlythehigh-endsmartphonestodaythat haveGPSbuiltin,includingtheiPhone,Android-based devices,andthenewerNokiaN-series.Analternative (oradditional)methodfordeterminingthecurrentlocationisWIFIaccesspointorcell-towertriangulation: correlatingsignalstrengthswithknownlocationsallows auserorservicetocomputeadevice’scoordinateswith highprecision,aswedemonstratein § 4.Ifadevice doesnotdirectlygeo-tagmediaitself,suchinformation canalsobeaddedinpost-processing,eitherbycorrelatingrecordedtimestampswithacorrespondinglogfrom ahand-heldGPSreceiver;ormanuallyusingamapor mappingsoftware.
Metadata.Forourdiscussion,weareprimarilyconcernedwith geo-tagging,i.e.,theprocessofaddinglocationinformationtodocumentslateruploadedonline. Themainmotivationforgeo-taggingisthepersonalized organizingandsearchingthatitenables.Forexample, byincludingcurrentlocationandtimewithaseriesof vacationphotos,itbecomeseasytolatergroupthemau-
tomatically,aswellastofindfurtherphotosonlinefrom otherswhovisitedthesameplace.
Themostcommonmechanismforassociatinglocationswithphotosare EXIF records,whichwereoriginallyintroducedbytheJapanElectronicIndustryDevelopmentAssociationforattachingmetadatatoimages suchasexposuretimeandcolorspace.SincethenEXIF hasbeenextendedtoalsocovergeographicalcoordinates intheformoflatitudeandlongitude.Currently,EXIFis usedonlywithJPEGandTIFFimagefilesandWAVaudiofiles.However,mostothermultimediaformatscan containmetadataaswell,oftenincludinggeo-tags.For videos,proprietary“makernotes”arethemostcommon formforstoringlocations.Alltheseformatsareeasy toparsewiththehelpofstandardtoolsandlibraries,includingbrowserpluginsforrevealingmetadataaswellas Apple’s Preview programthatoffersaconvenient Locate buttonforgeo-tagstakingonedirectlytoGoogleMaps.
Ingeneral,metadatacanposeaprivacyriskbystoring unexpectedinformationnotimmediatelyapparentwhen openingadocument.MurdochandDornseif[6]demonstratedthateditingsoftwaremayleavethumbnailsofthe originalimagebehindinEXIFdata,andsimilarproblemshavebeenfoundwithotherformats,suchasWord andPDFdocuments.
Itturnsout,however,thatmanyautomaticimagemanipulationtools—especiallythoseusedincontentmanagementsystems—“accidentally”discardmetadataduringprocessing.Forthatreason,wefindthatimageson manyofthelargerWebsitesdo not haveanymetadata attached.Aswediscussin § 4,wedidhoweverfindEXIF data(andthusalsolocations)onprivatehomepagesand blogsaswellasonsitessuchasCraigslistandTwitPic.
3PrevalenceofGeo-TaggedData
Inthissectionanumberofexperimentsarepresentedthat aimatunderstandingtowhatdegreeimageandvideo dataisgeo-taggedtoday.
Flickr.Flickrhascomprehensivelyintegratedgeolocationintoitsinfrastructureanditprovidesapowerful APIforlocalizedqueries.ThisAPIallowsdirectqueries onthenumberofimagesthatare,orarenot,geo-tagged withinacertaintimeinterval.Examiningall158millionimagesuploadedinthefirstfourmonthsof2010, wefoundthatabout4.3%aregeo-tagged.Whenlooking atthedevelopmentoverpastyears,wesee—somewhat counter-intuitively—adecliningtrend:whiletherewas steepincreaseingeo-taggingfrom2004toabouttheend of2006(whenitpeakedat9.3%),itssharehasbeendecliningtothecurrentlevelsincethen.Wespeculatethat Flickr’sopt-inprivacypolicyisthereasonforthisdevelopment:asmoreusersarejoiningFlickr,thenumberof thoseexplicitlyenablingEXIFimportislikelyshrinking, andthusthenumberofimagesnotgeo-taggedisrising
muchmorequicklythanthosethatdo.Thiswouldthen indicatethatsuchanopt-inpolicyisindeedsuitableto containtheamountofgeo-tagging.
Wealsoexaminedthebrandsofcamerasusedfor takingthephotosthathavegeo-information,derived fromtheirEXIFrecordswhichcanberetrievedvia Flickr’sAPIaswell.Doingsohoweverrequiresone APIrequestperimage,andhenceweresortedtorandomlysamplinga5%setofallgeo-taggedimagesuploadedin2010.Wefoundthatthetop-fivebrandswere Canon(31%),Nikon(20%),Apple(6%),Sony(6%), andPanasonic(5%).Acloserlookattheindividualmodelsconfirmsourobservationin § 2thattodayitismostly devicesatthehigherendofthepricescalethataregeotagging.
YouTube.LikeFlickr,YouTubealsoallowsqueries restrictedtospecificlocations.WithYouTubehowever, duetorestrictionsofitsAPI,itisnotpossibletodirectlydeterminethenumberofgeo-taggedvideos,aswe canwithFlickr.YouTuberestrictsthemaximumnumberofresponsesperqueryto1,000;andwhileitalso returnsan(estimated)numberoftotalresults,thatfigureisalsocappedat1,000,000.Still,webelievewecan estimatetheshareofgeo-taggedvideosinthefollowingway:Wefirstsubmittedanumberofdifferentunconstrainedqueriesthateachyieldedasetof1,000,000 results.Wethenrefinedthesequeriesbyaddinganadditionalfiltertoincludeonlyvideosthathadgeo-location. Wefoundthatthesizesoftheremainingresultsetsrange fromabout30,000to33,000videos.Inotherwords,out ofwhatweassumetobearandomsampleof1,000,000 YouTubevideos,roughly3%havegeo-location.While thisnumberisclearlyanestimate,itmatcheswithwhat wederivedforFlickr. 1
Craigslist.ThevirtualfleamarketCraigslistallows userstoincludephotoswiththeirpostingsbyeitheruploadingthemdirectlytothecompany’sservers,orbyinsertingexternalHTML IMG links.Intheformercase, imagesarerecodedandstrippedofftheirmetadata.Inthe lattercase,however,suchalinkcanpointtotheoriginal imageastakenbytheposter’scameraandthusmaystill haveitsEXIFrecordsintact.Toestimatethenumberof geo-taggedphotoslinkedtofromCraigslistpostings,we examinedallpostingstotheSanFransciscoBayArea’s ForSale sectionoveraperiodoffourdays(includinga weekend).WhileCraigslistdoesnotprovideadedicated queryAPI,itoffersRSSfeedsthatincludethepostings’ fullcontent.Consequently,duringourmeasurementinterval,wequeriedasuitablycustomizedRSSfeedevery 10minutesforthemostrecent500postingshavingimages,eachtimedownloadingalllinkedJPEGsthatwe hadnotyetseen.Intotal,wecollected68,729images,
1YouTube’sAPIdistinguishesbetweenvideos without location, with coarse location(usuallymanuallyadded,e.g.“Berlin”),andwith exact location.Forourexperiments,weonlyconsideredthelatter.
#Model #Model
414iPhone3G 6CanonPowerShotSD780
287iPhone3GS 3MB200
98iPhone 2LGLOTUS
32Droid 2HERO200
26SGH-T929 2BlackBerry9530
20NexusOne 1RAPH800
9SPH-M900 1N96
9RDC-i700 1DMC-ZS7
6T-MobileG1 1BlackBerry9630
Table1: Devicesgeo-taggingphotosfoundonCraigslist ofwhichabout48%hadEXIFinformation.914images weretaggedwithGPScoordinates,i.e.,about1.3%of thetotal.Wepresumethatthisnumberislowerthanwhat wefoundforFlickrandYouTubebecausemanyphotos onCraigslistareeditedbeforeposting.Still,alreadywith acursorylookwefoundseveralcaseswherepreciselocationshadthepotentialtocompromiseprivacy,aswe discussin § 4.Wealsoexaminedthecameramodelsused totakethegeo-taggedCraigslistphotos(Table1).While theiPhonemodelsareclearlyaheadofallothermodels, itisinterestingtoseeawiderangeofotherdevices.
4CybercasingScenarios
Inthissectionwetaketheperspectiveofapotentialattackertoinvestigateexamplesof cybercasing.Wefocusonfourdifferentscenarios:oneonCraigslist,oneon Twitter,andtwoonYouTube.Tonotfurtherharmthe privacyofthepersonsinvolvedinourexperiments,we refrainfromdescribingidentifyingspecifics.
Craigslist.Inourfirstscenario,wemanuallyinspectedarandomsampleofCraigslistpostingscontaininggeo-locatedimages,collectedasdescribedin § 3. Onetypicalsituationwefoundwasacarbeingoffered forsalewithimagesshowingitparkedinaprivateparkingspace.Mostofthetimeitwasstraight-forwardforus toverifyaphoto’sgeo-locationbycomparingtheimage withwhatwesawonGoogleStreetView.
Afairnumberofpostingswithgeo-locatedimages alsoofferedotherhigh-valuedgoods,suchasdiamonds, obviouslyphotographedathome,makingthempotential targetsforburglars.Inaddition,manyofferedspecifics aboutwhenandhowtheownerwantstobecontacted (“pleasecallSundayafter3pm”),enablingspeculation aboutwhensomebodymightnotbeathome.Sincemany postingspublishedmorethanoneimage,andsomelocationsweretheoriginofmorethanoneoffer,amoreaccurateestimationofthepostaladdresswouldhavebeen possiblethroughaveragingthegeo-tags.
Whilewedidnotfurtherverifyaddresses,weset upanexperimenttoassessGPSaccuracyinatypical Craigslistsetting:Wefirstphotographedabikeinfront ofagaragewithaniPhone3G,asifwewantedtooffer
itforsale(seeFigure1).Whenwethenenteredthegeocoordinatesthatthephoneembeddedintothepictureinto StreetView,Googlewasabletolocatethephoto’spositionwithin +/ 1 m.Suchaccuracyismuchhigherthan whatwebelievemostpeoplewouldexpect.
AmongtheCraigslistpostingswithgeo-information wealsofoundasignificantnumberwheretheposter chosetonotspecifyahomeaddress,phonenumber, ore-mailaccountandoptedforCraigslist’sanonymous emailingoption.Wetakethisasanindicationthatmany posterswerenotawarethattheirimagesweregeo-tagged andthusleakedtheirlocationinformation.
Wenotethatwhileweonlyperformedexperiments withCraigslist’s“ForSale”category,itisnothard toimaginewhatconsequencesunintendedgeo-tagging mighthavein“Personals”or“AdultServices”.
Twitter.Blogginghasbecomeacommontoolfor celebritiestoprovidetheirfanswithupdatesontheir lives,andmostofsuchblogscontainimages.Likewise, manycelebritiesnowalsousepublicTwitterfeedsthat, besidespotentiallybeinggeo-taggedthemselves,may alsolinktoexternalimagestheytook.Oursecondscenariothereforeinvolvedtrackingapopularreality-TV hostwhoisveryactiveonTwitter.HisshowisbroadcastonUSnationaltelevisionandhasbeenexportedinto variousforeigncountries.Inrecentepisodes,thechannelevenbeganadvertisingthatthehostismaintaininga Twitterfeed.Itturnsoutthatmostimagespostedtothat feed—includingphotostakenatthehost’sstudio,places wherehewalkshisdog,andofhishome—weretaken withaniPhone3GSandarehostedon TwitPic,which conservesEXIFdata.Inaddition,wenoticedthatthe hostisalsocommonlytweetingwhileheistravelingor meetingotherwell-knownpeopleawayfromhome.UsingtheFirefoxplug-in ExifViewer,aright-clickonany oftheTwitterimagessufficestorevealtheselocations usinganInternetmapserviceofone’schoice.Again,averaginggeo-tagsfrommultipleimagestakenatthesame locationwouldincreaseaccuracyfurther.
Geo-locationcanalsobeexploitedfortakingtheoppositeroute:findingacelebrity’s non-advertisedTwitterfeedintendedonlyforprivatepurposes(e.g.,forexchangingmessageswiththeirpersonalfriends2).Doing sobecomespossiblewithsitessuchas Picfog,whichallowsanybodytosearchallimagesappearingonTwitterbykeywordandgeo-locationinreal-time.Havingaroughideaofwhereapersonlivesthusallowsa usertotailorqueriesaccordinglyuntiltherightphoto showsup.Asanexperiment,wesucceededinfindinga non-advertisedbutpublicly-accessibleTwitter-feedofa celebritywitharesidenceinBeverlyHills,CA.
YouTube.Inourfinalsetup,weexaminedwhether onecansemi-automaticallyidentifythehomeaddresses ofpeoplewhonormallyliveinacertainareabutarecurrentlyonvacation.Suchknowledgeoffersopportunities
2Bydefault,Tweetsarepublicanddonotrequireauthentication.
Figure1: PhotoofabiketakenwithaniPhone3GandacorrespondingGoogleStreetViewimagebasedonthestoredgeocoordinates.Theaccuracyofthecameralocation(marked)infrontofthegarageisabout +/ 1 m.Manyclassifiedadvertisements comewithphotosofobjectsofferedforsale,withgeo-tagsautomaticallyadded.
forburglarstobreakintotheirunoccupiedhomes.We wroteascriptusingtheYouTubeAPIthat,givenahome location,aradius,andakeyword,findsasetofmatching videos.Forallthevideosfound,thescriptthengatherstheassociatedYouTubeusernamesanddownloads allvideosthatareacertain vacationdistance awayand havebeenuploadedthesameweek.
Inourfirstexperiment,wesetthehomelocationtobe inBerkeley,CA,downtownandtheradiusto60miles. Asthekeywordtosearchforwepicked“kids”since manypeoplepublishhomevideosoftheirchildren.The vacationdistancewas1000miles.Ourscriptreported 1000hits(themaximumnumber)fortheinitialsetof videosmatching“kids”.Thesethenexpandedtoabout 50,000totalvideosinthesecondstep,identifyingall othervideosfromthecorrespondingusers.106ofthese turnedouttohavebeentakenmorethan1000milesaway anduploadedthesameweek.Siftingquicklythrough thetitlesofthesevideos,wefoundaboutadozenthat lookedpromisingforsuccessfulcybercasing.Examiningonlyoneofthemmorecarefully,wealreadyhada hit:avideouploadedbyauserwhowascurrentlytravelingintheCaribbean,ascouldclearlybeseenbycontent, geo-tagging,andthedatedisplayedinthevideo(oneday beforeoursearch).Thetitleofthevideowassimilarto “firstdayonthebeach”.Also,commentspostedalong withthevideoonYouTubeindicatedthattheuserhad postedmultiplevacationvideosandisusuallytimelyin doingso.Whenheisnotonvacation,heseemedto livewithhiskidsnearAlbany,CA(closetoBerkeley) asseveralvideoswerepostedfromhishome,withthe kidsplaying.Althoughthegeo-locationofeachofthe videoscouldnotbepinpointedtoasinglehousedueto GPSinaccuraciesindoors,theuserhadpostedhisreal nameintheYouTubeprofile,whichwouldlikelymakeit easytofindtheexactlocationusingsocialengineering. Wealsoperformedasecondsearchwiththesameparameters,exceptforthekeywordwhichwenowsetto
“home”.Thistime,wefoundapersonwhoseemedto havemovedoutofthecity.Whilemanyofthatperson’s videoshadbeengeo-taggedwithcoordinatesataspecific addressinSanFrancisco,themostrecentvideowasata placeinNewJerseyforwhichGoogleMapsoffereda real-estateadincludingapriceof$399,999.Theperson hadspecifiedageandrealnameinhisYouTubeentry. Finally,wenotethatusingour204-linePythonscriptwe wereabletogatherallthedataforthesetwoexperiments withinabout15minuteseach.
5ImprovingLocationalPrivacy
Educatingusersaboutitsmisusepotentialisclearlykey toavoidwide-spreadmisuseoflocationinformation. However,itisourexperiencethatcurrently,evenmany tech-savvyusersfinditdifficulttoaccuratelyassessthe risktheyface.Wethusbelievethatthesecurityandprivacycommunityneedstotakeamoreactiveroleinshapingthedeploymentofthisrapidlyemergingtechnology. Wedeemitcrucialtoensurethatusers (i) areputinto apositionwheretheycanmakeinformeddecisions;and (ii) aresufficientlyprotectedunlesstheyexplicitlyopt-in topotentiallyriskyexposure.Inthefollowing,weframe preliminarysuggestionstowardsthisend.
Onagenerallevel,weencourageourcommunityto aimforaconsensusonwhatconstitutesanacceptable privacypolicyforlocation-basedservices.Currentapproachesdifferwidelyacrossdevicesandservices,and webelievethatestablishingaunifiedstrategyacross providerswouldgoalongwaytowardsavoidinguser confusionandthusunnecessaryexposure.Morespecifically,webelievethataglobalopt-outapproachtosharinghighaccuracylocation-informationisalmostalways inappropriate.Rather,usersshouldneedtoacknowledgeusageatleastonaper-applicationbasis.Apple’s iPhone3Gtakesastepintotherightdirectionbyre-
Figure2: Ourmockupofamobile-phonedialogtogiveusers morecontroloverthegeo-locationembeddedintheirphotos.
questingpermissioneachtimeanewapplicationwants toaccesstheGPSsensor.However,itsuserinterface stillhastwoshort-comings: (i) itdoesnotapplythatpolicytophotos/videostakenwiththeinternalcamera;and (ii) foreachapplication,itisanall-or-nothingdecision. Regardingthelatter,itseemsthatoftensimplyreducing alocation’sresolutionmightalreadybeasuitabletradeoff.Asanexperimentonhowsuchanapproachcouldbe supported,Figure2showsamockupwedidforextendingtheiPhone’sstandardpermissiondialogwithaslider allowingtochooseanacceptableresolutionforeachapplicationinintuitiveterms.Accordingtothechoice,the devicewouldthenstripoffacorrespondingnumberof theleast-significantdigitsofanycoordinates.Notonly wouldthisgiveusersmorecontrol,butitwouldalsoexplicitlypointoutthathouse-levelaccuracyisinthecards. Forjail-brokeniPhones,therearealready3rd-partytools availablethatspoofthelocationinformationvisibleto otherapplications.
Analternativeapproachisenforcingprivacypolicies atthetimewhenfilesareuploadedtopublicrepositories,ratherthanwhentheyarecaptured/recorded.For example,abrowsercouldprovidetheuserwithadialog similartoouriPhonemockupwhensheisabouttosend videostoYouTube.Thebrowserwouldthenadaptany geotagsaccordingtotheuser’schoicebeforeproceeding.
ItisalsostimulatingtothinkabouthowAPIssuchas thoseofferedbyFlickrandYouTubecanofferahigher levelofprivacywithoutrestrictinggeo-technologyin itscapabilities.Onewaywouldbefor them toreducetheresolution;thathoweverwouldlimitsomeservicessignificantly.Conceptuallymoreinterestingisto leverageapproachesfromrelatedfieldssuchasprivacypreservingdatamining.Asdiscussed § 2,researchers havestartedtoexaminesuchapproaches,yetweare notawareofanyreal-worldAPIthatincorporatesthese ideas.
6FinalRemarks
Thisarticlemakesacasefortheemergingprivacyissue causedbywide-spreadadaptationoflocation-enabled
photoandvideocapturingdevices,allowingpotentialattackerstoeasily“caseoutjoints”incyberspace.Several factorsaggravatetheproblem.First,manypeopleare eitherunawareofthefactthatphotosandvideostaken withtheircellphonescontaingeo-location,especially withsuchaccuracy;orwhatconsequencespublishingthe informationmayhave.Second,evenexpertsoftenfail toappreciatetheeasysearchcapabilitiesoftoday’sonlineAPIsandtheresultinginferencepossibilities.Third, thefactthatonlyasmallpercentageofalldataiscurrentlygeo-taggedmustnotmisleadusintoignoringthe problembecause (i) withallthecommercialpressure,the numberseemspoisedtorise;and (ii) ourpreliminaryexperimentsdemonstratethatevenaseeminglysmallfractionlike1%canalreadytranslateintoseveralhundred relevantcaseswithinonlyasmallgeographicalarea.
Finally,wewanttoemphasizethatwearenotadvocatingavoidingtheuseofgeo-locationingeneralor geo-taggingspecifically.Itisawonderfultechnology thatdrivesinnovationinmanyareas.However,wefeel thereisaclearneedforeducation,aswellasforresearch ondesigningsystemstobelocation-awarewhileatthe sametimeofferingmaximumprotectionagainstprivacy infringement.
Acknowledgments WewouldliketothankGregorMaierand NicholasWeaverfordiscussionsandfeedback,theanonymous reviewersforvaluablesuggestions,andMichaelEllsworth for Englishcorrections.ThisworkwassupportedinpartbyNSF AwardCNS-0831779andbyNGANURI#HM11582-10-10008.Opinions,findings,andconclusionsorrecommendations arethoseoftheauthorsanddonotnecessarilyreflecttheviews ofthesupporters.
References
[1]AndrewBesmerandHeatherRichterLipford.MovingBeyond Untagging:PhotoPrivacyinaTaggedWorld.In Proc.InternationalConferenceonHumanfactorsinComputingSystems,2010.
[2]DavidCrandall,LarsBackstrom,DanHuttenlocher,andJon Kleinberg.MappingtheWorldsPhotosMappingtheWorldsPhotos.In Proc.WorldWideWebConference,2009.
[3]EFF.OnLocationalPrivacy,andHowtoAvoidLosingitForever. http://www.eff.org/wp/locational-privacy
[4]IanGoldbergGeZhongandUrsHengartner.Louis,Lesterand Pierre:ThreeProtocolsforLocationPrivacy.In Proc.Privacy EnhancingTechnologiesSymposium,2007.
[5]JohnKrumm.ASurveyofComputationalLocationPrivacy. PersonalandUbiquitousComputing,13(6):391–399,2009.
[6]StevenJ.MurdochandMaximillianDornseif.FarMore ThanYouEverWantedToTellHiddenDatainInternet. http://md.hudora.de/presentations/forensics/ HiddenData-21c3.pdf
[7]FemiOlumofin,PiotrK.Tysowski,IanGoldberg,andUrsHengartner.AchievingEfficientQueryPrivacyforLocationBased Services.In Proc.PrivacyEnhancingTechnologies,2010.
[8]NayotPoolsappasitandIndrakshiRay.TowardsAchievingPersonalizedPrivacyforLocation-BasedServices. Transactionson DataPrivacy,2(1):77–99,2009.
[9]PleaseRobMe-RaisingAwarenessAboutOver-sharing. http://pleaserobme.com