Based on materials from Quartz
Many people are aware that smartphones track their location. But what if you are worried about this and deliberately turn off geolocation services, do not use the appropriate applications, and do not even insert the operator's SIM card at all?
Quartz's investigation revealed that even if you follow all of these precautions, the phones at Android collect your location information and send it to Google when you connect to the Internet.
Since the beginning of 2017, phones on Android began to collect information about the addresses of nearby mobile towers, even when geolocation services were disabled, and send this data to Google. As a result, Google has access to data on the location of individual users and their movements. And that goes far beyond what the average user thinks about a normal level of privacy.
Quartz reviewed the data collection issue and contacted Google, which confirmed the existence of such a practice.
The mobile tower addresses included in the information sent to the system have been used by Google to manage push notifications and messages on Android phones for 11 months, according to a Google spokesman. The company says that this data is not used or stored in any way, but after the request of Quartz, steps are being taken to stop this practice. By the end of November, phones on Android will no longer send cell tower locations to Google, at least as part of a particular service that users cannot turn off.
“In January of this year, we began to investigate the use of Cell IDs as an additional signal to improve the speed and efficiency of message delivery,” said in an email from a Google spokesman. “However, we never included Cell ID in our network synchronization system, so the data was immediately deleted, and now we have updated the system and it no longer prompts for Cell ID.”
Mobile tower location data sent to Google. Received by Quartz
It is unclear how mobile tower addresses, transmitted as string data identifying a specific tower, can be used to improve message delivery. But the confidentiality problems that inevitably arise in situations with hidden transmission of location data are obvious. If information about one tower can only help you to approximately understand the location of a mobile device, then using several towers you can triangulate and clarify the location with an accuracy of up to 400 meters, and in urban conditions, where towers are located closer to each other, it is even more accurate.
So this information is very unpleasant for people who prefer not to be followed, especially for such categories as law enforcement officials or victims of domestic violence who turn off geolocation and are sure that their whereabouts are unknown. Although the data sent to Google is encrypted, it can potentially fall into the hands of third parties if the phone is compromised by malware or otherwise hacked. Each unit has a unique number with which location data can be associated.
Google and other Internet companies are already under the gun of lawyers and regulators, including for how omnivorous they are in terms of the information they collect about their users. Such personal data, from political views to purchase history and location, is the key to the success of businesses like Facebook or Alphabet, built on personalized advertising and valued by investors at more than $ 1.2 trillion.
Tower location information collected and sent to Google Android – phone with geolocation turned off, Washington. Received Quartz
The practice of sending location data does not seem to be tied to any particular type of phone or tablet at Android. Apparently, Google was collecting data from all modern Android devices prior to Quartz. According to an informed source, the addresses of communication towers began to be sent to Google after changes in the Firebase Cloud Messaging service, owned by Google and by default running on Android phones, occurred in early 2017.
Even those devices that were reset to factory settings, with disabled geolocation services, according to Quartz, sent the addresses of the nearest towers to Google. Devices with mobile data or Wi-Fi enabled seemed to send data to Google every time they came within range of another mobile tower. And when Android – devices connected to the Wi-Fi network, they sent the addresses of the towers to Google, even if they did not have a SIM card inserted.
“This is a concern,” said Bill Badington, a software engineer at the Electronic Frontier Foundation, a nonprofit that advocates digital privacy. “You can imagine how many situations there are when a user is threatened by extremely sensitive information.”
The location data section of Google's privacy policy states that Google collects location data from devices that use its services, but does not specify if data is collected from devices at Android where location services are turned off.
'When you use Google services, we may collect and process information about your current location. We use a variety of technologies to determine location, including IP address, GPS and other sensors, which, for example, can provide Google with information about nearby devices, Wi-Fi hotspots and mobile towers. '
According to a Google spokesman, the system that manages push notifications and messages at the company is “clearly separated from the location services that locate the device in apps.” Android – Devices have never offered users a way to opt out of collecting mobile tower data.
“The real mystery is why this isn't optional,” says Matthew Hickey, a security expert and researcher at Hacker House, a London-based security agency. “From Google’s side, it’s very annoying to collect information related only to operator networks, from devices where there are no SIM cards or working services.”
While Google claims to not use the location data they collect, users' location information can be used to create personalized advertising content – which already has obvious commercial value. A company can track the exact location, for example, in order to show a specific advertisement to a user Android – a device or a person using Google applications who has entered a particular store.