This article is reproduced with the permission of New Scientist for exclusive use by Nova users.

Location-based phone features could aid snoops
04 July 2007
NewScientist.com news service
Michael Reilly, San Francisco

There is no point in hiding. As long as it's on, your cellphone knows where you are, and it might not mind who it tells.

Kevin Bankston, a lawyer for privacy advocacy group the Electronic Frontier Foundation in San Francisco, is well aware of this. Since late 2005 he has been trying to thwart secret attempts by the US government to access users' cellphone tracking information without a warrant.

With the help of a few concerned lawyers and judges, Bankston has made headway. But now he has something else to worry about. He says that a raft of emerging technologies known as location-based services, or LBS, may make people more vulnerable to government spying than ever before. Earlier this year, he publicised details of his worst fears at the Where 2.0 conference in San Jose, California. Meanwhile, police departments and lawyers are increasingly relying on forensic data captured by cellphones to solve cases (see "Cellphones dish the dirt on crime suspects").

The term LBS covers a broad range of location-tracking services that promise to use GPS and other similar technologies to do everything from helping you find your friends in a crowded city, to recommending a nearby restaurant, to locating lost children. Companies selling these services say they have great potential to change the way we stay connected to one another. They can also enhance existing websites and services by presenting only information relevant to your location, such as restaurant reviews.

But Bankston and his colleagues worry that as people flock to adopt these services, they do so without understanding the risks they pose to their privacy. "Most people don't know they have a location-tracking device in their pockets," he says.

The ability to track your whereabouts is built into the way cellphones work, but precision depends on the phone's location and whether it is equipped with GPS. All phones transmit a unique identifying number to the nearest cellular mast, which means the phone's location can be pinned down to within a few kilometres at least. In urban areas, however, where masts are densely packed, more precise tracking is possible. The phone can communicate with several towers at once and, because the closest tower gets the strongest signal, the information can be combined to triangulate the phone's position to within a few tens of metres.

Since the beginning of 2005 US federal law has required all phones to make this information available to emergency call centres (New Scientist, 25 September 2004, p 24). In the UK, the London Ambulance occasionally relies on this information to locate callers as well. Law enforcement agents have also used the feature to link suspects to crime scenes by analysing their phone records.

Increasingly, however, the precision with which someone can be tracked is dropping to a few metres, thanks to the addition of GPS devices to cellphones, which vastly improves the services LBS companies can provide. For example, last September start-up company Loopt of Palo Alto, California, launched cellphone software that combines cellular triangulation with GPS to display your location to selected friends.

But it also means that users can be pinpointed in a way that simply wasn't possible before, which Bankston says could play into the hands of snoopers.

However Loopt and uLocate - a company based in Framingham, Massachusetts, that uses information gathered by a GPS-equipped cellphone to allow users to search for nearby restaurants, hotels and ATM machines - are at great pains to stress that a person's location is only available to "buddies" they have personally approved. And when a user logs off, their session history is wiped, so no record remains. "We are very cognisant of you as the end user being in control," says Dan Gilmartin of uLocate.

Nonetheless, even if it doesn't store it, the phone gathers highly precise GPS location information in real time, and Bankston says that the government could still ask a judge for permission to access it. "[Loopt's] architectural protection is high, but their legal protection is low," he says.

Federal law prohibits phone companies from disclosing users' locations without their permission, except when the government is pursuing a criminal investigation. In this case, it has to get the go-ahead from a judge. Recently, however, the circumstances under which a judge grants permission seem to be open to interpretation.

Traditionally, judges have only granted permission to track someone if the government has a warrant, which requires that there is "probable cause" to suspect them of a crime. But in September 2005, it emerged that the US Department of Justice had secretly asked a judge for permission to track users in real time without evidence of probable cause. The DOJ argued that the tracking was necessary to build its case. Although a judge in New York initially rejected the DOJ, another judge in the same state later granted it access to a different suspect's phone. Because the hearings can take place behind closed doors, no one knows how many times judges have approved requests to spy without probable cause, says Bankston. "We don't know what's going on," he says.

The chances of the government watching a specific individual are "very low", says Orin Kerr, a law professor at George Washington University in Washington DC, because only around 50 to 100 requests a year make it to court. But he says that cellphones are a concern. "A few innocent people probably will have their privacy compromised."

From issue 2611 of New Scientist magazine, 04 July 2007, page 24-25

Cellphones dish the dirt on crime suspects The precise location data supplied by GPS-equipped cellphones could allow governments to track the movements of suspects more closely than ever before. But it turns out that a mobile's dirt-digging talents are even more extensive. Cellphones may not look like smoking guns, but that's exactly how some police officers see them. Their digital memories are home to a treasure trove of contacts, audio and video recordings, images, emails and text messages, while their hardware is a source of reliable physical evidence such as DNA and fingerprints. "Although cellphones were not invented for law enforcement they have become incredibly significant in that field," says Amanda Goode, a digital evidence consultant with Forensic Telecommunications Services (FTS), which has labs in the UK and Canada. One source of DNA on a phone, she says, is from loose cheek cells that have settled in the microphone from the user's breath. Skin flakes in the button recesses and earpiece, meanwhile, might also harbour valuable DNA. Cellphones are also a source of high-quality fingerprints, thanks to the way users interact with them. For instance, Goode notes that just sliding a SIM card into its slot with an index finger often leaves a highly readable print behind. Both fingerprints and DNA can be critical to proving who actually used a phone, since they are frequently borrowed or stolen. "Our customers are sometimes defence lawyers seeking to prove someone was not the phone user. They ask us to recover fingerprints or DNA to show that," Goode says. On the digital side, the data that forensic software specialists retrieve is surprisingly robust. Even immersing a cellphone in water won't readily change the state of its memory transistors, so contact lists, photos and other information, which can establish a suspect's network of contacts, often remain. "We were still able to recover the data from a phone that had been at the bottom of a lake for over a year," says Goode. FTS has developed software that extracts user data from different types of handset, using a knowledge of the different ways companies make use of a subscriber's PIN to encrypt their digital memories. Phone forensics also poses new challenges, however. Officers at a crime scene can accidentally mess things up just by leaving a phone switched on while in transit to the lab. A key piece of data, the location area code (LAC) - which specifies the cellphone mast the phone last connected to - will be wiped from memory and replaced with the phone's current location. "You have to stop the phone attaching to the network. Even allowing new text or Bluetooth messages to be received could destroy evidence on it," says Goode. As a safeguard, the phone has to be switched off at the crime scene or sealed in a foil bag to shield it from the radio waves that will attempt to connect it to the network. "If the police don't do that, we often find the LAC simply identifies the mast near our lab," says Goode. Once in the lab, a white noise "jammer" prevents the cellphone sensing and connecting to a network while it is being examined. As phones become ever more useful to forensic experts, including in the bombing attempts in London last Friday morning, securing the data on them is critical. "There is virtually no criminal case now that does not involve phone evidence," says Goode. Paul Marks

For the latest from New Scientiist visit www.newscientist.com