Josh Wolford | April 21, 2011

By whom and for what reason is undetermined, but data scientists Alasdair Allan and Pete Warden have discovered a tracking file within devices that operate on iOS 4.  Allan and Warden revealed their findings yesterday at the Where 2.0 location conference in Santa Clara, CA.

Do you have an Apple device? How much would a tracking log concern you? Let us know.

The file is called consolidated.db, and is completely unencrypted and unprotected. The file can be accessed on the device itself and it also appears on any computer with which the device has been synched. Apparently, the tracking began with the iOS 4 update.

The file contains latitude and longitude coordinates along with timestamps, which is basically all you need to track someone’s movements along any given time-frame.  According to Allan, there can be up to tens of thousands of data points in any one consolidated.db file which could track movements back to around one year ago.

Their research found no evidence to suggest that this information is leaving the devices, but one security researcher thinks the information is leaving your devices – and being sent straight to Apple.  Why would Apple want all of this location information?  One reason could be for the creation of their own location database.  With information being sent every day from the millions of iPhones currently in use, Apple might have found an easy, cost-efficient way to expand its own global location database.

According to this theory, Apple may send information about your location twice a day.  How can they do this?  It is possible that the opt-in procedure for Apple’s geo-tracking is buried innocuously within the initial iTunes installation, which iPhone users require for proper synching of their devices.

Then again, if this is all starting to sound too conspiracy theory for you, lets not forget that Apple is already keeping track of where you are – but with a certain sheen of anonymity.  It’s right in their privacy statement:

To provide location-based services on Apple products, Apple and our partners and licensees may collect, use, and share precise location data, including the real-time geographic location of your Apple computer or device. This location data is collected anonymously in a form that does not personally identify you and is used by Apple and our partners and licensees to provide and improve location-based products and services. For example, we may share geographic location with application providers when you opt in to their location services.

This statement on location data collecting doesn’t mention the transfer of this data directly to Apple or third-parties though.  Carefully read, it really only says that location data is logged in order to help applications like maps services, Foursquare or Twitter.

But…uh…privacy, anyone?    Whether this location data is being harvested by Apple for unknown purposes or it simply sits, unencrypted, on your devices and computers waiting to be accessed – there is some basis for concern.  Folks worried about privacy need not even own an Apple product to worry, though.   It’s not like geo-tracking logs aren’t already kept on everyone – all the time.  Mobile providers have this data, but its protected and requires court orders to access.  It would seem the scary thing about this particular find, for some, would be the relative ease with which the data is accessible.

The sky is hardly falling, however, says forensic data researcher Alex Levinson is an article published today.  He outlines three issues the may make this find by Allan and Warden a non-story.

First, he says that Apple is definitely not collecting this data:

Apple is not harvesting this data from your device. This is data on the device that you as the customer purchased and unless they can show concrete evidence supporting this claim – network traffic analysis of connections to Apple servers – I rebut this claim in full. Through my research in this field and all traffic analysis I have performed, not once have I seen this data traverse a network.

Second, the hidden consolidated.db file that is the culprit isn’t really new or hidden:

It’s just moved. Location services have been available to the Apple device for some time. Understand what this file is – a log generated by the various radios and sensors located within the device. This file is utilized by several operations on the device that actually is what makes this device pretty “smart”. This file existed in a different form prior to iOS 4, but not in form it is today.

Lastly, Levinson says that this information is not even new or revelatory.  People have known about this tracking file for a while now.  Not most of the general public, mind you, but people in his industry aren’t strangers to it.

It looks like Washington thinks that this is a real privacy concern, as Senator Al Franken has already written a letter addressed to Steve Jobs asking questions concerning this  issue.  Here are the questions he asks:

1. Why does Apple collect and compile this location data? Why did Apple choose to initiate tracking this data in its iOS 4 operating system?
2. Does Apple collect and compile this location data for laptops?
3. How is this data generated? (GPS, cell tower triangulation, Wi-Fi triangulation, etc.)
4. How frequently is a user’s location recorded? What triggers the creation of a record of someone’s location?
5. How precise is this location data? Can it track the users location to 50 m, 100 m, etc.?
6. Why is this data not encrypted? What steps will Apple take to encrypt the data?
7. Why were Apple consumers never affirmatively informed of the collection and retention of their location data in this manner? Why did Apple not seek affirmative consent before doing so?
8. Does Apple believe that this conduct is permissible under the terms of its privacy policy?
9. To whom, if anyone, including Apple, has this data been disclosed? When and why were these disclosures made?

“Anyone who gains access to this single file could likely determine the location of the user’s home, the businesses he frequents, the doctors he visits, the schools his children attend, and the trips he has taken over the past months or even a year,” he says in the letter.

Indeed, this is a valid point.  But are people making a mountain out of a molehill here?  Are people worried that suspicious spouses will eventually be able to use data like this to nail cheating husbands?  That stalkers are going to be able to more efficiently stalk their victims? (Hello, we already have Facebook)

When you look at a visualization of how the data can be used, however, it does make it seem a little more frightening.  The two finders have created a program that allow users to do just that, and look at their own tracking data on a map.  You can download said program here.  It’ll look like this:

Originally published:  http://www.webpronews.com/iphone-tracking-your-movements-2011-04