Are You Being Tracked? And No, I’m Not Just Talking GPS

I got into this item a little late. it was base don a Washington Post article but I can’t find the original credits. The story involved following a normal American business woman (a real estate agent) as she goes about a single day and documenting just how much information is being gathered about her, by GPS or any other means. Pretty interesting stuff.

6:15 a.m.

Bernard, who is married and has a grandson, pads into the lobby of her Reston condo complex on the way to the building’s gym, and almost no one else is about. But a security camera records her. If the government or a divorce lawyer wants the tapes, they can subpoena them.

I don’t think the average person has any inkling of how many times they are staring on video in today’s day and age. It’s been a harsh winter back in Colorado Springs where my wife and I recently fled from the cold, and spouse takes great delight in sitting and watching the various weather and traffic cams that are online. There’s no telling just how much information with techniques such as ALPR various agencies or private individuals may, or may not be gathering from these ubiquitous, all-seeing “eyes”.

7:17 a.m.

Bernard returns to her condo after her workout, nestles into a bedroom love seat and fires up her laptop to check e-mail.

She opens a few, deletes 38 more - junk mail from Weight Watchers, a personal trainer, a firm that sells art posters. The U.S. government claims that even before she’s opened them, it should have the right to read them if it needs to. The technology exists to do that.

Bernard is not only trackable, but she is a tracker. She says it helps her be a better real estate agent. Through a Web-based notification service, she can see what homes her clients are interested in and copies of e-mails sent to new clients who register on her Web site, KittyBernard.com.

“I can e-mail them and say, ‘I see you’ve been on my Web site’.”

This illustrates one of the larger conundrums in this whole convenience versus privacy issue. Even those who are likely to scream the loudest at receiving unwanted emails (commonly called spam, but in the US the definition of “spam”, correctly stated as UCE, (Unsolicited Commercial Email) is tightly defined by law … many ’spams’ that we receive on a daily basis are legally not spam at all) think nothing of producing their own variation of “spam” because it has been proven to increase their business. If you visit a web site, Google knows a lot about you, the web site operator knows as much and more. What laws control what s/he can do with that information? Ever visit, just once out of curiosity a porn site or (scarier in today’s over-reactive Homeland Security world) a site about anarchy or bomb making? It’s not only the government who is collecting massive amounts of information on you every time you go online. And don’t rely on those “sanitizing” tricks and programs to hide where you have been … the sites themselves record the data and you can’t erase a visit after the fact.

8:30 a.m.

She takes a cellphone call from her daughter.

After a brief chat, she hangs up. But her cellphone is still sending its I.D. signals to the nearest cellular towers, giving her phone company her approximate location. Approximate, but precise enough that the FBI has used such information to locate suspects, and marketers are contemplating using it for targeted cellphone advertising pitches by text message.

There’s a generally held misconception in the press that most cell phones are GPS-equipped and if you’re into privacy all you have to do is avoid them. Well the truth is, the majority of cell phones are still not GPS-equipped but because of government regulations involving 911 calls (and the cell carriers own business interests) extremely accurate data regarding locations, calls made, calls received etc. are readily available. Unlike the data from wired-line phones one doesn’t even need to be a government agency with court order to mine this data, most carriers sell the information to more or less anyone and there are very few laws to control who can buy it. Just taking this one example of a real estate salesperson, were I a competitor and perhaps underhanded (but likely not illegally so), could I make mincemeat of her business by buying the information of who she was calling and from what location. Even worse were I stalking her daughter … the cell phone is a fantastic tool for a pedophile and in most cases there’s little the law currently does to prevent such acts.

8:35 a.m.

Bernard pulls into an Exxon Mobil gas station. She holds a small wand called a Speedpass to a sensor at the gas pump.

The gadget uses radio frequency identification (RFID) waves to charge her Exxon Mobil account directly. No cash. No card swipe.

RFID chips are being placed in credit cards, passports and items on store shelves. Some people have even had chips injected into their bodies so emergency-room doctors can have instant access to their medical records. The chips can track, conduct transactions and in some cases be hacked. They transmit information to private databases. Civil libertarians fear that one day soon this will mean a retailer could recognize Bernard as soon as she walks in the door, even before she identifies herself, or that data brokers could track how many times she entered a bar, even if she paid cash.

By default, Exxon Mobil has the right to share her name and other information it collects on her with “consumer reporting agencies, banks, insurance companies, retailers, publishers and direct marketers” unless Bernard “opts out.” But she has never done so.

Such information is often buried in the privacy polices sent in the mail or posted on retail Web sites that Bernard never bothers to read. “I don’t know anyone who’s read them,” she says.

I think Ms. Bernard’s statement there just about says it all. Most of us never read those terms of service and frankly, how many of us could even keep our eyes open long enough to. Again the massive amounts of data being collected are normally obscured from the unintentional providers of that data and almost always legally shareable with anyone who pays a fee.

10:25 a.m.

She logs on to Top Producer, Web-based software for real estate agents that allows Bernard to retrieve notes on her clients wherever she has access to the Internet. She can look up clients’ birthdays and home-buying anniversaries, lending a personal touch to her service.

The trend toward Web-based computing means that reams of data Bernard and others used to keep in notebooks are now stored on servers owned by private companies, where the data is potentially vulnerable to hackers and potentially accessible to government authorities.

And not only accessible to government authorities, but how about to the competition? I went and looked up the Privacy Policy of Move.com, the parent company that sells and hosts the Top Producer software mentioned here. They are actually not nearly as bad as many such policy pages, quite clearly written and basically tell Ms. Bernard and the other users who haven’t bothered to read them that the service becomes the owner of all data submitted, both personally identifiable and not personally identifiable and that they can share and share alike with companies they partner with. Also they have at least one paragraph there that’s honest:

Finally, unfortunately no data transmission over the Internet or the storage of information on servers can be guaranteed to be 100% secure and while we strive to protect your personal information, as described herein, we cannot guarantee or warrant its complete security.

So when you are buying or selling a house and your real estate professional brags to you about the wonderful software they use, realize you may be putting your whole life history and financial statement on line, and open to the highest bidder.

11:05 a.m.

She dials Domino’s for pizza.

Domino’s tracks her name, phone number, address, and size and type of pizza ordered. Unless a store decides otherwise, the data are held forever. That way, Domino’s can provide more personalized service - “Hi, Ms. Bernard, would you like your regular - mushroom and sausage?”

Domino’s, which hopes to have a national database of customers soon, says it does not share or sell customer information. But companies that specialize in providing unlisted and cellphone numbers, among other records, often buy phone numbers from pizza delivery services, according to Merlin Information Services, a data broker.

Enough said about this already … how’d you like to be in the market for health insurance and find out your prospective insurer was tallying up how many pizza’s you eat per month? Hmmm?

12:30 p.m.

Bernard gets back in her car, a 2003 Mercedes-Benz with navigation and roadside emergency service. She turns the key in the ignition, activating a Global Positioning System device that uses satellites to pinpoint her location and is constantly sending out signals.

GPS technology allows her to map out a route and find streets and landmarks, restaurants and hotels. She can use a CD, which displays on a dashboard screen, or push a button and connect to a roadside-assistance call center run by the Texas telematics firm ATX, which can guide her if she’s lost or call her a tow truck.

GPS can generate a record of her travels, though ATX says it does not keep such location records now. The company stores emergency call records - location, time, nature of call - for billing and other purposes.

And this is the meat of my story. yes, GPS tracking may be a two-edged sword. But what this article doesn’t even begin to address are all the other “black box” sensors already in Bernard’s car that are logging her speed, her brake applications, seatbelt use and many other actions which might or might not be of interest to law enforcement or any non-official third party. Unlike GPS which is optional and can be defeated or turned off, these other sensors are part of the vehicle’s basic operating systems and can’t be turned of if the car is to be drivable. There are few Federal guidelines, even fewer state laws and very importantly to my mind. no regulation of accuracy and true customer disclosure. Most car manufacturers today put a simple warning in the owner’s manual that states “we may have sensor son board that record things.”

12:35 p.m.

Bernard pulls up to a tollbooth on the Dulles Toll Road. A Smart Tag on her front license plate communicates with a sensor and pays her toll. A light flashes green.

Over the long run, Bernard has saved hours by using her Smart Tag, with its RFID chip, to zip through tollbooths.

The Virginia Department of Transportation records the date and time she passed, the toll location, the amount paid and her customer account information. The FBI has used this type of information to help solve murder cases, and private attorneys have used it in divorce cases.

As she passes, two cameras record her - one in front of her car and one in back.

ALPR cameras are a fact of life today at tollbooths. You can approach this and the other issues I’ve raised from the George Bush, “You’re either with us or against us” hubris or you can think about the issues as a rational, Constitution-respecting citizen and tell your elected representatives that enough is enough. 1984 has not only long past on the calendar, it has long passed in terms of “Big Brother” watching over us with no parental guidance.