Apple Posts Statement on iOS Location Data Collection

Wednesday, April 27, 2011

Headlines

69dafe8b58066478aea48f3d0f384820

UPDATE:  Apple Lied: Filed Patent for Mobile Device Tracking: Revelations of the patent application now confirm suspicions that Apple was quite aware of the storage of geolocation tracking data, that it was not merely a database of Wi-Fi locations, and the building of location histories on their customers was not due to a software glitch...

*   *   *

UPDATE:  Microsoft Also Posts Statement: We Collect Your Location Data Too

*   *   *

Apple has released a statement in Q&A format regarding the controversy over revelations that the iOS operating system maintains a geolocation tracking file that records location information of devices running the operating system.

Researchers have noted the hidden Apple iOS tracking file which subsequently prompted a lawsuit and a motion by plaintiffs who are seeking a court order to bar further collection of the location data.

The stealth iOS file records geolocation information derived from triangulating the location of a device using the signals from the closest cell phone transmission towers and Wi-Fi access points. The data is continuously collected and recorded regardless of whether the user has chosen to disable location services features on their mobile device.

Apple's statement employs some semantic play that attempts to both confirm and deny suspicions about the data collection, and attributes the controversy to the company's lack of open communication about what is regarded as a highly technical issue.

Apple confirms collecting location the data, but states that the information only reflects a database of Wi-Fi hotspots and transmission towers that a phone has come into signal range of - which is akin to saying your car is not tracked, just the streets it has been driven on.

Apple also admits that the information is being sent to the company, though they maintain that the data is encrypted and in an anonymous format, supposedly unable to be traced to a particular phone or user.

Apple also states that a portion of the information is stored in an unencrypted format on users' phones, and backed up by iTunes in either an encrypted or unencrypted format depending on the users' settings.

As for storing a year's worth of location data or more as has been reported, Apple claims this is caused by a software bug that will be remediated in a soon to be issued update to the iOS.

Apple also claims that a flaw in the software is causing the location database file to be updated even when users turn off their location services, and says this bug will also be remedied in the next update.

Lastly, Apple admits that some of the data may be shared with third-parties where it is related to system crashed associated with applications, but states that the information provided does not identify individual users.

The full Q&A statement from Apple is as follows:

Apple would like to respond to the questions we have recently received about the gathering and use of location information by our devices.

1. Why is Apple tracking the location of my iPhone?
Apple is not tracking the location of your iPhone. Apple has never done so and has no plans to ever do so.

2. Then why is everyone so concerned about this?
Providing mobile users with fast and accurate location information while preserving their security and privacy has raised some very complex technical issues which are hard to communicate in a soundbite. Users are confused, partly because the creators of this new technology (including Apple) have not provided enough education about these issues to date.

3. Why is my iPhone logging my location?
The iPhone is not logging your location. Rather, it’s maintaining a database of Wi-Fi hotspots and cell towers around your current location, some of which may be located more than one hundred miles away from your iPhone, to help your iPhone rapidly and accurately calculate its location when requested. Calculating a phone’s location using just GPS satellite data can take up to several minutes. iPhone can reduce this time to just a few seconds by using Wi-Fi hotspot and cell tower data to quickly find GPS satellites, and even triangulate its location using just Wi-Fi hotspot and cell tower data when GPS is not available (such as indoors or in basements). These calculations are performed live on the iPhone using a crowd-sourced database of Wi-Fi hotspot and cell tower data that is generated by tens of millions of iPhones sending the geo-tagged locations of nearby Wi-Fi hotspots and cell towers in an anonymous and encrypted form to Apple.

4. Is this crowd-sourced database stored on the iPhone?
The entire crowd-sourced database is too big to store on an iPhone, so we download an appropriate subset (cache) onto each iPhone. This cache is protected but not encrypted, and is backed up in iTunes whenever you back up your iPhone. The backup is encrypted or not, depending on the user settings in iTunes. The location data that researchers are seeing on the iPhone is not the past or present location of the iPhone, but rather the locations of Wi-Fi hotspots and cell towers surrounding the iPhone’s location, which can be more than one hundred miles away from the iPhone. We plan to cease backing up this cache in a software update coming soon (see Software Update section below).

5. Can Apple locate me based on my geo-tagged Wi-Fi hotspot and cell tower data?
No. This data is sent to Apple in an anonymous and encrypted form. Apple cannot identify the source of this data.

6. People have identified up to a year’s worth of location data being stored on the iPhone. Why does my iPhone need so much data in order to assist it in finding my location today?
This data is not the iPhone’s location data—it is a subset (cache) of the crowd-sourced Wi-Fi hotspot and cell tower database which is downloaded from Apple into the iPhone to assist the iPhone in rapidly and accurately calculating location. The reason the iPhone stores so much data is a bug we uncovered and plan to fix shortly (see Software Update section below). We don’t think the iPhone needs to store more than seven days of this data.

7. When I turn off Location Services, why does my iPhone sometimes continue updating its Wi-Fi and cell tower data from Apple’s crowd-sourced database? 
It shouldn’t. This is a bug, which we plan to fix shortly (see Software Update section below).

8. What other location data is Apple collecting from the iPhone besides crowd-sourced Wi-Fi hotspot and cell tower data?
Apple is now collecting anonymous traffic data to build a crowd-sourced traffic database with the goal of providing iPhone users an improved traffic service in the next couple of years.

9. Does Apple currently provide any data collected from iPhones to third parties? 
We provide anonymous crash logs from users that have opted in to third-party developers to help them debug their apps. Our iAds advertising system can use location as a factor in targeting ads. Location is not shared with any third party or ad unless the user explicitly approves giving the current location to the current ad (for example, to request the ad locate the Target store nearest them).

10. Does Apple believe that personal information security and privacy are important?
Yes, we strongly do. For example, iPhone was the first to ask users to give their permission for each and every app that wanted to use location. Apple will continue to be one of the leaders in strengthening personal information security and privacy.

Software Update

Sometime in the next few weeks Apple will release a free iOS software update that:

  • reduces the size of the crowd-sourced Wi-Fi hotspot and cell tower database cached on the iPhone,
  • ceases backing up this cache, and
  • deletes this cache entirely when Location Services is turned off.

In the next major iOS software release the cache will also be encrypted on the iPhone.

While the promise to fix some longstanding bugs related to the geolocation tracking is reassuring, the statement overall seems to be a bit condescending and is more intent on covering Apple's tracks on the issue than offering customers an honest mea culpa.

Possibly Related Articles:
16892
PDAs/Smart Phones
Apple iPhone Privacy Mobile Devices geo-location Smart Phone Headlines Tracking iOS
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.