Tag: privacy

By now you will have heard how the FBI is using cellphone data to track down people who were at the January 6 storming of the Capitol. Early last year, you may have seen the orange-dots-on-black maps that tracked a group celebrating spring break in Fort Lauderdale as they headed home — potentially carrying COVID. What about you? Have you been in any situations lately where you think someone might have been tracking your phone?

Whether you like or don’t like the idea of being tracked by your cellphone, it is happening!

Not because you are a suspect in a crime. Not because you could be carrying a virus. No, you are being tracked because you are a valuable marketing asset! In fact, years of your location data has probably already been recorded, sold and re-sold multiple times, without you getting a single penny for it!

By now you may also be wondering, “Virginia, what does phone location data have to do with emergency preparedness?” As you’ll see, there are a couple of interesting angles to this story.

Assumptions behind this Advisory

First, we assume you have a smartphone. If you’re like most people, you count on your phone as your main communications tool for emergencies. How your phone is set up could play an important role in its usefulness.

Second, we think everyone interested in preparedness should be knowledgeable about security. We assume this includes phone security.

Before we go any further, here’s a disclaimer. Cellphone technology changes monthly, maybe weekly! Please confirm what you read here today with experts (your phone manufacturer, the app developer, your IT consultant, etc.) before you take any actions!

The vocabulary of phone tracking

And before we jump into what I’ve learned this week, I have to start with some vocabulary. (I had to look up these words myself.)

• A GPS chip in the phone is what allows it to be tracked. The chip reveals location data: where your phone was and how long it stayed there. (GPS refers to the Global Positioning System, operated and maintained by the U.S. Air Force for “Space-Based Positioning, Navigation, and Timing.”) Satellites, cell towers and Wi-Fi can all be used to pinpoint the location of your phone.
• Metadata is the basic info about a phone message. It consists of who you are (your device, not your name), who you’re talking to (device), and when you’re talking.
• Content is what you are actually saying or sending by message. Your content can be encrypted for privacy.
• Encryption is a process whereby a message is converted into code, making it impossible to read unless you have the key to the code.

Of course, we rely on all this information on ordinary days and during emergencies.

GPS capability helps us chat with friends, make business arrangements and find our way there. It lets us check on what the weather’s going to be like, and figure out where to get gas.

In an emergency our phone uses the same technology. We can check to be sure family is OK, locate the fire or traffic jam, find our way to a shelter. If we’re trapped under a fallen wall, our phone could help direct First Responders to our rescue.

Some of these functions are built into the phone. We can add many other functions using apps – map apps, news apps, social apps, earthquake alerts, gaming, chat, roadside assistance, etc. etc. You will be interested to know that the average person has 40 apps installed on their phone — of the over 2 million available! That average person only uses about 20 of them, however. (As you might imagine, younger adults use more than older adults.) You can get more interesting details of phone app usage here.

So, phones and apps represent a lot of convenience.

The real value though, and the reason people are tracking your phone, is the information that apps capture about your location.

When you use your phone and apps, you are agreeing to be tracked in real time. Companies tell you they are tracking your phone in order to “Give you a better user experience” or “Improve service.” At the same time, many of the apps, and particularly the free ones, collect far more than the essential info they need.

They combine your location data with other users’ data and sell it to organizations that build and then in turn sell detailed user profiles for marketing purposes. Hundreds of companies buy the compiled user profile data. Examples are banks, insurance companies, credit companies, airlines, and retail giants like Nike and Amazon. Oh, and political parties!

Can the government buy this data, too? Typically, law enforcement has to prove why they need the data. But there’s been recent reporting of Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE) spending thousands of dollars on location data – without being authorized to do so. The ACLU is suing for infringement of privacy.

However the lawsuits work out, you can pretty much assume that some of your personal location information has been collected and passed along to private and perhaps even governmental agencies. And this won’t stop.

What can you do to keep the world from tracking your phone?

Here are simple things we all can do that will make it harder for our location to be traced.

• Turn off the radios (think Spotify) on your phone, whether they are cellular or wi-fi.
• Even if your phone is off, though, its location can be found because Wi-Fi and Bluetooth still receive data. The easiest way to stop this is to turn on the “Airplane Mode” feature. 
• Go to “Settings,” “Privacy” and “Location settings” on your phone, and adjust. Apple also has a setting to “limit ad tracking.” (A lot of the apps you like probably need location settings, so be careful in shutting things off entirely.)
• Shut the phone down completely and take out the battery. Of course, then you can’t use the phone at all!

If you read any crime novels like I do, at this point you will be asking, “What about using a burner phone? (For the non-crime reader, these are pre-paid cellphones used just a couple of times and then trashed.) If you want to use a burner to avoid being identified, be sure to buy with cash (away from where you usually shop), keep your calls short, and remove the SIM card before you toss the phone. These phones can still be located but even if the phone is located there’s theoretically no link to you as an individual.

What about protecting the messages you do send?

Location is metadata, and can be tracked in a number of ways and by a whole raft of commercial enterprises. What’s in your messages is “content.” Content is a lot harder for people to get to – and pretty easy for you to make more secure.

For security, insist on encrypted messages. I didn’t really realize it, but many of our most popular messaging services automatically encrypt what you send – as long as the person on the other end of the message has the same service (and thus the key to the encryption).

For several years my family and I have been using WhatsApp to send messages and photos. In 2016 WhatsApp announced end-to-end encryption. (WhatsApp had been purchased by Facebook a couple of years earlier.) In 2018, Apple’s iMessage and FaceTime also announced end-to-end encryption.

Sounds good, eh? But it’s important to remember that if these companies store or back up your messages, the messages may be available at a later time. And since  these are for-profit companies, we cannot know exactly how they intend to approach privacy in the future.

My research for this Advisory suggests that if you are concerned about having a good, free and private encryption message service, you should look into the Signal Messaging app. It’s a non-profit company that has always been dedicated to end-to-end encrypted calling and texting.

Caution: In recent months the demand for “privacy” online has led to dramatic growth for Signal, and experts are watching to see how the company will respond to this surge in new users.

So you’ve set up your phone for a better level of privacy. Now what?

What else can you do to your phone to yourself from being tracked, surveilled or hacked? Here’s a last list of suggestions. I hope most of these recommendations are familiar to you!

1. Set up a password on your phone, the longest one possible. Don’t be like the 70% of people who use the same password for multiple accounts!
2. Consider using a fingerprint or faceID instead of a passcode. Harder for a thief to get into your phone. On the other hand, easier for police to force you to open it.
3. Don’t charge your phone in public places like airports or shopping centers. You don’t know if that outlet itself has been compromised and thus might be transmitting your private data while all you think is that you’re charging the phone.
4. Use the same caution when picking public “hotspots” – like a Starbucks – for connecting to the internet.
5.  Remember that companies can be subpoenaed to give up your data. You may not even know it has happened.

Finally, keep track of your cellphone!  Over 70 million are lost or stolen each year!

Go onto YouTube and you can see video after video of people’s phones being stolen right out of their hands as they are standing talking on the street. Most of these “grab and run” thieves zip by on a bike or scooter and before you realize it, your phone hand is empty! We wrote about “scooter” thefts last year, when there was a rash of them in San Francisco.

And if you’re still remembering the image at the top of this page, it is meant to represent another situation where phones get stolen. You are going up the escalator, the thief is going down, and BINGO, your phone has disappeared.

I found a couple of inexpensive items that might be useful for forgetful or careless types.

First is a lanyard to keep you from walking away from your phone. This one comes in different colors, even in two-packs so you can change colors to fit your outfit (or share with another family member).

Doormoon Phone Lanyard, 6× Durable Patch, 2× Adjustable Neck Strap, Universal Nylon Phone Straps for Phone case Compatible with iPhone, Samsung Galaxy and All Smartphones (Black Purple)

Or maybe you’d prefer a wrist strap to you can keep the phone handy even when your hands are otherwise full. And a wrist strap would keep that escalator thief from grabbing and getting away!

Wrist Lanyard with id Holder, Doormoon Card Holder Credit Card Wallet with Starp for Smartphones Sleeve Extra Tall Pocket Totally Covers Credit Cards and Cash (Red)

If you’re worried about your phone slipping out of your pocket, or being slipped out by a pick-pocket, consider this. It uses a magnet to “pin” your phone securely in place inside your pocket or purse.

Stocking Stuffers : Cell Phone Accessories: Don’t Lose Your Phone, Wallet, Tablet, or Keys – Patented Anti-Theft, Anti-Drop, Magnetic Cell Phone Lock – Secures Your Mobile Device to Pocket or Purse

One last note about cellphone security.

Your security depends on the person you are sending to having good security, too. I love this oh-so-timely quote: “Think of it as herd immunity. The more people practice good security, the safer everyone else is.”

Virginia
Your Emergency Plan Guide team

P.S. What other suggestions do you have? Let us know. Dealing with our phones is not going to get any easier.

---

My shocking personal information story

Last weekend I got a text message from my daughter. She had been online and had found one of the personal information databases that had my name in it.

There are a couple dozen popular sites like the one she checked. They all offer background and personal information about anyone, usually including phone number, address (and past addresses), email address, relatives, pictures, social connections, court records, etc. While you usually can get one or two pieces of information just by typing in someone’s name, for a fee you can get all the records.

Well, my daughter got my whole record and sent it to me. IT WAS SO, SO INACCURATE!  Wrong birth date. Unknown foreign “friends.” Places I’d never been to! When I got to the (false) court records I shut the phone in horror!

(Now my daughter being who she is, she sent me specific instructions of how to cancel the account, which I was able to do within 24 hours. At no charge.)

Still, it was a shock. While I spend a lot of time online, I simply don’t use personal information databases and have never looked myself up.

But since we talk about cyber-security a lot here at Emergency Plan Guide, it seemed important to share more about it today. These personal information databases are legal. They have found information about you without breaking any laws. There have been no “leaks.”

But your privacy is certainly threatened by them.

The Big-Daddy Personal Information Databases in all our lives – the Credit Bureaus

Most everyone is familiar with the credit bureaus that track 9 of every 10 adult Americans: Experian, Transunion and Equifax. A fourth seems to have been added to this list: Innovis.

While we often speak of “your credit rating,” or your “credit score,” you really have one from each company.  

But each credit report will be different. Why?

All four companies track money that you owe: mortgages, bank loans, car loans, student loans, and credit card debt. Credit bureaus also get information from public records, like property tax rolls or court records.

But businesses are not required to report the loans they make to you, so many businesses report to only one or two of the credit bureaus. That explains the variations in the reports

Action item: Check your credit reports.

If you haven’t checked your credit scores lately, you may want to. According to the Federal Trade Commission “You’re entitled to one free copy of your credit report every 12 months from each of the three nationwide credit reporting companies. Order online from annualcreditreport.com, the only authorized website for free credit reports, or call 1-877-322-8228. You will need to provide your name, address, social security number, and date of birth to verify your identity.”

According to the Innovis website, they offer a free credit report, too.

I have checked my own records in the past. Every time I found errors. Once it was a misspelling that dropped someone else’s debt into my file. If you see debts you don’t recognize, or other strange information, you can work with the credit bureaus to get your report cleaned up.

The “people-finder” sites track even more personal information.

Wikipedia says there are close to 4,000 “information brokerages.” This probably includes the credit bureaus. All of these companies are for-profit organizations that make money by charging for certain services and by selling your personal information to marketers – and to each other.

The people-finder sites are giant personal information databases. They start with names and aliases. They list addresses where you have lived and currently live. Some have reverse directories – enter an email and they’ll give you a phone number to go with it, or enter a phone number and you’ll get an address.

That is just the start. You may find lists of your children. Other relatives and ex-relatives. Lists of friends. Where you’ve traveled. Property you own. If you’ve been in trouble with the law or owe taxes. If you are a sex offender. Have declared bankruptcy. You may find photos of yourself!

How much of this information do you want to be available to anyone willing to shell out a few dollars? What if there are errors in the data? How can you protect your privacy?

When I found out about being on one of these sites, I immediately jumped into action to find out more.

How the people-finder information databases work:

• You usually can’t get a complete look at your people-finder record  — or the record of someone else — without paying at least $1 for a “trial.” If you sign up for a trial, read the fine print. Trials typically turn into a “regular monthly subscription” unless you cancel within the specified time, which may be just a few days.
• If you want to update or clean up your record at the people-finder site, you will run into challenges. They get your information by scraping the web – that is, by finding publicly available info. Obviously, you can’t “change” public information, although you can delete some of it. (Looks as though you can’t delete court records that aren’t officially expunged.)
• Once the site is updated, you will be offered the option to subscribe for a monthly fee to monitor your account to keep it clean and also to be able to search for other people. Subscription prices seem to vary starting at as little as $5/month (for a multiple-month contract) but most are more in the $20-30/month range, with an extra fee for what has been termed the “juicy stuff” – criminal records, tax records.
• Like me, you may want to close the account and remove all the information. Every site’s requirements for opting-out of the site are different – but from what I am reading, it is possible but your patience will be tried. You should not have to pay anything to get off the site but you may have to jump through hoops.
• Even after you are successful at having the account closed, it may reappear again in the future when they “find” new information . . .

Here are some of the sites I came across in my research.

 I used an old email to check on a couple of them and found myself in every one I looked at. My photo was there, too! I am not recommending any of these sites — they are just to help you get started on your own research!

• Peoplefinder
• Beenverified
• Mylife
• Instant CheckMate
• Spokeo
• Anywho
• Truthfinder
• Whitepages
• People
• Peoplesmart
• Intelius
• US Search
• Radaris
• SeekVerify
• Pipl

Can you remove yourself from these online databases?

How to get off the credit bureaus. The only way to get off them entirely is to become one of the 26 million or so people in the U.S. that have no debt profile. That means they have no credit cards. No mortgage. No car payment.

Most of us couldn’t function without at least some of these. So the best thing to do is to be sure your credit report is at least accurate.

How to get yourself off the people-finders. It looks to me as though getting totally off is impossible. You would need to have no online banking accounts. No social media accounts. No websites. You’d have to avoid using public wi-fi, and if you went online, use a Do Not Track browser. (Apparently Google does have a Removal Tool but it sounds as though they make it tough to use.)

Best thing to do here? Go to as many of the people-finder sites you can and ask that your information be deleted. Go there regularly. This is a lot of work.

Hire a “reputation manager” to help?  You can hire a “reputation manager” company that will search out negative info on your behalf, then remove or suppress it. Some of these companies specialize in business reputation management, others work for individuals. Fees for their services depend on the complexity of your situation, but customized plans seem to start at around $400 – 500/month.

“Privacy is dead. Get over it.”

You have probably heard this quote. It is attributed to the co-founder and CEO of Sun Microsystems, Scott McNealy – and he said it way back in 1999!

Obviously, the more we rely on digital communications to run our lives – essentially everything on the Internet of Things — the less privacy we will be able to maintain. Is there an answer – or is the genie out of the bottle, never to be returned?  I’m afraid the genie is dancing in triumph right now!

But in being conscious of what data you’re making available by participating in the digital society, you can at least be better prepared for what might come!

Virginia
You Emergency Plan Guide team

P.S. I am not an expert in this topic. If it interests you, YOU need to become your own expert. If you already have stories to tell, please share them with us by leaving a comment below!

P.P.S. We have written pretty regularly about security and privacy. Here’s an earlier Advisory that talks about why home electronic devices are so vulnerable to hacking.