Telegram-канал takebackourtech - #TBOT: Take Back Our Tech: Неотсортированное

#TBOT: Take Back Our Tech

16 декабря 2023 01:21

⚡️Google Maps Is Ending Location History - That Doesn't Mean The End of Sensorvault
@takebackourtech

Most of you that follow this channel are aware of Sensorvault, Google's geolocation surveillance database that collects usage data from Google Maps (through Google Location Services and the Google Maps app).

Geofence warrants have now become one of the leading types of law enforcement request for data, 25% of Google warrants are Geofence warrants. All investigators have to do is pick a place and time to see how many phones were in the area.

In a recent Google announcement - updates were announced for local timeline histories, suggesting that location data would only be uploaded during a backup. These changes will roll out in 2024, a change which the Electronic Frontier Foundation has lauded as a big win for users.

Most of our information on Sensorvault and what location data Google collects is a result of the 2022 case US v Chatrie, in which Sensorvault was used to narrow down suspects in a bank robbery.

A Google product manager made a declaration in this case that alleged:
- Google's location history is the only form of location data that Google believes to be responsive to a geofence request
- Location History information can be searched in response to a geofence request, searched across all LH data in a timeframe, within geographic parameters
- Web & App Activity data is also recorded, some of these entries contain location information. Stored WAA data is only approximate to a square kilometer, so this data is too coarse to be 'responsive' to the warrant in their case

In 2019, one-third of active Google users had LH enabled on their accounts. Google estimates 'numerous' tens of millions, but this number could easily be several hundred million or even a billion devices - Google has around half of the global market.

Google uses interesting language here and makes the distinction of geolocation data that is not sufficiently granular to be responsive to and searchable. This type of data would require association with a specific user account, and be able to pinpoint user's location within a particular radius.

Most now are aware of Google's willful geolocation data collection that occurs through Google Location services, and an ecosystem of apps that use Google Location Services.

Even though Google is making these changes to Google Maps & location history, these changes do not rule out the possibility of additional geolocation databases that do not fit the standards for a 'geofence' warrant but have different use cases. According to Google's definitions, there could be other geolocation data that is being collected but not attached to a specific user account.

Google mentions the separate service and databases for Web & App Activity, and Google Location Accuracy which gathers data from WiFi APs and cell towers.

This other data and other databases could be attached to an pseudo-unique data point, such as an IP address, unique like a device identifier, or a combination of multiple datapoints. As always, Google has complete control over the many different data streams that come from devices such as operating system and app level logging - which it can use to rebuild incomplete data.

There is a lot of legal-speak in their declaration that leaves plenty of room for more geolocation based surveillance. It wouldn't be the first time Google's privacy protection features turned out to be bogus, such as Chrome's incognito mode which continued to track its users. Google ended up paying the largest internet privacy settlement in history at $392M.

Should we and organizations like the EFF give Google the benefit of the doubt?

Is this the end of Sensorvault, or have they just gotten better creating loopholes?

✌️ MORE POSTS | 🗯 CHAT GROUP | 📩 NEWSLETTER
Follow 🫶 @takebackourtech