GEOINFORMATICS
AALBORG UNIVERSITY COPENHAGEN
Every move you make:
An update on the state of
GEOPRIVACY
Carsten Keßler | Aalborg University Copenhagen
http://carsten.io | @carstenkessler
1
Every breath you take
Every move you make
Every bond you break
Every step you take
I'll be watching you
2
Every breath you take
Every move you make
Every bond you break
Every step you take
I'll be watching you
3
4
Keßler, C. & McKenzie, G.,
2018. A geoprivacy manifesto.
Transactions in GIS, 22(1),
pp.3–19.
5
6
7
Meet Jane
After Jane wakes up to the chime of her smartphone’s alarm, she brings up the
weather app to check how to dress for the day. While she skims her inbox, her
phone brings up an alert, telling her that her commute might take a little
longer today because of construction work on her subway line. She quickly
gets ready and leaves the house, to make sure she will not be late for work,
and swipes her monthly pass to enter the subway station. Since the
construction work only caused a few minutes’ delay in her commute, she still
has time to stop at her favorite coffee shop, using her credit card to pay for
a cappuccino. When she enters the office building she works in, her phone
brings up the reminder she had set the day before to make sure she downloads
the client presentation she had been working on last night from her cloud
storage to her office computer.
8
Meet Tom
Jane’s husband Tom left the house early this morning for a two-day meeting out
of town. He did not really mind the 2 hr drive, since this was his first
opportunity for an extended trip in his brand new car. When he purchased it the
week before, he had signed up for the roadside assistance plan after his old
station wagon had left him stranded several times. Following the GPS
instructions, he takes the toll bridge to get out of town and onto the highway.
Before he arrives at the meeting, he decides to find a place for breakfast,
checking for online ratings and recommendations first. Later that day, Tom goes
out to have dinner with his colleagues, checking in at the restaurant with his
favorite social network to let his friends know about their fantastic selection
of red wines. After paying with his company credit card, he uses the limousine
app on his phone to find a nearby driver to take him back to the hotel.
9
Location data shared with ...
The weather app provider, the operator of the
digital assistant, the subway operator, two credit
card companies, the reminder app, the cloud storage
provider, the roadside assistance provider, the toll
station operator, the restaurant ratings service,
the social network, and the limousine app service
10
11
Two categories
— Concrete lat/lon position, usually provided by
GPS or mobile device's location services
— Places or objects that can easily be located,
e.g. toll station, subway gate, or restaurant
name
12
What is geoprivacy?
"A special type of information privacy which
concerns the claim of individuals to determine for
themselves when, how, and to what extent location
information about them is communicated to others.
In short, control of location information is the
central issue in location privacy."
(Duckham & Kulik, 2006, p. 36).
13
What is geoprivacy?
"It refers to the ability of an individual to move
in public spaces with a reasonable expectation that
their location will not be systematically and
secretly recorded for later use by a third party."
(Kerski & Clark, 2012 as cited by Kerski, 2016).
14
Why a manifesto?
— State and reflect on the state of the art
— Formulate goals and challenges
— Trigger a discussion in the community
— Allows you to voice your opinion, not just
scientific facts
⇢ 21 theses on geoprivacy
15
Yet again, spatial is
special
16
Thesis 1: Information about an individual’s
location is substantially different from other kinds
of personally identifiable information.
17
Thesis 2: Ubiquitous positioning devices and easy-
to-use APIs make information about an individual’s
location much easier to capture than other kinds of
personally identifiable information.
18
Case in point: Android
mFusedLocationClient.getLastLocation()
.addOnSuccessListener(this, new OnSuccessListener<Location>() {
@Override
public void onSuccess(Location location) {
// Got last known location.
//In some rare situations this can be null.
if (location != null) {
// Logic to handle location object
}
}
});
19
Thesis 3: Users of information services have a
substantial incentive to share their location with
service providers, as location information can
significantly improve the quality of a service and
make it more useful.
20
21
22
Thesis 4: Users often share their current location
unknowingly.
23
24
25
Thesis 5: Having access to a user’s location
history allows for a broad range of location-based
inferences, such as information about their health,
consumer behavior, or social status.
26
27
Thesis 6: Location-based inferences can reveal
information that the user never intended or agreed
to share with a service.
28
29
Thesis 7: Incorrect location-based inferences can
have severe adverse effects for affected individuals,
with little or no opportunity to rectify these
errors.
30
31
Economic value of location
information
32
33
34
Thesis 8: Knowing a customer’s location is an
economic asset for a business.
35
36
Thesis 9: Users value their own location
information based on level of detail and use case.
37
Thesis 10: A new market is currently emerging in
which businesses and users directly trade personal-
level location information.
38
39
40
Thesis 11: Discounts for customers who agree to
share their location with a business are effectively
penalizing customers who refuse to do so, and may
erode the solidarity principle behind collective
insurance.
41
42
Safeguarding geoprivacy
43
44
Thesis 12: Preserving geoprivacy involves more than
obfuscating geographic coordinates. Location can be
inferred from non-explicit geospatial information
such as interests, activities, and socio-
demographics.
45
Digital exhaust
Let's say I'm careful to keep any location
information off Facebook, but I like the pages of FC
København, Aalborg University Copenhagen, Vega music
club, etc.
⇢ How hard will it be to figure out where I live?
46
Thesis 13: Any location-based service offered to a
user is limited by the amount of private
information the user is willing to share.
47
48
Thesis 14: Mobile operating systems lack fine-
grained control mechanisms for location services,
thus severely limiting the degree of control users
have over their location information.
49
50
Thesis 15: An individual’s level of geoprivacy
cannot be reliably assessed because it is
impossible to know what auxiliary information a
third party may have access to.
51
Tell-all telephone
52
Legal and ethical aspects
53
Thesis 16: The ethical ramifications of advances in
location-enabled technology are often viewed as an
afterthought and legal concerns over privacy
aspects lag behind technological advances.
54
55
Geoprivacy as a
tension field
56
Thesis 17: Geoprivacy as a research topic is
situated in a tension field between technological,
ethical, economical, legal, and educational aspects
that have only been addressed separately so far.
57
Economic
Interest
driven by leverages
enable
provide
offer
depends on
has
is looking for
provides
installs
and uses
influence
use
influences
influence
regulate
implement
Ethical
Considerations
Legal
Framework Tools
Service
Provider
Technological
Developments
User
Location
Information
Precision
Information
and Education
Utility
share data
with
Third Party Services
and Businesses
58
Thesis 18: Users often have no way of checking
whether the location-aware services and devices
they use act within the legal and ethical
frameworks and adhere to the provided description
and privacy policy.
59
60
61
Thesis 19: A higher level of user education in the
area of position tracking and location-based
services is required to allow them to make more
informed decisions about the tools and services
they are using.
62
Anecdotal evidence that there is room for
improvement...
Several students in my undergraduate Digital Earth
class thought that the satellite element of the GPS
system could track each individual GPS receiver
63
Thesis 20: A better-educated user base can push for
more restrictive legislation and force service
providers to be more transparent about their data
collection and use policies.
64
The political dimension of
geoprivacy
65
Thesis 21: Constant surveillance of citizens’
locations can be used as a tool for oppression and
to limit freedom of speech, even in democracies.
66
.
.
See ZDNET and NY Times
67
68
Privacy is an achievement of
modern civilization, and not
just a mere "blip in human
history" %
%
Weigend, A. (2017). Data for the people: How to make our post-privacy economy work
for you. New York, NY: Basic Books. P. 47.
69

Geoprivacy Talk @ UJI Castellòn

  • 1.
    GEOINFORMATICS AALBORG UNIVERSITY COPENHAGEN Everymove you make: An update on the state of GEOPRIVACY Carsten Keßler | Aalborg University Copenhagen http://carsten.io | @carstenkessler 1
  • 2.
    Every breath youtake Every move you make Every bond you break Every step you take I'll be watching you 2
  • 3.
    Every breath youtake Every move you make Every bond you break Every step you take I'll be watching you 3
  • 4.
  • 5.
    Keßler, C. &McKenzie, G., 2018. A geoprivacy manifesto. Transactions in GIS, 22(1), pp.3–19. 5
  • 6.
  • 7.
  • 8.
    Meet Jane After Janewakes up to the chime of her smartphone’s alarm, she brings up the weather app to check how to dress for the day. While she skims her inbox, her phone brings up an alert, telling her that her commute might take a little longer today because of construction work on her subway line. She quickly gets ready and leaves the house, to make sure she will not be late for work, and swipes her monthly pass to enter the subway station. Since the construction work only caused a few minutes’ delay in her commute, she still has time to stop at her favorite coffee shop, using her credit card to pay for a cappuccino. When she enters the office building she works in, her phone brings up the reminder she had set the day before to make sure she downloads the client presentation she had been working on last night from her cloud storage to her office computer. 8
  • 9.
    Meet Tom Jane’s husbandTom left the house early this morning for a two-day meeting out of town. He did not really mind the 2 hr drive, since this was his first opportunity for an extended trip in his brand new car. When he purchased it the week before, he had signed up for the roadside assistance plan after his old station wagon had left him stranded several times. Following the GPS instructions, he takes the toll bridge to get out of town and onto the highway. Before he arrives at the meeting, he decides to find a place for breakfast, checking for online ratings and recommendations first. Later that day, Tom goes out to have dinner with his colleagues, checking in at the restaurant with his favorite social network to let his friends know about their fantastic selection of red wines. After paying with his company credit card, he uses the limousine app on his phone to find a nearby driver to take him back to the hotel. 9
  • 10.
    Location data sharedwith ... The weather app provider, the operator of the digital assistant, the subway operator, two credit card companies, the reminder app, the cloud storage provider, the roadside assistance provider, the toll station operator, the restaurant ratings service, the social network, and the limousine app service 10
  • 11.
  • 12.
    Two categories — Concretelat/lon position, usually provided by GPS or mobile device's location services — Places or objects that can easily be located, e.g. toll station, subway gate, or restaurant name 12
  • 13.
    What is geoprivacy? "Aspecial type of information privacy which concerns the claim of individuals to determine for themselves when, how, and to what extent location information about them is communicated to others. In short, control of location information is the central issue in location privacy." (Duckham & Kulik, 2006, p. 36). 13
  • 14.
    What is geoprivacy? "Itrefers to the ability of an individual to move in public spaces with a reasonable expectation that their location will not be systematically and secretly recorded for later use by a third party." (Kerski & Clark, 2012 as cited by Kerski, 2016). 14
  • 15.
    Why a manifesto? —State and reflect on the state of the art — Formulate goals and challenges — Trigger a discussion in the community — Allows you to voice your opinion, not just scientific facts ⇢ 21 theses on geoprivacy 15
  • 16.
    Yet again, spatialis special 16
  • 17.
    Thesis 1: Informationabout an individual’s location is substantially different from other kinds of personally identifiable information. 17
  • 18.
    Thesis 2: Ubiquitouspositioning devices and easy- to-use APIs make information about an individual’s location much easier to capture than other kinds of personally identifiable information. 18
  • 19.
    Case in point:Android mFusedLocationClient.getLastLocation() .addOnSuccessListener(this, new OnSuccessListener<Location>() { @Override public void onSuccess(Location location) { // Got last known location. //In some rare situations this can be null. if (location != null) { // Logic to handle location object } } }); 19
  • 20.
    Thesis 3: Usersof information services have a substantial incentive to share their location with service providers, as location information can significantly improve the quality of a service and make it more useful. 20
  • 21.
  • 22.
  • 23.
    Thesis 4: Usersoften share their current location unknowingly. 23
  • 24.
  • 25.
  • 26.
    Thesis 5: Havingaccess to a user’s location history allows for a broad range of location-based inferences, such as information about their health, consumer behavior, or social status. 26
  • 27.
  • 28.
    Thesis 6: Location-basedinferences can reveal information that the user never intended or agreed to share with a service. 28
  • 29.
  • 30.
    Thesis 7: Incorrectlocation-based inferences can have severe adverse effects for affected individuals, with little or no opportunity to rectify these errors. 30
  • 31.
  • 32.
    Economic value oflocation information 32
  • 33.
  • 34.
  • 35.
    Thesis 8: Knowinga customer’s location is an economic asset for a business. 35
  • 36.
  • 37.
    Thesis 9: Usersvalue their own location information based on level of detail and use case. 37
  • 38.
    Thesis 10: Anew market is currently emerging in which businesses and users directly trade personal- level location information. 38
  • 39.
  • 40.
  • 41.
    Thesis 11: Discountsfor customers who agree to share their location with a business are effectively penalizing customers who refuse to do so, and may erode the solidarity principle behind collective insurance. 41
  • 42.
  • 43.
  • 44.
  • 45.
    Thesis 12: Preservinggeoprivacy involves more than obfuscating geographic coordinates. Location can be inferred from non-explicit geospatial information such as interests, activities, and socio- demographics. 45
  • 46.
    Digital exhaust Let's sayI'm careful to keep any location information off Facebook, but I like the pages of FC København, Aalborg University Copenhagen, Vega music club, etc. ⇢ How hard will it be to figure out where I live? 46
  • 47.
    Thesis 13: Anylocation-based service offered to a user is limited by the amount of private information the user is willing to share. 47
  • 48.
  • 49.
    Thesis 14: Mobileoperating systems lack fine- grained control mechanisms for location services, thus severely limiting the degree of control users have over their location information. 49
  • 50.
  • 51.
    Thesis 15: Anindividual’s level of geoprivacy cannot be reliably assessed because it is impossible to know what auxiliary information a third party may have access to. 51
  • 52.
  • 53.
  • 54.
    Thesis 16: Theethical ramifications of advances in location-enabled technology are often viewed as an afterthought and legal concerns over privacy aspects lag behind technological advances. 54
  • 55.
  • 56.
  • 57.
    Thesis 17: Geoprivacyas a research topic is situated in a tension field between technological, ethical, economical, legal, and educational aspects that have only been addressed separately so far. 57
  • 58.
    Economic Interest driven by leverages enable provide offer dependson has is looking for provides installs and uses influence use influences influence regulate implement Ethical Considerations Legal Framework Tools Service Provider Technological Developments User Location Information Precision Information and Education Utility share data with Third Party Services and Businesses 58
  • 59.
    Thesis 18: Usersoften have no way of checking whether the location-aware services and devices they use act within the legal and ethical frameworks and adhere to the provided description and privacy policy. 59
  • 60.
  • 61.
  • 62.
    Thesis 19: Ahigher level of user education in the area of position tracking and location-based services is required to allow them to make more informed decisions about the tools and services they are using. 62
  • 63.
    Anecdotal evidence thatthere is room for improvement... Several students in my undergraduate Digital Earth class thought that the satellite element of the GPS system could track each individual GPS receiver 63
  • 64.
    Thesis 20: Abetter-educated user base can push for more restrictive legislation and force service providers to be more transparent about their data collection and use policies. 64
  • 65.
    The political dimensionof geoprivacy 65
  • 66.
    Thesis 21: Constantsurveillance of citizens’ locations can be used as a tool for oppression and to limit freedom of speech, even in democracies. 66
  • 67.
    . . See ZDNET andNY Times 67
  • 68.
  • 69.
    Privacy is anachievement of modern civilization, and not just a mere "blip in human history" % % Weigend, A. (2017). Data for the people: How to make our post-privacy economy work for you. New York, NY: Basic Books. P. 47. 69