iPhone location data controversy won't go away, despite no real evidence

There were two comments to my previous post about the iPhone and iPad's storage of location data that I want to address:

Anonymous said...
Except that apple is not using the location based services (which I can turn off) in this case, but instead is using cell phone tower triangulation that I can not turn off.
I did not agree to that !!!!!!

Anonymous said...
It says "real-time location data". This does not address access to historical location data, which is different.
...and, like the previous reply said, you can't actually turn off the tower triangulation unless you turn the phone off.

Indeed, there is evidence that turning off location services does not actually stop the storage of such information.  Hopefully, Apple will address this issue very soon, especially considering that using the term "location services" implies more than just GPS, and presumably includes cell tower triangulation data. Still, as I stated in the previous post, the storage of this data is expressly contemplated in the licensing agreements.  The second comment, which suggests that "[i]t says "real-time location data". This does not address access to historical location data, which is different" is actually incorrect, as the license agreement says "...transmit, collect, maintain, process and use your location data, including the real-time geographic location..." Specifying the inclusion of real-time data does not exclude historical data, only that it is a part of a larger body of data.

The bigger issue are the allegations that the "iPhone sends your location to Apple twice a day." Despite this blog post and some rather sensational news reporting of this issue last week and throughout the weekend, no one has actually been able to produce a shred of data that suggests this is true.  While no one can prove a negative, @Dakahuna2007 captured 24 hours of his iPhone's traffic this weekend and found no such "phone home" evidence.

In closing, I'll ask the same question I asked last week: Does anyone actually have a capture file showing location data being transmitted to Apple, or are we just repeating unsubstantiated rumors?

Outrage over storage of Apple location data is misplaced

The infosec community is outraged today that iPhones and iPads are storing location data. Headlines proclaim the travesty: iPhone and iPad 3G caught keeping secret location tracking database andiSpy Conspiracy: Your iPhone Is Secretly Tracking Everywhere You've Been. Two researchers developed an open source application that plots this location data on a map.  I too would be outraged, except for the fact that Apple's licensing agreements for the iPad and iPhone expressly address this issue:

(b) Location Data. Apple and its partners and licensees may provide certain services through your iPad that rely upon location information. To provide these services, where available, Apple and its partners and licensees may transmit, collect, maintain, process and use your location data, including the real-time geographic location of your iPad. The location data collected by Apple is collected in a form that does not personally identify you and may be used by Apple and its partners and licensees to provide location-based products and services. By using any location-based services on your iPad, you agree and consent to Apple's and its partners' and licensees' transmission, collection, maintenance, processing and use of your location data to provide location-based products and services. You may withdraw this consent at any time by not using the location-based features or by turning off the Location Services setting on your iPad. Not using these features will not impact the non location-based functionality of your iPad. When using third party applications or services on the iPad that use or provide location data, you are subject to and should review such third party's terms and privacy policy on use of location data by such third party applications or services.

 Note that the iPhone agree is virtually identical. The text in bold is Apple's emphasis.

Now I'll be the first to admit that I don't read terms of service and licensing agreements. Very few people do, but the failure to do so doesn't give you a free pass to complain. Ignorance of service agreements does not justify moral outrage. You suck it up and admit to yourself that you didn't read it, and move on.

Apple #FAIL in the App Store

Yesterday came news from Apple and app developers that WiFi scanning apps were being banned from the App Store. The reason? "[U]sing private frameworks to access wireless information," which seems to be code for anything that is using the iPhone's 802.11 radio. Any of these such apps have been removed, including WiFiTrak, WiFiFoFum, yFy Network Finder, WiFi-Where, WiFi Get and WiFi Get Plus. It is interesting to note that among them, WiFiFoFum has been available on the App Store since September 2008.

To me, this means either that 1) Apple's security process is incredibly flawed (having an allowed an app that used a "private framework" since 2008); or more likely 2) it's not about security at all, and more about DRM, control and changing the rules at their own whim (which, frankly, also says a lot about their security process).

I don't have my phone with me at the moment, but I am assuming that any such apps already installed should continue to work (I have read about the rumored Apple remote kill switch for apps, but that they have apparently never actually used it). As a result this will just add momentum to the reasons to jailbreak; the developer of yFy Network Finder has signalized his intent to make his app available on Cydia.

I'm gonna go out on a limb here and say that Apple probably won't be refunding money to the people who paid for these apps, either.

#FAIL

BWI Airport woes

Yesterday my wife and I went to Baltimore-Washington International Airport (BWI) to pick up our daughter who was flying into town on Southwest. We arrived at about 4:45PM to pick her up from her 5:05PM arriving flight, and because she is a minor, I figured I would go meet her at the gate.

I explained my situation to the agent at the beginning of the ticket lines and she quickly ferried me into a short line, avoiding the dozens of passengers checking in for flights. After all, I only needed a gate pass, not a ticket. It wasn't going to take the ticket agent very long to get me through.

Passengers were getting checked in at a healthy rate from lines to the left and right of me, but it seemed like only one agent was handling the people in my line. It was pretty slow going and I was getting a little impatient. Our daughter's flight was due to arrive soon.

Finally I was next in line, but the agent who was handling the people in front of me suddenly starting accepting passengers from the queue on our right, signalling to me that she was alternating lines. Not so, as she accepted three more passengers from the right line. I threw up my hands in an exagerrated "What the heck" type of look, and explaining that I only needed a gate pass. Meanwhile, another ticket agent who was helping people inexplicably walked away from his terminal.

My daughter called and explained that her plane had already landed. I finally approached the counter and explained that I only needed a gate pass, not a ticket. It took the ticket agent less than one minute to get me a gate pass. The flight was arriving at Gate A1, but she told me that I should go through the security checkpoint at Gate B because it was faster.

I hustled off to the security checkpoint but there were probably 50-100 people in front of me which would have been a considerable wait. My daughter called again to let me know she was in the terminal, so at this point I pretty much abandoned my plan to meet her at the gate and just guide her to baggage claim. I walked back passed the ticket agents on the way to baggage claim and passed the security checkpoint in front of the A gates, where less than a dozen people were in line. So much for being faster the other way...

My wife was driving the Jeep and I tried calling her to let her know our timetable, but the calls failed. Again, and again. And again. I tried at least a dozen times, but no luck. AT&T, 3G service showing 4-5 bars, but calls failed. I tried an email, failed. Nothing was working.

I ended up meeting our daughter at baggage claim and were fortunate to grab her bag and meet up with my wife without incident. As we were driving away from the terminal, my email arrived...

Southwest Airlines was disappointing. Meeting a minor at the gate is no problem, airlines will give you a gate pass to get through security, but if you can't even remotely get there in time, what is the point? I realize that ticket agents are busy, but I was presumably put in the "quick" line because I wouldn't have burdened them for more than a minute. Which is exactly what ended up happening. I realize that I probably could have arrived at the airport sooner, but even 30 minutes earlier might not have been enough time.

AT&T was a complete FAIL. 4-5 bars of service means nothing when the backhaul isn't sufficient to meet demand. No doubt time of day and location are factors here, but reliability of absolutely zero is unacceptable anywhere given otherwise normal conditions.

But hey, its Friday. ;-)