GEOG 479
Cyber-Geography in Geospatial Intelligence

Expectations of the Intelligence Community and the Current Understanding of IP Geolocation Technologies

Print

Geolocation data, in the context of this class, is the information collected through tracking technologies or other means regarding an individual's location in the world. This data can be collected through multiple means and can be used for multiple purposes, including: providing directions, unlocking locked vehicle doors, avoiding traffic issues, direct marketing of products and services based on your current location, tracking and locating employees, providing assistance in an emergency, monitoring children or even monitoring elderly family members with memory issues, and monitoring sex offenders and other criminals. Despite multiple legitimate and, in some instances, invaluable uses, the collection of geolocation data also can provide individuals, businesses, and, particularly, governments with serious privacy concerns and responsibilities.

Geodata is valuable intellectual property that is usually owned by the collection agency doing the collecting, unless the ownership has been transferred or sold to someone else. The entity collecting the geodata – whether intentionally or supplemental to other data being collected – is logically responsible for the use, maintenance, security, and disposal of the data – or should be.

Geolocation data is collected in multiple ways, including GPS devices, web browsing using IP addresses of personal computers, 3G mobile smart phones, credit card transactions, highway toll collection technologies, recharging connection for electric automobiles (via Smart Grid technology), geotags in photos, and posts on Facebook among other social networking sites. As this data is collected and compiled, it is becomes exponentially easy for the companies collecting the data - and their clients - to watch an individual's routines, habits, and transactions and accurately predict an individual's future course of action. With such predictive power, businesses (and governments) are able to target customer’s habits on a time and location specific basis, making geolocation data a valuable component of intellectual property for any business and a possible source of intelligence for a government. The entities collecting geodata are numerous, especially when you consider the number of businesses (and other entities) that collect geodata supplemental to other data collected.

Examples of this are credit card companies that obtain geodata each time a person uses a credit card. The collection of geodata is supplemental to the primary purpose of collecting the underlying transaction information – goods or services purchased, amount of the transaction, etc.). Geodata collection entities include 3G phone companies, TV cable companies, ISP providers, banks, state toll highway collectors, federal, state, and local law enforcement agencies, advertisers, and others.

Surprisingly, there are few legal restrictions on how these geodata collection entities can use the data collected, how long they can maintain it, and who they can share it with. Laws and statutes regarding the collection and use of geodata are still limited at both the state and federal levels. When geodata is conflated with other data that gives an entity the ability to identify an individual or a specific industry or category of information that is itself regulated (i.e., bank records, health records (HIPPA), etc.), the data are considered personally identifiable information ("PII") and are protected by additional laws and regulations. Title II of the Communications Act imposes numerous obligations on telecommunications companies for the handling of customer information, including geodata, and requires consumer consent before the data can be shared. Further, the Cable Communications Policy Act of 1984 (added to the Communications Act of 1934), which applies to cable operators who may collect geodata through ISPs or other means, imposes various obligations on cable operators that involve PII.

In online advertising, where advertisers can use geodata to monitor and analyze an individual's behavior for marketing purposes, the Federal Trade Commission ("FTC") issued a report in 2009 called “Self-Regulatory Principles For Online Behavioral Advertising: Behavioral Advertising Tracking, Targeting & Technology.” It contains self-regulatory guidelines for the online advertising industry. These are further codified by the Practicing Law Institute in, “Online Behavior Advertising: Industry's Current Self-Regulatory Framework is Necessary, but Still Insufficient On Its Own To Protect Consumers,” 994 PLI/Pat 797 , 804 (West 2010). Additionally, many online advertising industry groups released self-regulatory guidelines for industry entities. While the FTC has not specifically defined "sensitive data," precise geographic location is provided as an example of "sensitive data." The FTC recommends in its report that entities provide written notice on their websites that data is being collected, that consumers have the ability to opt-out of the collection process, that consumers are made aware of any changes in any agency or company privacy policies and must provide consent before previously-collected data is used in a fashion not originally stated in the privacy policy, and mandatory "opt-in" for the handling of sensitive information (although the FTC has not specifically defined "sensitive data," precise geographic location is provided as an example of "sensitive data"). It should be noted that these recommendations are not binding and only serve as a guide to online advertisers collecting relevant data, except where FTC law explicitly states otherwise.

In conclusion, in the US, collection of geodata is a hot topic because of the 4th Amendment and law enforcement surveillance ("The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. Constitution, 4th Amendment.) There is still some debate whether an individual has a reasonable privacy interest in their own movement (i.e., geolocation). Currently, federal case law generally allows the installation and use of GPS devices by the government to track a suspect's vehicle without a warrant for a limited time. (See, e.g., United States v. Moran, 349 F. Supp. 2d 425, 432 (N.D.N.Y 2005); but see United States v. Maynard, 615 F.3d 544, 558 (D.C. Cir. 2010) cert. denied, 131 S. Ct. 671, 178 L. Ed. 2d 500 (U.S. 2010) (warrantless use of global positioning system (GPS) device on defendant's vehicle for a month was a search.) Such use is not protected or limited in most overseas countries. More on this later.

As mentioned earlier, many businesses collect geodata supplemental to other information collected. Each time you use an electronic toll-paying device, some state authority knows where you are and where you are traveling in a general sense. When and if this data is aggregated, discernible patterns may develop. If you travel through the same toll booth in a M-F workweek at the same time, the state authority not only knows you paid a toll, but it can approximate when you go to work each day and when you come home (and, by extension, what route you take). While this data may be of limited use to the state, other commercial businesses may have uses for it. This geodata combined with other personal information that may be available with the state authority may also hold value for criminals and other unauthorized persons.

What the Experts Say: To better understand the current limits of geolocating over the Internet, you may want to review the following papers on the topic:

  1. “Towards Street-Level Client Independent IP Geolocation” with a (Listen to the Experts) presentation by the authors at the link below: (highly recommended to view)
    Click here for transcript of the Towards Street-Level Client-Independent IP Geolocation video.

    Insert transcript here

    Credit: Aleksandar Kuzmanovic, Northwestern University
  2. “Mining the Web for IP Address GeoLocations”
  3. “An Investigation of Geographic Mapping Techniques for Internet Hosts”