May 11, 2020 19:00:00

“Buying and selling smartphone location information” has become a major business, and it is possible to easily identify an individual even from anonymized ones.

`` A large number of smartphones are tracking location information even in only some cities in Norway and it is sold, ''

NRK , a Norwegian public television and radio station, summarizes the content of its own survey ..

Avslørt av mobilen – Norge
https://www.nrk.no/norge/xl/avslort-av-mobilen-1.14911685

At any time such as work, kindergarten pick-up, dining out with friends, users bring out their smartphones. Therefore, by tracking the location information, it is possible to continuously collect the information 'What does this person like?'.

Some smartphone apps require access to your location, which allows the app to continuously collect your location. This data is invaluable, and many mobile app developers are making money by selling location information, 'creating a whole new industry,' NRK points out.

A company whose primary business is selling location information is called a 'data reseller.' Data resellers continue to sell location information collected from users' smartphones to companies, government agencies, and other organizations that want to know where people are. Data resellers claim that the data they sell is anonymized, so you shouldn't be able to determine the identity of the owner of your smartphone just by getting your location.

However, NRK said, 'How anonymous is the data that is actually sold? Is it possible that the location information could fall into the wrong company? To solve these questions , We started a survey of data resellers around the fall of 2019, 'explaining how we started a survey on data resellers that sell location information.

First, NRK attempted to purchase location data for smartphones used in Norway from several data resellers in order to investigate whether the data was completely anonymized. NRK explained to the data resellers, 'It is necessary to use location information in projects related to people's movement patterns and public transport public development,' and the reason for the purchase.

One of the data resellers in response to NRK's request is a British company called 'Tamoco'. NRK will pay NOK 35,000 and get a comprehensive dataset from Tamoco that summarizes location data collected from tens of thousands of Norwegians in 2019. This data is a collection of location information collected from over 140,000 mobile terminals.

The dataset that NRK purchased from Tamoco is location information for tens of thousands of people collected from 140,000 mobile terminals, and the number of location information exceeds 400 million points. It seems that location information was summarized in a

table format in the dataset. In addition, the location information gathered on the table includes the date, time, and information about the mobile terminal that was the source of the information, as well as `` When, where was the mobile terminal, It showed exactly, ”NRK said.

The number of location information provided differs depending on the mobile terminal, and it seems that some terminals provided thousands of location information and some terminals provided only tens of location information. ..

NRK uses the location information obtained from Tamoco to verify whether it is possible to identify the owner of the mobile device. First, NRK randomly selects one mobile device from the data set. The following is the location information of the terminal marked on the map with orange points, and according to NRK, 'I was tracking the location of the mobile terminal for most of 2019'.

Of these, NRK did a detailed survey of the places that mobile devices visited many times. Then, it turned out that the owner of the mobile terminal spends many days and nights at a specific address. From this, NRK speculates that the place you spend in the daytime is your 'workplace' and the place you spend at night is your 'address.'

First of all, when I investigated the place that seems to be an address, it turned out that a male and female couple live here. Next, when I searched the Facebook profile of these two people, I found that the profile of a man stated that he worked at a logistics company. When I looked up this logistics company, it seems that the owner of the mobile device matched the address of the place that he frequently visited during the day. Therefore, NRK wrote, 'Tamoco sells the data anonymously, but it was possible to identify the owner.'

It was Karl Bjarne Bernhardtsen, who lives in Norway, who collected the location information for one year. The data set purchased by NRK had been collecting Bernhardtsen's location information for over 200 days. In addition to Bernhardtsen's location information, there are places that I regularly ask in addition to my home and work, and when I asked the person directly, it turned out that this is the parents' home.

Further investigation of Bernhardtsen's location information revealed that at some point in May, he was moving to a place different from his workplace during the day. Stay at the destination for about an hour, then move again. Since it was moving at high speed on the road at the time of movement, it can be guessed that it was a car movement. Two weeks later, Bernhardtsen will go to a different place in the daytime than his first workplace. From this, Bernhardtsen lost his job around May, was able to guess that he found a new job and found a new job, even with only location information. If you combine this with information published on social networks such as Facebook, you should be able to more accurately infer information about Bernhardtsen.

The location data set obtained by NRK contains location information for tens of thousands of people other than Bernhardtsen, so what happens if a criminal accesses this information? Is not it. NRK made an appointment directly with Bernhardtsen and told him that the above location information was collected. Bernhardtsen felt uncomfortable with his location being tracked in detail and said, 'Countries should protect this kind of data.' What was particularly uncomfortable for Bernhardtsen was the fact that he was being tracked in detail, such as 'he was visiting the hospital when his son was born' and 'on vacation with his family at a specific point'. That's right.

There are also cases in which the location information records Bernhardtsen's behavior on a specific date in more detail than the person himself. For example, on Saturday, June 22, 2019, Mr. Bernhardtsen is visiting the Christian Sun Zoo according to location information. The location was first recorded at 10:25 outside the restaurant inside the zoo. Around 11:57, according to the location information, we arrived in the jungle area, and when we actually checked with Bernhardtsen, it seems that the monkey was shooting in the area. At 14:39, we arrived at the boat bazaar area where ice cream and other products are sold. At 14:46 I came to the show area called Kjuttaviga, but Bernhardtsen said that he had never seen the show. Then, at 14:59, stop by the largest souvenir shop at Christian Sun Zoo, and at 15:59, head to the area where you can see wolves, wolves, and foxes. And at 18:15 we are heading to the car.

NRK survey results show that Norwegian location information is sold on the open market. It's definitely legitimate and in line with privacy law, Consumer Council

Inger Lise Blyverket (ILB) told NRK. An ILB official said, 'I think it's virtually impossible for consumers to know where their personal information will end up when they download the app, and then agree to the terms of use.' He pointed out that it is impossible to escape from tracking location information while using smartphones and apps in the ecosystem.

In 2018, the EU General Data Protection Regulation (GDPR) was enforced in EU countries including Norway. As a result, companies needed a well-documented and justified reason to legally store personal information such as an individual's name, phone number, and address. If a company fails to provide a sufficient basis for the retention of personal information, it may be fined under the GDPR. However, GDPR does not seem to be a major obstacle for data resellers who sell location information.

According to NRK, it is impossible to accurately estimate the number of Norwegians whose location information is tracked via the app. It's also very difficult for consumers to know which apps share data. In addition, some data resellers say that they 'share their location information with each other,' so there are cases where multiple companies are obtaining location information from the same app.

Bernhardtsen says, “I'm more afraid of the damage that people other than me will have, rather than the disaster that can happen to me by tracking location information.” Bernhardtsen hopes that politicians will take up the topic of location trading and help many understand what is happening and take precautions. In addition, Bernhardtsen is arguing that the apps installed on his smartphone should be reviewed and unnecessary ones removed.