As the furball around a
recently publicized hidden iOS location tracking file continues to expand, both a senator and a congressman have sent separate letters to Apple CEO Steve Jobs, asking about the file and why it is unencrypted. At the same time, it seems the discovery is not a discovery after all.
Sen. Al Franken (D-MN), sent a letter dated Wednesday, April 20 to Apple CEO Steve Jobs (.PDF), in which he said (in part):
[...] because the data is stored in multiple locations in unencrypted format, there are various ways that third parties could gain access to this file. Anyone who finds a lost or stolen iPhone or iPad or who has access to any computer used to sync one of these devices could easily download and map out a customer’s precise movements for months at a time. It is also entirely conceivable that malicious persons may create viruses to access this data from customers’ iPhones, iPads, and desktop and laptop computers. There are numerous ways in which this information could be abused by criminals and bad actors
Franken also asked the following questions, of which it would be interesting to see an official Apple response:
- Why does Apple collect and compile this location data? Why did Apple choose to initiate tracking this data in its iOS 4 operating system?
- Does Apple collect and compile this location data for laptops?
- How is this data generated? (GPS, cell tower triangulation, WiFi triangulation, etc.)
- How frequently is a user’s location recorded? What triggers the creation of a record of someone’s location?
- How precise is this location data? Can it track a user’s location to 50 meters, 100 meters, etc.?
- Why is this data not encrypted? What steps will Apple take to encrypt this data?
- Why were Apple consumers never affirmatively informed of the collection and retention of their location data in this manner? Why did Apple not seek affirmative consent before doing so?
- Does Apple believe that this conduct is permissible under the terms of its privacy policy? See Apple Privacy Policy at “Location-Based Services” (accessed on April 20, 2011),
- available at www.apple.com/privacy.
- To whom, if anyone, including Apple, has this data been disclosed? When and why were these disclosures made?
On Thursday, Franken was joined by Rep. Ed Markey (D-MA). He also sent a letter to Steve Jobs, but he asked Jobs about the possible effect of this file on minors. After all, iDevices are quite popular with minors, and Markey asked:
Given the widespread usage of iPhones and iPads by individuals under the age of 18, is Apple concerned that the wide array of precise location data logged by these devices can be used to track minors, exposing them to potential harm? If yes, what is Apple doing to reduce the potential for such harm? If not, why not?
However, it seems that the discovery made by the two researchers, Allan and Warden, and disclosed on Wednesday wasn’t a discovery at all. The hidden file in iPad 3Gs and iPhones that contained tons of location data had previously been detailed, by one Alex Levinson, a student at the Rochester Institute of Technology, who says he discovered this file back in 2007, as part of his research and work with forensic firm Katana Forensics.
Why, then, did no one notice it then? And why did no one listen to Levinson on Wednesday, when he was reportedly emailing media about it?
First, in 2007, he published the research in “Hawaii International Conference for System Sciences 44.” If he really wanted to get some attention, there is nothing wrong with that, but perhaps clueing in CNN might help. [In all fairness, however, he also contributed a chapter to a book on iOS forensic analysis, "iOS Forensic Analysis: for iPhone, iPad, and iPod touch," which although it is certainly not a NYT bestseller, ranks 31 on Amazon.com for books on Security and Encryption. One would think that might have brought some attention to the matter.]In a blog post, Levinson said the following:
This hidden file is nether new nor secret. It?s just moved. Location services have been available to the Apple device for some time. Understand what this file is ? log generated by the various radios and sensors located within the device. This file is utilized by several operations on the device that actually is what makes this device pretty ?smart?.
Through my work with various law enforcement agencies, we?ve used h-cells.plist on devices older than iOS 4 to harvest geolocational evidence from iOS devices.
Yep, you read that correctly: it’s already being used by law enforcement. He spoke to GigaOM, and there was more:
[...] the press missed the story first time around, and now seems more focussed on the horror of data storage than the reality (there, for example, is no evidence that the data is sent back to Apple at the moment).
?I do blame the press somewhat for sensationalizing them without recourse,? he says. ?I emailed 20 of the top media outlets who covered this, linking them to my side ? none of them replied, except a famous blogger who cursed me.?
Although this isn’t new news, it’s certainly news. The fact of the matter is that despite the fact that the data isn’t being sent back to Apple (yet), the data is stored unencrypted on the device and on your computer. That’s pretty risky. As far as what the file is there for, Daring Fireball believes it’s a bug, and that it was the log file was supposed to be culled. If that were true, however, then that “bug” has been around since 2007, according to Levinson’s findings.
We’ve all thought it, but never dared think it could be true: what if Microsoft, Yahoo, and AOL actively monitor our instant messenger chats? What if mentions of ‘bomb’ and ‘underage’ are tracked and sent to law enforcement agencies? What if chat providers don’t agree with the things we say, or the links we share, and filter or censor the content of our transmitted messages?
