In The core of the matter at hand I gave the example of someone attending a conference while subscribed to a geo-location service. I argued that the subscriber's cell phone would pick up all the MAC addresses (which serve as digital fingerprints) of nearby phones and laptops and send them in to the centralized database service, which would look them up and potentially use the harvested addresses to further increase its knowledge of people's behavior – for example, generating a list of those attending the conference.
A reader wrote to express disbelief that the MAC addresses of non-subscribers would be collected by a company like Google. So I close this series on WiFi device identifiers with this quote from what Google calls its “refresher FAQ” (emphasis in the quote below is mine):
How does this location database work?
Google location based services using WiFi access point data work as follows:
- The user’s device sends a request to the Google location server with a list of MAC addresses which are currently visible to the device;
- The location server compares the MAC addresses seen by the user’s device with its list of known MAC addresses, and identifies associated geocoded locations (i.e. latitude / longitude);
- The location server then uses the geocoded locations associated with visible MAC address to triangulate the approximate location of the user;
- and this approximate location is geocoded and sent back to the user’s device.
So certainly the MAC addresses of all nearby phones and laptops are sent in to the geo-location server – not simply the MAC addresses of wireless access points that are broadcasting SSIDs. And this is significant from a technical point of view.
Why not edit out the MAC addresses you don't need prior to transmission, reducing transmission size, cost and the amount of work that the central database server must do? Clearly, it was considered useful to collect all the phone fingerprints – including those of non-subscribers. Of course Google's WiFi cars also collect the same fingerprints – while driving past peoples’ homes. So it is clearly possible for their system to match the fingerprints of non-subscribers to their home locations, and thus to their natural identities.
Is this matching of non-subscribers being done today? I have no idea. But Google has put in place all the machinery to do it and pays a premium to operate its geolocation service so as to gather this information. Further, if allowed to mature, the market for the extra intelligence collected about our behaviors will be immense.
So there is nothing unlikely about the scenario I describe. I have now examined all the issues I wanted to bring to light and I'll move on to other matters for a while.
