If you are new to doing privacy threat analysis, I should explain that to\u00a0do\u00a0it, you\u00a0need to be thoroughly pessimistic.\u00a0\u00a0A privacy threat analysis\u00a0is in this sense no different from any other security\u00a0threat analysis.\u00a0\u00a0<\/p>\n
In\u00a0our pessimistic\u00a0frame of mind we then need to brainstorm from two different vantage points.\u00a0 The first is the vantage point of the party being attacked.\u00a0 How can people in various situations potentially be endangered by the new technology?\u00a0 The second is the vantage point of the attacker.\u00a0 How can people with different motivations misuse the technology?\u00a0 This is a long and complicated job, and should be done in great detail by those who propose\u00a0a technology.\u00a0 The results should be published and vetted.<\/p>\n
I haven't seen such publication or vetting by the proponents of world-wide WiFi packet collection and giant central databases of device identifiers.\u00a0 Perhaps the Street View team or someone else has such a\u00a0study at hand – it would be great for them to share it.<\/p>\n
In the meantime I'm just going to throw out a few simple initial ideas – things that are pretty obvious, by constructing a few scenerios.<\/p>\n
SCENARIO:\u00a0\u00a0Collecting MAC Addresses is Legal and Morally Acceptable<\/strong><\/p>\n In this\u00a0scenario it is legal and socially acceptable to drive up and down the streets recording people's\u00a0MAC addresses\u00a0and other network\u00a0traffic.\u00a0 \u00a0<\/p>\n It\u00a0is also fine for anyone to\u00a0use\u00a0a geolocation service to build\u00a0his own database of MAC addresses and street addresses.\u00a0<\/p>\n How could\u00a0a collector could possibly get the software to do this?\u00a0 No problem.\u00a0 In this scenario, since the activity is legal and there is a demand, the software is freely available.\u00a0\u00a0In fact it is widely\u00a0advertised on various Internet sites.<\/p>\n The collector\u00a0builds his collection\u00a0in the evenings, when people are at home with their WiFi enabled phones and computers.\u00a0 It\u00a0doesn't take very long to assemble a really detailed map of all the devices used by the people who live in an entire neighborhood\u00a0 – perhaps a rich neighborhood<\/em>.\u00a0<\/p>\n Note that it would not matter whether people in the neighborhood have their WiFi encryption turned on or off – the drive by collector would be able to map their devices, since WiFi encryption does not hide the MAC address.<\/p>\n SCENARIO 2 – Collector is a sexual predator<\/strong><\/p>\n In Scenario 1, anyone can be “a MAC collector”.\u00a0 In this scenario, the collector is a sexual predator.<\/p>\n When children pass him in the park, they have their phones and WiFi turned on and their MAC addresses are\u00a0discernable by his laptop software.\u00a0 Normally the MAC addresses would be meaningless random numbers, but\u00a0the collector\u00a0has\u00a0a complete database of what MAC addresses\u00a0are associated with a given house address.\u00a0\u00a0It is therefore simple for\u00a0the collection software on his\u00a0laptop to automatically convert\u00a0the WiFi\u00a0packets emitted from the childrens’ phones\u00a0into the\u00a0street addresses where the children live, showing\u00a0the locations\u00a0on a map.<\/p>\n There is thus no need for the collector to go up to the children and ask them where they live.\u00a0 And it won't matter that their parents have taught them never to reveal that to a stranger.\u00a0 Their devices\u00a0will have revealed it\u00a0for them.<\/p>\n I can easily understand that some people might have problems with\u00a0this example simply because so many questionable things have been justified through reference to predators.\u00a0 That's not a bandwagon I'm trying to get on.\u00a0<\/p>\n I chose the example not only because I think it's\u00a0real and exposes a threat, but because it reveals two important things germane to a threat analysis:<\/p>\n Finally, I hope it is obvious\u00a0I am not arguing Google\u00a0is doing\u00a0anything remotely on a par this example,\u00a0\u00a0I'm\u00a0talking about something different:\u00a0the matter of whether we want WiFi snooping to be something our society condones, and what some of the\u00a0software that might come into being\u00a0if we do.<\/p>\n \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":" What are the implciations of living in a world where it is legal and socially acceptable to drive up and down the streets recording people's MAC addresses and other network traffic? <\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[63,17,11,69,77],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1111"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1111"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1111\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n