![\"\"](\"\/wp-content\/images\/2010\/06\/WirelessMacAddresses.GIF\")
<\/p>\nWe've explored many of the basic issues of\u00a0WiFi snooping.\u00a0\u00a0I would now like to go\u00a0directly\u00a0to\u00a0the core of\u00a0the matter: why do large centralized databases of MAC addresses linked to our street addresses have really serious consequences for\u00a0peoples’ privacy?\u00a0 I'd like to approach this through an example:<\/p>\n
Consider the case of someone attending a conference at which people are using laptops and phones over a wireless network.\u00a0 We picture the devices within range of a given attendee in Figure 1:<\/p>\n
<\/p>\n
The green dot represents the WiFi access point through which conference attendees gain access to the Internet.\u00a0 For now, let's assume this is a permanent WiFi network.\u00a0\u00a0Let's therefore assume its\u00a0MAC address and location are present within the linking database that also contains our residential MAC to street address mapping.<\/p>\n
Now suppose one or more people at the conference have opted into a geo-location service that makes use of the database.\u00a0 And let's assume that the way this service works is to listen for nearby MAC addresses (all the little circles in the figure) and submit them to the\u00a0geo-location system for analysis.<\/p>\n
The geo-location system will learn that the opted-in user (let's call him Red<\/strong>) is near the given WiFi point, and thus will know Red is at a given location.\u00a0 If the geo-location system is also capable of searching the web (as one would expect that Google's could), it will also\u00a0be able to\u00a0infer that\u00a0Red is in\u00a0a given hotel, and that\u00a0the hotel is hosting a conference C on the date in question.\u00a0<\/p>\n If Red stays in the same location for some time, and is surrounded by a number of other people who are in the same location (discernable because their MAC addresses continue to be near by), the smart service will be able to infer that Red is attending\u00a0conference C being held in the hotel.\u00a0<\/p>\n So far, there's nothing wrong with this, since Red has opted in to the geo-location service, and presumably been told that's how it works.<\/p>\n However, note that the geo-location system also learns about the MAC addresses of all the attendees within range who have NOT opted into the system (Green).\u00a0 And if they remain within range over time, it can also deduce that they too are present at conference C.\u00a0 Further, it can look up their MAC addresses in the database to discover their street addresses.\u00a0 This in turn can be used to make many inferences about who the attendees at the conference are, since a lot of information is keyed to their street addresses.\u00a0 That can itself become further profile information.<\/em><\/p>\n Opting out doesn't help<\/strong><\/p>\n The problem here is this:\u00a0\u00a0The geo-location system is\u00a0perfectly capable of tracking your\u00a0location and associating it with your home street address whether you opt in or not.\u00a0\u00a0Home address is\u00a0a key to many aspects of your identity.\u00a0 Presto – you have linked many aspects of your identity to your location, and this becomes intellectual property that the geo-location can service sell and benefit from in a myriad of ways.<\/p>\n Is this the way any particular geo-location services would actually work?\u00a0 I have no idea.\u00a0 But that's not the point.\u00a0 The point is that this is the capability one enables<\/strong> by building the giant central database of laptop and phone MAC addresses\u00a0linked to\u00a0street addresses.<\/p>\n Commercial interest will naturally\u00a0tend towards maximal use of these capabilities and the information at hand.\u00a0<\/p>\n That is why we need to fully understand the implications of wirelesstapping on a massive scale and figure out if and where we want to draw the line.\u00a0 How does the collection of MAC addresses using WiFi trucks relate to the regulations involving data collection, proportionality and consent?\u00a0 Are there limits on the usage of this data?\u00a0<\/p>\n One thing for sure.\u00a0 Breaking the Fourth Law, and turning a unidirectional identifier into a universal identifier is like the story of the Sorcerer's Apprentice.\u00a0 All the brooms have started dancing.\u00a0 I wonder if Mickey will get out of this one?<\/p>\n \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":" All the brooms have started dancing. I wonder if Mickey will get out of this one?<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,17,71,2,47,40,77],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1116"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1116"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1116\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}