Jacques Bus\u00a0recently shared a communication he has circulated about\u00a0the mobile technology issues I've been exploring.\u00a0 To European readers he will need no introduction:\u00a0 as Head of Unit for the European Commission's Information and Communication Technologies (ICT)\u00a0Research Programme he oversaw and gave consistency to the programs\u00a0shaping Europe's ICT research investment.\u00a0\u00a0Thoroughly expert and equally committed to results,\u00a0Jacques’ influence on ICT policy thinking is clearly visible in Europe.\u00a0\u00a0 Jacques\u00a0is now an independent consultant on ICT issues.<\/p>\n
On June 20, Kim Cameron [KC] posted a piece <\/a>on this blog titled: Harvesting phone and laptop fingerprints for its database – Google says the user\u2019s device sends a request to its location server with a list of all MAC addresses currently visible to it. Does that include yours?<\/p>\n It was the start of a series of communications that reads like a thriller. Unfortunately the victim is not imaginary, but it is me and you.<\/p>\n He started with an example of someone attending a conference while subscribed to a geo-location service. “I [KC] argued that the subscriber\u2019s cell phone would pick up all the MAC addresses (which serve as digital fingerprints) of nearby phones and laptops and send them in to the centralized database service, which would look them up and potentially use the harvested addresses to further increase its knowledge of people\u2019s behavior – for example, generating a list of those attending the conference.”<\/p>\n He then explained how Google says its location database works, showing that “certainly the MAC addresses of all nearby phones and laptops are sent in to the geo-location server – not simply the MAC addresses of wireless access points that are broadcasting SSIDs.”<\/p>\n His first post was followed by others, including reference to an excellent piece of Niraj Chokshi in The Atlantic and demonstrating that Google's messages in its application descriptions are, to say the least, not in line with their PR messages to Chokshi.<\/p>\n On 2 July a discussion of Apple iTunes follows in KC's post: Update to iTunes comes with privacy fibs with as main message: As the personal phone evolves it will become increasingly obvious that groups within some of our best tech companies have built businesses based on consciously crafted privacy fibs.<\/p>\n The new iTunes policy says: By using this software in connection with an iTunes Store account, you agree to the latest iTunes Store Terms of Service, which you may access and review from the home page of the iTunes Store. So iTunes says: Our privacy policy is that you need to read another privacy policy. This other policy states:<\/p>\n We also collect non-personal information – data in a form that does not permit direct association with any specific individual. We may collect, use, transfer, and disclose non-personal information for any purpose. The following are some examples of non-personal information that we collect and how we may use it:<\/p>\n \n I think KC rightly asks the question: What does downloading a song have to do with giving away your location???<\/p>\n Clearly Apple would call its unique device identifier – and its location – \u201dnon-personal data\u201d. However, personal data means in Europe any information relating to an identified or identifiable natural person. Even Google CEO Eric Schmidt <\/a>would under this EU definition supposedly disagree with Apple, given his statement in a recent speech quoted by KC: Google is making the Android phone, we have the Kindle, of course, and we have the iPad. Each of these form factors with the tablet represent in many ways your future\u2026.: they\u2019re personal. They\u2019re personal in a really fundamental way. They know who you are. So imagine that the next version of a news reader will not only know who you are, but it\u2019ll know what you\u2019ve read\u2026and it\u2019ll be more interactive. And it\u2019ll have more video. And it\u2019ll be more real-time. Because of this principle of \u201cnow.\u201d.<\/p>\n We could go on with the post of 3 July: The current abuse of personal device identifiers by Google and Apple is at least as significant as the problems I discussed long ago with Passport. He is referring to a story by Todd Bishop at TechFlash<\/a> – here I refer readers to the original thriller rather than trying to summarize it for them.<\/p>\n What is absolutely clear from the above is how dependent we all are on mobile technology. It is also clear that to enjoy the personal and location services we request one needs to combine data on the person and his location. However, I am convinced that in the complex society we live in, we will eventually only accept services and infrastructure if we can trust them to work as we expect, including the handling of our personal data. But trust can only be given if the services and infrastructure is trustworthy. O'Hara and Hall<\/a> describe trust on the Web very well, based on fundamental principles. They decompose trust in local trust (personal experience through high-bandwidth interactions) and global trust (outsourcing our trust decisions to trusted institutions, like accepted roles through training, witnessing, or certification). Reputation is usually a mix of this.<\/p>\n For trust to be built up the transparency and accountability of the data collectors and processors is essential. As local trust is particularly difficult in global transactions over the Web, we need stronger global trust through a-priori assurances on compliance with legal obligations on privacy protection, transparency, auditing, and effective law enforcement and redress. These are basic principles on which our free and developed societies are built, and which are necessary to guarantee creativity, social stability, economic activity and growth.<\/p>\n One can conclude from KCs posts that not much of these essential elements are represented in the current mobile world.<\/p>\n I agree that the legal solutions he proposes are small steps in the right direction and should be pursued. However, essential action at the level of the legislators is urgently needed. Data Protection authorities in Europe are well aware of that as is demonstrated in The Future of Privacy<\/a>. Unfortunately these solutions are slow to implement, whilst commercial developments are very fast.<\/p>\n Technology solutions, like developing WiFi protocols that appropriately randomize MAC addresses and also protect other personal data, are also needed urgently to enable develop trustworthy solutions that are competitive and methods should be sought to standardize such results quickly.<\/p>\n However, the gigantic global centralization of data collection and the possibilities of massive correlation is scaring and may make DP Commissioners, even in group in Europe, look helpless. The data is already out there and usable.<\/p>\n What I wonder: is all this data available for law enforcers under warrant and accepted as legal proof in court? And if not, how can it be possible that private companies can collect it? Don't we need some large legal test cases?<\/p>\n And let\u2019s not forget one thing: any government action must be as global as possible given the broad international presence of the most important companies in this field, hence the proposed standards of the joint international DP authorities in their Madrid Declaration<\/a>.<\/p>\n Smart questions and conclusions.<\/p>\n \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":" Influential European ICT expert Jacques Bus on my posts about MAC addresses and their use by Google and Apple<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[17,2,47,77],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1147"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1147"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1147\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n