The following informational note was prepared anonymously for the Ontario Civil Liberties Association (OCLA) by an informed industry professional.
Privacy Caution on the Use of WiFi: Trading your privacy for a little bit of Wifi
Did you never wonder how Facebook pays the bills? Have you sent them a cheque recently? Did you think those lame adds they show you for something you already bought last week were keeping the lights on? Did you think there was money in posting cute kitten videos on the Internet?
If you go to a mall or restaurant, and they have free Wifi, and you use your Facebook credentials to use the “Free” wifi, then you are the product. Your personal information is what they sell.
When you sign in to “free” wifi and use your FaceBook, or Google account as a credential to get access, you are compromising your privacy.
Wifi is “free” in the same way kittens are “free”. You can be sure there will be a cost down the road. In the case of Wifi, if you use credentials to sign in, the cost is your privacy.
The owner of that facility that provides the Wifi can buy your details from FaceBook and now knows just about everything they need to know about you. Name, Age, Sex, Phone Number, Where you live, who your friends are.
Every time you go to the mall, the Wireless Access Points (WAP’s) will see the MAC address of your phone. Even if you don’t sign in. Most people don’t turn off Wifi on their phones when they leave the house, they leave it on, meaning that wherever they go their phones are pinging off Wi-Fi access points, effectively leaving a digital footprint. (MAC is an acronym for Media Access Control, not “Macintosh”. It’s the unique 48 bit number burned in to every network chip in every network device ever made. The first 6 digits identify the manufacturer and the rest are a unique serial number. Every device has a unique serial number.)
If you go to a different mall owned by the same company, they will see you walking in. They will see that you have an iPhone, or an Android device from the MAC address, and the unique serial number ties it to you.
Do you remember the old Family Circus cartoons where little Billy took an indirect route home, and it was illustrated by the dashed lines all over the neighbourhood? Well, you can do that with any Wifi enabled device, but if you sign in with Facebook, now I can attach the name “William (Billy) Keane” to the ant track, and I can see where William Keane goes in the mall. Where he sits, for how long, where he meets friends, and if your friends sign in to the “Free” wifi, then I know who he is meeting. I can watch them all go to dinner or a movie together.
If you combine this information from closed circuit television streams, then they can literally watch you.
I can track how often you go to the mall, how long you stay, and which stores you go into. I know if you took the subway, or if you drove based on where I first see your device on the property. If I target you and your demographic with advertisements on Facebook, I can track how effective the advertising campaign is, because I can actually determine who comes to the store after the campaign has run.
That is information that mall owners use. If someone wants to open a store for teen fashions, I can prove to them that the teens come off the subway, go to food court, and then hang around the fountain for hours. That makes it easier to sell them a location near the fountain and have them pay more to be in the right spot. Foot traffic in a mall determines rents. Being able to target that information and get analytics down to the personal level means additional revenue for the mall owner.
Mall owners take a percentage of sales from all the stores, so it’s in their best interest not to put the teen fashions and the ice cream kiosk at the wrong end of the Mall near the Sears store or the bank, or some other boring old person’s store. It makes sense to cluster it with the other venues that cater to teens.
Individual retailers can watch you move through the store and see the hot and cold spots, and redesign the layout of the store to match foot traffic and demographics.
If you use your Facebook credentials to sign in to anything “Free” then you are selling your identity, your anonymity, and your friends list. You are the product. Given how ubiquitous Wifi has become, it’s possible that you can be tracked from your front door, through your city’s wifi network, through the “free” wifi on the transit system, through the mall you walk through on the way to work, and all the way to your destination.
“Using just one GPS observation per day per person allows us to estimate the location of, and subsequently use, WiFi access points to account for 80% of mobility across a population.”*
You are leaving little ant trails everywhere you go. We have all willingly strapped a parolee’s ankle bracelet to ourselves.
This might also get you thinking about how Google Maps knows that there is traffic congestion up ahead.** Your phone is always sending information about where you are over the cellular LTE connection. Exactly how anonymous is that information? Who knows?
There are a few retail organizations that are sophisticated enough to manage the analytics, and coordinate wifi, bluetooth, cell, cctv video, loyalty cards, credit cards, shop cards, proximity sensors and people counters, but not many in Canada.
The transit agencies are constrained by PIPEDA [The Personal Information Protection and Electronic Documents Act (federal)], MFIPPA [Municipal Freedom of Information and Protection of Privacy Act (Ontario)], and government privacy policies. They are mostly concerned with aggregated anonymised data to analyze foot traffic and commuter patterns to figure out the placement of ticket machines and kiosks, and figure out how people get from A to B. Having worked in Public Transit, I can tell you they certainly aren’t capable of doing the big brother stuff people think they are doing.
The security services however certainly can.
Endnotes:
* Sapiezynski P, Stopczynski A, Gatej R, Lehmann S (2015) Tracking Human Mobility Using WiFi Signals. PLoS ONE 10(7): e0130824. https://doi.org/10.1371/journal.pone.0130824
** Stenovec T (2015) Google has gotten incredibly good at predicting traffic — here’s how, Business Insider
http://www.businessinsider.com/how-google-maps-knows-about-traffic-2015-11
