Thread by @podehaye

As #CPDP2022 was about to start, I visited the conference location to try to better understand how Google (and others!) might be tracking participants

As an "aside", Google is a Platinum sponsor at the conference

https://twitter.com/markscott82/status/1529020465402060804?s=20&t=4OwrvRpCgWE2nmZTlsUGGw

1/n

So, let's dig in! The day before, May 20th, I went near the venue with Semantic Location History activated. That gives me a glimpse at the infrastructure of surveillance Google is leveraging.

2/n

When I takeout my Google data (and visualize it a bit more with tools developed during the #digipower investigation), I see that Google knows I was there, with 70% confidence and for 565 seconds.

Furthermore, Google knows how I arrived (where from, with which transportation mechanism) and how I left (where to), based mostly on activity sensors (gyroscopes, accelerometers, and a layer of machine learning).

It also knows I searched for the destination 20 minutes earlier.

How does Google deduce where I am? Most ppl think it will have occured through GPS. However that is not the case...

Instead, Google uses (among other signals) MAC addresses of routers for whom it knows the location, heard from my phone, and to which I DID NOT connect. Here they are, centered at the average location where they were heard during those 10 minutes.

Note the MAC address in plain, and the fact that noone has been asked for consent by Google for this type of tracking (what happens for MAC addresses associated to hotspotting phones?).

Also, is this part of the data collected by roaming cars?

Supposedly, you can opt-out by appending the "_nomap" suffix to your router (unilaterally decided by Google).

I am told even then this data is uploaded to Google servers.

More interesting: G tells me how it reached its conclusion on where I was.

Highlighted in red is "Les Halles" (I stayed in front for 10 min), with probability 85%. But I could be at restaurant Ane Vert right in front, with 2.5% probability.

This is based on triangulation of wifi signals, but as indicated earlier other signals are also used.

Here is an example from Lausanne.

We indicate with the green circle that the restaurant has been searched, which helps G figure it all out.

Here is an even more interesting example, taken from @markscott82 's data in Berlin.

We see that he has searched a place, and that this affects the probability calculation of where he was (indicated by thickness line to the red dot, which is still most probable according to G)

We think this is very interesting from a regulatory perspective, to better understand how different signals are used by G, for different purposes (and associated gain).

We also think it shows the utility of transparency... to some extent.

We activated Semantic Location History in order to get the data back showing the inference made by G. But we have close to 0 transparency on what G does with raw signals when they don't have additional layer of consent.

And G is ahead of the curve of others for transparency...

for some facets of the collection, certainly compared to other #CPDP2022 sponsors!

Are you interested in doing this for yourself?

Instructions here:
digipower.hestialabs.org/google#load-da…

Are you interested in digging in all this with us or students?

Contact me!