Wait, did Oracle tip off world to Google’s creepy always-on location tracking in Android?
War over Java spills into mobile privacy world
By Thomas Claburn in San Francisco, published on The Register, on November 22, 2017
Analysis Having evidently forgotten about that Street View Wi-Fi-harvesting debacle, Google has admitted constantly collecting the whereabouts of Android devices regardless of whether or not they have location tracking enabled.
Between 2007 and 2010, during the debut of its Street View service, Google gathered all the Wi-Fi network names and router MAC addresses it could find from wireless networks encountered by its cars as they drove around snapping photos of buildings and roads. It also captured some network traffic from open Wi-Fi networks and, in the years that followed, was pilloried and fined some measly millions by privacy authorities around the world for doing so.
On Tuesday, Google said since the beginning of 2017, it has been collecting the locations of cell towers near Android phones. But having not found much use for the info, the practice is supposedly on its way out.
Essentially, when an Android handheld passes a phone mast, it quietly contacts Google’s servers to report the location of the tower, even if the user has disabled location services – allowing the ad giant to potentially figure out folks’ whereabouts as they wander about town. Google claims the collection is part of an experiment to optimize the routing of messages through mobile networks.
The admission came in response to a Quartz report, one that security researcher Ashkan Soltani, via Twitter, said had been shopped around the press by Oracle…
Soltani, who served as the chief technologist for America’s trade watchdog, the Federal Trade Commission, from 2014 through 2015, and then did a four-month stint advising the White House, did not respond to requests for comment.
Oracle, Google, and Quartz reporter Keith Collins also did not respond to requests for further information about Soltani’s claim. Not even a “no comment.”
Oracle has been antagonistic toward Google for years as a result of the success of Android. It sued Google in 2010 claiming the Chocolate Factory had infringed its Java copyrights and patents, a case it ultimately lost last year, though there’s an appeal underway.
The database giant has seen more success siccing regulators on Google’s search and Android business practices, specifically in Europe, through its participation in FairSearch, a lobbying group composed of various Google foes.
Oracle also helped fund a nonprofit advocacy group formed last year called the Campaign for Accountability. The group’s ostensible mission is to hold the powerful accountable, through its Google Transparency Project has a very specific focus.
Google, unsurprisingly, has been critical of the group’s claims.
Back to today’s discovery of the cellular base station tracking, and Google said it considered mapping cell coverage to improve message delivery. The web goliath insisted it never actually used or retained the info, though, and Android has been revised to no longer phone home mast information.
Google slurped the data regardless of whether or not location services was enabled because, according to an unnamed source cited by Quartz, the data was tied to Google’s Firebase Cloud Messaging service.
The internet billboard’s explanation is that its push notification and messaging infrastructure is distinct from Android’s location services, which provide location data to apps. A consequence of that separation is that there was no way an Android user could disable the cellular tower checks using location data privacy settings short of powering down his or her device.
Google’s privacy policy disclosure on location data discusses cell tower data collection, but does so in the context of location services. It says: “We use various technologies to determine location, including IP address, GPS, and other sensors that may, for example, provide Google with information on nearby devices, Wi-Fi access points and cell towers.”
Google may be able to recover from this latest privacy blunder with sufficient contrition and repetitions of “we take your privacy very seriously,” but it could still get in trouble with regulators for not adequately disclosing its cell tower shenanigans and for failing to provide a way to opt out. ®
