Truth About iPhone Tracking: Neither New Nor Secret

CREDIT: Apple, Inc. View full size image

The news that the iPhone secretly tracks and records the location data of its users came as a shock to many, but it turns out security researchers have known about it for some time.

The public was surprised when security researchers Alasdair Allan and Pete Warden revealed April 20 that the iPhone and iPad 3G track users' location data and store it in hidden files called "consolidated.db" on the devices as well as the computers they're synced with.

The news drew fervent responses throughout the tech community. Some were appalled the invasion of privacy by the devices' manufacturer, Apple.

Others were less surprised, and saw it as simply another way online companies such as Facebook take advantage of users' personal information – including location – to push targeted advertisements on them.

iPhone tracking is nothing new

"This hidden file is neither new nor secret," Alex Levinson, security researcher and senior engineer for Apple iOS-based research company Katana Forensics, wrote on his blog.

Levinson, an author and graduate student at Rochester Institute of Technology, said that prior to the "consolidated.db" file used in the iPhone 4, users' location data was stored on older iPhone models in a similar file, called "h-cells.plist."

The data in these files could be "easily acquired through simple forensic techniques," he said.

Location logs from these pre-iPhone 4 files have been used by "various law enforcement agencies," Levinson said.

App developers are in on it, too

Levinson first spread the word about Apple's location in November 2010 at the Paraben Forensics Innovation Conference in Utah, where he announced Lantern 2.0, software he had developed that would integrate all the geolocational data stored on the iPhone in the hidden files.

Then, at a security conference two months later, Levinson presented a paper called, "Third Party Application Forensics on Apple Mobile Devices."

Written in 2010, before the June release of the iPhone 4, the paper explained that Apple explicitly offers location tracking ability to third-party app developers; it's called "Core Location Framework Reference."

It's all there in the fine print

Researchers at the security firm RedSn0w said you shouldn't be surprised your iPhone is tracking your every move – because Apple tells you that's exactly what it's going to do.

In the terms and conditions of the iTunes license agreement, necessary to activate an iPhone or iPad, Apple writes, "Apple and our partners and licensees may collect, use, and share precise location data, including the real-time geographic location of your Apple computer or device."

The fine print continues: "This location data is collected anonymously in a form that does not personally identify you and is used by Apple and our partners and licensees to provide and improve location-based products and services."

The 18 pages of terms and conditions can be read at Apple's website.

But how fine is the print?

Mikko Hypponen, chief researcher for the Finnish anti-virus company F-Secure, wrote that iTunes' installation process includes a "highly misleading" prompt, which reads, "You can help Apple improve its products by sending us anonymous diagnostic and usage information about your iPhone."

The prompt makes no mention of tracking your location, but clicking "Agree" gives Apple that power.

Hypponen also believes that the iPhone sends its location log to Apple twice a day.

However, this isn't an issue unique to Apple. As the blog Digital Ninja pointed out, every smartphone company includes a similar statement of intent in its respective terms and conditions.

Here come the politicians

No matter when the iPhone started tracking its users, the problem has left the security world and is now a full-blown political issue.

Congress and the FCC are now "looking into the matter," according to the political news site Politico.

Senator Al Franken, D-Minn., wrote a letter to Apple's CEO Steve Jobs on April 20 expressing his concerns over iPhone users' privacy in light of Allan and Warden's findings.

"The existence of this information – stored in an unencrypted format – raises serious privacy concerns," Franken wrote.

He went on to say that anyone who finds a lost or stolen iPhone "could easily download and map out a customer's precise movements for months at a time."

Franken expressed concern especially for children, writing, "The millions of children and teenagers who use iPhone or iPad devices also risk having their location collected and compromised."

Rep. Jay Inslee also spoke out against iPhone tracking, according to Politico, saying he plans to ask Apple "some very direct questions to understand the frequency and extend of this data collection and the use, protection and sharing of this sensitive information."

This story was provided by SecurityNewsDaily, a sister site to LiveScience.