How your movements create a GPS 'fingerprint'

Report: It's easy to identify smartphone users by their movements
Researchers from MIT and elsewhere tracked 1.5 million people for 15 months
Each mobile user's daily movements are unique and create a "fingerprint"
Privacy advocates worry how law enforcement and others may use that data




(CNN) -- Can you be identified only by where you take your phone? Yes, according to a new study, which finds it's not very hard at all.
While most of us are free to go wherever we want, our daily and weeklyovement patterns are pretty predictable. We go to work, to school, to church, to our neighborhood gym, grocery store or coffee shop, and we come home -- all quietly tracked by the GPS in our phone.
And with nothing more than this anonymous location data, someone who wanted to badly enough could easily figure out who you are by tracking your smartphone. Patterns of our movements, when traced on a map, create something akin to a fingerprint that is unique to every person.
Those are the findings of a report by researchers from MIT and elsewhere, published this week in the journal Scientific Reports.
They say that, throughout history, people have always yearned for some degree of privacy, and there have always been others who wanted to keep an eye on them. With modern technology, they say, tracking people is easier than ever.
"Modern information technologies such as the Internet and mobile phones, however, magnify the uniqueness of individuals, further enhancing the traditional challenges to privacy," they wrote. "Mobility data is among the most sensitive data currently being collected. Mobility data contains the approximate whereabouts of individuals and can be used to reconstruct individuals' movements across space and time."
For the study, the research team studied 15 months of anonymous mobile data for roughly 1.5 million people. What they found was that, if they got accurate hourly updates on a person's whereabouts, tracked by their mobile carrier's cell towers, four "data points" were all they needed to figure out the person's identity 95% of the time.
That's the sort of thing that has privacy advocates, like the Electronic Frontier Foundation, worried.
In a wrap-up of last year's developments in mobile privacy, the group's Hanni Fakhoury and Marcia Hofmann noted that, in multiple cases, law enforcement has approached wireless carriers for mobile data to track users. At least one court has ruled that users have no reasonable expectation of privacy regarding their cell phone data.
"(T)he government claims that cell phone users give up their privacy rights because they have voluntarily disclosed their physical location to the cell phone providers every time a phone connects to the provider's cell tower," EFF said in a statement related to an October court case. "... However, this theory undermines privacy in nearly any networked communication."
Increasingly, the makers of mobile operating systems are opening up anonymous location data to developers designing apps that do things like target local advertising to the users. Apple, for example, states in its privacy policy that it can share anonymous mobile data with "partners and licensees."
The study's authors said keeping data anonymous is not necessarily enough to ensure real privacy.
"A simply anonymized dataset does not contain name, home address, phone number or other obvious identifier," they wrote. "Yet, if individual's patterns are unique enough, outside information can be used to link the data back to an individual."
So, for example, say that you wake up at home every morning, head to the office five days a week, then hit the gym on three of those days. That's three data points already. Then maybe you go to the same church, or restaurant for brunch, every Sunday. There's the fourth -- plenty to figure out who you are, the authors say.
Every additional location you hit regularly just makes it that much easier.
Like EFF, the study's authors said that has troubling implications.
"These findings represent fundamental constraints to an individual's privacy and have important implications for the design of frameworks and institutions dedicated to protect the privacy of individuals," they wrote.
if(typeof CNN.expElements==='object'){CNN.expElements.init();}