Mobile Wi-Fi may make users 'unknowing informants'

Wi-Fi systems on smartphones and laptops may be used to secretly report the locations of users, their family and friends unless changes are made to their design, warns Ontario's Information and Privacy Commissioner Ann Cavoukian.

Wi-Fi devices have unique addresses that are being used in mapping systems built and maintained by companies such as Apple, Google, Microsoft, Research In Motion, Skyhook and others, Cavoukian said in a report released Tuesday.

In the future, the user's device may be able to relay the addresses of friends, family members and co-workers, the paper warned, "turning him or her into an 'unknowing informant,' revealing the location of others who are not necessarily participating in location-based services."

To prevent that type of incident from arising in the future, the paper recommended that "in no case" should the unique address of a mobile user's device — known as media access control (MAC) address — be collected or recorded without the user's consent.

"Privacy must be designed into Wi-Fi positioning systems to prevent unintended consequences," Cavoukian said in a statement.

Wi-Fi is an important alternate tracking system for location-based services like interactive maps, navigation apps and some social networking apps because it doesn't drain a mobile device's battery as much as GPS and GPS signals may be weak in some urban areas, the report said.

Such systems map the locations of nearby Wi-Fi access points and compare those to the ones visible on a user's device to figure out the device's location.

Transparency key: Cavoukian

While releasing her paper at the SC Congress Canada security conference in Toronto Tuesday, Cavoukian suggested that lessons about privacy practices for location-based services could be learned from the Apple iPhone controversy that erupted in April.

That was when security researchers reported that iPhone stores a record of users' movements for up to a year.

Cavoukian noted that users were most concerned about the fact that they didn't know their location data was being collected by the devices.

"This was a huge problem," she said. "They felt this eroded trust."

She urged companies to be transparent with customers about the information they collect and to avoid gathering personally identifiable data when possible.

"They need to ask themselves, 'Do I need the data?' A lot of times they don't need it," she said. "You can collect information without having personal identifiers linked to it."

The key to ensuring privacy, Cavoukian believes, is to make it a top consideration when designing software and hardware. If devices are built with protecting the user's privacy in mind, hacks or data breaches can be better avoided. Companies and organizations must also be aware that threats can equally come from the outside and the inside, she said.

"People always think, 'oh, get the firewalls up," she said. "They add a lot of security so that hackers can't get into [a database]. That may protect it from the outside, but you need to protect it from the inside job, the rogue employee."

The simplest way personal data can be protected is to encrypt it, so only the people who need to see it are able to, according to the commissioner.

Cavoukian noted that a couple of days after the security report on the iPhone, Apple CEO Steve Jobs said publicly that Apple never tracked individuals and won't in the future.

"Wonderful messaging," she said. "But do that before the breach."