RFID, GPS Technology and Electronic Surveillance

Stalkers Exploit Cellphone GPS

August 3, 2010

The Wall Street Journal - Phone companies know where their customers' cellphones are, often within a radius of less than 100 feet. That tracking technology has rescued lost drivers, helped authorities find kidnap victims and let parents keep tabs on their kids.

But the technology isn't always used the way the phone company intends.

One morning last summer, Glenn Helwig threw his then-wife to the floor of their bedroom in Corpus Christi, Texas, she alleged in police reports. She packed her 1995 Hyundai and drove to a friend's home, she recalled recently. She didn't expect him to find her.

The day after she arrived, she says, her husband "all of a sudden showed up." According to police reports, he barged in and knocked her to the floor, then took off with her car.

The police say in a report that Mr. Helwig found his wife using a service offered by his cellular carrier, which enabled him to follow her movements through the global-positioning-system chip contained in her cellphone.

Mr. Helwig, in an interview, acknowledged using the service to track his wife on some occasions. He says he signed up for the tracking service last year.

"AT&T had this little deal where you could find your family member through her cellphone," he says.

But he didn't use it to find his wife that day, he says. Mr. Helwig, who is awaiting trial on related assault charges, declined to comment further about the matter. He has pleaded not guilty.

The allegations are a stark reminder of a largely hidden cost from the proliferation of sophisticated tracking technology in everyday life—a loss of privacy.

Global-positioning systems, called GPS, and other technologies used by phone companies have unexpectedly made it easier for abusers to track their victims. A U.S. Justice Department report last year estimated that more than 25,000 adults in the U.S. are victims of GPS stalking annually, including by cellphone.

In the online world, consumers who surf the Internet unintentionally surrender all kinds of personal information to marketing firms that use invisible tracking technology to monitor online activity. A Wall Street Journal investigation of the 50 most-popular U.S. websites found that most are placing intrusive tracking technologies on the computers of visitors—in some cases, more than 100 tracking tools at a time ...

There are various technologies for tracking a person's phone, and with the fast growth in smartphones, new ones come along frequently. Earlier this year, researchers with iSec Partners, a cyber-security firm, described in a report how anyone could track a phone within a tight radius. All that is required is the target person's cellphone number, a computer and some knowledge of how cellular networks work, said the report, which aimed to spotlight a security vulnerability.

The result, says iSec researcher Don Bailey, is that "guys like me, who shouldn't have access to your location, have it for very, very, very cheap."

That is, in part, an unintended consequence of federal regulations that require cellphone makers to install GPS chips or other location technology in nearly all phones. The Federal Communications Commission required U.S. cellular providers to make at least 95% of the phones in their networks traceable by satellite or other technologies by the end of 2005. The agency's intention was to make it easier for people in emergencies to get help. GPS chips send signals to satellites that enable police and rescue workers to locate a person ...

But as GPS phones proliferated, tech companies found other uses for the tracking data. Software called MobileSpy can "silently record text messages, GPS locations and call details" on iPhones, BlackBerrys and Android phones, according to the program's maker, Retina-X Studios LLC. For $99.97 a year, a person can load MobileSpy onto someone's cellphone and track that phone's location.

Craig Thompson, Retina-X's operations director, says the software is meant to allow parents to track their kids and companies to keep tabs on phones their employees use. He says the company has sold 60,000 copies of MobileSpy. The company sometimes gets calls from people who complain they are being improperly tracked, he says, but it hasn't been able to verify any of the complaints.

Installing such programs requires a person to physically get hold of the phone to download software onto it.

GPS-tracking systems provided by cellular carriers such as AT&T and Verizon Communications Inc. are activated remotely, by the carriers.

Domestic-violence shelters have learned the consequences. As soon as victims arrive at shelters run by A Safe Place, "we literally take their phones apart and put them in a plastic bag" to disable the tracking systems, says Marsie Silvestro, director of the Portsmouth, N.H., organization, which houses domestic-violence victims in secret locations so their abusers can't find them ...

Another source for cellphone tracking information: systems meant to help police and firefighters. Some cellular carriers provide services for law-enforcement officers to track people in emergencies. Using such systems requires a person to visit a special website or dial a hot-line number set up by the carrier and claim the data request is for law-enforcement purposes.Cellular carriers say they try to verify that callers are legitimate. An AT&T spokesman says an office is manned around the clock by operators who ask for subpoenas from law-enforcement officials using the system ...

But federal law allows carriers to turn over data in emergencies without subpoenas. Al Gidari, a lawyer who represents carriers such as Verizon, says such location-tracking systems can be easy to abuse. Police, he says, often claim they need data immediately for an emergency like a kidnapping, and therefore don't have time to obtain a warrant, in which a judge must approve an information request.

Mr. Gidari says law-enforcement's easy access to such data makes the systems easy to abuse. He says carriers would like to have a system in place requiring agents to get warrants. Without such a requirement, there is little carriers can do to resist warrantless requests, say Mr. Gidari and Mr. Altschul of trade group CTIA. Federal law says carriers may comply with such requests, and law-enforcement agencies have pressured them to maintain the tracking systems, Mr. Gidari says.

The easiest way for stalkers to locate a target—and perhaps the most common, say therapists who work with victims and abusers—is by using systems offered by carriers. When cellphone users sign up for a "family plan" that includes two or more phones, they have the option to contact the carrier and activate a tracking feature intended to allow them to keep tabs on their children.

The AT&T FamilyMap program, for example, is free for 30 days and requires only a phone call to activate. "Know where your kids and loved ones are at any time!" says AT&T's website. The system is for parents, says an AT&T spokesman. He says the company hasn't received complaints about FamilyMap being used by stalkers.

The system provides an on-screen map on the smartphone or computer of the person doing the tracking. A dot on the map shows the location and movement of the person being followed. The carrier sends a text-message to the person being tracked that their phone is registered in the program.

These add-on services can be lucrative for carriers. AT&T debuted its FamilyMap system in April 2009. It charges $9.99 a month to track up to two phones, $14.99 for up to five. FamilyMap users must agree to "terms-of-use" stating that they may not use the system to "harrass, stalk, threaten" or otherwise harm anyone ...

On the Web's Cutting Edge, Anonymity in Name Only

August 4, 2010

The Wall Street Journal - You may not know a company called [x+1] Inc., but it may well know a lot about you.

From a single click on a web site, [x+1] correctly identified Carrie Isaac as a young Colorado Springs parent who lives on about $50,000 a year, shops at Wal-Mart and rents kids' videos. The company deduced that Paul Boulifard, a Nashville architect, is childless, likes to travel and buys used cars. And [x+1] determined that Thomas Burney, a Colorado building contractor, is a skier with a college degree and looks like he has good credit.

The company didn't get every detail correct. But its ability to make snap assessments of individuals is accurate enough that Capital One Financial Corp. uses [x+1]'s calculations to instantly decide which credit cards to show first-time visitors to its website.

In short: Websites are gaining the ability to decide whether or not you'd be a good customer, before you tell them a single thing about yourself.

The technology reaches beyond the personalization familiar on sites like Amazon.com, which uses its own in-house data on its customers to show them new items they might like.

By contrast, firms like [x+1] tap into vast databases of people's online behavior—mainly gathered surreptitiously by tracking technologies that have become ubiquitous on websites across the Internet. They don't have people's names, but cross-reference that data with records of home ownership, family income, marital status and favorite restaurants, among other things. Then, using statistical analysis, they start to make assumptions about the proclivities of individual Web surfers.

"We never don't know anything about someone," says John Nardone, [x+1]'s chief executive.

Capital One says it doesn't use the full array of [x+1]'s targeting technology, and it doesn't prevent people from applying for any card they want.

"While we suggest products that we believe will be of interest to our visitors, we do not limit their ability to easily explore all products available," spokeswoman Pam Girardo says.

A Wall Street Journal investigation into online privacy has found that the analytical skill of data handlers like [x+1] is transforming the Internet into a place where people are becoming anonymous in name only. The findings offer an early glimpse of a new, personalized Internet where sites have the ability to adjust many things—look, content, prices—based on the kind of person they think you are ...