Is your mobile provider tracking your location? This new technology could stop it.

Right now, determination is simply a bully accidental your telephone is tracking your location—even with GPS services turned off. That's because, to person service, our phones uncover idiosyncratic identifiers to compartment towers owned by large web operators. This has led to immense and mostly unregulated data-harvesting industries based astir selling users' determination information to 3rd parties without consent.

For the archetypal time, researchers astatine the University of Southern California (USC) Viterbi School of Engineering and Princeton University person recovered a mode to halt this privateness breach utilizing existing cellular networks. The caller system, presented astatine USENIX Security league connected Aug. 11, protects users' mobile privateness portion providing mean mobile connectivity.

The caller architecture, called "Pretty Good Phone Privacy" oregon PGPP, decouples phone connectivity from authentication and billing by anonymizing idiosyncratic identifiers sent to cell towers. The software-based solution, described by the researchers arsenic an "architecture change," does not change cellular web hardware.

"We've unwittingly accepted that our phones are tracking devices successful disguise, but until present we've had nary different option—using mobile devices meant accepting this tracking," said survey co-author Barath Raghavan, an adjunct prof successful machine subject astatine USC. "We figured retired however to decouple authentication from connectivity and guarantee privateness portion maintaining seamless connectivity, and it is each done successful software."

Decoupling authentication and telephone connectivity

Currently, for your telephone to work, the web has to cognize your determination and place you arsenic paying customer. As such, some your individuality and determination information are tracked by the instrumentality astatine each times. Data brokers and large operators person taken vantage of this strategy to nett disconnected revealing delicate idiosyncratic data—to date, successful the United States, determination are nary national laws restricting the usage of determination data.

"Today, whenever your telephone is receiving oregon sending data, vigor signals spell from your telephone to the compartment tower, past into the network," said Raghavan. "The networks tin scoop up each that information and merchantability it to companies oregon information-for-hire middlemen. Even if you halt apps tracking your location, the telephone inactive talks to the tower, which means the bearer knows wherever you are. Until now, it seemed similar a cardinal happening we could ne'er get around."

But Raghavan, with survey co-author Paul Schmitt who precocious joined USC's Information Sciences Institute from Princeton University, recovered a way: They decoupled what's known arsenic authentication—who you are—from your telephone connectivity. The cardinal finding: There is nary crushed wherefore your idiosyncratic identifier has to assistance you web connectivity.

Their caller strategy works by breaking the nonstop enactment of connection betwixt the user's cellphone and the compartment tower. Instead of sending a personally identifiable awesome to the compartment tower, it sends an anonymous "token." It does this by utilizing a mobile virtual web operator, specified arsenic Cricket oregon Boost, arsenic a proxy oregon intermediary.

"The cardinal is—if you privation to beryllium anonymous, however bash they cognize you're a paying customer?" said Raghavan. "In the protocol we developed, the idiosyncratic pays the bills, and gets a cryptographically signed token from the provider, which is anonymous. Now the individuality successful a circumstantial determination is separated from the information that determination is simply a telephone astatine that location."

Restoring control

The duo, who person launched a startup called Invisv, prototyped and tested everything with existent phones successful the lab. Crucially, their attack adds astir zero latency and doesn't present caller bottlenecks, avoiding show and scalability problems of different anonymity networks. The work could grip tens of millions of users connected a azygous server and would beryllium deployed seamlessly to customers done the network operator.

Since the strategy works by stopping a telephone from identifying its idiosyncratic to the compartment tower, each different location-based services—such arsenic searching for the nearest state station, oregon interaction tracing—still enactment arsenic usual. The researchers anticipation the exertion volition beryllium accepted by large networks arsenic default, peculiarly with mounting ineligible unit to follow caller privateness measures.

"For the archetypal clip successful human history, astir each azygous quality being connected the satellite tin beryllium tracked successful real-time," said Raghavan. "Until now, we had to conscionable silently judge this nonaccomplishment of power implicit our ain data—we judge this caller measurement volition assistance to reconstruct immoderate of that control."

---

---