Your Cell Phone = Your Fingerprint

(thanks, you know who you are)

The more you use your cell phone, the more it’s like a fingerprint for you. It doesn’t even matter who you call, and it matters a lot less whether or not it’s registered under your name. For most people (that follow similar routines every day) just looking at the places a given phone’s been is enough to identify it from other users.

Researchers have figured out that 95% of peoples’ activity is so unique (compared with other people) that just four random points on their location trace is enough to uniquely identify them.

Implications: what we have here is another nail in the “anonymized data” coffin… there’s no such thing as “anonymized” location data if you can uniquely identify people so easily.

Defense: Pull the battery from your phone when not using it, or use a shielded “RF blocker” pocket / cell phone case with >110dB attenuation. Voicemail FTW.

Question: We touched on this ages ago, but the “cell phones track you even when turned off” rumor keeps floating around. Has anyone seen any actual evidence (or e.g done tests in a faraday cage) that the damn things do this?

Ages ago I had an idea to characterize host-accessible unit-to-unit variations in USB memory sticks and use that as a unique identifier for a lock… I wonder if the same is possible with passive reflections from an RF front end in a cell phone *horror*

“…data from just four, randomly chosen “spatio-temporal points” (for example, mobile device pings to carrier antennas) was enough to uniquely identify 95% of the individuals, based on their pattern of movement. Even with just two randomly chosen points, the researchers say they could uniquely characterize around half of the 1.5 million mobile phone users. The research has profound implications for privacy, suggesting that the use of mobile devices makes it impossible to remain anonymous – even without the use of tracking software.

For their research, they studied anonymized carrier data from a “significant and representative part of the population of a small European country.” In the study, the researchers used sample data collected between April 2006 and June 2007. Each time a user interacted with their mobile phone operator network by initiating or receiving a call or a text message, the location of the connecting antenna was recorded, providing both a spatial and temporal data point.

The dataset contained one trace “T” for each user, while each spatio-temporal points contained the region in which the user was and the time of the interaction. The researchers evaluated the uniqueness of each trace given a set of randomly chosen spatio-temporal points.

The data recorded user interactions with his or her phone – around 114 per month scattered across 6,500 mobile antennas. The data collected was highly effective in identifying individuals by their movements. Just four random points, were enough to uniquely characterize 95% of the users studied. ”

Using a complex mathematical and statistical analysis of that data, the researchers discovered that it is possible to find one formula to express what they call the “uniqueness of human mobility”: e 5 a 2 (nh). Roughly stated, the formula says that the more sparse the data becomes (such as among infrequent users, or in areas with fewer cell towers) the less accurate any individual trace is, and the more data points are needed to uniquely identify an individual.

“We show that the uniqueness of human mobility traces is high, thereby emphasizing the importance of the idiosyncrasy of human movements for individual privacy,” the researchers write. “Indeed, this uniqueness means that little outside information is needed to re-identify the trace of a targeted individual even in a sparse, large-scale, and coarse mobility dataset. Given the amount of information that can be inferred from mobility data, as well as the potentially large number of simply anonymized mobility datasets available, this is a growing concern.””

%d bloggers like this: