Is your cell phone spying on you?

Last week I wrote about Google's plan to put a social network in your pocket via its new Latitude mapping app for smart phones. Latitude uses cell phone towers, GPS, or WiFi to locate you and several hundred of your closest personal friends on a Google Map. That makes some people afraid their cell phones will secretly be used as surveillance devices.

Unfortunately, I had trouble getting Latitude to work on my Windows smart phone or T-Mobile's Android-based phone, the G1. And I had some questions about who has access to your location data and what happens to it.

Well, now I have answers. And the short answer to the question I pose above is, Yes (theoretically, anyway).

But before I get into that, here's some geeky information about Latitude and Windows Mobile phones.

Because my Pantech Duo phone doesn't support calls to the Windows Mobile Cell ID application programming interface, Google Latitude can't find me using cell towers. So while I can use Latitude to see where my friends are, they can't see me.

Sprint and Verizon subscribers who have Windows Mobile phones like mine - which lacks both GPS and WiFi antennas - are in the same boat. The same goes for the original Samsung BlackJack, the Motorola Q, Palm Treo 700, and at least 10 other popular WinMo handsets. Pretty much any CDMA-based phone made before 2008 and a few GSM models won't work, says Google product manager Steve Lee, but nearly all new WinMo phones do support it.

The G1 phone is another story. By late Friday night T-Mobile had updated the G1 to Google Maps 3.0, enabling it to use Latitude. It's a much slicker implementation on Android than on Windows. You can look up your friends, start a Google Talk conversation with them, get directions from your location to theirs, or search for businesses near them.

Another nice touch: Once I signed up, Google automatically added the Latitude window to my iGoogle home page, so I can keep watch on my friends all day long at work.

Why would anyone want to use Latitude? Say you're traveling to a town where you've got friends. You can look up their location and send them a message saying, "Hey, there's a Starbucks two blocks from you on Main, let's meet there in 30 minutes." And they can do the same to you when they're in town. Nothing evil about that.

Of course, if your boss is in your network, she might also be able to see that you're really at Starbucks when you're supposed to be working. (In that case, I suggest you use the "Hide from this friend" feature. You can also sign out of Latitude, or manually set it to any location, regardless of where you actually are.)

But Latitude is still a bit buggy. For example, I had trouble getting it to email invitations to some people in my network. My editor here at Computerworld could not get the Latitude Web app to work on her iGoogle page. And as I write this, it still doesn't work on the iPhone; all Lee will say is that Latitude for the Jesus Phone is "coming soon."

(I'm still scratching my head over why Google would announce this product before it fully supported Android or the iPhone. But that's a topic for another post.)

Another problem is accuracy, though this isn't really Latitude's fault. Using just cell towers and WiFi, the G1 placed me anywhere from two blocks to half a mile from my actual location. (Lee says location can be off by as much as 10 miles in rural areas with few cell towers.) When I turned on the GPS antenna it located me within a few yards when I was outdoors. Indoors and away from windows, though, it couldn't find me at all. These are just the limitations built into each technology - which is why for real location tracking you need more than one wireless tech.

Then, of course, there are those pesky privacy questions. Services like Latitude (and Verizon's Chaperone, and Loopt) are opt in; nobody's forcing you to use them. But if you do use them, it's possible Johnny Law could use them to find you - or at least, your phone -- provided they have the requisite legal authority to do so.

Sayeth a Google spokeshuman:

Google complies with valid legal process, such as court orders and subpoenas. These same processes apply to all law-abiding companies. At the same time we have a legal team whose job is to scrutinize these requests and make sure they meet not only the letter but the spirit of the law. We have a history of being an advocate for user privacy. In 2006, we went to court to resist a Department of Justice subpoena for millions of search queries on the grounds that it was excessive and invaded our users' privacy. The judge ultimately ruled in Google's favor, establishing an important precedent for user privacy.

In any case, nobody can use these services to "breadcrumb" you or track your location history, because these services only store and report your most recent location. (I was wrong about Google purging your location information after 24 hours, though. If you last checked in with Latitude a week ago, that's what's in Google's location database.)

But people get who bent out of shape over services like Google Latitude forget a larger point: You cell phone is already a tracking device, and in the right circumstances it could save your life or help a loved one.

Just last month, police in Athol, Massachusetts, located a 9-year-old girl who'd been allegedly abducted by her grandmother by exploiting the GPS chip in the girl's cell phone.

Investigators contacted the wireless company, which recorded the GPS coordinates in the girl's phone each time it was used. They ultimately tracked her down to an intersection in Natural Bridge, Virginia. The cops then used Google Street View to figure out which building the missing girl was most likely in (a motel). The girl is now safely home, and grandma may be looking at kidnapping charges.

There are many stories like this. A similar incident happened to a family member of mine. Neither of those phones had Google Latitude, Verizon Chaperone, Loopt, or any other people-finding application installed. They weren't necessary. The wireless companies had all the data they needed to help police track these people down. That's why e911 laws were enacted - to enable first responders to find you via your cell phone. What most people don't realize is that this service can work in reverse; if they want to find you, they can just ping your phone.

[UPDATE: It seems I have this slightly wrong. Per Verizon spokesperson Debra Lewis:

When we work with law enforcement (usually in an exigent or emergency situation and always under court order) we can find the cell tower on which the phone has registered its last call or text message.

So if you don't use your phone, they can't just ping you. Sorry for the confusion.]

Whether law enforcement or the wireless companies abuse this information remains to be seen. Everyone I've spoken to on this matter over the years has said it would be foolish for companies to annoy potential customers by misusing location data, and illegal for the authorities to do it. That doesn't mean it won't happen.

If it does, don't blame social mapping apps like Latitude. Blame the lifeline in your pocket. The trade off for being always connected is that the connection goes in both directions. In other words, if you don't want anyone to find you, leave your phone at home.

When not covering his cell phone with a lead-lined hankie, Dan Tynan tends his blogs, Culture Crash and Tynan on Tech. He is also author of Computer Privacy Annoyances (O'Reilly 2005) and has been writing about Internet privacy for more than 10 years.

Copyright © 2009 IDG Communications, Inc.

  
Shop Tech Products at Amazon