Senator Al Franken Grills Steve Jobs About iPhone Tracking

Senator Al Franken (D-MN) wants answers about the iPhone’s undisclosed tracking features.

As reported, the iPhone and 3G iPad secretly record your location as you travel around and sync it with your computer. It appears to be a serious violation of privacy. It was first disclosed by security researchers Alasdair Allan and Pete Warren at O’Reilly’s Where 2.0 conference.

Apple hasn’t yet explained the matter, prompting Sen. Franken to publish an open letter to Steve Jobs demanding answers.

Sen Franken wants to know why Apple is collecting the data; how it is collected; what it is used for; why it isn’t encrypted; if the data is shared; and why consumers aren’t asked before the data is collected.

Here’s the full text of Sen. Franken’s letter to Jobs:

April 20, 2011

Mr. Steve Jobs
1 Infinite Loop
Cupertino, CA, 95014

Dear Mr. Jobs,

I read with concern a recent report by security researchers that Apple’s iOS 4 operating system is secretly compiling its customers’ location data in a file stored on iPhones, 3G iPads, and every computer that users used to “sync” their devices. According to the researchers, this file contains consumers’ latitude and longitude for every day they used an iPhone or 3G iPad running the iOS 4 operating system-sometimes logging their precise geo-location up to 100 times a day. The researchers who discovered this file found that it contained up to a year’s worth of data, starting from the day they installed the iOS 4 operating system. What is even more worrisome is that this file is stored in an unencrypted format on customers’ iPads, iPhones, and every computer a customer has used to back up his or her information. See Alasdair Allen & Pete Warden, Got an iPhone or 3G iPad? Apple is Recording Your Moves (Apr. 20, 2011), available at http://radar.oreilly.com/2011/04/apple-location-tracking.html.

The existence of this information — stored in an unencrypted format — raises serious privacy concerns. The researchers who uncovered this file speculated that it generated location based on cell phone triangulation technology. If that is indeed the case, the location available in this file is likely accurate to 50 meters or less. See Testimony of Michael Amarosa, Before the House Judiciary Committee, Subcommittee on the Constitution, Civil Rights and Civil Liberties, June 24, 2010 at page 7 available at http://judiciary.house.gov/hearings/pdf/Amarosa100624.pdf.

Anyone who gains access to this single file could likely determine the location of a user’s home, the businesses he frequents, the doctors he visits, the schools his children attend, and the trips he has taken — over the past months or even a year. Cf. People v. Weaver, 909 N.E.2d 1195, 1199-1200 (N.Y. 2009) (“What this technology yields and records with breathtaking quality and quantity is a highly detailed profile, not simply of where we go, but by easy inference, of our associations … and of the pattern of our professional and avocational pursuits.”).

Moreover, because this data is stored in multiple locations in an unencrypted format, there are various ways that third parties could gain access to this file. Anyone who finds a lost or stolen iPhone or iPad or who has access to any computer used to sync one of these devices could easily download and map out a customer’s precise movements for months at a time. It is also entirely conceivable that malicious persons may create viruses to access this data from customers’ iPhones, iPads, and desktop and laptop computers. There are numerous ways in which this information could be abused by criminals and bad actors. Furthermore, there is no indication that this file is any different for underage iPhone or iPad users, meaning that the millions of children and teenagers who use iPhone or iPad devices also risk having their location collected and compromised. An estimated 13% ofthe 108 million iPhones and 19 million iPad devices sold are used by individuals under the age of 18, although some of these devices may not have been upgraded to iOS 4. See AdMob, AdMob Mobile Metrics Report at 5 (Jan. 2010), available at http://metrics.admob.com/wp-content/uploads/201 0/02/AdMob-Mobile-MetricsJan-10.pdf; Complaint of Apple Inc. v. Samsung Electronics, CV-11-1846 at 4-5 (N.D. Cal. Apr. 15, 2011).

These developments raise several questions:

1. Why does Apple collect and compile this location data? Why did Apple choose to initiate tracking this data in its iOS 4 operating system?

2. Does Apple collect and compile this location data for laptops?

3. How is this data generated? (GPS, cell tower triangulation, WiFi triangulation, etc.)

4. How frequently is a user’s location recorded? What triggers the creation of a record of someone’s location?

5. How precise is this location data? Can it track a user’s location to 50 meters, 100 meters, etc.?

6. Why is this data not encrypted? What steps will Apple take to encrypt this data?

7. Why were Apple consumers never affirmatively informed of the collection and retention of their location data in this manner? Why did Apple not seek affirmative consent before doing so?

8. Does Apple believe that this conduct is permissible under the terms of its privacy policy? See Apple Privacy Policy at “Location-Based Services” (accessed on April20, 2011), available at www.apple.com/privacy.

9. To whom, if anyone, including Apple, has this data been disclosed? When and why were these disclosures made?

I would appreciate your prompt response to these questions and thank you for your attention to this matter.

Sincerely
Al Franken
United States Senator

The entire letter is  here (PDF).