Microsoft stops ID-ing phones in jab at Google
Redmond jettisons unique device identifiers
Microsoft will stop identifying specific mobile devices that use its location-tracking services, a change that differentiates its Windows Phone 7 from Google's competing Android operating system.
Under a new policy, outlined in a letter (PDF) sent to members of Congress on Monday, Microsoft has already stopped storing and using unique identifiers collected from devices that use Windows location services to pinpoint nearby coffee shops or get driving directions. What's more, devices running a forthcoming Windows update will no longer send the identifiers to the company's location service at all.
“We believe that, when designed, deployed and managed responsibly, the location-based feature of a mobile operating system should function as a tool for the user and the applications he or she elects to use, and not as a means to generate a database of sensitive information that can enable a party to surreptitiously 'track' a user,” Andy Lees, president of Microsoft's mobile communications business, wrote. “Without a unique identifier, or some other significant change to our operating system or practices, we cannot track an individual device.”
Lees made many of the same points in a recent blog post.
The change comes as Congress and privacy advocates scrutinize similar location services offered by phones running Google and Apple OSes. As previously reported, when Android phones have location services enabled, they collect the MAC address, signal strength and GPS coordinates of every wireless network they see and zap it to Google servers, along with the unique ID of the handset.
Android handsets also send a unique ID when transmitting cell tower information. These events happen several times an hour, according to independent researcher Samy Kamkar.
By combining the locations and the unique identifier collected several times a day every single day, it wouldn't be hard for Google – or someone subpoenaing Google – to figure out where a user lives and works. And since Android phones track the signal strength of each Wi-Fi network they see, there's a good chance the data could be used to learn the MAC address of a user's home and business routers.
Microsoft, Google, and Apple phones all store the locations of nearby Wi-Fi networks and cell towers so that location services consume less battery power and work in areas where satellite signals aren't available. Much of the recent hoopla over location services started last month, when researchers disclosed that iPhones often stored a “scary” amount of this data and allowed it to be transferred unencrypted to users' computers. Apple eventually changed this practice.
Apple has said the file is compiled only when location services are enabled on the iPhone, but Kamkar has said the locations were stored even when the service was turned off.
For Google's part, the locations of Wi-Fi and cell towers are cached by Android phones only when location services are turned on, and data is regularly deleted to prevent it from storing too large a list. The company has said it anonymizes the location data it collects.
But so far Google has showed no signs that it plans to curb the collection of unique identifiers, making it the only one of the three mobile OS providers to do so, Kamkar said. ®
Update
A Google spokeswoman emailed us to say that it's not accurate to say the company collects a "unique identifier" from phones that share location data with the company. She cited written testimony submitted this week to Congress that states the following:
Google is also very careful about how we use and store the data that is generated by location-based services. The location information sent to Google servers when users opt in to location services on Android is anonymized and stored in the aggregate and is not tied or traceable to a specific user. The collected information is stored with a hashed version of an anonymous token, which is deleted after approximately one week.
COMMENTS
Understanding fail
You do realise that 99% of users treat any such prompt as one more annoying box to tick before they can get on with whatever they were doing? (I'm not saying this is what *should* happen, merely that this is what *does* happen.) And that the explanation of what ticking the box actually implies is buried somewhere on page 23 of the 9,000 word legal document that you 'agreed' to when you broke the seal on the box in which your device was packed?
You're both mistaken
@Chris Miller: No, actually I see that prompt every time I update Ultimate Droid on my phone (about once a month). It's very clear what it is for. Google can't be held responsible for the fact that people are too lazy to read three lines and uncheck a box if they don't want their location shared with Google.
@Tom Sparrow: You're mistaken. You can still use location services if you choose not to allow Google to collect the data. Unchecking the box to allow Google to collect anonymous data doesn't disable either GPS or WiFi location services on the phone. I speak from experience.
Very slick piece of PR
Microsoft needs a PR hit, when it has had so many misses lately. I expecially like the wording of
"a database of sensitive information that can enable a party to surreptitiously 'track' a user,”"
- exactly! Apple and Google squirm and wriggle and say "we don't collect this information" but they don't mention that they do do stuff which allows others - an unspecified party, as Microsoft has it - to do exactly that.
If this can put pressure on Apple and Google to tighten up their ship, it will be a good result for everyone.
molehill maybe
but I don't want molehills one my lawn (though a mountain in my back garden would be cool).
They may give you the choice, but if you don't want your data sent out, you have no location functionality. Which is not much of a choice in my book.
GPS requires no data to be sent anywhere, cell tower and wifi based location tracking (and associated AGPS features) require a little data to be swapped ("I can see this base station" - "OK, that lives here...").
None of this requires anyone to know who's asking. Leave my phone ID out of it please. If I want you to know where I am, I'll log in and tell you.
@dssf
Really? How does that work then?
We are talking about historical location tracking data here, remember? Do tell how you suddenly "unanonymise" a load of this that lacks any identification..........
If all that's of interest is current state / location, the carriers can do this without MS's help by just asking their network which cell(s) the IMEI is talking to. As they do now.
