Google has confirmed it has been able to track the location of Android users via the addresses of local mobile phone masts, even when location services were turned off and the sim cards removed to protect privacy.
Revealed by a report by Quartz, Google’s Android system, which handles messaging services to ensure delivery of push notifications, began requesting the unique addresses of mobile phone masts (called Cell ID) at the beginning of 2017.
The information was captured by the phone and routinely sent to Google by any modern Android device, even when location services were turned off and the sim card was removed. As a result Google could in theory track the location of the Android device and therefore the user, despite a reasonable expectation of privacy.
A Google spokesperson said: “In January of this year, we began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivery.
“However, we never incorporated Cell ID into our network sync system, so that data was immediately discarded, and we updated it to no longer request Cell ID.”
Google requested the Cell ID alongside what is called the mobile country code and mobile network code, which identify the country and mobile phone operator that the smartphone is using. That data is used to ensure the phone stays properly connected to Google’s Firebase Cloud Messaging system, which handles the delivery of messages and notifications to the smartphone.
A persistent connection is required for the system to work, but instead of staying constantly connected, the phone pings Google’s servers at set intervals. The more pings, the greater the battery drain, so the data collected about the country and mobile networks is used to work out the the minimum number of pings required to stay connected without draining the battery – so called heartbeat analysis.
The benefit of having the address of the mobile phone mast to ensure message service reliability is not clear, but through a process of triangulation – the same used to assist when a user is actively using location services – the position of the user can be revealed down to a roughly 400m radius at a minimum, and often much more accurately in urban areas.
Google said that the data was never stored and that Cell ID requests would stop by the end of November, after an update to the messaging system.
Location tracking via smartphones is a common practice used by all the major players, either locally on the device or remotely on a server and is used to provide many of the services expected of a modern phone.
Beyond mapping services, location data is used for delivering the weather, localised news results, shopping services, augmented reality features and even things as mundane as the ability to pair two different wireless devices simply by colocation.
But in most cases it is possible to prevent the location tracking systems from recording data, should services be disabled and privacy features enabled. That was not the case with the Cell ID collection, whether or not the data was stored by Google.
Source: https://www.theguardian.com/technology/2017/nov/22/google-track-android-users-location-services-turned-off-sim