How location data on just two apps is enough to identify someone

A team of computer science researchers at Columbia University and Google has successfully demonstrated that geotagged posts on two social media apps is enough to link accounts, and identify that person.

This revelation introduces a whole new sect of privacy concerns. 

Over the course of a day, an individual can leave many digital traces in his / her wake through the use of various apps and programs. Of all this data, location metadata is the most revealing because it details a person’s real world movements and actions. In fact, a person can be positively identified using just a few data points from one data set. For example, an individual can be identified from millions of credit card users with just four credit card purchases. 

This new study takes everything one step further, and shows that a person can be identified with relatively high confidence by matching their movements across just two data sets. 

“If you look unique in how you make phone calls, it is possible to connect that to where you've made credit card purchases,” said study co-author Chris Riederer, a graduate student in computer science at Columbia Engineering.

To prove their theory, the team created an algorithm that compared geotagged posts on Twitter with posts on Instagram and Foursquare to link accounts held by the same persons. Basically, it works by calculating the probability that one person posting at a given time and place could also be posting in a second app, at another time and place (they Tweet en route to a restaurant, and then check-in on Foursquare when at the restaurant). 

What’s more, the team also found that the algorithm could identify shoppers by matching anonymous credit card purchase against logs on mobile phones pinging the nearest cell tower. This particular method, the group found, outperformed other matching algorithms applied to the same data set.

Location tracking today is embedded in phones and apps because it’s believed to be incredibly useful. It’s used for everything from giving directions to finding out if friends are near to seeing if a store in the next neighborhood over is running any sort of promotion. Of course, the benefits of these programs do come with privacy risks, which are largely misunderstood at the moment.

“Many people choose not to identify themselves online,” said study author Augustin Chaintreau, a computer science professor at Columbia Engineering and a member of the Data Science Institute. “If I now tell you that your location data makes you recognizable across all of your accounts, how does that change your behavior? This is a question we now have to answer.”

“What this really shows is that simply removing identifying information from large-scale data sets is not sufficient,” said Yves-Alexandre de Montjoye, a research scientist at the MIT Media Lab who was not involved in the study. “We need to move to a model of privacy-through-security. Instead of anonymizing data and making it public, there should be technical controls over who gets access to the data, how it is used, and for what purpose.”

One of the bigger issues with the way things are set up now is how misunderstood everything is— this leads to many people unknowingly leaking their data just by carrying their phone around. To combat this issue, two Columbia undergraduate students built an app called “You Are Where You Go”, to allow users to better monitor their social media trail.

With just a few clicks, the program will retrace a person’s steps on Twitter, Instagram, and Foursquare. Some relatively simple algorithms then process this information to produce inferences about the person’s age, ethnicity, income, and whether or not they are parents. 

“People are now sharing their location on a growing number of apps, often without realizing it,” said Riederer. “Companies no longer have to be very sophisticated to access this data and use it for their own purposes.”

The team hopes add more social networks and predictions to the tool, and to create avenues for users to donate their data to science, or otherwise give recommendations. 

Via Columbia University