What is geolocation? It’s the practice, or some would say black magic, of inferring your geographic location from your computer, phone, or another device. It has legitimate uses, but also can arguably be an invasion of privacy. Here’s how it works, and how to defeat it.
In a nutshell, it works like algebra, where you solve something you don’t know based on two or more things you do know.
How geolocation works
Every computer on the Internet has a numeric address, called an IP address. There are only 4 billion possible addresses. That sounds like a lot, but we know a lot about all of them, including who owns them, and the geographic region they are in. Based on that, it’s possible to pull data from other sources to narrow it down a bit. Sometimes it’s only possible to narrow it down to part of a U.S. state, but addresses in major cities can be narrowed down to that particular metro area.
When I subscribe to MLB.tv, it knows I’m in St. Louis, so it doesn’t let me watch Cardinals games live. That’s a concession to cable companies. I can watch any game that my cable companies wouldn’t be broadcasting. When you try to pin me on a map based on my IP address, it’s off by a good 20 miles, but you’ve pinpointed my location to an accuracy within 20 miles, just based on a number.
This type of geolocation isn’t a huge privacy concern. If you need to defeat it, the only way to do it is to use a VPN.
There are methods of geolocating that are much more precise.
Geolocating based on wifi
Several companies have databases of every wifi network in the United States. Not every wifi network name is unique, but there’s a number that each access point emits that’s supposed to be unique. The combination of that number and the network name is likely unique. It’s safe to assume you won’t see the same combination of names and numbers in my front yard anywhere else in the world.
Based on that, it’s possible to pinpoint a device’s location with rather good accuracy based on what wifi networks it’s able to see. My former coworker’s 10-year-old son used this feature to locate his tablet, and therefore, locate his dad’s stolen car.
When we misplace our phone, I use Android’s Find my Phone feature–the same feature my coworker’s son used. It can pinpoint where the phone is down to approximately what room of the house it’s in. If the map says the phone is in the kitchen, it’s in the kitchen or close to it. My coworker didn’t just get his car back. He also got his tablet back, because he was able to point to the window of the house where he thought the tablet was. The cop was skeptical, but he knocked on the door, and the guy gave the tablet back when the cop asked about it.
My phone uses this feature to tag all the photos I take. This makes it incredibly easy to find the pictures you take on vacation or on business trips.
Some people object to this. Your phone knows things you’ve forgotten about yourself. Google makes it possible to disable it for exactly this reason. Some people allege that Google ignores that and gathers that information anyway. So your alternative is to buy Apple devices, disable location tracking on those, and trust Apple.
If you want to be certain you’re defeating location tracking, turn off your wifi. That’s the only way to be certain.
But there’s still a way to track you.
Cellular tower triangulation
Every cell phone also tracks your location, even if it doesn’t have any wifi capability at all. There’s a very good reason for this. If you dial 911 with your cell phone, the dispatcher has to know where you’re calling from. Your phone figures this out based on nearby cellular towers. It works pretty much like locating based on wifi networks. What towers my phone can sense from my street will be a little different from what it can sense a few blocks away.
This means your cellular provider knows where you are, or at least where your phone is, at all times. It’s possible that two of them do. AT&T and T-Mobile both use a technology called GSM to provide phone service. Verizon and Sprint both use a rival technology called CDMA. It’s safe to assume that phones on AT&T’s network use T-Mobile towers for triangulation and vice versa, and that Sprint and Verizon phones do the same thing.
Does your cellular provider store the data? Yes. And they’ll provide it to authorities. Does your cellular provider’s rival store the data? It’s likely they do, but the data they have on a rival provider’s phones is likely to be less complete. Do they share this with other companies? Also yes. And in May 2018, one of those companies leaked it.
You can defeat this by turning off your phone when you’re not using it. But of course then you can’t receive calls or do anything else with the phone.
What is geolocation, in conclusion
So what is geolocation? It’s probably something you didn’t realize was possible. It’s surprising what you can infer from data, especially when you have enough of it.
But with the data comes responsibility. I once participated in a project to determine when my coworkers were and weren’t using their computer. There’s a problem with this, though. Not using your computer isn’t the same as not working. I had a coworker who would spend a good two hours standing at a whiteboard explaining something or puzzling something out on a regular basis. Maybe not every day, but three or four times a week, easily. Some people thought he was the hardest working guy in the company and some thought he was the laziest. All my data did was reinforce what everyone already thought about him. This made me uncomfortable, so I didn’t stay there very long.
Data is very useful. But data without context is incredibly dangerous. We’re still puzzling through how to use it responsibly and ethically.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.