Surveillance is pervasive: Yes, you are being watched, even if no one is looking for you
- Written by Peter Krapp, Professor of Film & Media Studies, University of California, Irvine
The U.S. has the largest number of surveillance cameras per person[1] in the world. Cameras are omnipresent on city streets and in hotels, restaurants, malls and offices. They’re also used to screen passengers[2] for the Transportation Security Administration. And then there are smart doorbells[3] and other home security cameras.
Most Americans are aware of video surveillance of public spaces. Likewise, most people know about online tracking – and want Congress to do something about it[4]. But as a researcher who studies digital culture and secret communications[5], I believe that to understand how pervasive surveillance is, it’s important to recognize how physical and digital tracking work together.
Databases can correlate location data from smartphones[6], the growing number of private cameras, license plate readers[7] on police cruisers and toll roads, and facial recognition technology[8], so if law enforcement wants to track where you are and where you’ve been, they can. They need a warrant to use cellphone search[9] equipment: Connecting your device to a mobile device forensic tool[10] lets them extract and analyze all your data[11] if they have a warrant[12].
However, private data brokers[13] also track this kind of data and help surveil citizens[14] – without a warrant. There is a large market for personal data, compiled from information people volunteer, information people unwittingly yield – for example, via mobile apps[15] – and information that is stolen in data breaches. Among the customers for this largely unregulated data are federal, state and local law enforcement agencies[16].
How you are tracked
Whether or not you pass under the gaze of a surveillance camera or license plate reader, you are tracked by your mobile phone. GPS tells weather apps or maps your location, Wi-Fi uses your location, and cell-tower triangulation[17] tracks your phone. Bluetooth[18] can identify and track your smartphone, and not just for COVID-19 contact tracing, Apple’s “Find My” service, or to connect headphones.
People volunteer their locations for ride-sharing[19] or for games like Pokemon Go[20] or Ingress[21], but apps can also collect and share location[22] without your knowledge. Many late-model cars feature telematics that track locations – for example, OnStar or Bluelink[23]. All this makes opting out impractical.
The same thing is true online. Most websites feature ad trackers and third-party cookies[25], which are stored in your browser whenever you visit a site. They identify you when you visit other sites so advertisers can follow you around. Some websites also use key logging[26], which monitors what you type into a page before hitting submit. Similarly, session recording monitors mouse movements, clicks, scrolling and typing, even if you don’t click “submit.”
Ad trackers know when you browsed where, which browser you used, and what your device’s internet address is. Google[27] and Facebook are among the main beneficiaries, but there are many data brokers[28] slicing and dicing such information[29] by religion, ethnicity, political affiliations, social media profiles, income and medical history for profit.
Big Brother in the 21st century
People may implicitly consent to some loss of privacy in the interest of perceived or real security – for example, in stadiums, on the road and at airports, or in return for cheaper online services. But these trade-offs benefit individuals far less than the companies aggregating data. Many Americans[30] are suspicious of government censuses[31], yet they willingly share their jogging routines on apps like Strava[32], which has revealed[33] sensitive and secret military data[34].
In the post-Roe v. Wade legal environment[35], there are concerns[36] not only about period tracking[37] apps but about correlating data[38] on physical movements with online searches and phone data[39]. Legislation like the recent Texas Senate Bill 8[40] anti-abortion law invokes “private individual enforcement mechanisms,” raising questions about who gets access to tracking data[41].
In 2019, the Missouri Department of Health[42] stored data about the periods of patients at the state’s lone Planned Parenthood clinic, correlated with state medical records. Communications metadata[43] can reveal who you are in touch with, when you were where, and who else was there – whether they are in your contacts or not.
Location data from apps on hundreds of millions of phones lets the Department of Homeland Security[44] track people. Health wearables[45] pose similar risks, and medical experts note a lack of awareness[46] about the security of data they collect. Note the resemblance of your Fitbit or smartwatch to ankle bracelets people wear during court-ordered monitoring.
The most pervasive user of tracking in the U.S. is Immigration and Customs Enforcement (ICE), which amassed a vast amount of information[47] without judicial, legislative or public oversight. Georgetown University Law Center’s Center on Privacy and Technology reported on how ICE searched[48] the driver’s license photographs of 32% of all adults in the U.S., tracked cars in cities home to 70% of adults, and updated address records for 74% of adults when those people activated new utility accounts.
Video cameras and license plate readers, like those attached to this Baltimore streetlight, monitor and record the comings and goings of pedestrians and cars on city streets.
AP Photo/Julio Cortez[49]
No one is watching the watchers
Nobody expects to be invisible on streets, at borders, or in shopping centers. But who has access to all that surveillance data, and how long it is stored? There is no single U.S. privacy law[50] at the federal level, and states cope with a regulatory patchwork; only five states – California, Colorado, Connecticut, Utah and Virginia – have privacy laws[51].
It is possible to limit location tracking[52] on your phone, but not to avoid it completely. Data brokers are supposed to mask your personally identifiable data[53] before selling it. But this “anonymization[54]” is meaningless since individuals are easily identified by cross-referencing additional data sets. This makes it easy for bounty hunters and stalkers[55] to abuse the system.
The biggest risk to most people arises when there is a data breach[56], which is happening more often – whether it is a leaky app[57] or careless hotel chain[58], a DMV data sale[59] or a compromised credit bureau[60], or indeed a data brokering[61] middleman whose cloud storage[62] is hacked.
This illicit flow of data not only puts fuzzy notions[63] of privacy in peril, but may put your addresses and passport numbers, biometric data and social media profiles, credit card numbers and dating profiles, health and insurance information, and more on sale[64].
References
- ^ largest number of surveillance cameras per person (www.techspot.com)
- ^ screen passengers (www.mordorintelligence.com)
- ^ smart doorbells (www.vox.com)
- ^ want Congress to do something about it (morningconsult.com)
- ^ studies digital culture and secret communications (scholar.google.com)
- ^ location data from smartphones (theconversation.com)
- ^ license plate readers (www.wired.com)
- ^ facial recognition technology (www.theverge.com)
- ^ cellphone search (www.upturn.org)
- ^ mobile device forensic tool (csrc.nist.gov)
- ^ analyze all your data (www.forensicmag.com)
- ^ if they have a warrant (casetext.com)
- ^ data brokers (www.wired.com)
- ^ help surveil citizens (issues.org)
- ^ via mobile apps (www.digitaltrends.com)
- ^ federal, state and local law enforcement agencies (www.vox.com)
- ^ cell-tower triangulation (cyberforensics.com)
- ^ Bluetooth (www.eurekalert.org)
- ^ ride-sharing (us.norton.com)
- ^ Pokemon Go (www.pokemon.com)
- ^ Ingress (www.ingress.com)
- ^ collect and share location (research.checkpoint.com)
- ^ OnStar or Bluelink (www.popularmechanics.com)
- ^ Oscar Wong/Moment via Getty Images (www.gettyimages.com)
- ^ ad trackers and third-party cookies (themarkup.org)
- ^ key logging (www.malwarebytes.com)
- ^ Google (www.politico.com)
- ^ data brokers (privacybee.com)
- ^ slicing and dicing such information (www.cbsnews.com)
- ^ Many Americans (theconversation.com)
- ^ censuses (www.pewtrusts.org)
- ^ Strava (www.theguardian.com)
- ^ revealed (www.popularmechanics.com)
- ^ military data (www.washingtonpost.com)
- ^ post-Roe v. Wade legal environment (scholarworks.law.ubalt.edu)
- ^ concerns (www.nytimes.com)
- ^ period tracking (www.stopspying.org)
- ^ correlating data (www.techdirt.com)
- ^ phone data (theconversation.com)
- ^ Texas Senate Bill 8 (legiscan.com)
- ^ access to tracking data (www.politico.com)
- ^ Missouri Department of Health (www.vox.com)
- ^ metadata (www.icij.org)
- ^ Department of Homeland Security (www.politico.com)
- ^ wearables (www.democraticmedia.org)
- ^ lack of awareness (pubmed.ncbi.nlm.nih.gov)
- ^ amassed a vast amount of information (americandragnet.org)
- ^ reported on how ICE searched (americandragnet.org)
- ^ AP Photo/Julio Cortez (newsroom.ap.org)
- ^ no single U.S. privacy law (www.nytimes.com)
- ^ have privacy laws (www.natlawreview.com)
- ^ limit location tracking (www.consumerreports.org)
- ^ personally identifiable data (dataprivacymanager.net)
- ^ anonymization (www.techdirt.com)
- ^ bounty hunters and stalkers (www.vice.com)
- ^ data breach (www.tripwire.com)
- ^ leaky app (www.forbes.com)
- ^ hotel chain (www.theverge.com)
- ^ DMV data sale (www.techdirt.com)
- ^ credit bureau (www.securityweek.com)
- ^ data brokering (www.cnn.com)
- ^ cloud storage (www.washingtonpost.com)
- ^ fuzzy notions (www.theatlantic.com)
- ^ on sale (epic.org)
Authors: Peter Krapp, Professor of Film & Media Studies, University of California, Irvine
