From the first thread on this issue[0], it appears that the GPS data transfer exchange is happening underneath the OS level.

I tried the locationsmart demo, after disabling the GPS on my phone, and all location services, my exact location was still be able to be pinpointed utilizing their GPS option.

[0]: https://news.ycombinator.com/item?id=17081684

It's using the cell tower location. If you don't connect to the cell tower (Airplane mode), there's no location.

>> From the first thread on this issue[0], it appears that the GPS data transfer exchange is happening underneath the OS level.

> It's using the cell tower location. If you don't connect to the cell tower (Airplane mode), there's no location.

So you're saying that person quite explicitly saying this is GPS data is explicitly wrong about this? (i.e. you have more information than that person, and it is explicitly to the contrary?)

FWIW the Kerbs article makes no mention of GPS, only nearby cell towers

https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...

That person was clearly claiming to have 'insider' information. I'm not sure why one would expect Krebs to have been privy to the same information.

It does AGPS, pointed to where exactly I was in my house.

Or it's being reported as part of the E911 data for emergency services.

This seems like the most likely explanation to me.

It looks like this is the creepiest of all the ways "they" get your location:

https://www.qualcomm.com/products/izat

There are 3 operating systems running in any phone:

* iOS / Android * The SIM card JVM * The baseband RTOS

And Qualcomm is in most phones, running their RexOS, which Has that IzAt service, which has full access to memory, GPS, etc, and uses this access to send your location data to Qualcomm / the carrier.

https://news.ycombinator.com/item?id=17082485

https://en.wikipedia.org/wiki/REX_OS

https://news.ycombinator.com/item?id=6722292

https://forums.oneplus.com/threads/what-does-this-do.373496/

While I’d love to believe that’s enough, you can’t really be certain the SIM isn’t uploading Location data that’s been stored while in airplane mode. Until SIM is open source (which is pretty unlikely) there’s no way to be sure outside of a device not having a cellular radio or gps capability.

Why would it? The SIM card itself has no real functionality, and cannot just randomly affect the radio components of the phone. It just stores its identity and keys, so the cell tower can identify and bill the right user.

The way the location tracking works is simply by logging what phone connected to the cell tower, at the tower itself. To be able to adjust the power the radio component needs to output (to get a good signal), it needs to know the distance to the tower. You get location by then correlating with multiple towers, because the phone has to choose which one it has the strongest reception to, and therefore has to gather data from all nearby towers.

In short: that’s not how a SIM card works.

Leaving aside the SIM card, there's no way to really know what the baseband is up to: https://www.extremetech.com/computing/170874-the-secret-seco...

SIM cards do run some sophisticated software, e.g. a. Java Card runtime.

Even with something running on it, that’s not automatically gonna give it access to any other hardware component in the phone. The phone itself is only interested in using it for identification.

> Even with something running on it, that’s not automatically gonna give it access to any other hardware component in the phone. The phone itself is only interested in using it for identification.

I can't tell if this is true or false, but it seems that in either case, access to the SIM can imply access location data:

> With the all-important (and till-now elusive) encryption key, Nohl could send a virus to the SIM card, which could then send premium text messages, collect location data, make premium calls or re-route calls.

[1] https://www.forbes.com/sites/parmyolson/2013/07/21/sim-cards...

AP MAC addresses, signal strengths and locations have been collected by Google for years to provide WiFi-based location services to Android users.

I wouldn't be surprised if other platforms/applications/companies are using that data, as well.

Mozilla also.

https://location.services.mozilla.com/