I have access to some marketing data and for fun,

select * from mobile_location where latitude between 38.88778433380732 and 38.891917997746894 and longitude between -77.01269830654866 and -77.00613225870377 and epoch_timestamp between 1609954200 and 1610067600

Returned quite a number of mobile devices accurate to the meter. Was fun to see which phone was in which room or blade of grass of the building. I'm not even American.

Yeah, that raises a whole bunch of other ethical questions though, like why you’re able to do this, what access to PII you have and why you’re able to run queries like this on a Saturday.

I hope your employers keeps track of stuff like this.

My guess is that this being possible would be the norm, rather than the exception. And that keeping track of individual queries is not.

Well, that sounds worrying.

What do you think, most such data comes from Apps, they just ask for permission and give you no rights at all. Location data is a such business, for traffic or business. Look at this example from Thasos. The look many hours and shifts are in companys and sell the data to traders. http://thasosgroup.com/blog/thasos-data-tesla-wsj/

Just because something is being done does not mean it’s ethical. Fortunately, this is illegal in Europe.

I did not say, I think it's a good thing or it's ethical. It's just the truth. But we all accept it somehow, so Google or wherever can make us good traffic warnings. Here in Switzerland the location data is also sold by the telco companys, you have to opt out by yourself (at least by Swisscom).

Might be illegal in Europe but it still happens [1].

[1] https://nrkbeta.no/2020/12/03/my-phone-was-spying-on-me-so-i...

Does your company log every select query you do on your prod db? If yes, does it automatically raise alerts when PII is accessed?

I'm genuinely asking, I have never seen such a setup.

As someone who works for a tech giant I'd like to provide some input here.

1. Absolutely yes for ad hoc queries and there's a wealth of logging and privacy features built into all of our tools.

2. Absolutely yes and those queries are audited. For any query that matches some heuristics it'll warn us with a big scary message to make sure the query is legitimate work.

For the query linked above about checking who was around a location at a given time I'd probably be fired before the query completed. It's a pretty comfortable job but they don't mess around with user data, it's zero tolerance if it's abused and even if there was never a warning message your ass is still out the door when they catch you.

For all the flak tech giants get around PII I think it's horrifying that smaller players can still get hordes of sensitive data and yet have basically no safeguards to prevent misuse like querying whatever some internal engineer wants to look at.

This is how it should be.

It does not. Maybe it should though. I know a company I worked at logged everything that was done or accessed within our Salesforce instance, maybe something needs to be done like that rather than allowing folks to run arbitrary sql queries against the database.

This is standard practice at large companies with proper data controls. Usually they have a "break glass" feature for emergencies and don't let any humans access PII without a damn good reason.

99% of "marketing" companies are shady fly-by-night ops, are you expecting any standard procedures from there?

> to some marketing data

I guess this part answers the questions of "why", "what" and "does the employer care". Well, at least these people now know what they did "not" have to hide the whole time.

It’s precise to the meter but is it really accurate to the meter?

You should be fired.

What if I own the company and it's an acceptable Terms of Service use? What if I'm unemployed? Should I still be fired?

Interesting. Who sells marketing data like this?

It's not triangulation, it's multi-lateration and the spatial resolution depends on just how good the basestation clocks are. And they've become very good. Every telco in the USA stores multi-lateration for cell handsets location for 2-5 years by default. They both sell this commercially and provide/sell it to authorities on request.

>Multilateration should not be confused with triangulation, which uses distances or absolute measurements of time-of-flight from three or more sites, or with triangulation, which uses a baseline and at least two angles measured e.g. with receiver antenna diversity and phase comparison.

Is that first "triangulation" supposed to be "trilateration"?

5G significantly increases granularity by a metric shit ton, and if they were continually pinging in the same area, eventually you end up with roughly one zone.

Could you share some resources with more information on this- how does it increase granularity?

Here's Verizon's explainer [1] about how 5G works. Basically, since the frequencies needed to transmit large amounts of data are so high (28 - 39 GHz millimeter wavelength bands), the signal does not reach as far as a 4G tower. Therefore, a higher density of towers is needed (500 feet apart to effectively penetrate buildings [2]), allowing for higher granularity cell-phone triangulation/tracking as a by-product.

[1] https://www.verizon.com/about/news/how-far-does-5g-reach

[2] https://www.celltowerleaseexperts.com/cell-tower-lease-news/...

So it's not a protocol change from 4G, it's just the higher density of access points allowing for more granularity. Gotcha.

Well GPS is 1.2 to 1.5GZ and you can get accuracy to a few meters easily. I have a higher end module that gets down to a meter[1]. Seems obvious that G4 which uses roughly same frequencies but with cell towers vastly closer than a GPS satellite could get 1M.

[1] Give it a few minutes and it'll pin point where my desk is inside my office.

GPS does not use triangulation.

It does some real dark arts physics wizardry to compute a position. Nothing like that can be done for cell phone signals.

Technically it's not triangulation, it's trilateration.

But the math is not significantly harder. The only meaningful quirk is that without a perfect clock you don't know the exact distances to each satellite, instead you have distances a+n, b+n, c+n, etc. Still though, you're just looking for the spot where your numbers line up. There's no wizardry in the "compute a position" part of GPS.

OK, I looked it up, and the GPS system is a different and simpler from what I thought I heard.

In the end the math is indeed similar, but how it gets there is quite different.

For one thing, each satellite carries an atomic clock to make things work. And the receiver locates itself by listening to signals, while triangulation is several receivers working together to locate a transmitter.

I will note that you could make the system work fine without an atomic clock on the satellites. There are circuits that can keep a good enough sync to a ground-based reference. It would just be annoying.

Both GPS receivers and cell phone towers use the same basic approach based on the time it takes for the signal to travel between transmitter and receiver.

The only substantial difference is that in case of GPS the calculation happens on the receiver side (GPS signals only go in one direction), while cellular service providers calculate time advance on the tower side.

AFAIK, cell towers don't even calculate phone position beyond what's needed to determine which tower should handle it.

Maybe there is an element of triangulation in that, but it's far less precise and ambitious than GPS.

Cell tower needs to know timing advance [1] (how long it takes for the signal to travel between the tower and the handset) to make sure signals from different handsets do not overlap.

Once you know which tower the phone is connected to, coordinates of that tower, antenna pattern, and distance (from timing advance and speed of light), you can calculate approximate cell phone location.

You get more data if the phone moves or propagation changes and phone changes towers. In urban environment with many towers location obtained this way can be very precise. Not as good as GPS, but good enough to within a block.

This is a simplification. Real systems also use signal strength, take into account multipath propagation, and apply some filtering from physical constraints (how fast a cell phone can move).

[1] https://en.wikipedia.org/wiki/Timing_advance

OK, I didn't know about "timing advance". Obviously that gives at least a radius from the tower.

Your link is for GSM and states a 550 meter resolution, but I tried looking up LTE and I think it said 10 meters there.

I also understand modern (maybe next generation) towers will use directional transmission to avoid sending signals in all directions. Even if that's a 20° beam, that narrows don't the location by a lot.

Isn't it still triangulation, just accounting for relativity?

You need to lock with multiple satellites, I assumed this was for triangulation.

> GPS does not use triangulation.

LOL

Who the hell has a 5G device?

Is this....a serious question? All new iPhones are 5G compatible for the start and they sell millions, and loads of other manufacturers have released 5G compatible phones. In fact I'd risk a guess that if you bought a phone in the last 12 months it's likely to be a 5G compatible phone.

I bought a Pixel4 in March 2020 :(

Assuming you meant Pixel 4a, that one does not have 5G. The "4a 5G" model does, though, but it came out later in the year.

No, the regular Pixel4. No 5g.

Probably anyone that has signed a contract that came with a free phone in the last year and a half, anyone upgrading iPhones.

Lower cost prepaid carriers are also pushing 5G phones heavily (albeit somewhat crappy ones), and offering them for free.

It doesn’t matter if you have a 5G device, it is a function of the increased tower density. Those towers are capable of the old frequencies, too.

Alot of people buy new Iphones.

You don't even need iPhones - most of the cheap prepaid brands that you'd see next to a payday loan shop are offering Samsung's lower grade phones or OnePlus 5G phones for free if you set up autopay (it's locked to that carrier). Of course it comes with even more privacy-violating bloatware than ever, but still - 5G is no longer a rarity or expensive.

I’m guessing people who flew into DC on a weekday are more likely than average to own a decent smartphone. QAnon folk don’t seem to avoid mainstream technology in the quantity HN users do.

AT&T is still installing Carrier IQ on almost all Androids. That application is collecting info like GPS and barometric readings to estimate floor location in a highrise, etc.

Absolutely. In addition all carriers use multi-lateration and sectorization to fine tune location. The better the location the more valuable it is for commercial resale and CALEA sales.

Notice that all of this is entirely legal, above board, and you agreed to it as part of your service agreement.

Source: I worked for AT&T and Carrier IQ

> you agreed to it as part of your service agreement

"Agree" implies willful consent and being in harmony with the implied outcome.

People accept because they have no meaningfully acceptable choice - which is the exact target that carriers aim for.

They don't even need Carrier IQ, they can use Minimization of Drive Tests, it's part of 3GPP standards.

But even using timing advances, if the cells aren't too big, you get a pretty reasonable accuracy.

You don't get that level of granularity from a single ping, but you theoretically could from hundreds, the noise will tend to center around the true location.

Also consider that more than 3 stations probably were nearby.

Modern mobile networks choose the best 7 for the client but the number of towers within physical range getting pinged is quite substantial.

It's an awesome, deep and nuanced topic certainly not suited to a political HN comments section. "Timing Advance" is the probably the jumpoff keyword for anyone interested.

Mobile towers also use beam-forming in two directions and have a few other techniques to get better signals, the metadata involved with these things (if kept) essentially drops the error range down to GPS levels if not better.