- Resource Center
- General security
- Privacy risks of beacons
General security
On October 6th 2014, buzzfeed.com published a report stating that Titan, a company controlling a number of New York City's phone booth advertising displays, installed tiny wireless devices called beacons in hundreds of phone booths. The beacons pinged out a Bluetooth signal that could be received by mobile phones on which certain apps are installed and activated. Such apps can identify the location of the mobile phones on the basis of the received Bluetooth signals and send targeted advertisem*nts to the users of the phones. The term "targeted advertising" refers to placing advertisem*nts in such a way as to reach consumers based on various behavioral, demographic, and psychographic attributes.
FREE role-guided training plans Get 12 cybersecurity training plans — one for each of the most common roles requested by employers. Download Now
Because beacons are inexpensive (a beacon costs less than USD 25) and can be easily placed wherever people carrying mobile phones walk by, it is expected that the use of beacons in the near future will increase significantly. BI Intelligence forecasts that by 2018 there will be 4.5 million beacons. An article published by Business Insider stated that the business of in-store beacons is "the fastest-growing in-store technology since mobile credit card readers."
Although businesses invest significant financial and human resources in developing mobile phone applications collecting data from beacons, businesses do not put significant efforts in informing the users of such applications about the privacy risks associated with beacons. This article examines the privacy risks posed by beacons (Section 2) and proposes solutions as to how to reduce such risks (Section 3). Finally, a conclusion is drawn (Section 4).
Privacy risks posed by beacons
The use of beacons is associated with at least two privacy risks, namely, a risk of unlawful surveillance (Section 2.1) and a risk of receiving undesired targeted advertisem*nts (Section 2.2). These two risks are examined in more detail below.
Risk of unlawful surveillance
The location data submitted by beacons can be used not only by legitimate software applications, but also by malware programs which can provide criminals with information about the location of individuals. In this regard, it is worth mentioning that there is a large number of malware programs designed specifically for operation systems of mobile devices. In the first half of 2014, the research team of Kaspersky found 175,442 new unique malware programs created specifically for Android. A large number of these malware programs are invisible. As a result, a victim whose location data is collected may not even know about the unauthorized collection of his/her data.
Criminals may use the collected location data to identify behavior patterns of potential victims. Such patterns will facilitate the criminals in the selection of their victims. For instance, an individual who often visits rich parts of a city may be more attractive for thieves than an individual who visits poor parts of a city. Thieves already use online information for the selection of their victims. In 2014, thieves stole jewelry amounting to GBP 100,000 from the owners of an English law firm after reading on the Internet about the luxury lifestyle of the lawyers.
Risk of receiving undesired targeted advertisem*nt
Many users simply agree with the terms and conditions statements and the privacy policies of the mobile applications without reading them. It was estimated that a person needs 244 hours per year to read every new privacy policy encountered by her. Hence, many users would not read a legal provision in a privacy policy stating that "You agree that we may collect location data from beacons. You agree that we may pass the collected location data to third parties who may then regularly send communications to you and provide information offers and services that may be of interest to you." Once the user agrees to such a provision, hundreds of advertisers can send advertisem*nts customized in accordance with the location of the user. Such targeted advertisem*nts would not be "unsolicited" or "unlawful" within the meaning of many national laws. This is because the user agrees to receive them.
Reducing the privacy risks posed by beacons
The privacy risks posed by beacons can be reduced by enhancing the information security protection of mobile phones (Section 3.1) and obliging the companies selling mobile phone applications to obtain users' express consent before collecting location data (Section 3.2).
Enhancing the information security protection of mobile phones
The information security protection of mobile phones requires the joint efforts of users and manufacturers of mobile phones, developers of mobile phone operation systems and anti-malware software, and governments. The roles of these players in the enhancement of the information security protection are examined below.
Users of mobile phones
In order to avoid information security issues, the users of mobile phones may: (1) install up-to-date anti-malware software; (2) avoid the installation of suspicious software programs; and (3) learn how to avoid being tracked if they suspect that their mobile phones are affected by malware programs. For example, the users can avoid being tracked via beacons by turning off their Bluetooth devices.
Manufacturers of mobile phones
Manufacturers of mobile phones may: (1) reduce the vulnerabilities of their mobile phones to the maximum possible extent; (2) inform the users about the problems that may be caused by users' negligence in relation to the information security of their phones; and (3) de-incentivize the public disclosure of vulnerabilities related to mobile phones.
The mobile phone producers need to conduct extensive testing in order to reduce the vulnerabilities of their mobile phones. The manufacturers will incentivize the users to protect their mobile phones by informing them that malware programs collecting location data facilitate crimes (e.g., thefts of personal belongings). The mobile phone producers will decrease the number of information security attacks using publicly available knowledge by providing the users with full control over the operating systems and the hardware of their phones. If users do not have such control, they need to "root" or "jailbreak" their phones by finding, publicly disclosing, and exploiting vulnerabilities.
Developers of mobile phone operation systems
Most malware programs for mobile phone applications exploit the security vulnerabilities of mobile phone operations systems. For instance, the DroidDream malware used two exploits of the Android operating system, namely, Exploid6 and RageAgainstTheCage7. The utilization of these two exploits allowed DroidDream malware to gain root control of the operating system and install software applications without the permission of the user. The non-malicious web page JailbreakMe 3.0 for iOS devices exploits two vulnerabilities to "jailbreak" (i.e., unlock features) the operation systems of mobile phones. It is up to the developers of mobile phone operation systems to detect and remove information security vulnerabilities in their operation systems.
Developers of anti-malware software
The developers of anti-malware software have an important role in the enhancement of the information security protection of mobile phones. This role relates to the detection and neutralizing of malware.
Governments
To enhance the information security protection of mobile phones, governments can prohibit the sale of mobile phone spyware which collects data from users without their permission. In this regard, it should be noted that the sale of apps which transmit location data without permission of the user is a crime in some countries. For instance, in 2014, the CEO of a Pakistani company InvoCode was indicted in the United States of America for selling an app called StealthGenie which allows the buyers of the app to collect data, including location data, from the users of the app without their permission. In relation to the arrest, Assistant Attorney General Caldwell stated:
"Apps like StealthGenie are expressly designed for use by stalkers and domestic abusers who want to know every detail of a victim's personal life – all without the victim's knowledge. The Criminal Division is committed to cracking down on those who seek to profit from technology designed and used to commit brazen invasions of individual privacy."
Obtaining users' express consent before collecting location data
In the EU countries, the websites using cookies are obliged to obtain the express consent of the users before installing cookies on their computers. In order to obtain express consent, websites place a pop-up window on the main page. The pop-up window asks the users whether or not they agree with the installation of cookies. If the users disagree, the websites will not install cookies on their computers.
If the sellers of mobile phone applications are obliged to use similar pop-up windows when collecting location data, users would be aware of the fact that their location data is being collected. The screenshot below displays a sample pop-up window that can be used for obtaining users' consent to collect location data from beacons.
Conclusion
The use of beacons is associated with at least two privacy risks, namely, a risk of unlawful surveillance and a risk of undesired targeted advertisem*nts. The risk of unlawful surveillance can be significantly reduced by the joint efforts of users and producers of mobile phones, developers of mobile phone operation systems and anti-malware software, and governments. The risk of undesired targeted advertisem*nts can be reduced by the adoption of regulatory measures obliging the sellers of mobile phone applications to obtain the express consent of the users before collecting location data from beacons.
FREE role-guided training plans Get 12 cybersecurity training plans — one for each of the most common roles requested by employers. Download Now
Sources
- Bernstein, J., Ryley, S., Singer-Vine, J., 'Exclusive: Hundreds of Devices - Hidden Inside New York City Phone Booths', BuzzFeed, 6 October 2014.
- Brandom, R., 'Advertising beacons discovered in hundreds of NYC phone boots', The Verge, 6 October 2014
- Brunty, J., Miller, L., Helenek, K., 'Social Media Investigation For Law Enforcement', Routledge, 2014.
- Gross, G., 'CEO indicted for company's alleged mobile spyware app', NETWORKWORLD, 29 September 2014.
- Federal Bureau of Investigation (FBI), 'Pakistani Man Indicted for Selling StealthGenie Spyware App', FBI.GOV, 29 September 2014.
- Hill, K., 'How To Avoid Being Tracked By The Hidden Devices In New York City's Phone Booths', Forbes, 6 October 2014. Available on .
- Light, J., Pering, T., Sundar, M., Want, R., 'Privacy, Security and Trust Issues
- Raised by the Personal Server Concept', in 'Privacy, Security and Trust within the Context of Pervasive Computing', Robinson, P. (Ed.), Vogt, H. (Ed.), Wagealla, W. (Ed.), Springer Science & Business Media, 2006.
- Lloyd, I., 'Information Technology Law', Oxford University Press, 2014.
- Masnick, M., 'To Read All of The Privacy Policies You Encounter, You'd Need to Take A month Off from Work Each Year', TechDirt, 23 April 2012.
- 'Mobile Threat Report 2011', Lookout.com.
- Neagle, C., 'Secret ad beacon network uncovered, shut down in New York City', NETWORKWORLD, 6 October 2014.
- O'Reilly, L., 'Hundreds of Ad Beacons Have Been Placed Inside NYC Phone Booths Without Public Consent', Business Insider, 6 October 2014.
- Perry, K., 'Law firm couple suffer £100,000 jewellery raid after thieves 'read about their luxury lifestyle on company website'', The Telegraph, 19 November 2014.
- Smith, C., 'THE BEACONS REPORT: Growth Forecasts For The Most Important Retail Technology Since The Mobile Credit Card Reader', Business Insider, 14 November 2014.
- Wagstaff, K., 'New York City Nixes Advertising 'Beacons' in Telephone Boots, NBC News, 6 October 2014
Posted: December 8, 2014
Daniel Dimov
View Profile
Dr. Daniel Dimov is the founder of Dimov Internet Law Consulting (www.dimov.pro), a legal consultancy based in Belgium. Daniel is a fellow of the Internet Corporation for Assigned Names and Numbers (ICANN) and the Internet Society (ISOC). He did traineeships with the European Commission (Brussels), European Digital Rights (Brussels), and the Institute for EU and International law “T.M.C. Asser Institute” (The Hague). Daniel received a Ph.D. in law from the Center for Law in the Information Society at Leiden University, the Netherlands. He has a Master's Degree in European law (The Netherlands), a Master's Degree in Bulgarian Law (Bulgaria), and a certificate in Public International Law from The Hague Academy of International law.
In this Series
- Privacy risks of beacons
- Free Valentine's Day cybersecurity cards: Keep your love secure!
- How to design effective cybersecurity policies
- What is attack surface management and how it makes the enterprise more secure
- Is a cybersecurity boot camp worth it?
- The aftermath: An analysis of recent security breaches
- Understanding cybersecurity breaches: Types, common causes and potential risks
- Breaking the Silo: Integrating Email Security with XDR
- What is Security Service Edge (SSE)?
- Cybersecurity in Biden’s era
- Password security: Using Active Directory password policy
- Inside a DDoS attack against a bank: What happened and how it was stopped
- Inside Capital One’s game-changing breach: What happened and key lessons
- A DevSecOps process for ransomware prevention
- What is Digital Risk Protection (DRP)?
- Will immersive technology evolve or solve cybercrime?
- Twitch and YouTube abuse: How to stop online harassment
- Can your personality indicate how you’ll react to a cyberthreat?
- The 5 biggest cryptocurrency heists of all time
- Pay GDPR? No thanks, we’d rather pay cybercriminals
- Customer data protection: A comprehensive cybersecurity guide for companies
- Online certification opportunities: 4 vendors who offer online certification exams [updated 2021]
- FLoC delayed: what does this mean for security and privacy?
- Stolen company credentials used within hours, study says
- Don’t use CAPTCHA? Here are 9 CAPTCHA alternatives
- 10 ways to build a cybersecurity team that sticks
- Verizon DBIR 2021 summary: 7 things you should know
- 2021 cybersecurity executive order: Everything you need to know
- Kali Linux: Top 5 tools for stress testing
- Android security: 7 tips and tricks to secure you and your workforce [updated 2021]
- Mobile emulator farms: What are they and how they work
- 3 tracking technologies and their impact on privacy
- Quantitative risk analysis [updated 2021]
- Understanding DNS sinkholes - A weapon against malware [updated 2021]
- Python for network penetration testing: An overview
- Python for exploit development: Common vulnerabilities and exploits
- Python for exploit development: All about buffer overflows
- Python language basics: understanding exception handling
- Python for pentesting: Programming, exploits and attacks
- Increasing security by hardening the CI/CD build infrastructure
- Pros and cons of public vs internal container image repositories
- CI/CD container security considerations
- Vulnerability scanning inside and outside the container
- How Docker primitives secure container environments
- Top 4 Zapier security risks
- Common container misconfigurations and how to prevent them
- Building container images using Dockerfile best practices
- Securing containers using Docker isolation
- Introduction to container security
Related Bootcamps
- CompTIA CASP+ Training Boot Camp
- ISC2 CISSP® Training Boot Camp
- ISC2 CCSP® Training Boot Camp
- ISACA CISA Training Boot Camp
- ISACA CISM Training Boot Camp
- ISC2 CSSLP® Training Boot Camp
- CompTIA CySA+ Training Boot Camp
- CompTIA Network+ Training Boot Camp
- CompTIA Security+ Training Boot Camp
- Ethical Hacking Dual Certification Boot Camp (CEH and PenTest+)
Get certified and advance your career
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, ISC2, Cisco, Microsoft and more!
View Certifications
General security
Free Valentine's Day cybersecurity cards: Keep your love secure!
General security
How to design effective cybersecurity policies
General security
What is attack surface management and how it makes the enterprise more secure
General security
Is a cybersecurity boot camp worth it?