Main content
Computers and the Internet
Course: Computers and the Internet > Unit 4
Lesson 3: User data trackingGeolocation
AP.CSP:
IOC‑2.A (LO)
, IOC‑2.A.12 (EK)
, IOC‑2.A.14 (EK)
, IOC‑2.A.4 (EK)
, IOC‑2.A.7 (EK)
The Internet is global, yet it can help us find the services, products, and events near us. Where's the nearest bank? What restaurants will deliver to me? Which of my friends live in the area? What bus will get me to my destination?
To answer those questions, a program needs to know a user's geolocation: an approximate latitude and longitude describing their geographic location.
Let's review the ways that geolocation can be determined and consider the many ways it can be used.
Device positioning systems
The geolocation of a user is actually the position of a user's device, whether that's a home computer, laptop, smartphone, or fitness tracker.
There are multiple ways for a device to determine its own position in the world, ranging from the most precise (GPS) to the least precise (IP-based geolocation).
Global positioning system (GPS)
The US government started the GPS project in the 1970s and now controls around 30 GPS satellites orbiting the earth. start superscript, 1, end superscript
GPS receivers are tiny sensors with antennas that receive radio signals from the GPS satellites orbiting in the sky above. In most cases, if a sensor can receive signals from at least four satellites, the receiver can calculate its position using a technique called trilateration.squared
GPS works best in an outdoor environment with a clear view of the sky. A smartphone can typically record a geolocation that is accurate to within 4.9 m (16 feet) in open sky. GPS doesn't work as well indoors or near buildings due to the interference caused by roofs, walls, and other objects, but it is still the most precise source of geolocation data.
Wi-Fi positioning system
Wi-Fi positioning is a strategy that works well in dense, urban areas filled with Wi-Fi networks (nearly the opposite of where GPS works well).
First, a device with a Wi-Fi antenna can scan for Wi-Fi access points and measure the signal strength to each network.
That results in information like the table below. Note that signal strength is always negative, so the number closest to zero is strongest.
| BSSID | MAC address | Signal strength (RSSI) |
|---|---|---|
| NETGEAR09 | A3:F3:5D:2A:A3:1B | -59 |
| NETGEAR09-5G | A3:F3:5D:2A:A3:1B | -72 |
| Sonic-b346 | 53:19:DA:E0:57:3A | -79 |
| Emdutos | E3:84:14:BC:BC:FF | -84 |
| Baskind Bunch | 52:8D:5E:29:E7:5A | -85 |
| Sonic-9472-5G | 4C:4C:DB:91:1A:1A | -88 |
| xfinitywifi | F8:59:F4:FC:C5:F1 | -93 |
Once the device has that information, it can use trilateration. The device determines the location of each access point by looking it up in a Wi-Fi location database or in their own (smaller) cache of locations. It then estimates its own location based on the found locations and their signal strength.
A more accurate technique is fingerprinting, but it's only possible if a fingerprint map has been made ahead of time. To make the map, a portable device computes the fingerprint for many reference points within a particular area. Each fingerprint is the list of nearby networks and their signal strength, like the table above, plus a pair of geographic coordinates.
When a mobile device enters the area and needs to know its location, it can send its fingerprint to the machine with the radio map, and the machine uses an algorithm to compute the closest fingerprint and estimate the coordinates accordingly.
This technique can be very accurate indoors, especially with a dense fingerprint map, but it's not yet in common use, since it depends on the existence of that fingerprint map.
Cell tower trilateration
In the US, cellular phones are legally required to report their approximate location in the case of 911 calls, to help emergency services get to the callers quickly. If a cell phone is unable to use GPS to report its location, it can instead use cell tower trilateration.
Cell towers are what makes cellular networks possible. Each cell tower includes three sets of directional antenna arrays in a triangular shape:
The cell tower can estimate the distance between the tower and a phone by measuring the round-trip delivery time and signal strength. It can improve that estimate by knowing which of the three antenna arrays sent the signal. A single tower is enough to calculate a wide area, but if multiple towers are available, the location can be narrowed down to a smaller area.
IP-based geolocation
Whenever a device sends data over the Internet, it also sends along an IP address. Even though an IP address isn't like a mailing address that describes an unmoving place in the world, it is often possible to map IP addresses to a geographic area.
IP geolocation databases contain millions of rows mapping IP addresses to locations. Companies create those databases based on a variety of sources such as regional IP address registries, user-submitted locations on websites, data from ISPs, and estimates based on network routes.
To give you an idea for the accuracy, I looked up my own IP address in three different IP geolocation databases. The results:
| Country | State | City | Latitude | Longitude |
|---|---|---|---|---|
| USA | California | Corona | 33.8753 | -117.5664 |
| USA | California | Richmond | 37.9358 | -122.3478 |
| USA | California | Santa Clara | 37.3541 | -121.955 |
The databases all got the country and state correct, and for some purposes, that might be all that's needed. However, the coordinates span a range of 475 miles! 😬
IP-based geolocation is typically the last resort, since it is the most inaccurate of all the techniques. Plus, if a user is accessing the Internet through a VPN (Virtual Private Network), their true IP will be hidden and the VPN's IP could be geolocated in an entirely different continent.
Program access to geolocation
Even when a device has a way to determine its geolocation, it doesn't necessarily expose that information to the software running on it.
Let's look at the various ways that websites and mobile applications can find out the user's location.
Request access
Webpages can use the browser's built-in geolocation API to request the current geolocation. The browser calculates the geolocation using many of the strategies mentioned above and returns the most accurate one.
The browser will first ask the user for permission, however.
Here's what that request looks like in the Chrome browser:
Mobile apps also typically must ask for permission for the current geolocation, although that depends on the mobile platform (i.e. Android vs. iPhone). Some apps will even request permission to continually collect the user's geolocation, even while they're not actively using the app.
Here's a request from an app on an Android phone:
IP-based geolocation
When a user visits a website, their browser sends an HTTP request to the web server. The HTTP request is wrapped in an IP packet, so it always includes the sender's IP address.
As we described above, the web server can use an IP geolocation service to turn the user's IP address into an approximate location.
IP-based geolocation isn't terribly accurate, but it can at least give a website a clue as to where their users are coming from. The website can use the approximate location to personalize the experience, serve targeted advertisements, or simply understand their user demographics better.
User input
Websites and apps can also simply ask the user for their location.
For example, the user can type in an address and the website can use a geocoding service to convert that into a latitude and longitude.
Here's a store locator that shows the nearest stores for a user's zip code:
Websites can also detect the geolocation of user uploaded photos by looking at the metadata of each photo file, since many phones automatically record location inside photo files. Users don't always realize that, so online photo galleries have become a treasure trove of publicly available user locations.
Benefits and risks
Thanks to geolocation, we can find our lost phone, discover a local café to satisfy our craving for a quiche, or document an epic cross-country bike ride. Law enforcement agencies can locate violent offenders, and ambulances can rush to a caller's location.
But geolocation is also private information, and public access to private information always has its risks:
- There have been multiple cases of people using publicly accessible geolocation data to stalk a former partner or a stranger. cubed
- Law enforcement agencies have been accused of using an inaccurate geolocation to wrongly accuse someone of a crime. start superscript, 4, end superscript
- Websites can choose to censor information based on where they think a user lives.
🤔 What are other negative consequences of allowing our geolocation to be tracked by devices, networks, and programs?
🙋🏽🙋🏻♀️🙋🏿♂️Do you have any questions about this topic? We'd love to answer—just ask in the questions area below!
Want to join the conversation?
There is a lot of reasons to why geolocation is dangerous. But the main one is why do you want to tell that company where you are at what time and even why. In a few years, we will have no more privacy.(9 votes)
This worries me. The claim usually is for targeted advertisements but all mine seem to come from search history and larger corporations. I tried a typing practice site and it wanted to know within 7 meters. There are no stores within 7 meters of my home keyboard. So why so much importance on knowing location?
Have you ever read terms and conditions before agreeing, it can be scary.(2 votes)
Almost all photo contains GPS data. But if you upload with a lossy format that data will not upload.(4 votes)
You can delete the metadata or alter it before uploading. Also lossy formats can contain metadata.(3 votes)
i feel like i either missed the definition of fingerprinting somewhere or i forgot it somehow(5 votes)
the definition of fingerprinting is,
fin·ger·print
[ˈfɪŋɡəprɪnt]
VERB
fingerprinting (present participle)
record the fingerprints of:(1 vote)
- when someone is at sea do GPS satilites connect with the ship you are on, or do they communicate with the nearest land conneting point and then the land conecting points communicate with the ships?(3 votes)
both. On a ship, the GPS satellites are primarily used (directly to the ship), but sometimes land points are used (directly to the ship) to give a more precise reading.(3 votes)
Geolocation is dangerous in many ways. But we could turn off our GPS on apps. What will happen if in a few years we can't do that?(1 vote)
I'd say that if you can't turn off GPS, use an older operating system/model, or if this is an app-specific issue, simply use a different app. Your geolocation is likely not worth whatever service the app provides.(4 votes)
- I was just curious(2 votes)
is hacking into fortinte to get the battle pass for free bad(2 votes)
Yes, anything that uses an exploit to get something that costs money for free is a crime.(1 vote)
- Why does it always ask for our location(2 votes)
Encryption is not a crime(1 vote)
I agree. It is not a crime.(2 votes)
- how does this tie in?(1 vote)
