Here’s the NSA’s advice for reducing the exposure of cellphone location data – CyberScoop

Written by Shannon Vavra Aug 4, 2020 | CYBERSCOOP

Take it from the experts: There is no way to fully eliminate the risk that a mobile device is exposing location data to somebody trying to track it, but there are ways to limit what leaks and why.

Thats the main theme from guidanceissued Tuesday by the U.S. National Security Agency, which directed its advice toDepartment of Defense personnel andother national security programs but published the document publicly.

Theguidanceexplains the different kinds of location information that can be used to locate mobile devices and their users, provides an analysis of misconceptions about location data, andrecommends way to help users protect themselves.

The NSA warns, for instance, that in addition to mobile devices storing location data in their own mobile device logs, cellular networks receive real-time coordinates for cellphones every time they connect to the network. That communication with the network also can makelocation information vulnerable.

This means a provider can track users across a wide area. In some scenarios, such as 911 calls, this capability saves lives, whereas for personnel with location sensitivities, it may incur risks, the NSA notes in the guidance. If an adversary can influence or control the provider in some way, this location data may be compromised.

Bad actors using devices that imitate legitimate cellular towers could also obtain sensitive location information even without providers cooperation, the NSA warns.

Theguidance comes amid months of ongoing protests around the U.S. against police brutality and racial injustice. And although the guidance is targeted toward U.S. federal government users,it could have broad appeal as concerns mount that law enforcement agencies are interested in tracking crowds during protests.

TheNSAs primary mission is signals intelligence for the U.S. military and the intelligence community, so it isintimately familiar with how to track cellphone locations around the world, as former NSA contractor Edward Snowden revealed in 2013. But the guidance issued Tuesday comes from a new directorate the NSA establishedin 2019to focus on cybersecurity. One of its goals has been to issue more public guidance and advice on cybersecurity as part of the recognition it can do more to spread awareness of cybersecurity issues.

Location data can be extremely valuable and must be protected. It can reveal details about the number of users in a location, user and supply movements, daily routines (user and organizational), and can expose otherwise unknown associations between users and locations, the NSA warns. Mitigations reduce, but do not eliminate, location tracking risks in mobile devices Users should be aware of these risks and take action based on their specific situation and risk tolerance.

Even if users turn off cellular service on a mobile device, the NSA warns, Wi-Fi and Bluetooth can still be used to identify a users location. Disabling a phones location services thegeolocation datathat devices provide to apps also has a limited effect.

Perhaps the most important thing to remember is that disabling location services on a mobile device does not turn off GPS, and does not significantly reduce the risk of location exposure, the guidance states. Also important to remember is that GPS is not the same as location services. Even if GPS and cellular data are unavailable, a mobile device calculates location using Wi-Fi and/or [Bluetooth].

To reduce the risk of location data exposure, the NSA recommends users disable location services, advertising permissions, Bluetooth and Wi-Fi when theyre not in use, and Find My Device settings that allow lost or stolen devices to be tracked. The DOD signals intelligence agency also recommends giving apps as few permissions as possible, minimizing the amount of data containing location information that is stored in the cloud, setting browser privacy settings to block location data usage, and using a Virtual Private Network (VPN).

The NSA also warns that the risks of being tracked through location information are not exclusive to cellphones users should consider the risks of using smart watches, fitness trackers, and other internet of things (IoT) devices even gadgets, such as smart thermostats, that dont leave the house.

The guidance comesapproximately one week after the smartwatch and wearables companyGarmin confirmed it had been the victim of a ransomware attack.

Anything that sends and receives wireless signals has location risks similar to mobile devices. This includes, but is not limited to, fitness trackers, smart watches, smart medical devices, Internet of Things (IoT) devices, and built-in vehicle communications, the NSA states. These security and privacy issues could result in these devices collecting and exposing sensitive location information about all devices that have come into range of the IoT devices. Geolocation information contained in data automatically synced to cloud accounts could also present a risk of location data exposure.

Users should also be cautious of what they share on social media since many applications may collect and share information that reveals a users location, the NSA warned, noting that sharing photos online may expose sensitive location data stored in metadata.

Many apps request permission for location and other resources that are not needed for the function of the app. Users with location concerns should be extremely careful about sharing information on social media, the guidance says. If errors occur in the privacy settings on social media sites, information may be exposed to a wider audience than intended.

Read the original:
Here's the NSA's advice for reducing the exposure of cellphone location data - CyberScoop