Subject: Mobile Location Based Service user privacy (commercial issue)

From: Alex WANG JiaYi <[email-masked]>
Date: Thu, 19 Jul 2001 16:55:43 +0800

Hi there,

I just got to know this WG. It is really great to share ideas here.

I am raising a question from commercial/legal perspective on Mobile Location
Based Service (LBS) user privacy issue. The location information disclosure
due to technical problem (hacker attack, etc.) may not be relevant and
touched here. 

All the parties involved here include User(s), Mobile Network Operator
(MNO), and LBS Application Service Provider (ASP). My concern is on the
relationship and privacy issues among User, MNO, and ASP.

First, I would like to define all the relevant parties in LBS chain.

User(s) include both the user whose location is requested by other parties
and the user requesting the location of other users.

Mobile Network Operator (MNO) is defined as the owner and operator of mobile
network. It has the technical capability to locate its mobile
users/subscribers. MNO could also provide some LBS Applications/Services.
MNO will be the party to ensure that the location information of a User is
not abused so as to protect user privacy as well as to protect itself from
legal issue since it physically controls and provides the user location
information.

LBS Application Service Provider (ASP) is defined as the service provider
that utilizes the location of users to deliver service. If it is not
specifically stated, ASP does not include the ASP function carried out by
MNO. 

My question is how MNO can ensure the end user location information is
respected and protected and not abused by ASP.

I give an example as follows.

The user wants to find his own location.

		The user enters a new city and is not sure about the
surrounding environment. He thinks he will be feeling safe/comfortable if he
knows his location. Thus, he checks with his MNO, requesting his own
location to be delivered to him.
		This sounds simple and straightforward. But there is the
tricky part here. If the service is provided by MNO, MNO will ensure that it
will carry out the positioning only upon request. But if an ASP other than
MNO provides the service, how does MNO ensure user privacy? Say the ASP may
tell MNO to locate John. But actually John did not request for this. The ASP
just did this out of curiosity or some other reasons. Another privacy issue
is that every time John requests his own location, the ASP may keep a record
for some reasons, say, just for fun or selling it to third party. The user
and MNO may not know all these. One day when the user gets to know his, he
is likely to sue both ASP and MNO, as MNO is the one who provided user
location information to ASP.

Things become more complicated when more than one user is involved. Say
parent wants to know whereabouts of his/her daughter. A guy wants to find
his buddy. Boss wants to know the location of his/her employee.
In those cases, shall MNO keep all the Location-related user profiles under
its own control or keep a mapping record of the user profile of different
applications? But it is difficult for MNO to keep all the Location-related
user profiles. First, there could be dozens of applications provided by ASP
as the LBS becomes popular. And it is not efficient as well. For example,
User A tries to locate User B by Application Zero. Since the profiles are in
both ASP and MNO, first Application Zero checks its database and finds A has
the right to locate B. Thus it gives green light to A. Then the Application
Zero interrogates MNO for B's location. Once again, MNO has to check its
mapping database of Application Zero to grant permission. Second, the
Location-related user profile is highly dynamic. For example, an employee
agrees that his boss can locate him from 9am to 6pm, Monday to Friday. But
somehow on one Thursday, the employee is allowed to knock off at 3pm. So he
changes his Location-related user profile at ASP side. How does MNO know the
change? Shall MNO ask ASP to export all these changes all the time to it?
Once again, this is not efficient and cost is high.

My point is that it is not advisable for MNO to control all the
Location-related user profile in different applications. As this is not
efficient and incurs a lot of cost when there are a lot of LBS applications.

Then, how to protect MNO?

Is it enough just to sign an agreement with ASPs, stating that they can only
request for the location of the right person at the right time with the
right authorization and the location information will be guarded and not
released to third party? 

By signing the agreement, it seems that MNO can push aside the legal issue
to between ASPs and Users. However, by doing so, MNO is still in a
vulnerable position. Whenever there is a location request of its subscriber
from an authorized ASP (with the aforementioned agreement signed), MNO will
provide this information, although the location request may be illegal. So,
is MNO 100% safe here?

I would appreciate if you may share your idea with me.

Thank you.

Alex WANG Jiayi
Mobile, StarHub Pte Ltd
51 Cuppage Road, # 07-00 StarHub Centre, Singapore 229469
Tel:          (+65)    825 5547
Mobile:     (+65)  9004 0768
Email:	[email-masked]

The contents of this email and any attachments are confidential and may be
privileged or otherwise protected from disclosure. Unauthorised use, review,
distribution and copying of this email and any attachments herein are
prohibited. If this email has been transmitted in error please delete it
immediately and notify the sender. 
Unless otherwise stated, any pricing information provided or implied in this
email and any attachments herein is merely indicative, does not constitute
an offer to deal at any price quoted and is subject to contract.

---

From: Shahid Shoaib <[email-masked]>
Date: Thu, 19 Jul 2001 13:13:31 -0700

My comments are inline. I have tried to use your terminology instead of the
actual UMTS terms.

> legal issue since it physically controls and provides the user location

Yes I agree. MNO will have control over the location information. MNO may
use this information for performance enhancements (e.g. location assisted
handoff) as well as providing location based services by itself or through a
third party. Just a little clarification, positioning maybe mobile based,
mobile assisted, network based or network assisted.

> MNO provides the service, how does MNO ensure user privacy?

Case 1: Mobile Station (MS) requests own location
The MNO always maintains a subscription profile for each MS. If the
subscription profile of the MS allows Basic Self Location, then the MNO will
send basic location information back to the MS. No ASPs will be involved.

Case 2: MS requests location assistance data
Location assistance data may be used by the MS to compute its own location
in an extended period using mobile based positioning methods. Location
assistance data will be provided by the MNO to the MS only if it subscribes
to the Autonomous Self Location profile. No ASPs will be involved.

Case 3: MS requests transfer of location information to some ASP
If the MS wants its location information to be delivered to some other ASP
(for example, in order to find out the nearest Italian restaurant) then it
must have a subscription to the Transfer to Third Party profile. In this
case the user will be aware that his location information is being sent to a
third party.

The new 3G phones in development are equipped with GPS receivers and
download/store city maps and locality information etc themselves. In most
cases, these phones won't even tell the MNO what they are doing.

> Say the ASP may
> just did this out of curiosity or some other reasons.

The ASP can only request location information for John if John himself has
subscribed to push-type location services from that particular ASP. John's
subscription profile will define who can query his location, at what times,
how many times and whether his prior authorization is required or not.

> Another privacy issue

No one can stop MNO or ASP from storing location information. However,
something may be done about selling it to third parties. When you divulge
your information on the internet, most companies agree to not selling your
information to third parties.

> efficient and incurs a lot of cost when there are a lot of LBS
applications.

Well in UMTS, its the job of the MNO to keep the subscription profile of its
users.

----------------------------------------------------------------------------
--------------------------
Shahid Shoaib                                  +1-408-451-4740 Direct
DoCoMo USA Labs Inc.                  +1-408-573-1090 Fax
[email-masked]         http://www.docomo-usa.com

---

From: Andrew Daviel <[email-masked]>
Date: Sat, 21 Jul 2001 02:49:44 -0700 (PDT)

This is quite an interesting discussion about things I hadn't considered.

I thought I'd describe how my hypothetical device might behave in these
situations. It is typically built of components that I'm familiar with,
and could build today if I wanted. I seem to use Linux for everything, and
spend a lot of time logging into work from home, and home from work, so
my device fits into that environment. Using off-the-shelf components,
it consists of a laptop, a cellphone, wireless modem, and GPS set with
NMEA connection. Or a device like a Blackberry PDA, which I'm told has an
API to obtain its location from the network provider. The GPS receiver
and wireless connection may be inside the laptop on PCMCIA cards. The
laptop (or future multifunction device) is running a multiuser operating
system with  authentication and remote access mechanisms.

> The user wants to find his own location.

The GPS receiver sends location information to the laptop, which displays
it to the user. No other agency is involved.

> parent wants to know whereabouts of his/her daughter.

Push: At regular intervals, or when the location changes, the daughter's
device sends a message containing the location to the parent. This might
take the form of a public-key encrypted mail message, or the daughter
might have an account on the parent's computer with a trust relationship
established with a cryptographic key. The location could then be written
into a file to which the parent has read access, e.g. with SSH.

Pull: The parent has an account on the daughter's device, which has read
access to the position data. When the parent wants to know the location,
they connect to the daughter's device using SSH and read it.

(currently, as it happens, my daughter has an account on my computer and
she has an account on mine. In view of her age & level of computing
knowledge, I am the administrator on both)

> A guy wants to find
> his buddy.

Not so likely that the user would set up normal accounts for all their
buddies.
Push: The user sets up an account on a trusted server, sets up ACL lists,
and pushes location
data to it with SSH or HTTP/SSL. Their buddies authenticate with the
server using SSL certificates from a PKI.
Pull: The user runs a server on their mobile device, and their buddies
authenticate and connect directly

>Boss wants to know the location of his/her employee.
> For example, an
> employee agrees that his boss can locate him from 9am to 6pm, Monday
> to Friday. But somehow on one Thursday, the employee is allowed to
> knock off at 3pm.

Push: The user pushes location data to the employer's server when they are
working.
Pull: The employer's authentication on the user's device is time-dependant
(this feature is standard on Linux/Unix but I've never used it)

I think this arrangement is likely to go wrong, for human reasons. The
user will forget to change things when they knock off. Maybe the user has
one device that belongs to the employer, which stays at work, and one
which belongs to them. Hmm, if the user is a traveller or driver who works
from home, that wouldn't work.

The "buddy list" seems the most difficult problem. It's not like a group
with a single access control, because you don't trust everyone equally
and you probably don't trust the buddy of your buddy. So it needs some way
to reliably authenticate everyone separately without getting so
complicated that noone will use it. I *think* SSL certificates can handle
this kind of thing, though I haven't tried to set it up. I think one of my
utility companies (electric) tried doing this - set up a CA, then get
customers who wanted online account access to download and install a cert
into their browser - but that was a couple of years back when people were
a bit less experienced with eCommerce etc. and I think it wasn't popular.

The ASP in this case knows everyone's location and name, because real
names are probably required to get a cert from the PKI. THis may not be a
problem - people seem willing to trust their sexual preferences to a
webserver or instant messanging service. Hm; but that's not using real
names. Maybe we need an anonymous PKI.

Andrew Daviel
Vancouver Webpages

---

From: Randy Bush <[email-masked]>
Date: Sat, 21 Jul 2001 09:05:18 -0700

> knowledge, I am the administrator on both)

i missed the part where the daughter makes the decision of what and if
to reveal.

randy