Privacy and Girls Around Me

This is what can happen when you don’t understand the fine nuances of privacy policies: you could wind up a pop-up on Girls Around Me (“GAM”). GAM is a really creepy iPhone app that coordinates data from GPS readings on cell phones and Foursquare, and data from Facebook and Google Maps to give the user pop-up images of women physically located near the user. The user can then, innocuously enough, go approach these women to flirt and ask them for dates.

Or he could use the same data to determine where their homes and workplaces are, follow and stalk them, or rape them.

And while it looks like this is an astonishing and malevolent invasion of privacy, it really isn’t; the app only uses data that the victims subjects themselves have “chosen” to broadcast and make public. So what’s to do about this other than to lecture people to actually read privacy policies before deciding to share data about themselves?

If your answer to that question is “nothing,” then you’re probably a reasonably strong libertarian, or you’re like Scott McNealy, who famously quipped, “You have zero privacy anyway. Get over it.” (Pre-9/11, natch.) If your answer to that question is “write a law,” then you’re probably the opposite. None of these seem like they’re particularly satisfying as answers, and I think the reason for that is when we talk of “privacy” these days, we don’t mean what that word has meant in the past.

Consider another challenge facing businesses and consumers: how to be price-competitive and price-savvy in a world that blends brick-and-mortar shopping with online commerce. Linking up the diverse bits of information about a consumer and connecting that to the consumer’s cell phone creates a world of opportunity for retailers. Google, Bing, and who knows how many other companies gather information about your search habits, your web surfing habits, and come to some sometimes accurate and sometimes silly decisions about the sorts of products, media, and services you would like to consume. Combine that information with, say, the data files your grocery store keeps about you, and mentions of product consumption behavior on your Facebook page, and coordinate that with the GPS in your phone, and if a retailer can gather all that data and assemble it fast enough the way GAM does, the retailer could in theory exploit that information to “guide” your consumer behavior while you’re in the retailer’s store. As described in the linked article, this variant of GAM aimed to benefit retailers could be benign or at worst annoying. But it takes very little imagination to come up with scenarios in which this assemblage of information would be exploited in more unplesant sorts of ways.

The libertarian in me objects, “So what if Macy’s figures out your credit rating when you walk in its door? It’s up to you to make good spending and good credit decisions.” Which is true enough. But the sorts of people who don’t make good spending and good credit decisions are the sorts of people who, by definition, are susceptible to attractive offers to make poor financial decisions. Enhanced information technology could be used to exploit this — to make varying credit offers to varying consumers and create financial products on the spot that would effectively double the price of goods sold in retail stores to the unsophisticated consumers likely to buy into the pitch. When enough of that accumulates, that starts to create a drag on the larger economy. So I’m not sure that the libertarian solution of utitur emptor is going to be an adequate solution from a social policy standpoint.

The instinct is to point to privacy protection laws, and urge people to opt out of data-sharing. Certainly we can do that. But the utility and advantages that these same companies offer is tremendous and we don’t want to do without that. It’s handy having a gmail account that you can access from anywhere in the world, across multiple devices. I’m willing to let Google gather information from my e-mail and blog reading habits to take ham-handed guesses about what kinds of advertisements would prompt me to click through in order to get that service, just like I’m willing to take “discounts” from my grocery store in exchange for letting it gather data about the kinds of products I buy, which in turn influences the coupons I’m given and the junk mail I get in my mailbox.

But there’s a limit to how far I’m happy about that sort of thing going. The issue is not that I’m super-protective of all this data about myself; there are things I’m willing to allow corporations to do with data about me. So the issue isn’t “privacy” in the sense of me controlling who has access to information about me — it’s “privacy” in the sense of controlling what they do with that information. This is a diminishment of privacy from the deontological sense of the word; the abuse of privacy that becomes objectionable stops being the inherent loss of one’s seclusion, but rather it is a utilitarian issue — the abuse of privacy is the use of that information in a manner that is somehow thought to be in violation of moral or social norms, the use of information in a manner that somehow harms the subject.

For instance, a single woman who is identified on GAM and is approached by an attractive, nice guy who found her on the service, might be pleased that a romantic opportunity came her way with seemingly no effort on her part. Or maybe she might be irritated by it but not distinguish it from other approaches. But there’s no effective way for GAM to allow her to choose “Only broadcast my information to really cute straight single guys with credit ratings of not less than 700, no criminal convictions other than traffic and parking tickets, who are at least five foot eleven inches tall,” even if the authors of GAM were remotely interested in doing such a thing. And she would resent being approached by a creepy guy she would never date, and she would be deeply upset (litigiously so, I should think) if that same creepy guy stalked her or hurt her somehow. The chances of the cute guy she wants to attract approaching her through GAM seem infinitesimally small compared to the number of outcomes that seem bad.

I’ve actually read some privacy policies, like Google’s. In this sense I suspect I’m ahead of the power curve of 95% or more of data service consumers. I do not know what companies Google shares its data with; my impression is that Google shares its data with pretty much whomever is willing to pay to access it, and a variety of governmental entities. One thing we could start with would be demanding, either as consumers or as citizens, to be told to whom our data is given, and to be able to opt out of data-sharing with companies with whom we do not choose to share our information.

Another thing to understand is that people sign up for services and forget about them. I might sign up for Foursquare or Latitude, thinking it would be handy for my wife and I to know where each other are. (Amusingly, Latitude sometimes places us more than a mile apart from one another when we are actually riding in the same car, which usually results in jokes about infidelity.) A periodic reminder from these services that it is sharing data with other entities would be helpful in allowing me to control what information about myself is exploited.

Come to think of it, some ability to know what governmental agencies are gathering information about me would be nice, too. Unless I’m being investigated as a suspect for a crime or there is some other overriding national security reason, I already have the right to make the government gather information about me and tell me what it is — but so few people actually use their FOIA rights that it’s a negligible burden on the government as a whole. If the government had to tell me, from time to time, “We have files about you with the Internal Revenue Service, Social Security Administration, Selective Service Administration, and the Tennessee Valley Authority,” or whatever it might be, I could be more aware of who was doing things with information about me and I could control my relationship to the government better. I might be prompted to take action to protect my privacy, or I might decide I don’t care. But it would be an easier decision to make and an easier decision to implement if I got the information to begin with instead of being charged with having to go root it all out like a detective.

As things stand now, the burden is on me to go seek out all of this information. Maybe shifting that burden, requiring some disclosures and opt-ins, is the right balance between burdensome tight legislative controls and laissez-faire libertarianism. Maybe if a woman were told that “we’re selling your GPS data to a Russian company that broadcasts that information to creepy stalker guys,” she might be better able to decide whether she wants to leave herself open to meeting a tall, handsome, tech-savvy stranger — or whether she prefers to avoid winding up dead in a ditch.

Please do be so kind as to share this post.
Share

22 thoughts on “Privacy and Girls Around Me

  1. I think the issue is less “you chose to tell us this stuff and therefore we can do what we want” and more “you weren’t aware that your phone had a unique identifier code and was always updating its location, and that anyone could add a feature to their program that grabbed this location/identifier pair and displayed it to other users without notifying you”.

    To put it more pithily, there’s a difference between walking over a steam grate and someone sticking a leaf blower under your skirt.

      Quote  Link

    Report

    • Further, caveat emptor has a flip side doesn’t it?

      Suppose consumers, after years of getting the wrong end of deals like this- getting ripped off after finding out too late that the fine print on the bottom did all sorts of bad crap- actually DID become more wary, more cautious.

      Suppose people stopped living on credit and massively deleveraged; if credit cards became a thing of the past; if people refused to buy anything but “tried and true” products they intimately knew and trusted;in short, stopped taking risks knowing that they really were on their own in a jungle of swindlers and cheats without regulation and governance.

      What would be the impact on the economy?

       

        Quote  Link

      Report

      • Expecting American citizens to Go Galt is a bit much.  For every technological advance, there are at least two pitfalls.  It’s great when we can recover our stolen toys with geolocation, not so great when the cops and other freaks can geolocate us.

        Why anyone with an IQ higher than room temperature has a Facebook account is a great mystery to me, knowing Zuckerberg has to be selling the information thus obtained.  Only a moron would use Foursquare.  The combination, well, there’s no protecting such people from themselves.  Ugh, it’s so creepy, they cry out with a will, blissfully unaware the real creeps at NSA are building an enormous facility in Utah to track literally every keystroke you will ever type and every phone call you will ever make, with Bayesian networks written by people like me (only with less scruples and more patriotism) to tie you out to everyone with whom you will ever communicate.   These fuckers are already running dozens of splitters, duplicating all the traffik on the fiber optic cables and routing it to their sniffers, all that data obtained without a warrant, natch — and these are the people who are trying to scare you with tales of the Great Cyberwall of China.

        Put it this way, you won’t get the network graphs thus generated with a FOIA request.

          Quote  Link

        Report

        • Blaise, whatever we post here on the League is just as (if not) more likely to get us flagged than anything we put on Facebook.

          Facebook is full of noise.  The gubmint has a tendency to track sites that they think may represent a conglomeration of weirdos more than sifting through noise, even with all the new shiny datamining tools.

            Quote  Link

          Report

          • I gotta go with BlaiseP on this one.  Before G+, I had very little on the internet that would provide a reliable trackback to me.  Sure, it wasn’t impossible (Amazon’s/my credit card provider’s financial information would be the best way) to track me down and find out who I really am.  However, it wasn’t something that the casual person/marketer would be able to link.  Even when I did blogging under my internet name, I’ve always edited myself.  With G+, I do so even more because it uses my real name. 

            Then you have to add to this what one of the ITSEC people on my G+ keeps saying:

            “If you are not paying for it, you’re not the customer;
            you’re the product being sold.”

            Facebook, Foursquare, etc have made a big business of selling list involving personal information.  At this point in the game, there is no excuse for people to not know this.  This is why I do a lot of self-edit and am slow to adopt things such as social media.  I’ve always accepted the notion that EVERYTHING that I put on the internet will be traced to me.  I think it’s well past time everyone understood that.

            Ultimately, I too would say “nothing” because I believe that people need to take responsibility for what they put out on the web.    In this sense, GAM may temporarily provide a societal bonus as it is getting enough media heat for people to actually start thinking about such things.

              Quote  Link

            Report

    • That’s not how it actually works. As I understand it, Girls Around Me used your phone’s GPS to determine your location, and Foursquare’s API to find people who had checked in to nearby venues. I haven’t used Foursquare myself, but as far as I can tell, it doesn’t have an automatic check-in option. You have to make a conscious choice to check in each time you do it.

      That said, the Foursquare API has a “herenow” function which allows you to query to determine who is currently checked in to a particular location. Now, this is throttled to prevent you from scanning the whole city to find a particular person, but it’s done on an opt-out basis. This strikes me as something that ought to be done on an opt-in basis, as it doesn’t really seem intuitive that strangers would have access to this information. In Foursquare’s defense, they probably didn’t anticipate that people would use this to scan several nearby venues instead of just the one the user is currently at. In the latter case, it’s really not that much different from just taking a look around the room.

        Quote  Link

      Report

      • Foursquare knew it was possible and put it into their terms of use.   You’re correct, in terms of how you’d use the results of the Foursquare API, but these days I’m doing a fair bit of work with PostGIS solving problems of roughly this sort.

        Use case:  non-emergency medical transportation firm dispatches a van from the barn to an elderly person’s home, takes that person to the doctor and the van returns to the barn.   Three legs, one billable leg. The ride home is yet another instance of this use case.

        Wrapping use case:  transportation company is presented a list of rides, determines which rides are profitable based on billable miles over total miles.   Optimising network attempts to chain rides and get empty vans into an optimal position, bettering ratio of billable miles over travelled miles.

        Van driver runs an Android app, capable of receiving dispatch messages and sending in-route status messages including an on-demand location message.   Dispatcher runs a node application capable of interacting with a “load board” model and controller with other such firms, forming a cooperative-competitive model:  one firm’s unprofitable run might be another firm’s profitable run.   State of Wisconsin’s system is completely fished up.   My stuff optimally reorganises those runs.

          Quote  Link

        Report

  2. I like your approach to the problem–that it’s use, rather than possession, that accounts for the harm in privacy violation.  But I don’t know if your proposed solution would do that much good.  After all, most people don’t read privacy policies at all–they just skim to the bottom and click OK.  I doubt they’d pay more attention to a list of companies, especially once “Creepy Russian App Makers Inc” decided to rename itself as “Bland Corporate Facade LLC”.

    Ultimately, I think the answer will have to come from a shift in social norms.  Don’t put anything online that you wouldn’t be willing to say in a crowded bar.  It’s probably more realistic for the norm to change than for the genie to go back in the bottle or people to start paying attention to privacy policies.

      Quote  Link

    Report

  3. I’m reasonably comfortable reading very boring things, and I never read privacy policies. Mostly because I assume the specific language has implications that I don’t understand that is giving the companies permission to use my data.

    No matter how cute, tall, credit-worthy a guy was, if I found out he had approached me using that app, it would be a deal-killer. Even under the best imaginable circumstances, it’s seriously creepy.

      Quote  Link

    Report

  4. The assumption that because they’re nearby they’re interested is what makes it weird. I’d never assume that because women were within my general vicinity they were somehow more likely than average to want to even know me, let alone do other things, and it’s ridiculous of the app to even imply such.

    Beyond that…your default answer to anything following legalese you can’t comprehend should always be “no”. And if enough of those clicks on “no” makes using whatever site you’re on unworkable, then ditch them.

     

      Quote  Link

    Report

  5. Is a guy more likely to hit on a girl because he learns she is in his vicinity than one he happens to see is in his vicinity? If not, I don’t see what this app adds to the situation.

    Let’s say that there is a certain % of women in any crowd a guy finds attractive. This app, obviously, does not affect that %. So why should there be any more approaches/stalking/whatever than there already is? Sure,a guy may learn that a woman of interest might be found by going to some particular area (though I doubt this, because any area pinpointed by cell technology in a large city is going to have so many people in it that it is very unlikely he could zero in on the woman, anyway, particularly since she is likely to be on the move). But unless the guy is attracted to only one in a very large number, there are going to be just as many in his immediate surroundings as there are in the area he proposes to move to. So why move, particularly,as seeing someone in the flesh is always more informative than seeing a picture?

    For example, let’s say the app identifies half a dozen women within a few blocks of where a guy is, as an illustration accompanying the article suggests. Given that not all the women are going to be using the service at that particular time, it is highly probable that this half dozen number is a significant underestimate. There are likely to be, I don’t know, let’s say twenty or more.  But if this is the case, some of them are going to  be in his immediate vicinity. And even if they weren’t, the odds of his finding ones of interest in any particular area that he moves to randomly are just as good as they are in the areas actually pinpointed by the app.

    Bottom line: regardless of what kind of woman some man finds attractive, the odds of running into her are pretty much determined by the population density of wherever he happens to be. He is just as likely to see her in one area as another, unless one area has a much larger density of people, or a much higher density of woman, or a much higher density of woman he considers attractive. But in that case,the logical thing to do would simply be to hang out in areas like that.

    So I just don’t see the point of this unless someone is looking for someone very specific. But if that is the case, the minimal information available in a popup photo, or even in a FB profile, would probably not be enough.

      Quote  Link

    Report

    • You assume that the man in question is looking for a consensual romantic encounter with someone he finds attractive, that the service will legitimately be used for the ostensible purpose of the app. Some men are not nearly so selective with regards to selecting their prey and it ought not take much imagination to come up with a scenario a good deal scarier and more violent than that.

        Quote  Link

      Report

  6. I live in fear that the dystopian vision put forth in “Minority Report” comes to pass, in which I am bombarded by adverts tailored to my “interests” whenever I enter a store.

    That said, I actually like the feature of having Web ads that have been so tailored.  I will deliberately click on the Amazon ad when it advertises something I like (eg. running paraphernalia) so I’m more likely to see them in the future when I’m on the lookout to buy some of it.

    However, I also pretty strictly adhere to the “don’t write anything online you’re not prepared to repeat in person in front of an unspecified audience.”

      Quote  Link

    Report

  7. “But there’s no effective way for GAM to allow her to choose “Only broadcast my information to really cute straight single guys with credit ratings of not less than 700, no criminal convictions other than traffic and parking tickets, who are at least five foot eleven inches tall,” even if the authors of GAM were remotely interested in doing such a thing.”

    You KNOW this is comming.  And you know, I might just be willing to buy such a service.

    It’s my data, I should be able to do with it what I want.  If I provide you (a vendor) with info to improve my shopping experience with you, I’ve done so with the express intention for you to improve my shopping experience only, not sell it to some other fool.  You want to sell it, get my permission….and if I agree, I’m taking a slice of the cash too.  And if I decline, you damn well better comply.

    Sadly, this is not the state of events….

      Quote  Link

    Report

Leave a Reply

Your email address will not be published. Required fields are marked *