Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When you use a GPS device, satellite signals are used to give you your position. It seems reasonable to assume that information about the device you're using may be transmitted to the satellite as well.

The question is whether this information is logged and if it can potentially identify you.

It seems that if you registered your GPS device the information could be linked. If the GPS is instead from a mobile phone, it could be easily linked through IMEI and phone number, and even transmitted by internet when the device connects to wifi.

Is that correct and is it preventable?

share|improve this question
3  
When it comes to GPS itself, the connection is only one way: Satellite->GPS receiver. The issue here is the implementation. For example, if you're using your phone with Google Maps, then some data about you, your device, and your location are transmitted to Google. You cannot prevent that, it's just the terms of service. Google (or any other provider) tells you "Give me this information, and I'll give you a map/navigation service". –  Adnan May 31 '13 at 7:18
1  
@Strapakowsky I was about to ask the same about the downvotes. I don't get what's wrong with the question. You are wrong in that data is sent to the GPS satellite, but it's indeed "reasonable to assume" from most people's perspective. We're all here to learn after all. So indeed, @ others, why the downvotes? –  Luc May 31 '13 at 7:50
1  
@Luc, not among the downvoters, there's probably some cognitive dissonance involved here: a person with high rep asking a question which can be answered by reading through one passage in the Wikipedia article - section Basic Concept of GPS. –  Deer Hunter May 31 '13 at 9:07
1  
Wikipedia is not always a reliable source. Getting the consensus of the community through upvotes is more reliable in my opinion. This is a reasonable question. –  sybind May 31 '13 at 10:18
1  
The received GPS signal is pseudo-random noise below the noise threshold. At the position GPS satellites orbit, you're going to need a directional dish and some power to get enough signal out there for the satellite to hear, if it had that capability. It doesn't. –  Fiasco Labs May 31 '13 at 15:16

2 Answers 2

up vote 3 down vote accepted

Yes, even passive GPS devices may leak location data, but it is a bit complicated.

The RF signals sent from GPS satellites are unidirectional from the satellite to the earth. The RF receivers for those L1 and L2 bands require extremely precise timing information. This is because depending on your current location and the time of day, the GPS satellites available to those receivers changes. That is why older GPS devices and sometimes even modern devices need a "long time" (several minutes) to acquire the satellite.

The devices searches for up to four satellites in one of six different orbits. In each orbit a device typically sees one or two satellites. Determining which satellites are being received is critical to decoding the signal because each of the twenty four satellites uses a different code to send data to the receiver.

To make the acquisition time fast, many devices store information about the satellite's orbits to calculate what satellites are available rather than searching for each of the 24 satellites. This happens even in passive systems like hiking gps devices.

A examination of the ephemeris data (satellite prediction data) stored on even a passive dives gives a rough estimate of where the user has been recently. For example if a person used a GPS device yesterday south of the equator and then flew at least a few hundred kilometers north of the equator. An examiner may find evidence in the GPS device to prove that fact. This is because the satellites stored from yesterday would only have been visible from a location hundreds of kilometers south of where the user is today.

share|improve this answer
    
Oh. That's some cruel and unusual punishment for the forensics expert. Usually, getting the track is sufficient... –  Deer Hunter Jun 3 '13 at 8:39
    
this.josh, selected your answer for going beyond the obvious –  Strapakowsky Jun 14 '13 at 7:21

There are several ways to perform and log location of a person. When using a phone it and the GPS is turned on, an application can access your GPS location (if the app has permissions to do that) and send it through the internet to a remote location. He can also store this in a database and send it after a sucessful connection.

GPS is certainly not the only way of doing this, a more interesting way is to track the cell tower identifiers (in Android you can actually create and subscribe to a broadcast that notifies you when the celltower changes) and keep these in a database. From there you can send the data to a remote location once the device is connected to the internet and match the cell tower identifiers to their geographical location. This will allow you to make an approximation of where the person was walking.

The only way to try to prevent this is by checking the permissions (access) your application wants/needs and just not install software that wants to access your cellular network or GPS location.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.