The Bad and the Ugly - Google Sensorvault

On April 18, 2019, Jennifer Lynch with the EFF (Electronic Frontier Foundation) wrote an article about Google’s Sensorvault, a database Google keeps that records location data of its users. The Sensorvault is a valuable tool for Google, and as it turns out, an invaluable tool for law enforcement as well. How? Well, it starts with what amounts to a blank search warrant that an incompetent judge signs off on, requiring Google to release data to law enforcement that spans a time period (up to about a week) and a geographic region. So, what’s wrong with that? For starters, that is ass-backwards detective work right there and to learn why that is, keep reading.

What is Google Sensorvault?

Sensorvault is a large database that Google keeps all location information for every single Android and Google user in the world, with some obvious limitations regarding country-specific laws. Of course, here in the United States, no such limitations exist as law enforcement and the judicial system seem to completely ignore the Fourth Amendment to the U.S. Constitution. More on this later.

As Ms. Lynch states, Google might know where you were five years ago, five days ago, and even five minutes ago. If you have an Android phone and have Location Services turned on, even if it is for something as benign as Google Maps, you’re in the database. Are you using Google Maps on an iPhone? You’re probably in that database too, but how much information is stored there will depend on whether you are logged into a Google account at the same time or not.

Sensorvault collects the GPS information of a user as well as the type of device and the personal identity of said user. Let’s say you were at Starbucks this morning for your morning latte - Google knows this, they stored it in their database, and will likely attempt to serve you an advertisement or two later today related to that information. But it doesn’t stop there. Google knows where you went after Starbucks, and your mode of transportation as well. GPS data includes speed/velocity, so Google can tell if you are walking, roller skating, riding a bicycle, or riding in a vehicle.

Law Enforcement

According to a deputy police chief quoted in Lynch’s article, the data Google provides in response to a warrant:

Google Sensorvault “shows the whole pattern of life.”

This is a scary quote, and you’ll see why shortly. The data Google provides is collected regardless of what people are doing with their phones, and in fact, they don’t have to even be using the phone for Google to collect said data. The phone being in your pocket and pinging the nearest cell tower gives Google all of this information.

Let’s say the Starbucks you visit on a regular basis is robbed. The camera’s don’t catch the thief, no witnesses can describe the perpetrators, and there are no witnesses to how the thief (thieves) left the scene. Detectives gather whatever information they can but they come up empty handed. Instead of filing the case in the cold case directory, they contact a judge to get a single warrant known as a geo-fence, or reverse location warrant. The warrant signed by the judge will cover a geographic location which could be as small as the Starbucks itself, or as large as multiple city blocks.

Google receives the request and eventually complies, handing over the requested data to the police. What the police receive is not data for a single or group of thieves; rather they receive ALL of the data for every single Android or Google user that was in the vicinity of the crime at the time it occurred, or whatever the relevant time period and location information the warrant requests. Yes, this means a large number of innocent people end up on law enforcement’s radar, and makes this writer wonder what happened to “Innocent until proven Guilty in a court of law.” Literally every single individual that was in the wrong place at the wrong time is now a suspect for this hypothetical Starbucks robbery.

As Lynch discusses in her article, there are a number of innocent people that have been steamrolled as a result of this data collection and abuse of law enforcement power, some having lost nearly everything they had (i.e., job, car, house). The Fourth Amendment to the U.S. Constitution protects citizens from unreasonable searches and seizures and provides guidelines (that are open to interpretation unfortunately) for judges and law enforcement on obtaining evidence and conducting warranted searches and seizures. Judges understand law, you must give them that. However, they typically don’t understand technology, and more often than not, fail to protect the privacy of U.S. citizens.

How to Stop Sensorvault

The best way to determine if you are saving location history is to navigate to https://myactivity.google.com and review what data Google has collected on you, including Location Data. If you have a Google Account, and you’ve disregarded the Terms of Service agreement (like so many of us do!) and accepted Google’s application requirements on an Android or iOS phone, you likely have data stored on Google’s servers, including in Sensorvault.

This will come as a breath of fresh air though - You can DELETE this data that Google has collected on you. However, there is no telling if Google will keep the data backed up or not, but assume they have. If you want to prevent the collection of data, or reduce what Google collects, go through every part of your My Activity, review what is stored and collected, and turn off (or on) what services you wish Google to collect. If you want a more detailed instruction set and some more information, check out How-To Geek’s article written by Chris Hoffman.

Summary

Privacy is an inalienable human right and don’t let anyone tell you otherwise. All too often, corporations and governments attempt (and often succeed) to overstep these boundaries resulting in profuse apologies that it won’t happen again or it was an algorithmic error or some other poor excuse that runs thick with bullshit. Not everyone is comfortable with or knowledgeable enough to overpower the Googles and Facebooks of the world, thus accepting whatever these companies throw at them on their phones and in their web browsers.

Take the time to learn about your data, your privacy, and how to manage it all. It is incredibly important that users of devices and applications provided by these big technology corporations learn to effectively wall themselves off from the big data collection that exists today, to protect themselves from future harm.