title:

Google's Latitude: not new but worrisome

By: Scott Bradner

Google made a big splash the other day when it announced Latitude (http://www.networkworld.com/news/2009/020409-google-latitude-service-lets-you.html) - their new application that lets you let your friends know where you are in real time. The size of the splash is a bit puzzling since there is almost nothing new or novel in Latitude but there are reasons to talk about the service anyway.

Latitude (http://www.google.com/latitude/intro.html) is enabled by an application that can be loaded on some cell phones and lap top computers. The user can configure the application to send Google the actual location of the phone or computer. The user then configures the Google Latitude service to enable other specific phones or computers to receive information on your location. The information provided to each of the other devices can be your actual location, a location you select (whether you are at that location or not) or no location information at all.

There is nothing particularly new about the service Google is providing with Latitude. Location based services of various types have been available for most of a decade. There are multiple services around which enable parents to track their kids cell phones or employers to track their employee's Blackberrys. But, likely because it was Google announcing a service, the press paid more attention than the actual service warranted.

Also, likely since its Google, the privacy community paid a lot of attention. The most far out privacy related response to date was from Privacy International which engaged in a little hyperventilating over a quite real, but easy to fix, flaw in the current Google application. (http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-563567) Because the current version of the Gloogle application does not constantly tell the user that location reporting is enabled it is theoretically possible for someone to enable Latitude on a user's phone without them knowing it.

As a card carrying member of the privacy community myself I do have some worries about Google's new service that I've not seen expressed elsewhere.

Google is basically a set of vast databases with interfaces to cash registers. Google knows where almost everything is in the Internet -- you can tell Google to ignore your corner of the Net if you want to but if you do so your corner of the Net is effectively invisible to anyone who does not already know of its existence. Google also knows everything that its users are interested in, and in many cases, everyplace they have wandered on the Internet through its recording of search queries and through many companies subscribing to Google Analytics (http://www.google.com/analytics/) Now, for the users of Latitude, Google knows everyplace you wander in the physical world.

I have no idea what use Google might put all this information to and we may never be quite sure what Google does in fact do. Google's privacy statements (general: http://www.google.com/intl/en/privacy.html and for mobile: http://www.google.com/mobile/privacy.html) are less than precise when saying what use they make of the information they collect. These privacy statements also do not say how long they hold onto the information, although elsewhere they Google has given some hints. (see Google data policy no prize - http://www.networkworld.com/columnists/2007/032007bradner.html)

Google's introduction of Latitude further legitimizes third parties tracking where people are (the phone companies have been doing it just about for ever). At the most benign it will mean more pop up ads for the Starbucks a block away from where you are. We will only find about the other extreme over time.

disclaimer: Few people consider Harvard benign and, I expect, some consider at least parts of Harvard extreme but I know of no university position on Google as the world's database so the above are my mutterings.