iPhone Tracking Only Tip Of Security Iceberg

Slideshow: Apple iPhone 4, A True Teardown (click for larger image and for full slideshow)

Revelations that the iPhone stores data about where users have been on the device and on the computer used to sync the iPhone turn out to be less revelatory than claimed.

Alex Levinson, a senior engineer at Katana Forensics and the developer of a leading iOS forensics application, says that the purported discovery put forward at the Where 2.0 conference on Wednesday has been known for months. Levinson himself contributed to a book--iOS Forensic Analysis for iPhone, iPad, and iPod touch, published in December, 2010--that details the database used to store location data on the iPhone and in iTunes.

Yet, if the privacy risk presented by the presence of this data on iPhones and in iPhone database backups may be less than the researchers reporting the issue this week have suggested, it's nonetheless prompting concern among regulators and businesspeople.

Senator Al Franken (D-Minn.) has penned a letter to Apple CEO Steve Jobs seeking clarification on how iPhone location data is handled, why the data is not encrypted, and whether Apple's handling of this data is permissible under the terms of its privacy policy. Congressman Ed Markey (D-Mass.) has sent a similar letter to Jobs, asking for an answer by May 12--this despite the fact that Apple already explained its location data policy to Markey in a letter sent last July. And Germany's Federal Ministry of Food, Agriculture, and Consumer Protection has expressed interest in clarifications from Apple, according to Reuters.

Apple has legal cover for its actions under its iPhone 4 software license agreement, which states, "Apple and its partners and licensees may transmit, collect, maintain, process and use your location data, including the real-time geographic location of your iPhone, and location search queries." Nonetheless, the company is likely to be forced to change its ways and/or provide a more specific explanation for keeping location data in unencrypted form on iPhones and iPhone database backups, if only because maintaining this information about minors may be legally risky.

Apple has not responded to requests for comment.

Though queries from regulators sound like political opportunism more than anything else, Apple's data storage scheme deserves a closer look. For companies that issue iPhones or iPads to their employees, or that allow employees to use such devices to conduct business, the issue goes beyond Apple's failure to provide specific notification about how and where its software stores unencrypted location data. The issue is that the iPhone, just like other mobile devices, isn't all that secure.

For example, security firm Zscaler security researcher Michael Sutton on Thursday revealed that JotNot Scanner Pro, an iOS application, stores passwords for other applications unprotected in the iTunes backup database. In a blog post, Sutton explains, "Unfortunately, the authentication credentials stored for Evernote, Google Docs, Apple's iDisk and any WebDav enabled server are stored in plain text. Therefore, anyone that gained access to this backup file, would then have your username/password for these services."

Mobile devices present a unique security challenge, particularly because they are often simultaneously consumer and business devices. It's not an insurmountable challenge, however.

Frank Kenney, VP of global strategy for Ipswitch, a maker of secure file transfer software, says that his experience with companies that implement iPhones leads him to believe that access to users' location data is pretty well covered when organizations lock down computers carefully.

Slideshow: Apple iPhone 4, A True Teardown (click for larger image and for full slideshow)

But Kenney sees location data, particularly in the context of social media, as an under-appreciated risk. He suggests that if employees, enabled by mobile devices, are broadcasting their location through Twitter or Facebook posts, that might provide competitors with valuable information. The repeated presence of a particular executive at a hotel near particular company might reveal a potential acquisition target, for example.

David Michael, CIO of UBM TechWeb, which operates InformationWeek, finds concerns about the iPhone's store of location data overwrought, at least for employees. He notes that many enterprises buy laptops that come with services like Computrace, which allow laptops to be tracked.

"Location-wise, you may think you're invisible but that's not the case," he said in a phone interview.

Michael says the challenge right now is the co-mingling of corporate and personal data. There's a huge desire among UBM TechWeb workers to access corporate email on their personal mobile devices.

"You cannot believe how desperate they are to hook up their iPads to read email," he said.

Michael supports the idea because it would allow employees to be more productive without incurring additional hardware costs. The company's IT department has the ability and tools to allow consumer devices to connect to the corporate network, but the company's lawyers aren't so sure.

"Privacy lawyers are very concerned about the risks," he said.

Alexander H. Southwell, a partner at Gibson, Dunn & Crutcher, says it always complicates things when employees use devices provided by their employer for personal communication. "The way that many companies deal with that is they make it very clear there's no expectation of privacy," he said in a phone interview.

There's a fundamental tension, he says, between convenience and risk. "Everyone wants the latest and best gadget, but no one wants to worry about security," he said.

Southwell observes that social media presents a particular challenge. "We're seeing increasing issues where employees' off-duty conduct comes back to affect their employment situation," he said.

Miriam Wugmeister, chair of the global privacy practice at law firm Morrison & Foerster, echoes that assessment and stresses than employers should make it clear to employees that they can't expect privacy using corporate devices. While she observes that allowing employees to backup personal devices containing corporate data on a home computer could pose an e-discovery problem in the event of litigation, she also says there are good technical solutions that allow corporate IT administrators to create sandboxes that segregate personal and corporate communications.

However, Wugmeister says that privacy expectations and laws differ significantly abroad. "A big mistake is taking U.S. technology policy worldwide," she said in a phone interview. "You have to be very careful with employee monitoring in other countries." As an example, she points to South Korea, where it's a criminal offense to read another person's email without consent.

She also believes the intersection of mobile devices and social media will cause problems for companies. "As more and more communication happens on social media, the blurring of the lines [between personal and professional] will get more complex," she said.