What is Cross-Device Tracking?
Investigating Common Technologies Used to Track People
Invasions of privacy are nothing new in the modern internet-connected world. One method used to track and influence the behaviors of others is the embedding of tracking IDs into signals, encoded in the ultrasonic range just outside of human hearing, but still available to microphones and speakers of common devices such as phones, laptops, and TVs.
These technologies have been around for decades, however the practice of using them for cross-device tracking was not popular until the widespread adoption of mobile devices in the early 2000s.
With the advent of large datacenters and networks of devices capable of harvesting and storing large amounts of data for analysis, the means by which information is collected from the public have become incredibly complex, and challenging to map out and understand.
Background
Tracking measures work by creating a digital footprint of a person using as much collected information as possible, then using that data plus new realtime input (such as web or location activity) to predict behaviors.
Data is collected and matched to the user by a wide variety of means and pathways, effectively placing the digital footprint or shadow within a large graph of correlations and predictions.
This graph, and various renderings or views of the resultant datasets, are used by interested parties such as corporate or government analysts to gain near-realtime insights into a person’s daily activities. Additionally, because of the two-way / duplex nature of communication, the behavior of individuals or even entire groups can be modified with suggestive advertising and other tools.
Methods
The process of locating individuals and predicting their actions is accomplished by collecting data not only directly from someone’s own devices, but also by using them to analyze the surrounding environment with beacon technologies and other means.
Ultrasonic beacons operate within the audio range of about 15KHz to 20KHz, towards the upper-bound limit of what most consumer devices are able to capture and reproduce with built-in audio transducers. Additionally. other equipment such as the gyroscope or accelerometer may be used in some instances to capture audio data (since these modules are sensitive to vibrations and therefore pick up sound).
Within densely-populated areas, much of the ambient noise is generated by artificial means, creating a unique noise profile around each person in the local environment. Very simple means of using audio to locate someone would be for example hearing a feed from a local concert on the microphone and hearing the same audio broadcast locally (most likely, the person with the phone is at the concert or at least nearby).
More advanced methods involve the embedding of inaudible ultrasonic “cookies” that contain various tracking information encoded into a signal that can be passed around in the 15 to 20 KHz range. These can be embedded by advertisers or other interested parties into radio and television broadcasts, online streaming content, or even into hidden audio played on websites.
Impact
While security measures exist on many common phones and other devices to mitigate unwanted effects, there is always some risk present with most consumer-grade hardware. Protecting one’s digital footprint or identity requires some discipline and a general understanding of information security and how to prevent things from falling into the wrong hands.
There is ongoing research into the concern that long-term exposure to ultrasonic noise may induce tinnitus in people — a truly unwanted side effect of a technology that nobody asked for.
Since there is no general standard for ultrasonic beaconing and similar technologies, regulation is difficult, resulting in challenges to security and privacy in addition to increased general atmospheric noise in the ultrasonic and near-ultrasonic range. While this noise pollution is generally harmful, there are steps which can be taken to reduce unwanted effects.
Risk Mitigation
Mitigating the risks and unwanted effects of these issues can be accomplished by a combination of basic changes and upgrades:
- Reducing exposure to ambient ultrasonic noise by turning off internet-connected electronics when not in use, and by engaging in healthy activities in locations where there is likely much less noise, such as in nature or in a quiet space in which you can control the environment
- Minimizing use of consumer electronics in general or choosing simpler over complex, such as using analog equipment instead of digital when it makes sense (i.e. hi-fi audio or music instruments), or using simple electrical appliances instead of internet-enabled IoT devices.
- Limiting exposure to social media “feeds” and other downstream consumer content. The less random content playing in your local environment, the less exposure you will receive from beaconing.
- Implementing semi-advanced security within your local network and on your devices, such as DNS-filtering VPNs which can block much of the inbound advertising behind the scenes and mitigate unwanted capture of data from your microphone or other hardware.
- Placing acoustic absorbing and dampening materials in your local environment which can reduce the reflection of high frequency audio (this is generally good for your ears anyway, as this sort of noise really is hard on the sensitive equipment of the ear in humans and animals).
Conclusion
While it may not be possible to completely eliminate cross-device tracking and the profiling of individuals within their environment by third-parties such as governments or advertising corporations, increased awareness of these issues combined with basic counter-measures can greatly reduce the risk and negative impact of these often unwanted technologies.
Beacons and device tracking when used properly can be a great feature for society, enabling realtime interactions and context-aware software among other things, however these are not things we necessarily want at home or in our work or education environments either.
