Apple Belatedly Addresses Locationgate, Admits to Software Bugs

A week after researchers discovered that Apple's iPhone and iPad devices were tracking and storing customer locations as they moved around geographically, the company finally issued an official response, disavowing some of the claims while admitting to software bugs. But in the hypetastic buildup to Apple's response, I'd already argued that no one should be surprised that location-aware smart devices were tracking device movements. The big question now is: What took Apple so long to explain itself?

In its often belligerent response to the claims—a response that includes a public statement and a single, on-the-record interview with The Wall Street Journal—Apple and its key executives answered that question too.

"It hasn't been a couple of weeks," Apple CEO Steve Jobs said testily to the WSJ when asked what took so long. "This all started last Wednesday and we put out our response this morning [on Wednesday]. It took us slightly less than a week." [It's unclear how Wednesday to Wednesday is slightly less than a week.]

"When people accuse us of things, the first thing we want to do is find out the truth," he said. "That took a certain amount of time to track all of these things down. And the accusations were coming day by day. By the time we had figured this all out, it took a few days. Then writing it up and trying to make it intelligible when this is a very high-tech topic took a few days. And here we are less than a week later."

Put more accurately, here we are (at the time of Jobs' statement) more than a week later, and it's a bit unclear how Apple's engineers weren't able to immediately refute or confirm what the iPhone and iPad do or do not do with the location data they do or do not store. It took a couple of days? Really?

Apple's public statement about the location storage snafu, which I'm dubbing Locationgate, is a bit more accurate but equally testy in spots, full of direct denials of many accusations while also curiously admitting to more than one bug in the iPhone's and iPad's iOS system software. For example:

Q: Why is Apple tracking the location of my iPhone?

A: Apple is not tracking the location of your iPhone.

Q: Why is my iPhone logging my location?

A: The iPhone is not logging your location.

And so on.

The gist of Apple's defense is that the researchers who discovered that the iPhone and iPad are storing location-based data—which they are—incorrectly guessed what that data really was. So, instead of tracking and logging the user's actual location, the iPhone and iPad are instead tracking and logging the location of "Wi-Fi hotspots and cell towers around your current location, some of which may be located more than one hundred miles away." The locations of these Wi-Fi hotspots and cell towers are, in Apple's words, used to more quickly determine the user's location and thus can in fact be used to track and store the user's general location over time (not that Apple admitted to that).

But don't take my word for it. Microsoft uses the exact same method to track and store device location on Windows Phone (though Microsoft stores this information in the cloud, not on the phone). But unlike Apple, the software giant admits that this technology is in fact used to track and store the location of the user's device. "To provide location services, Microsoft assembles and maintains a database that records the location of certain mobile cell towers and Wi-Fi access points," a Microsoft statement reads. "These data points ... provide an approximate location of the user's device."

In Apple's defense, the company does have a very clear privacy policy, and its iPhone and iPad devices push numerous location-based notifications in front of the user any time an app wishes to use this information. This is in contrast to other handset OS makers, like Google and Microsoft, which also track and store location-based information, either on the phone itself (Google) or in the cloud (both companies).

And Apple has admitted that the way it stores location information on the devices—unencrypted, and for too long a period of time—is wrong, and is in fact a programming mistake. So it will be changing this behavior in two coming software updates, the first of which is due soon. "Sometime in the next few weeks, Apple will release a free iOS software update that reduces the size of the [location] database cached on the iPhone, ceases backing up this cache, and deletes this cache entirely when Location Services is turned off," the Apple statement reads. "In the next major iOS software release the cache will also be encrypted on the iPhone."

Put simply, smart devices with location-based services need to know where they are geographically to work properly. So the underlying OS has to have a way to gather this information and store it. And Apple's devices—like those designed by Google, Microsoft, and other companies—do exactly that, though the exact methods might differ on a device-by-device basis. What this event has (hopefully) taught these companies is that they need to pay more attention to the privacy concerns of users, whether those concerns are real or imagined, and do a better job of protecting this data when a user does opt in to its use. (Google probably needs the most work here; its Android-based location services are essentially opt-out, not opt-in, so users of that platform need to be a lot more vigilant.)

In Apple's case, the company's infamously belligerent attitude toward any criticism at all—again, real or imagined—plays against it here as surely as it did last year when the company tried to pretend there was nothing wrong with the iPhone 4's external antenna, proximity sensor, or the several other hardware faults that continue to mar that device to this day. Apple has to have known exactly what the issue was the minute the original claims appeared, but its desire to massage the news to its own means precluded a quick response. And it's something the company really needs to reconsider.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.