Privacy concerns have been raised by the revelation that Apple's iPhone and iPads record users' locations and hidden files on the devices. Hello, I'm Eric Chabro of Information Security Media Group, and I'm pleased to be chatting with David Navada. He's founder of the Law Firm Information Law Group, and David specializes in IT security and privacy law. Welcome, David.
Thank you. How alarming is it that Apple or any other vendor of mobile devices can track the whereabouts of customers' unbeknownst to them? On one level, I'm not sure it should be that alarming. I think many companies and applications for that matter collect information about people's whereabouts, and I think it's fairly well known that the capability exists.
On the other hand, I can see why people may be sent to the city issue, and may be concerned, but perhaps unbeknownst to them, certain information about their whereabouts made it. Now again, I'm not sure if there's anything nefarious going on here, but perhaps certain people didn't know that this information would be collected. I can see that causing consternation and headaches for some people. You raised a point.
I find interesting. Technology has done a lot of this in recent years. Do you think that people use technology with a certain kind of ignorance? It's hard to know exactly what technology is doing for the average person, including myself, the average lawyer.
What's somewhat surprising to me is that with articles in the Wall Street Journal and the authorities about Facebook, people are somewhat surprised that these types of information have been collected, disclosed, used in some manner. I think there's a certain kind of activity that goes down with people surfing the web with privacy policies that are out there that they may not have read. And oftentimes, in those policies, a lot of these activities are undisclosed on some level. So, I don't know if people are ignorant enough necessarily or don't care about it necessarily as hard privacy is concerned, especially when it stays in the privacy policy.
I think what happens in what's happening recently is we're getting a lot of media attention to somebody. I think it's ratcheting up in some corners. People are now really, because the media has been attention to a lot of these issues, they're starting to really kind of wake up to what is happening with their information as they serve the internet and use their various mobile devices. From what you know, I'm assuming what Apple is doing is legal.
It's not surprising to me. You have to look at a lot of different things, whether there are any laws that apply in this context. One thing, geolocation, there aren't necessarily a lot of laws that are on point withation. That is actually one thing that I think we're seeing is that the technology tends to move a little bit faster than the law, or quite a bit faster oftentimes, and where privacy policies have often dealt with, personally identifiable information, first name, last name, account numbers, plus security numbers, correct?
We are seeing other types of information, such as geolocation information, that are really pushing boundaries of what a personal information is and what personal information may eventually be regulated. The regime we're in right now is, is the privacy policy notice consent type regime. I don't know what the privacy policy or what's because if you provide certain notices that this is being collected or used in some manner, typically that's the best way to address the regime needs to be changed. What are the legal implications for acting?
Could law enforcement or other parties, plaintiffs, or defendants, for instance, subpoena records? Yeah, an issue comes about in the court contact after the location of one of the parties is that issue, and they have an iPhone, certainly I wouldn't be surprised if those records were subpoenaed or came up as part of a discovery process. I got from a point of view of an individual who's out there traveling around in one location, maybe some issue in a location, a period of time, all their location data is in a particular geolocation cache. If some law enforcement agency wants to know a location of an individual, do they have to alert the individual?
Can a law enforcement official go to Apple and say I want to know where this iPhone user was without notifying the iPhone user? Well, first of all, I don't know, in the report, you're unclear as to whether the data ever gets back to Apple. In order to get the information, if Apple doesn't have it, you'd have to go to the user. If Apple does have it, Apple could be subject to subpoena and information if the people are in printing his order around that.
If they have it, perhaps they would have to provide it in that context. Certainly, party delegation and the information relevant to that location, and on your computer, you may have to turn it over as well. We're seeing more of these devices being used for business. What are the legal implications for people who manage security on a business, such as a bank or perhaps at a hospital or government agency?
Legal implications are, I guess, if this data is being used with respect to where their employees are and it's helping the issue phones, then perhaps even organizations that want to track that data or get that data to know where their employee is, as long as it's closer to being given, whether it's an indication that their privacy is used for employees. But if it's someone who is using their personal device but uses it for business, the company would not have any legal rights to the data. The data ends up on people's tools. So, wherever you end up putting this information, when you don't have your login, and basically think of your iPhone computer, I believe that's when the data ends up under you.
To extend that employer to try and access that on personal devices, that could be problematic. That could exist on the iPhone, iPad, and the backups that you create. So, basically, it would be an any machine you think with your device authentication. Which, I guess, could make it easier to expose it to others.
I think security take points for itself be lost for someone having it into the computer where you think it's on up to you. Anything else I should be thinking about in this issue? The data, some sort of security breach of some sort where someone was trying to seek the data to get it and use it for whatever purpose is. Until that happens, there may not be a huge issue within receiving it.
But right now, it seems that the data does exist, but probably isn't being used by anyone. And with it or why they're wanting to be collected, I'm sure we'll have more answers to those questions in the coming days. You raise a point on something I'm going to just mention. It is the potential of a security breach in the sense that if there is some information about an individual employee that is accessed by someone who shouldn't have access to that information, they could find out something about a company that maybe the company doesn't want people to know about.
It's something that relates to the person's location, and maybe some sort of stop-secret meeting or something, or a product developer at a certain location that may reveal some sort of information about the organization. Certainly, to attend, you can put the pieces together. It might reveal something of value potentially to someone to it. Thank you, David.
Thank you very much. I'm David Navada of Information Law Group. Honorek Travel, Information Security Media Group. Thanks for listening.