New Use of Cellular Networks

During the Notte Bianca 2007 (an event in Rome comparable with the Museum Night in the Netherlands), researchers from MIT’s SENSEable City Lab set up at different urban locations a number of big screens upon which they projected dynamic maps of the city. Light blue spots indicated large numbers of people, thus enabling visitors to the event to immediately see which museum was crowded and plan their route accordingly. Making the task even easier, yellow stripes representing Rome’s municipal buses could be followed live on the same map. This project – ‘WikiCity Rome’ – sounds like a nice gimmick. The researchers gained access to the location data of mobile phone users through a telecom company. The anonymized coordinates of individual phones were combined to compile an algorithm of a – handsomely designed – real-time map of nighttime Rome.

But ‘WikiCity Rome’ was more than just a gimmick. The project made use of an important shift in the functionality of the mobile phone (or ‘cellphone’, as it is called in parts of the English-speaking world). It is no longer simply a means of communication. Increasingly, the mobile phone is also being used as a sensor that gathers information about us and our surroundings.2 Location coordinates, images and sounds can be recorded and shared with friends, colleagues, social institutes or even with others who are unknown to us. This new use of mobile phones can have great social consequences, but it also raises questions about privacy. Who has access to all of this data we are gathering? To whom does this information actually belong? To us? The telephone company? Or should it – in anonymous form of course – be considered common property? Ought the government be allowed to monitor our movements in times of emergency? And if so, precisely what constitutes an emergency?

For the American civil rights organization Electronic Frontier Foundation (EFF), these developments are sufficient reason to introduce a new category of privacy: ‘locational privacy’. Will we still be able to move through a city in the near future without the places we go to being systematically recorded in all sorts of databases?3 The new developments are so far-reaching that we must ask ourselves whether our traditional idea of privacy is still tenable. The discussion is no longer only about the right to be able to act anonymously in our private lives without the government or our employers looking over our shoulders. In many instances, people will actually want to voluntarily make information about their private lives public. For the fact of the matter is that this can also have certain advantages, both for individuals and for society as a whole. But precisely what are the conditions under which this occurs? What possibilities does technology offer for sharing or protecting information? In this essay, I would first like to give a number of examples of how the use of the mobile phone as a sensor encroaches upon our lives in today’s society. Then I will go into the consequences of this for the debate on privacy and technology.1

At present, the mobile phone is already being used in this manner for health care research. In Kenya, for example, mobile phone data is being used to localize breeding grounds of infection for malaria. Other scientists have developed algorithms with which – again through data generated by mobile phone use – behavioural patterns that indicate the outbreak of a cholera epidemic can be identified. In the Dominican Republic, research into the spread of HIV is being conducted in a similar fashion.6

Urban planners are also enthusiastic about this new way of collecting information. The British ‘Cityware’ project tracked visitors to inner cities with the help of the Bluetooth technology on their phones.7 Here too, expectations are often high. Anthony Townsend, for instance, a researcher specialized in technology, sees the rise of networked sensors as a development comparable to the rise of aerial photography. For urban planners, that was a revolutionary media technology: for the first time, they could see the city from above, as a whole. And if aerial photography reveals the city’s skeleton, we now have a view of its nervous system. For the first time in history, people often optimistically say, we can observe all sorts of social interactions in the city in real time.

A little perspective is not out of place here, however. Although these methods of gathering data certainly can lead to new insights, the debate still does not address the question of exactly what kind of knowledge they actually produce. Data is not the same as knowledge, and so far the nature of the data is primarily quantitative. Researchers now know how many people are at certain places at certain times, where they have come from and where they are going. But more qualitative aspects – why do people move as they do, and what is their experience of that? – still remain out of the picture as a rule.

This is similar to a number of ‘Citizen Science’ projects, in which citizens use the mobile phone’s sensor capacity in order to work together for a specific purpose. Eric Paulos conducted research on campaigns in which neighbourhood residents charted the quality of the air with the help of mobile sensors. Such campaigns had many positive effects. The participants gained an increased awareness of the problem of air quality and their involvement in local politics improved.9 But there are also negative aspects: Just how trustworthy is the data that is collected? Can the results be influenced, for example by holding a sensor next to a car muffler?10

Christophe Aguiton, Dominique Cardon and Zbigniew Smoreda – researchers at Orange Labs, the R&D department of France Telecom – call this phenomenon ‘Living Maps’. A map is no longer a static representation of a geographical reality but a dynamic reflection of social activities. In the long run, the advent of such maps can lead to a cultural shift. Right now, our social lives still largely consist of making appointments that we write down in our agendas. But after a while, a ‘map of opportunities’ might very well seem like a much more attractive idea. If you momentarily have nothing to do, simply take a look at your personalized map. Who is in the immediate vicinity right now to meet up with? What is there to do at a reasonable distance from where I am?11

Critics point out that this can have huge consequences for life in the city. Does it still leave any room for chance encounters with the unknown? Will we become ‘people without characteristic traits’ who slavishly follow the recommendations of our ‘clever’ systems? These are relevant and meaningful discussions, which I do not wish to go into further right now. In the second part of this essay, I prefer to examine the notion of privacy that is at stake with these new technologies.12

Precisely what does ‘data ownership’ mean for the analysis of information on an aggregated scale? Are researchers only allowed to collect data if phone users give them permission to do so? And is that permission also necessary if the data is only used for mapping group behaviour? After all, in such cases the individual information is swallowed up in the group profile and a link with individual behaviour can no longer be made. But then, who is allowed to collect this sort of information, and under what conditions? Should telephone companies collaborate on this, for example?

Erin Keneally and Kimberly Claffy – researchers at UC San Diego – argue in favour of regulation that takes into account the positive aspects of sharing data. At present, the rules are not always so clear about what is allowed and what is not. As a result, many parties react defensively to requests for sharing data. They prefer not to take risks, seeing as the debate on privacy escalates quickly. The idea of privacy as the absolute right to protection of personal particulars soon loses out to the possible social benefits of sharing data – such as in the above-mentioned instances in the area of health care, for example. Keneally and Claffy call upon researchers and the telecom industry to develop a new protocol that makes the sharing of data possible and at the same time limits the risks of improper use of sensitive information.

Nathan Eagle compares ‘reality mining’ with large-scale medical research projects. There too, extremely sensitive personal information is stored in databases, which is why there are strict rules for their use: only professionals have access to the information and they must sign in when they want to use the databases. Eagle therefore proposes that such protocols also be quickly set up for the use of sensor data from mobile phones.

Organizations like the Dutch ‘Bits of Freedom’ are concerned about these new developments. Information that is stored anonymously, warns this organization, does not always remain that way. ‘Better technologies are always being developed to strip anonymous data of their anonymity. What might not be a “personal detail” now can soon turn into one.’15 Researchers Aguiton, Cardon and Smoreda concur. More than once in the past, new technologies have made it possible to trace anonymous data to specific users.16

The EFF therefore proposes using cryptography to design systems such that sensor information can be used without having to store it. Technologically, this is a rather roundabout way, although possible: ‘But we need to ensure that systems aren’t being built right at the zero-privacy, everything-is-recorded end of that spectrum, simply because that’s the path of easiest implementation.’17

In daily life, privacy is a complex and above all dynamic negotiation between various parties, argue researchers Paul Dourish and Leysia Palen. In social situations, what plays a role is not so much the fear of the state’s misusing information but is much more likely to be ordinary worries. People do not want to be embarrassed. They want to assert their authority or voice in a certain area. And they like to have control over their own lives. Because of this, we make different demands of privacy at different moments.

In social situations it is often more important to make yourself known than to protect your privacy. If you want to capitalize on your authority in a certain area, you have to be able to show the corresponding badges. With the help of all sorts of signs – varying from word choice to greeting rituals – we send out signals through which others can deduce our social status or background. Sometimes we want to give our opinion, or we benefit from letting others know who we are. Just how much we wish to reveal depends upon what estimate we make of a situation. Who exactly is the audience? What do we expect, hope or fear in regard to the situation? Privacy, in other words, is a question of ‘identity management’, in which we show or conceal different aspects of ourselves to different audiences in different situations.

Palen and Dourish’s most important point is that the use of the mobile phone as a sensor, combined with the storage of information in databases, changes the parameters of this privacy negotiation. The situations in which we find ourselves are originally spatial and temporal. They are physically limited, for instance by the four walls of a room, and have a certain duration. Both factors play an important role in the estimates we make. We can see who is present and who is not – and therefore who could call us to account for an eventual faux pas.

When we use automatic sensors to register our behaviour in all sorts of situations and share it with others – for instance through social networks – the nature of the situation changes. Suddenly, space, time and audience are no longer limited, and instead the registration of the situation can also be called up at other times and places. But can another audience actually interpret the original context of the situation properly? And maybe you would have acted very differently if you knew that the audience was going to be wider.

Researcher Danah Boyd has written about how this development can lead to all sorts of misunderstandings. As an expert on social networking, Boyd was approached by the admissions committee of a leading university. They had received an application from a student from South Central LA. In a letter describing his motivation, he wrote that he wanted to break away from the gang life there. But when the committee looked at his page on a social network, Myspace, they saw all sorts of symbols glorifying gang life. Was he making a fool of them? Boyd pointed out to the committee that there was also another possibility. The applicant’s Myspace page was intended for his classmates and neighbours, not the admissions committee. And in his neighbourhood the social pressure to be part of something is so high that the young man probably could do nothing else but post the gang’s insignia on his Myspace page.18

Similarly, a commotion arose over the Facebook website. There too, users can voluntarily keep a log of their activities, hobbies and other titbits of information. At first this was only possible on the person’s own page. But one day Facebook changed the setup of its site. All of the messages that users placed on their own page were now automatically published on the pages of all their ‘friends’. Facebook’s reasoning was that this way, friends would be better able to keep abreast of each other’s activities. Besides, hadn’t the information already been made public by users on their own page?

Facebook didn’t do much more than publishing what was already public. But many Facebook users thought otherwise. They saw a subtle difference between making something public on one’s own page, which others must make an effort to access, and automatically distributing that data.19 Once again, this was about the assessment that users make of their audience in determining what information they do or do not wish to make public. To be sure, the information was now being distributed among friends, but there were also subtle differences within that. Some friends might very well be difficult co-workers that a person would not want to offend by rejecting their ‘friendship request’. And people show different things to members of their family than they do to old school friends. Facebook does not make it possible to make that distinction.

CENS itself uses such an application in its Personal Environmental Impact Report (PEIR) project, in which data is again collected with the help of mobile phones. This information is then converted into a carbon footprint and simultaneously combined with databases on local air pollution. In this way, users not only learn how much they themselves contribute to air pollution but also how much pollution they are being exposed to. In a log file, users can see precisely how the system uses their data: what information is registered when, and uploaded and shared with whom. Eric Paulos argues that interfaces like this should also make clear how reliable such (collectively gathered) data are. It is important that users do not trust all flows of data blindly, but that they always remain aware that data can be manipulated, or even simply not collected accurately.21

Aguiton et al go one step further. Not only should users be able to have insight into the manner in which information about them is collected, they should also be able to manipulate that information. Users have the right to lie to the system about their actual whereabouts in order to protect their privacy, they claim.22

The above-mentioned examples show that our thinking about privacy has to be reconsidered. The sensor data collected by mobile phones can play an important social role, for example in the area of public health. Such data can – as in the ‘citizen science’ instances – play a role in civil society projects. And some people will experience sharing data with others as an enrichment of their lives.

Involved parties point out that many of the present regulations are inadequate. On the one hand, the positive aspects of sharing data anonymously should be given more attention. At the same time, the awareness must also grow that privacy is not a binary affair in which something is either completely public or completely private. Between the two extremes lie many gradations that by no means are always taken into consideration in the design of new technologies. And providers of location services and social networks, for example, should also be stimulated to give the many nuances of privacy in everyday life a place in their services.