Do You Know “I Can Stalk U”?

The following is a guest post provided by Ben Jackson and Larry Pesce. They are the creators of I Can Stalk U, a website that uses information from geo-tagged photos that have been uploaded to the Internet to expose people's locations. Their goal is to raise awareness about the potential risks of instantly publishing photos that contain location-aware information.  The opinions here are theirs only and do not necessarily represent those of CDT.

The combined use of social media, smart phones and location-aware services has recently skyrocketed. A byproduct of this high-tech trio is that people are increasingly posting photos online, because after all, a picture is worth a thousand words – not just 140 characters. However, every digital photo contains data about how it was taken, when it was taken, and sometimes where it was taken. This can be very handy, but when the instant publication of these photos to the Internet is thrown into the mix, it can quickly go from “useful” to “dangerous.” Most people have no idea their pictures contain this kind of information, let alone realize there are ways to manage when it's made public or kept private.

With little effort it's now possible to draw an intimate portrait of a person's life simply by tracking the data these digital images leave "laying around" thanks to the embedded GPS technology and applications that are keen to use a feature called "geo-tagging" as a way to provide people with location-aware information.

In order to educate the public about the personal stories they are unwittingly telling when they post images to Twitter, a project was started called I Can Stalk U. The project analyzes photos posted online for geo-tags and displays their specific location in addition to their tweeted message. While similar to Please Rob Me, the key difference is the large majority of users profiled by I Can Stalk U have no idea they’re giving out this information.

We believe there is a significant difference between posting a geo-tagged photo of a person’s favorite coffee shop online and “checking in” to the same location on a location-based service; although these services are similar in theory, they have different privacy implications. When a person “checks in” at a location, they are, on some level, making a decision to release that information. When a person posts a geo-tagged image, however, it’s usually a different story: Most just think a picture is a picture and are not aware that they’re saying, “I am at latitude X and longitude Y." There is no conscious decision to post that information – it’s merely incidental.

Implications Considered

Privacy was discussed during I Can Stalk U's planning phase. We wrestled with the question: While I Can Stalk U does something that anyone could do, by doing it in such a public manner, would it cross the line? Despite the name, the idea of possibly assisting someone in stalking a person does not sit well with most people. Certain decisions were made to make sure our message is delivered while keeping invasiveness to a minimum:

• I Can Stalk U only analyzes photos published on the public Twitter stream that anyone can view, leaving people who have kept their tweets private out of the spotlight.
• The amount of time someone is displayed on the site is typically under an hour, leaving a limited window for when they are exposed.
• The photos posted on the site are random: the massive amount of photos posted to photo services every moment allows I Can Stalk U to sample a small amount, so not every geo-tagged photo can be found.

While I Can Stalk U has been well received and has done a decent job of educating the public, the solution for this problem lies with the operating systems of the phones themselves and the developers of location-aware applications. While the recent improvements to Apple's iOS and Android that make geo-tagging easy to turn off are laudable, the true solution is to make geo-tagging and location based functionality specifically opt-in and explain to the users what this means when they enable it and what will happen to this information. By doing this, it will allow individuals to make well-reasoned decisions regarding their privacy and how much information they want to share.