Your iPad's watching you. Should you care?

Researchers announced Wednesday that they found what look like secret files on the iPhone that track user location and store it on the device, without the permission of the device owner. It's unclear what the data is used for and why Apple has been collecting it in iOS products that carry a 3G antenna for nearly a year now.

Alasdair Allan, senior research fellow in astronomy at the University of Exeter, and writer Pete Warden, who discovered the log file and created a tool that lets users see a visualization of that data, say there's no evidence of that information being sent to Apple or anybody else. Even so, the pair note that the data is unencrypted, giving anyone with access to your phone or computer where backups may be stored a way to grab the data and extrapolate a person's whereabouts and routines.

To help users understand more about the data that's being collected, what the risks are, and what they can do about it, CNET has put together this FAQ.

Who are the researchers and how did they find this?
Warden, who used to work at Apple (though not on the iPhone), and Allan had been collaborating on some location data visualization projects, including a visualization of radiation levels over time in Japan after the earthquake, when Allan discovered the file on an iPhone. "After we dug further and visualized the extracted data, it became clear that there was a scary amount of detail on our movements," they wrote in a blog post.

When did this start and what devices are tracking this data?
According to Allan and Warden, the tracking did not begin until iOS 4, which was released in late June 2010. This was the first version of iOS to drop support for devices like the original iPhone, with devices like the iPhone 3G and second-generation iPod Touch getting a more limited feature set. Along with iPhones, 3G-enabled iPads are also keeping track of the data, though it's unclear if this is true for people who have 3G devices without active cellular subscriptions.

The tracking data itself was actually discovered last year. A tool by French programmer Paul Courbis, that's similar to the one released by Allan and Warden, is able to plot up to 10,000 of these data points from the database file to a Google Map. The issue was known in forensics circles but not widely, Allan and Warden said in a news conference this afternoon at the Where 2.0 conference in Santa Clara, Calif. An application they released that allows people to see what data is on individual devices makes the abstract tracking concept more real.

Did they contact Apple on their findings?
The researchers said they had contacted Apple's Product Security team, but hadn't heard back.

Where is this data being stored?
The database of location information is stored primarily on your phone, though due to the iOS device backup system in iTunes, these files can also end up on your computer. When iTunes saves these backups, which are set by default to be stored every time you sync an iOS device, the data file goes along with it.

What's curious is that this log can extend across multiple devices as long as those devices use the same restore point. Allan and Warden noted that the database used as part of the project spanned an iPhone 3GS and an iPhone 4, the latter of which had used a restore point.

The researchers have more technical details and the downloadable application to see a visualization of the data collected from your phone over time here. The application does not work with iPhones on Verizon, the researchers said.

What's inside this data?
A database of cell tower coordinates and timestamps to indicate when your device was connecting with them. This includes what operator you're on and the country code. The research also found that Apple was tracking data about what Wi-Fi networks you were connecting to, which also included slightly less accurate location information, but continued to track that data by time. The researchers' visualization app shows large blue dots for frequent activity and smaller red or orange-colored dots for less frequent activity. However, it's unclear exactly what is triggering the logging, they said.

Is there an easier way to see that information than a giant database form?
Yes, Allan and Warden created an open-source software program that is able to go through the data from the database file and turn it into a visualization of what towers your device connected to based on the dates and times. The pair say the application intentionally cuts down on the accuracy of this data to keep the software from being used for bad things. You're also likely to see points in places you haven't been, since the tracking tools within the iPhone make use of nearby cell towers to triangulate location. "As a data geek I was excited to have this data set, but I don't want anyone else to have this data," Allan said.

What is the harm with this data being collected and stored on the device?
"By passively logging your location without your permission, Apple [has] made it possible for anyone from a jealous spouse to a private investigator to get a detailed picture of your movements," the researchers wrote in their FAQ.

While acknowledging that there is no need to panic, the researchers noted that if someone gets hold of the device, they can access the unencrypted data. "Your cell operator has this information," they said in the news conference. Anyone who wants it has "to get a court order to get that from a provider. But now, all you have to do is lose your phone in a bar."

Apps on the device cannot access the data, because it is "sandboxed," the researchers said. However, it could be accessed by software on the computer that holds the backup, they said.

How do I protect this data from being seen by others?
The data file itself is completely unencrypted, meaning anyone who gets hold of it can access the data freely. On the iTunes side, there's an option to encrypt your backups, which will keep someone who gets access to a backup file while rummaging through your hard drive from being able to dig through it and pull out the database file.

To enable that feature, click on the device icon when it's plugged into iTunes, then check the "Encrypt iPhone Backup" item in the "Options" area. As for your iPhone, or iPad with 3G, your best bet is to keep someone else from getting it in the first place, and then using Apple's free "Find My iPhone" app to do a remote wipe if it's lost or stolen.

How do I turn this tracking off?
Right now there's no way to turn the tracking off, since it's a baked into the operating system. Turning off GPS will make the device less functional for location-based services such as mapping.

Can Apple do this?
According to the iTunes terms and conditions, yes. The company pretty clearly spells out its right to "collect, use, and share" location data any time it pleases. From the document:

Location-Based Services
Apple and our partners and licensees may collect, use, and share precise location data, including the real-time geographic location of your Apple computer or device. This location data is collected anonymously in a form that does not personally identify you and is used by Apple and our partners and licensees to provide and improve location-based products and services. For example, we may share geographic location with application providers when you opt in to their location services.

Some location-based services offered by Apple, such as the MobileMe "Find My iPhone" feature, require your personal information for the feature to work.

That said, the company made a big kerfuffle about making third-party application providers--as well as the built-in Google Maps application--alert users when location was being used by including an arrow in the status bar that is required to appear whenever the phone is sending or receiving location data. This feature came as part of iOS 4, which is when the company began the tracking process.

Apple CEO Steve Jobs also made it a point during an interview at the D8 conference last year that privacy was a topic of utmost importance to the company. "Before any app can get location data, they can't just put up a panel asking if it can use location, they call our panel and it asks you if it's OK," Jobs said. "That's one of the reasons we have the curated App Store. A lot of the people in the Valley think we're old-fashioned about this. But we take it seriously."

Why is Apple doing this?
Apple has not responded to requests for comment. Allan and Warden suggest the company has been using this tracking technology as a precursor to extended location-based services it plans to add as a part of a future version of iOS.

Backing that claim up is an Apple patent application that surfaced back in February, which showed that Apple was considering a service called "Places." Based on the filing, the service would offer Apple device owners a way to locate one another using GPS. While there are third-party applications like Loopt, Foursquare, and Beluga that let people do this, such a feature would presumably be a built-in part of the phone, and rely on geodata logging for any past history features.

"There are legitimate use cases here, but the matter underscores the need for vendors to be clear about what data they collect and what they are doing with it," said Kevin Mahaffey, chief technology officer of mobile security provider Lookout in a call with CNET.

Is Apple the only one doing this?
Android does not appear to do this, sources familiar with the platform said. A Google spokeswoman said the company had no comment on the matter. A Microsoft representative told CNET that the company's Windows Phone platform does not store location history, and that the "Find My Phone" service only keeps the phone's most recent location.

CNET asked Research In Motion and Nokia whether their devices track behind-the-scenes location data, but has not yet heard back from them. These platforms let users track their own movements with GPS apps, though it's unclear whether there's tracking going on behind the scenes.

Coming back to the greater issue about location grabbing, Apple is not the first company to collect data without users knowing. Google got in hot water last year after admitting that it was collecting data from non-password-protected Wi-Fi networks for three years as part of its Street View project. As the Street View car with the camera on top would drive around, collecting imagery, it was also sniffing out information about nearby open networks. Following the privacy probes that came as a result of the disclosure, Google stopped the practice back in October.