“Every move you make, Every bond you break, Every step you take, I'll be watching you.”
— The Police

Data Collection

When looking for ways to obtain geolocation data, it quickly became clear that turning to data brokers was the most promising option.

By searching online on a platform allowing various data brokers to sell datasets, one database appeared more comprehensive than the others, especially for individuals located in France. Its description stated that it contained anonymized geolocation data and that a free sample was available. Pricing ranged from several thousand euros per month to over one hundred thousand euros per year depending on usage and geographic coverage — sometimes a trivial amount compared to the potential profits derived from such data.

In addition to this data — which is the main focus of this article — each row also included IP addresses, country and city indicators for the geolocation point, a measure of location precision at the time of recording, and other less relevant data. The database totaled approximately 15 GB and 100 million rows, requiring cleaning and sorting before analysis.

Processing

During data sorting, information was distributed into several columns to isolate what was useful for the project. Using Python, Jupyter Notebooks, and the Pandas module, an initial filtering was conducted to remove data unusable for our re-identification method.

We kept only: - Geolocation points - The timestamp of each point - The identifier linking each row to a mobile device.

A quick check revealed 5 million unique identifiers in the database — potentially 5 million “tracked” phones. Some had many geolocation points, others very few, sometimes only one. After excluding devices with insufficient data, approximately 800,000 identifiers remained usable.

The data was grouped by unique identifier, creating 800,000 distinct datasets, each retracing the movements of a phone. We call such a sequence of points a “trace.”

Data Clustering

At this stage, we focused on points of interest — sensitive locations that could enable re-identification.

Using a clustering algorithm that grouped points by time and day, we could quickly estimate where individuals spent weekends and nights, and where they were during weekdays.

Thus, for each trace, we could determine the likely home and workplace locations. Using OpenStreetMap functionality to convert geolocation into postal addresses, we identified addresses for each of the 800,000 mobile phones.

Of course, errors occurred — due to remote work during COVID-19 in October 2021 or location precision issues.

Open-Source Intelligence (OSINT)

The next stage involved open-source research. Techniques commonly used by journalists and investigators were applied to retrieve theoretically confidential information using only publicly available sources.

In our case, research mainly involved consulting phone directories (for residences) and LinkedIn (for workplaces).

Re-identification

To estimate how many people could be re-identified, we randomly selected 20 identifiers without filtering by location or trace length.

By searching corresponding addresses in directories, we quickly found several names, albeit with varying precision. Sometimes searching for one address returned the name of someone living next door. In other cases, multiple names appeared, indicating apartment buildings.

It is also important to remember that the displayed name may be that of the property owner, not the occupant. In France in 2021, one quarter of households owned 68% of private housing.

Workplaces were sometimes directly identifiable from the address. In other cases, mapping services were used. Once identified, searches combining the workplace name and the individual’s surname on social networks or company websites confirmed employment.

Within about one day, we identified 7 people (out of 20 sampled identifiers) whose home and workplace matched the dataset. Based on this sample, roughly one-third appeared re-identifiable from a random dataset. Anonymous, we said?

For these individuals, it was possible to reconstruct hour by hour what they did during the week of October 8–15, 2021: where they slept, when they shopped, which routes they took to work, when they dropped their children at school, and so on.

If political meetings had occurred that week, it would likely have been possible to infer certain political opinions from attendance patterns.

Remember: we only had access to a small sample. By paying the prices mentioned earlier, we could have obtained a dataset covering an entire year or a specific region.

Is Geolocation a Problem?

We are far from the first to study geolocation-based re-identification. Identifying individuals within location traces has been possible for years. However, the ease with which such data can now be obtained is more recent.

Since 2018, various reports have highlighted abuses:

• In 2018, more than 20 French intelligence agents were re-identified through Strava usage.
• More recently, a Danish media outlet purchased data from over 60,000 smartphones for €4,800.

Geolocation data is therefore highly sensitive. It can reveal religious practices, visits to sensitive buildings, or even private activities. In a previous LINC study using New York taxi data, it was possible to determine who visited which strip clubs.

Even with obfuscation mechanisms, everyday apps remain vulnerable (“A Run a Day Won’t Keep the Hacker Away”), and once data brokers enter the equation, privacy becomes extremely fragile. No real justification was required to obtain the data, and re-identification took very little time. The apps enabling this data aggregation remain unknown.

Illustrations: Pixabay & LINC