08.08.10

Foursquare's Stalker Problem

Social networks that broadcast your exact location make it easy for strangers to watch your every move—and become part of your life without you even knowing it.

Social networks that broadcast your exact location make it easy for strangers to watch your every move—and become part of your life without you even knowing it. The Crime Report's Lisa Riordan Seville on geotagging and stalking.

In the world of social networking, Carri Bugbee is hardly a novice. The social-media marketing strategist from Portland, Oregon, has 7,164 followers on Twitter, 1,197 friends on Facebook, and more than 500 connections on LinkedIn. But when she ventured into the world of geotagging—the technology behind many of the social networks that broadcast your location to the Internet—she received an unsettling wake-up call.

One evening last February, she picked up her phone and "checked-in" to a local restaurant on foursquare, the popular location-based social network that lets others know where you are in real-time. Foursquare posted her location to her feed and Bugbee went back to chatting with her friends over the menu. That's when the hostess came over to the table and told her she had a call on the restaurant telephone.

Bugbee didn't recognize the male voice on the other end of the line, and the voice didn't offer to introduce itself. It told her she shouldn't use foursquare because if she did, certain people might find out where she lived. She nervously laughed off the creepy comment, telling the caller it was pretty hard to find her house. That set him off. "You stupid bitch," he said, an opening to a string of insults. She quickly hung up, rattled.

The caller had tracked down Bugbee through PleaseRobMe.com, a website designed to warn people about the risks of geotagging by aggregating and publicizing updates from foursquare. In Bugbee's case, the warning was effective.

"I was totally creeped out," she recalls. "I just didn't ever think it would happen to me ... I slept with all the lights on that night." She also immediately quit foursquare and hired a house sitter. She says she felt that someone "basically stalked me," and she's become, as she put it, a "geotagging curmudgeon."

"I think that a lot of people have drunk the Kool-Aid without actually thinking that hard about" location-based technologies, says Bugbee. "At some point, some tragedy will occur."

PleaseRobMe shut down last spring after a string of incidents like Bugbee's suggested it might be a little too helpful to would-be criminals. Nevertheless, its founders said they had accomplished their goal of educating users about the risks of broadcasting their location to the world. And even without PleaseRobMe, it's often easy enough to find someone's location on foursquare itself, especially since many people cross-post their check-ins on Twitter and other websites.

"What is often forgotten is that you're not really talking to a small group of friends," says Douglas Salane, director of the Center for Cybercrime Studies at the John Jay College of Criminal Justice. "You're potentially talking to anyone on the Internet."

"I think that a lot of people have drunk the Kool-Aid without actually thinking that hard about" location-based technologies, says Bugbee. "At some point, some tragedy will occur."

Erin Gleason, a spokesperson for foursquare, emphasizes that users of the service can and should exercise control over who their locations are seen by. "Foursquare is meant to facilitate communication about location between friends, not between friends and strangers," she says. "When a user decides to check into a venue using foursquare, this check-in is only viewable by people that the user has chosen to accept as friends. Many users do choose to link their foursquare accounts to their Facebook and/or Twitter accounts and share their check-ins on these sites as well, but this is not required."

The future of the Web will likely rely heavily on information that users produce and broadcast, either actively or automatically. And much of that information may be geographical. Facebook, which hit 500 million users in July, plans to roll out a location-based feature any day now. And people today are leaving millions of pieces of location information in their digital wake.

Ben Jackson and Larry Pesce had both safety and privacy in mind when they started ICanStalkU.com in May. With $1,000 and some programming language, the New England-based securities information researchers picked up where PleaseRobMe left off.

ICanStalkU shows that even if you try to avoid location-based social networks like foursquare, you may still be unwittingly telling the Internet exactly where you are. ICanStalkU automatically searches thousands of photos on Twitter for geotags, tiny location markers attached to about three percent of all photos posted to the micro-blogging site. Then it turns them into a location message, showing how photos can be used to trace people in real time, using information many have no idea they put out there.

Despite the eyes-in-the-dark logo and dramatic name, Jackson said they intended the site to teach rather than threaten. "We just want people to make an informed decision," explained Jackson. "If they are posting this information, we want them to know what kind of risk this entails."

Stalking experts say the rapid evolution in locational technology has increased the risks. "It doesn't cause stalking, but it makes stalking a lot easier," says Rebecca Dreke, a senior analyst at the National Center for Victims of Crime.

About 25 percent of the 3.4 million people who reported being victims of stalkers during 2005-2006 said they had been stalked using some form of cyber technology such as email or instant messaging. The data, reported in a 2009 study by the Department of Justice, predated the wide use of newer technology such as geotagging, and so may seriously underestimate the scope of the problem.

Dreke helps educate law enforcement about how they might use the same technology to help uncover the offenders. It's an uphill battle. "The offenders and the criminals are usually keeping ahead of the people investigating the crime," she said.

Todd Zwillich, the Washington correspondent for the National Public Radio program The Takeaway, was driving around the capitol on a recent Saturday when he spotted a blue Chrysler with the license number NCCI70I. He grabbed a friend's iPhone, and ran into traffic to snap a shot of the "awesome" plate. "It's awesome because that is the ID number of the Starship Enterprise," said Zwillich, with a laugh.

Zwillich knew the image would lay bare his Trekkie obsession to friends and followers. But until ICanStalkU picked it up and The Crime Report contacted him, Zwillich didn't know that suddenly all of the Internet knew he was standing "nearby 669 New York Avenue NW Washington D.C." that day.

The idea didn't sit well. "I'm not interested in having constant GPS social surveillance," he said. "It's information I want to control."

But increasingly complex privacy settings and out-of-date laws can make that hard to do. In the courts and on Capitol Hill, debates have begun about how to fashion laws governing cellphone records and electronic communications that strike the right balance between safety and privacy.

"Most people's intuitions about their privacy and public space are wrong or out of date," says Andrew Blumberg, a professor of mathematics at the University of Texas, who has done extensive work on locational privacy. Which is why he welcomes sites such as PleaseRobMe and ICanStalkU as useful counterforces to the notion that citizens have nothing to fear, as long as the users of such metadata act responsibly.

"Is it legal to keep (such information) forever?" wonders Blumberg, who co-authored a paper on locational privacy with the San Francisco-based Electronic Frontier Foundation, which defends privacy rights in cyberspace. "We need to have a national debate about what the right legislation is."

The debate has started. The law currently governing the use of email communication is the 1986 Electronic Communications Privacy Act. In an unusual show of cooperation, privacy advocates, tech companies, and service providers from the ACLU to Facebook have come together to form Digital Due Process, a coalition seeking to update the law for today's geotagging world.

But ICanStalkU's Ben Jackson isn't sure the law can ever keep up. That's why he and others on the cutting edge of technology will likely keep setting up sites to show the world the digital breadcrumbs people have left behind.

Jackson is already thinking beyond geotagging. The question stuck in his mind is: "What's going to happen next year and the year after that to information I don't know I'm giving out now?"

A version of this story originally appeared on The Crime Report. Read it here.

Lisa Riordan Seville is a freelance writer and contributor to The Crime Report.org. She writes often about criminal justice, the arts, and Brooklyn.