Location-Based Services in the Context of Usable Data Security

Beringer: Let me give you a first introduction in what I do. And I am right now conducting my own research. I'm doing my master's thesis. I'm a research assistant at the Institute of Media Management at the Ostfalia University in northern Germany and I will give you some ideas of the research project, which is funded by the EU or European Union, and the topic of this research project is 'Location-Based Services in regional media communication' and we examined LBS from a social science perspective and conducted some acceptance research with a regional focus. We did some focus group discussions with some representatives of different relevant sectors of our region here in northern Germany. We conducted a market exploration at the very beginning to just to get to know in which market we are involved and how to move in this market, and all in all to provide an overview for the current LBS market in order to derive some certain possible success factors. And in June, we finished a Delphi study to identify some future developments or trends as perceived by specialist from the science and from the marketing perspective. It was an international study. Yes, it became very clear that data security and of course, data and security and usability, user friendly data security. Yeah, there is something or this is quite an interesting field, but we have not conducted some research about that topic and that was the history of my thesis. Right now, I am conducting interviews with different experts from the field of data protection or usability or whatever. My aim is to identify some factors that influence usable or user-friendly data security related to LBS technologies and before I start with my first question, I would like to know something about you. What is your research field and what are you working on right now?

Michael: Ok, so my field is the social implications of technology. I came out of industry in 2002. I was a telecommunications engineer at that time. I was building location-based services and then I entered academia in the School of Computer Science and Information Technology [comment: University of Wollongong, Australia], and I began to look at e-commerce platforms, self-service platforms, supply chains, e-business strategies and then I sort of came to a feeling that there was a gap in this area of social implications with technology in society intersect.

Beringer: Ok.

Michael: So, I started to do location-based services projects to look at similar questions as what you are asking, actually. I was successful in an Australian Research Council Grant. When I was a very young academic… we explored Location-Based services and telecommunications policy.

Beringer: Oh, nice yeah.

Michael: Particularly in emergencies.

Beringer: Ah ok, yeah.

Michael: So that's about it right now, I'm an academic at the School for the Future of Innovation in Society and School of Computing, Informatics and Decision Systems Engineering at Arizona State University.

Beringer: All right, nice. Great.

Michael: Yes.

Beringer: Anything else to say?

Michael: There’s lots of work always going on and Location-Based Services now is not just the coordinates and the phone. All right? Location-Based Services could be facial recognition. It could be drones; it could be satellites. It could be any type of technology. Right? We've got to broaden our understanding because, you know, we think that this is the ultimate and maybe it is right. Maybe chip implants will be in the future. Who knows? Or wearable devices? You know, we don't know. But in terms of the notion of location, we've got to think from infrastructure that is geostationary and, you know, satellites right down to the level of a vehicle that has a data collection mechanism that is aware of location as it roams around the streets and so that the camera has become a very interesting tool in Location-Based Services.

Beringer: That sounds like a new research topic.

Michael: Yes, it is.

Beringer: All right. Let's start! What comes to mind when you hear my topic like 'LBS in the context of usable data security'?

Michael: A project I worked on around 2005 when I was at the University of Wollongong was jointly with the Andrew Corporation, now CommScope was looking at how Location-Based Services could be used to enhance security in very sensitive domains. Let's say, for example, I have a document and this document here, this physical artifact must never, ever leave this room. And the minute my door opens, and I take this document out of the room, it will set off an exception in the incident report. So, I can put a QR code here and as soon as I leave the room, it can be scanned with a mobile device.

Beringer: Now I got it.

Michael: But that's Location-Based Services, but it's usually is the reverse of what you usually think about… So usually the location is on the electronics, not on the artifact, but now it's on the artifact as well. So, when we talk about data security and location. Everything now the sensors in the phone, the sensors in the laptops, this everything has a location sensor in it. We look at IOT devices. Right, internet of things devices. So, when you talk about data security, you can have what's called a minimum bounded rectangle. Right. An MBR to say: if this thing or this person, this object or subject goes outside this bound, it's an alarm, like the COVID-geo-fencing apps. If the person is in quarantine and defies quarantine and he goes or she goes outside the house - bang! On the data security side there, you are now talking about, are you talking about the securitization of location data or how location-based services can securitize data? You know what I mean? 

Beringer: Yeah.

Michael: Are you talking about how sensitive location information has become or you're talking about how can I use Location-Based Services to ensure data security?

Beringer: Maybe both? But previously, most likely, the first context right now.

Michael: Ok.

Beringer: But I definitely will take these questions to my work and I have to think about it.

Michael: Yeah, because all I'm going to say is, I think location information is more sensitive than identification.

Beringer: Ok.

Michael: So, you have to think about something usually on the earth's surface, I could have an X and Y coordinate unless it's a multistory building. Level one, level two, level three, where I share the same coordinate with somebody at the top floor. If you're not in a building and you're outside and only one person can be on the exact degrees, minutes, seconds. So, given the fact that only one person can be standing somewhere at a park, at a pub, at the beach, at the grassland, unless you have somebody on your back, you are carrying them, then you are the person that's there. There's no one else. Right, and that is more revealing than who, your name? Who cares about your name? Where are you? There could be 100 John Smiths, but there's only one person standing on that X and Y coordinate. That's unique.

Beringer: Oh, wow that is nice. That is unique of course. But let me just tell you some background of my research, we are hoping that in I think in October, we will or we're just working on the project, on a new project and we're hoping to get the project in October, and this project is. It's about a special mining region in near of our university and all the mines and all these, like the infrastructure of the mining area, are now closed. So, there is no mining work and this it's the politics decided to reinvent this area, to make it more attractive for tourists, for the people who live in the region. Maybe they build a new village. I don't know and the background of this project is to create a context sensitive platform to collect all this information for this region and to make it accessible for the people who live there and of course, for tourism, for marketing and like and for all the people who live there. And this is like. This is the main topic of the project and we are now here or I hope that I can and I hope that I can identify some factors which are important for the developing of the app, for the platform, and...

Michael: So, I'm working with someone who's actually a media marketing person and at the moment, what's happening because of the collapse due to COVID of newspaper industry. The local newspapers have just disappeared, so has the local journalists, right, because there's no funding. No one is buying newspapers now. There is something in your case has happened. But with an industry, let's call this the mining industry and now that what they are doing is called 'land reclamation', they are fixing the area and they are because I used to work as an associate dean for a mining school. So, and I have visited mining schools in China, for example. So, I know a lot about the land reclamation area. So, going back to the media person I'm working with and marketing person, he saying to me he has an idea and this idea is not really new because I said to him, look, the web will be critical for how you integrate the development of regional Australia, rural Australia, because we have the same issue in Australia, like a mining company leaves, they left behind a big, fat mess because there are houses that are absent. There are retail services, post offices, you know, they lose their money. So, what we were suggesting is the localisation of data of information. So, you don't have the journalists anymore to report on an area to grow, to bolster the area, to attract people. The journalists are not being paid. Who's going to generate the information? People, right? Citizens, right. Back to our location, interest stories, for example encourage your citizens in this mining area, whoever is staying behind because they don't want to lose their house. Right. They bought the house because of their job. You said to them, ok, start writing about your life, start writing about your location. So we're not talking really about Location-Based Services, but we are saying we need to understand how we're going to tag and categorize the name of the town, the name of the development, the hotel, the fun things that make people think, "oh, maybe I should go and visit there?". How do we attract attention? Right. And it all has to do with place, people and events. Place, it's about how do I, I live in an area, right? I live and he has maybe like ten thousand people in the municipality. How do I segment the areas? Is it by postcode? Is it by the beach and then by the parks and then? Or is it by housing estates. How do you segment, ok and then you label everything based on that segmentation. Everyone uses labels that are linked to the local area. So, if I'm if I live in Wollongong, I should use the term Wollongong. If I live in Tempe, it's Tempe, or Brighton-Le-Sands beach, then it should be that beach, ok. So, these tags drive search engine optimization and so if I can create a citizenry excitement about talking about people, place and events then it flows from there. Three things, then you are going to get people talking about things. You know, it's not dead. What you want to show is that the area, in fact, that you might use a campaign. Let says, you know, remember when it was a mining town, pretty boring. Right? But now we have this exciting, you know, platform. We've got each other, we've got events, we've got places that we've identified that we never used to think about before. We've got new recreation zones. But you've got a tag. You've got they. Location is important, but I don't mean X and Y coordinate. I mean the name of the place, because that's what people talk about it.

Beringer: That we call 'hyperlocal journalism'.

Michael: Yes! Hyperlocal journalism. Exactly! You may need a moderator, you may need someone who's like the elder of the village or the town who you trust because you don't want one hundred stories by a business, right. You need to have balance.

Beringer: Yeah. That's nice. All right, let's keep us to the next block and the next block is about data security and of course LBS and what do you mean, how is data security related to LBS? You mentioned some topics related to LBS. But maybe you can say it again or something else. What is important when I use LBS or when I use a special service on a location, like you mentioned, the situation in the big building or I don't know. What comes to mind?

Michael: In that context. Context is very important. Right. So, who is using the service? Is it a child? Is it an elderly woman? Is it a single mother? Is it a child with living with autism? Is it someone with schizophrenia? Who? Is it an indigenous person? So, this is the first thing. The second thing is usually coordinates using Location-Based Services, they are digital, ok? They are on the phone. The question is, who has access? Are the location coordinates bidirectional? For example, if there are two users, a government entity and me as a citizen, and if the government can track or see where I am, can I do the same with the entity, for example, mother and child, siblings, brother and sister, husband and wife, employer, employee. Now this we call this a taxonomy. These relationships require reciprocal sharing of location. Is not just one way, but the apps, Björn they usually one directional. Now, if a mother says to her child, I'm going to track you, she has the power, but the child doesn't automatically see where his mother is.

Beringer: That's the normal way right now.

Michael: Ok, the other thing is in terms of data security, is that we have come up with applications, for example, a kid friendly GPS device. You wear it on the wrist so the child can go anywhere. And we know if it's been kidnapped. We know if it's not going to school directly to the school and it's going somewhere else truanting. But the real thing here is that these systems are hackable. Right? So, what happens when someone can intercept? A sensitive location information of a child, right, depending on the demographic, but also beyond this, because we have seen it in some court cases, for example, someone took a GPS device, for example, this they stuck it on the car, they reclaimed the GPS data, and then they proceeded to murder or rape the individual. These are court cases. Ok, so. Now we have citizens. Buying devices and putting them on vehicles and saying, right, I can see the pattern, what they're going to do every day, I will intercept them and commit a crime, a crime against a person. And that's where I become very sensitive with children, because 'Snapchat', for example, in 2017, when it launched its location map, 'snap map' application.

Beringer: Oh, yeah. I remember.

Michael: It was all enabled. The default setting was, you could say, where the person was. So, we had children under the age of 13 carrying devices with 'snap map' on it and so your online location coordinates were revealing your physical location. So, I always told children do not enable the location sensor. In fact, even on my phone. I've got it enabled right now because of yesterday afternoon. But otherwise I have a disabled. Because why should I? You know, give 'Google' all the data that I have, you know, I need it to navigate and I love this application of navigation when I need it, but it shouldn't be on by default.

Beringer: It's like me. I only turn these GPS on when I need it.

Michael: When you need it and I was going to take mine off because I usually have it off, yes.

Beringer: All right. You already just entered the next question. If you are using LBS, how important is or what role play privacy protection and...

Michael: It's huge! Location privacy it's huge.

Beringer: It's like a perfect example with 'Snapchat' or the social media apps. Yeah, ok.

Michael: I give you an example, an American man in Arizona, the story that I was looking at, decided to do some social engineering. Ok, so he created a 'Snapchat I.D.', he befriended a group of girls. The girls weren't paying attention. Who is this '@G-Girls-number 18' and he would go and surveil the girls when they were having get togethers. He was a 40-year old. So, it's like this is the complexity if you're talking to me about locational privacy. Well, the apps have to come designed with privacy and security in built, not as an afterthought. You know, we made a mistake afterwards.

Beringer: Just a very common example of this context here in my university, I don't know which company it was, like the tracking or fitness watches. I don't know the company, but and then these watches were used by some soldiers in Afghanistan or Iraq. And they are just they keep running or they...

Michael: In Korea, ok and this was by the secret military base and through these tracking and publishing on social media, everybody knows where these special forces are.

Beringer: Maybe one reason, because this happened is that these soldiers are not knowing about the importance of tracking the location and what do you think: how should communication be realized to or no! That's another question. I'm sorry but let us keep this communication in mind. How should communication be realized to make data protection more user friendly or maybe a better question, how should people get information about the importance of location privacy?

Michael: So, this is something that is happening to us as we become more and more aware of as citizens. Some citizens, for example, will not download an app that requires their location data. They're going to just say, forget it. If this app is requesting access to my photos, my location, they just don't download. I guess there is a fair bit of consumer awareness happening. That's the first thing that people are starting to realize. My goodness. But now we've got companies who are looking at, for example, your pattern of behavior on your phone, so they can detect whether you might be suffering from mental health issues, for early intervention, right? We've got other applications that look out for trolling online on social media so that people who are threatening to commit suicide could be stopped or bullied. Cyber bullies actually brought to justice early so that they don't propagate the illness of the other person. So, we are seeing interventions, but it's constantly raising awareness about what's going on and what's going on is that we have a totally new visibility. The more of these cameras that go up in cities, the more smart cities that are erected, the more there is a proliferation of smart devices in IoT devices, the more we become desensitized and the stakes get higher. So, when I locational privacy becomes even more important, the more we become desensitized and the question is, what's going to be our limit?

Beringer: Oh, yeah!

Michael: Is everything going to be open? I remember when 'Google' was suggesting years ago that 'Google Now' this service called 'Google Now' would allow people to publish their emails openly.

Beringer: Ok, why?

Michael: And you can think about that for a second, right?

Beringer: Yeah.

Michael: It would be an incredible thing to have the whole world's emails open at the same time, the implications of doing that would be difficult for personal reasons. But the advantage of breaking things open between organizations, between governments it would put us on an equal footing to understand the cleanliness of our strategies for the future, to understand the collective awareness that we could garner from all the brands in the world going, oh, that's a really good idea. We should all do this as a society. But you say that's why we're never going to get to that point, because locational privacy, even personal data, all of these require something to be kept closed, if that makes sense and if we keep everything open like we're suggesting with all of these different apps, the trick is going to be, how can we have the use of location data anonymously and securely and without putting anyone at risk or harm. That's the trick. You know, we want to use location information, especially when we want to get somewhere, we want to use it… The issue is. How do we do that effectively and without compromising people's safety? You know, in emergencies, for example, we've seen a lot of apps come out now with COVID. A lot of people are saying, well, that's OK. I trust the government to an extent. But this is the first time they're tracking our every move. For example, in India, in China, in Taiwan and South Korea, they're asking for location coordinates not just did you come close to. Right, so this is really changing. But it's about awareness raising, is about citizens knowing their rights, not assuming that they have to comply. But also, I think there's nothing wrong with these systems if they are implemented the right way. Like I was on a panel a few days ago on 'facial recognition' - I don't want my face being taken photographs of the minute I leave my house, and I know a lot of Germans would be saying the same thing.

Beringer: That's completely true.

Michael: Ok, but there was a guy on the panel who builds the system. He says, "one day you might need the image" and of course, he was talking about heinous crimes. Right? So the question is, can we live in a world that is technology pervasive where we trust systems? Trust the controllers not to abuse, misuse, misrepresent, misinform and the thing is, because there are humans behind these systems, we can't. Right. I wish we could, but yeah. It is it comes back down to human rights issues.

Beringer: It's very interesting. Interesting thoughts from you. That it's like when every information or all the technology is or can be trusted and what is the impact on society maybe and we don't have to to put some information in secret, for which reason, I don't know. But yeah, it's like a like a philosophical theme.

Michael: Yes.

Beringer: But you mentioned the awareness of users and do you think are the users quite aware of how much the personal data is collected, disclosed or stored when they are using LBS apps?

Michael: None of us have any idea, that's the truth. We are growing in awareness and concern. We know it's sensitive, but then we still buy these devices. So, I'm talking to people who tell me that they're worried about the location information and they're wearing a Fitbit.

Beringer: It's like the 'privacy paradox'.

Michael: Yes, it’s like saying, “I'm a privacy advocate, but I've got 50 loyalty cards in my in my purse”, so there's something wrong there and so this is a realization of how we attract the basic necessity of cookies, of course, which is change with the GDPR. But cookies is only one thing. What about behaviors in gaming? People don't think about game engines as being harvesters of behavioral data.

Beringer: Oh, wow. Behavior data that is quite interesting.

Michael: How you query, how you hide, how you maneuver. It's all mental. They know you better than you probably know yourself and the same thing happens with location data if you track someone's breadcrumb. You know, we're creatures of habit, and the same thing happens with location information. If you track someone's breadcrumb, right. The location chronicle, where they were going, the whereabouts all day, every 30 seconds, the way points and you compare one week to the other to the other. We're all the same. You're going to kickboxing every week at the same time, you know, in the 10-week block.

Beringer: But I leave my mobile phone right here.

Michael: Oh, yes, I know that. But that what I'm saying to you, rather than making it personal, I'm trying to make the point that there is this thing called 'time of day data', right. Every five minutes the government does aggregate information about towns. That's how they work out where the buses go. Right? It's called 'time of day data'. It exists all over the world in fragments of five-minute blocks.  You will see in the German bureau as well. So, five-minute intervals. They know patterns of behavior because that's how the services planning happens. But its aggregate information, and it's usually done by interviewing in detail.

Michael: Not just by counting the cost counting you know. It's not just dumb, it's detailed interview. So someone will come and they'll come four times to your house. We have done this survey once with my husband here. They ask for adults. They ask you all day on this Saturday, what did you do today? And you go to them. I got up. Did you use two cars or one? Did you get the bus? I took the kids to sport. How many kids did you take to sport? Which were the venues like very detailed. Did you come back? Did you go anywhere else? Did you like it? After two hours you're tired of the questions. But I did this four times and they capture this data. But it's called 'time of day data' and so I know you say you leave the phone behind, but the thing is. That you could leave the phone behind. Ok, this is the personal tracker. Yes, but what about the lampposts? What about the CCTV camera? What about the other smart infrastructure that the facial recognition right, that's on the CCTV you used to be fore video is not for video anymore. They go and they upgrade the software on the CCTV firmware and that software can now do a very good tracking of individuals. They may not know who you are, but I know you came back. I was the same person again. Count, count, count and so this is when the environment becomes the tracking mechanism and not a device.

Beringer: Oh, wow, yeah!

Michael: That is totally different, and I can guarantee you there will be smart devices in the new town that is being built. 100 percent. The government is going to put in safety cameras, 100 percent.

Beringer: Yeah. All right. Nice. That's interesting.

Michael: The shopping malls, for example, have these systems in place that if you do go in with your phone, they call 'pass intelligence', the location intelligence and as you go around the shopping mall. They refer back to an anonymous identifier on your handset, not the IMEI, just an anonymous identifier, and they know where you go, what you are doing, that they know who you are, but they know where you go and then they take the data and they go back to the company that has the least ownership and they say, you have to charge this company two hundred dollars more, because the foot traffic is more. We know people go and they stop because we have tracked these devices. So you've got this environment tracking and location of the device tracking. Two things, working in concert.

Beringer: That's interesting.

Michael: Very powerful!

Beringer: Powerful, yeah, the environmental tracking. All right let us go to the third block about 'usability and data security'. Usability or usable security should consider the individual security needs of the user, of course. What do you think? Maybe we're now going to the architecture of LBS or how LBS are designed? And what do you think about that? And how can this be implemented in LBS technologies, especially the individual security needs?

Michael: I'm going to answer this question in a methodological way. The trick there is that you don't leave privacy to the end, where you say only if the customers complain and only if we have enough money. These are the two responses usually. Who cares about privacy is not a functional requirement. What a functional requirement is. I just need to get those location coordinates to what? I need to be able to do a good, accurate rate 99 percent of the time. So, the investment by the engineer is in the complexity of the technicalities rather than embedding the values that they're seeking or the customers are seeking in the design process and so ethics plays a part. Some people have called the 'ethics by design', 'ethical alignment', maybe others have called it 'values by design'. Others have called it 'engineering by design' and Cavoukian because of 'privacy and security by design'. So, there's a lot of approaches. But if we go back to the GDPR, of which Germany is a part of, the 'privacy by design' is embedded in the in the regulation. You see it is article eight, but a can't remember. Could be Article eight or 22 one of the other. I can't remember.

Beringer: I didn't have in my mind.

Michael: Yeah, yeah. I gave a presentation on this last year I should remember but I don't remember. So, the thing is, where socio technical theory comes into play is by encouraging the social to be discovered and addressed during the design process, not after the fact. It's essentially a technical theory requires the social issues of which privacy is one, the technical issues. How do I implement 'privacy by design' and then what's called the environment? Not the walls, not the buildings, but environment means the laws and regulations. Have I rolled out a service or am I about to roll out a service that abides by the principles, the legislation, the regulation of the local economy?

Beringer: Mostly, some business models are based on the trade of personal data and the user with his data represents the product in this case and what you think? Is digital privacy at all required when the user represents the product?

Michael: So, I think here. We have to change our business models. This notion of free is dead, nothing is free, nothing is free. I hate when you want to get wi-fi and they ask you even what you eat for breakfast. This is not free. Now, we going to companies like McDonald's, you sit down, you want access to the Internet again, you've got persistent access if you give over your whole life story. Otherwise, every time you go in, you've only got half an hour block, not two hours or three hours. But they want to know everything about you. Now, one of the reasons they want to know everything about you, I go back to my telecommunications work is because that's how you dimensioned traffic. That's how you know what your services requirements are. That's how you know what your network infrastructure is. Do I need a bus station here? Do I need a traffic, a media hub here? Do I need a server that allows people to download information about the goods in the shopping mall, whatever? Right. So, it's more usually commensurate. But the issue is here that we can't stop ourselves. This is what's called 'scope creep and function creep', retrospective use. We go, oh, we just need the networks. We just need to access the handset because they're in our service domain and service region. But then somebody has a bright idea a bit later to go, oh, we can use this for something different now. We can use this to figure out where they go shopping, what they buy, you know, how they look. Are they dressed appropriately? Are they rich or they're poor? Are they black? Are they Chinese? You know, we can't stop ourselves.

Beringer: Yeah, Ok. I just made some notes about an idea, just when we are looking to the future, to our hopefully our next project on the mining region, and maybe we should focus our research or when the app or the platform is created we should focus on the traffic data and, of course, the environment data, which maybe this is a good way to get to know the behavior of the people in this region. I don't know.

Michael: If you tell them you're doing that, that's not a problem. One of the distinctions I make is on 'covert versus overt'. Covert is when you hide the cameras, you hide there in fixtures that no one can see that it looks like a light. It doesn't look like a CCTV camera. Right and so that's covert. Right. Is hidden and a lot of the smart cities are trying to design an aesthetically pleasing to the eye areas. The question is, but does the consumer know and should we care? I think we should care. If they know the question, I have for you is, would it stop them going shopping? The likelihood is no, it won't, but they will feel reassured that they can trust. Right. More information is not bad. More information is good. So somehow there has to be some money. I'm talking into the millions of dollars set aside for the marketing and raising awareness of this work. Where does my daughter go? If I've got a question, but who can I call? My child was, for example, in a sensitive situation. I had to change them in public because they got paint all over them. Right? I think they were photographed naked. Ok, where can I go to delete that data from the records? Right. So, the more you tell people, the more they will trust you. Not the opposite unless you're lying to them. Right. Which you're not. So, know that there is a difference between obtrusive, unobtrusive, covert and overt. And if you're going to stick sensors in the environment, you tell people you are, you tell people how are you going to use the data and you tell them what is your threshold? You have to do a survey on consumers living in the area.

Beringer: It's quite good points and let us keep us going. In your opinion, what are some barriers against usable data security?

Michael: Yes, the more you secure, the less usable the system is.

Beringer: All right, perfect. Thank you.

Michael: That's for sure. For example, if I say to you, you can log onto the Internet, you need a password, you need a smart card, you need your face scanned, you need your fingerprint scanned. It takes longer. Right and so sometimes there is a tradeoff in the sense that it shouldn't be, and if we do this right, but usually more security does mean less usability usually.

Beringer: And how could data security be designed in the context of end user, providers and legislators?

Michael: Ok, so here you're talking about a value chain, and this isn't just a technical theory, all these different stakeholders. Firstly, you have laws and if you don't have laws governing location services, you need to create them. But I believe there are European wide laws and also a German-centric laws. Just look at the local laws because sometimes there are city laws, right. So, there are regulations in that city that determine different to the supra, to the national laws or even the European Union laws. So, become aware of the laws firstly on location data collection, then in terms of the citizens, they need to be completely aware and consent to what is being taken from their smartphone or otherwise. They need to have a consenting option that says, yes, I want to be part of this or no, I don't. And then the industry needs to abide by firstly the laws and secondly, the needs of the consumers. So, there is this there is this interaction, this feedback loop between the stakeholders. But someone has to champion that. And usually it's left to the company involved in building the app rather than driven by society or a societal representative.

Beringer: Ok, yeah and let me continue with the next question for the of course, the digital platform, as I mentioned before, and which aspects of data security would be particularly important in this context.

Michael: So, if we talk about data security, it's everywhere from the security of the token that's being used, whether it's a handset, whether it's a QR code, whether it's, you know, a smart card, whatever it is. Then the data itself, information or security or data security, as it's known, ensuring there's no leakage of data, that names are anonymous. You know, you don't really need the names of the people. As I said before, you know, you might have to, in the first instance, collect all this data, but before processing it, you remove any identifiable information and you ensure it cannot be identified. It's de-identified. So, you have to de-identify all the data you collect because all you're worried about or you should be concerned in this instance is the number of services required, the aggregate level of data. So, I would just say, as a rule, they should not be any data on a one individual basis in terms of transactions in the town or the region. In terms of network security. That's another layer altogether. Companies are very good at doing network security, generally speaking. But again, how do you allow a user to use your service? Do you require them to log in.

Beringer: What do you mean with that?

Michael: For example, say I live in a territory called Wollongong and I go to Wollongong every morning and I want to use some of the internet services, do I have to use my real name? Do I have to use my name? Do I have to give up my driver's license number? Well. That's the thing. At that point, a system usually wants to know which person they are dealing with, but my recommendation is, it doesn't matter who they are dealing with, so long as they age appropriate.

Beringer: Ok, last question and maybe in your field or in your research field, is there a trend you see in terms of...or all in all, in general is there some trends which you identify maybe related to location-based services?

Michael: My husband and I and a number of our colleagues who were students at the time worked on a concept called 'uberveillence' and this is an important concept to share with you.  

Beringer: Ok yeah, nice. Thank you.

Michael: That's how you spell it. 'Uberveillance' yes has to do with identity plus location plus condition and so the fourth item on there is photography, but you don't always need it. So, if I have your identity, which I can determine through your location and I have the condition information, because that's where we are all going, is not location will be always important, but then the condition of the subject or object at that location will be even more important. So, if I look at you right now, the British police are trialling facial recognition cameras. Obviously, they fixed so they know the exact location. But then they're looking if you're happy, sad, crying, screaming and that the denoting your mood, one of seven categories. Angry, stable, shouting, you know, so in the trying to use this to predict crime or to respond to crime faster. Now if I bring together identity, location and I've got condition and by the way, I've also got video or photography, I've got you! I've looked you out and I'll get you a hundred times a year. Once a day. You know.

Beringer: It's like profiling.

Michael: It's predictive profiling, yes and the profiling, of course, has a lot of links to neuromarketing because that's what it is. But it's also going to implicate us in crimes that we never committed because, we were seen somewhere upset for a reason or we don't fit. Maybe I'm living with a condition of dementia or I'm living with a condition of disability you know. I look different to the camera and said the location now starts with this notion of uberveillance you have three major pitfalls. You've got misinformation, you've got misinterpretation and the last one is information manipulation. I can make you look any way I want to if I have the data. If I have the images. I once went in front of a crowd and I started shouting like I lifted up a chair and I started shouting like this, it was in front of a crowd that was looking at body worn police cameras and I said to them, and I was wearing a a camera, a 'GoPro' on my head while I was presenting somebody from 'Exxon' was in the room, one of these police body worn camera companies. And I said to them "am I acting ore telling the truth?" and he said to me, "I think you're acting". I was a bit of hope. I was acting because I'm a professor. I hope I was acting. But what did the camera see? The camera saw me shouting and lifting up the chair and I said, "that's the camera".

Beringer: Yeah, that’s the reality of the camera.

Michael: That's my point and then if I want to well, I log you at a location in the mining town that is not really the nicest location, maybe, for example, or another location, for example, one of our ministers in Australia a couple of years ago, was caught frequenting, again, a bar that was associated with prostitution. Well, who cares? But he lost his job. You know, he was married, so it's like you might not think it will affect you, but you don't know how it will affect you. What's your context? Let's go back to that and so all I'm saying here is the new and put in this word, the 'new visibility', the 'total visibility' is changing everything and the technology is being harnessed retrospectively for things it was never meant to. Yes, it was there for a security camera and safety. All of a sudden, it's now become the predictive policing tool for the local police of the Aboriginal people or the indigenous people. Ok. Go try to reverse this, you can't. Unless a law comes in to say you can't do this by law.

Beringer: Wow, Ok.

Michael: Big issues that we're all grappling with and it is socio-technical and legal. They're the three things.

Beringer: All right. Great, yeah. All right. We're right now at the end of my questions. Thank you for that.

Citation: Interview on ‘Location-Based Services in the Context of Usable Data Security‘, conducted by Björn Beringer (B.A.), Ostfalia University of Applied Sciences with Prof. Dr. Katina Michael, Arizona State University, USA on August 27th. 2020.