IIT study warns of privacy risks from location permissions on Android apps

A new study by researchers at the Indian Institute of Technology (IIT) Delhi has revealed that mobile apps on Android devices requiring precise location permissions can access far more information than users realise, potentially exposing sensitive details about their surroundings and activities.

The research conducted by Soham Nag, an MTech student at the Center of Excellence in Cyber Systems and Information Assurance, IIT Delhi, and Smruti R Sarangi, Professor in the Computer Science and Engineering Department, IIT Delhi, found that even in environments where GPS signals were weak, it was possible to determine the user’s immediate environment, such as whether they were in a small or large room, underground, overground, or even on a flight.

The study, titled “AndroCon - An Android Phone-based Sensor for Ambient, Human Activity and Layout Sensing using Fine Grained GPS Information”, has been published in ACM Transactions on Sensor Networks, a widely-read journal in the field of privacy-aware sensing.

The researchers proposed that AndroCon, the first system to demonstrate that the fine-grained GPS data already accessible to Android apps with precise location permissions, could act as a covert sensor. Without using the camera, microphone, or motion sensors, AndroCon interprets nine low level GPS parameters, such as the Doppler shift, signal power and multi-path interference, to infer whether someone is sitting, standing, lying down, inside a metro, on a flight, in a park or in a crowded outdoor space. It can also detect if a room is crowded or empty.

To convert this raw GPS data into meaningful insights, the researchers combined classical signal processing with modern machine learning. “Across a year-long study spanning 40,000 sq km and a lot of different phones, AndroCon achieved up to 99 per cent accuracy in detecting surroundings and over 87 per cent accuracy in recognising human activities, even subtle ones like hand-waving near the phone,” Prof Sarangi said. While this opens up new possibilities for context-aware services, the study warns that any Android app could in this way potentially infer sensitive information.