Possible Bug?
“What happens on your iPhone stays on your iPhone” Apple advertised early this year. Security journalist Brian Krebs however, first discovered and reported a possible location tracking bug to Apple mid-November. Krebs noticed that his new iPhone continued to try and use location tracking while all Location Services toggles were switched off. Apple’s initial response was that this is “expected behavior” of the new iPhone and “there are no actual security implications”.
This is the Problem
Probed further by Brian Krebs and security whizzes, Apple later followed up with more details about what causes the problem. Newer iPhones come with ultra-wideband technology, that gives the device spatial awareness to detect other ultra-wideband devices. This technology is used, for example, to wirelessly share files via AirDrop. Apple explained that at present, the industry standard technology is “subject to international regulatory requirements”. Therefore iOS uses Location Services to help determine if the iPhone is in a location where ultra-wideband is allowed, through nearby Wi-Fi hotspots, satellites and masts.
Location Check Only on the Device Itself
The management of ultra-wideband compliance and its use of location data is done entirely on the device. Meaning Apple is not collecting or storing any of this information. In a tweet, iOs security expert Will Strafach confirms that there is no evidence of any data being sent to a remote server. So in reality, neither security nor your privacy is at stake here. It would have helped however, if Apple dealt with this issue more pro-actively and did not take weeks to respond to expert’s most pertinent questions.
What to Do
One way to disable this particular form of location requests, is to completely disable location tracking, via settings-privacy-location services. This should stop your phone from collecting any location data whatsoever. If you only want to block specific apps, you will unfortunately have to wait until a future iOS update. Apple said it will provide a new dedicated toggle option for the feature. This does raise questions about how that would be compliant with the international regulatory requirements Apple previously referred to, as several experts already pointed out.
