Roam, Sweet Roam

The convenience and versatility of the cellular phone has made it one of the most rapidly and widely adopted technologies in history. According to wireless industry analyst EMC, the world's one billionth cellular subscriber signed up for service in the first week of April 2002. The growth from 500 million subscribers to one billion was particularly impressive: It took just twenty-five months, with subscribers joining at the average rate of 450 people per minute. EMC predicts that the number of cellular subscribers will double to 2 billion by 2005.

The appeal of cellular phones is easy to appreciate: You want to meet your friends for a movie, but they're not home. You call their cellular number and discover that they're just two blocks away—you can even meet for a beer before the movie starts. Or perhaps your car breaks down on the highway. There's no need to hunt for a working public phone—just call AAA from your cell. The possibilities are endless. Around the world, people are using their cellular phones to find each other in crowded places, play games, pay for sodas, watch videos, check sports scores, and so on.

Cell Phones and Who You Call

In one sense, the information that a cellular phone can provide about you is the same as that provided by any other type of phone—a monthly bill that contains a list of telephone numbers you've called. But because cellular phone users in the United States pay for cellular air time regardless of whether they place the call or receive it, cellular phone bills also record the phone numbers of the telephone calls (cellular or otherwise) that were made to you.

As with credit cards, if you pay your own cellular phone charges, your employer will have access to that information only if you submit a request for reimbursement. But large numbers of businesses provide cell phones for their employees, which means that a copy of the bill (or the bill itself) for those phones is available to the employer, who then has the opportunity to review it.

In the not-too-distant future, your cellular phone bill may not only list the people with whom you spoke, but also pinpoint your specific location at various times. In Europe, for instance, cell phones are routinely used to make small purchases at vending machines, restaurant jukeboxes, and even car washes. In order for a vending machine to accept payments from a phone, the machine is assigned its own unique phone number; to obtain a soda, for instance, you dial the number of the vending machine, and a voice menu instructs you to press "one" for Coke, "two" for root beer, "three" for orange soda, etc. The cost of the soda is automatically added to your phone bill. That small transaction, while undoubtedly more convenient in many ways than trying to find correct change, is a potential treasure trove of information about your purchasing habits and your movements. As the pool of data steadily grows, the phone company's interest in offering that data to marketers will also grow. Moreover, if you use a company cell phone to make vending machine purchases, your employer knows what you've been buying, and with relatively little effort, can determine where you were when you made each purchase.

So far, the use of cell phones as payment devices (a trend known generally as "m-commerce") has not made much headway in the United States, but three of the largest cellular companies—Ericsson, Motorola, and Nokia—have been working on an open, standardized system for secure mobile electronic transactions. In addition to payments at vending machines, the companies also envision using cellular phones at cash registers, toll booths, or parking meters.

In addition, communication giant Sprint has announced a collaboration with eOne Global LP, an affiliate of First Data Corp., to create a national mobile payment system. Sprint hopes that cell phone users can be persuaded to store credit card and other banking information in their phone. When they're ready to make a purchase, they can transmit the data to the store's cash register, which can then transmit the information to the credit card computer for authorization. Presumably, users will also have the option to charge smaller purchases directly to their phone bill.

If successful, m-commerce initiatives will have the effect of turning each cellular phone into an ETC (electronic toll collection) device or credit card. How much purchasing behavior and location data is collected from each phone, of course, will depend on the extent to which you trade the convenience of cellular payment for the loss of privacy.

The monthly phone bill is only one potential source of information about how you are using your company cell phone. Most cell phones on the market today are equipped with the ability to store dozens or even hundreds of names and phone numbers. In situations where employers are concerned that an employee is stealing information or trade secrets, a cell phone can be a valuable source of information regarding the employee's contacts. The same is true for corporate litigation: Attorneys and private detectives now include cell phones and personal data assistants (PDAs) like Palm Pilots in their search for potential evidence.

The value of cell phones as potential sources of evidence will only increase as they are configured to work with or merged with personal data assistants. Devices like the Handspring Treo, the T-Mobile Pocket PC Phone, and the Kyocera Palm OS Smartphone combine the features of a phone with PDA operating systems like Palm OS or Windows CE. Again, the combination is undoubtedly convenient: You can look up a phone number in the PDA address book, tap a button, and have the device automatically dial the number. But if your employer has adopted a policy stating that it will periodically search any such employer-provided devices, the convenience of using the device must be balanced by the realization that any information you enter can be viewed by your employer.

Cell Phones and Where You Are

The chief benefit of the cellular phone—its portability—relies on a worldwide system of transmission towers, each located in a separate coverage "cell" (hence the name "cellular"). When you dial a call on a cellular phone, the call is broadcast from the phone to the nearest transmission towers. The call is then rebroadcast through the other towers in the network until it reaches the receiving phone, either by being rebroadcast to another cellular phone or by being connected to a landline.

Geography has always been a critical component of the cellular phone system, for reasons of both billing and call completion. In the United States, the cellular phone system began as a series of regional systems and initially, callers were only able to make cellular calls in the region in which they obtained their phone. But consumers quickly demonstrated an interest in being able to use their phones while traveling outside of their home region. To accommodate them, the cellular phone companies worked out agreements that allow cellular phone users to make calls anywhere near a transmission tower, regardless of which cellular company built it. In the process, the phone companies came up with the concept of "roaming," a term used to describe a cellular phone traveling outside of its home subscription area. Calls made while roaming generally cost more than calls made in the home area, largely because each cellular network that carries the call needs to be compensated for doing so.

It is the technical requirements of actually completing cellular calls that raise the most profound privacy concerns. In order for a telephone call to reach your cellular phone, the cellular phone system has to know where your phone is at any given time. When your phone is turned on, it periodically emits a brief signal that is picked up by one or more cellular towers. The system then knows to which tower a call should be routed so that your phone can receive the transmission.

If the only value of the locating signal were to receive phone calls, there would be few privacy issues raised by cellular phone use. To complete a call, the only thing the network needs to know is the location of the tower closest to you. Although cellular coverage cells vary dramatically in size, even the smaller ones in urban areas are large enough that it would be difficult to locate a particular caller.

But sometimes the location of the call is critically important. For instance, when 911 calls are made from land lines, the equipment used by emergency services is configured to provide the address from which the call was made. That's obviously not possible with cellular phones, and it has become a real problem for emergency personnel. In 2000, according to the National Emergency Number Association, fully one-third of all 911 calls were made from cellular phones. If the person making the call does not know where he is, it can be next to impossible for emergency personnel to find the caller in time to provide care.

Recognizing the problem, particularly as reports began surfacing of cellular callers who died because emergency personnel could not find them, Congress passed the Wireless Communications & Public Safety Act, which President Clinton signed into law on October 24, 1999. Pursuant to the provisions of that law, the Federal Communications Commission adopted a regulation requiring that either cell phones or cellular networks be equipped with technology that will enable the location of a cell phone to be detected within 300 feet. The initiative, known as E-911 (for "enhanced 911") was originally scheduled to be fully implemented by 2004, but due to complaints from cellular networks, various technological difficulties, and equipment delays, the deadline has been pushed to 2005.

Cellular networks and phone manufacturers are taking two different approaches to meeting the FCC's location requirement. One approach—triangulation—takes advantage of the fact that the locating signal emitted by each phone is usually picked up by more than one cellular tower. By measuring the strength of the locating signal from the phone, the phone's distance from each tower can be determined, and using those distances, its physical location can be determined.

Other companies plan to comply with the FCC requirement by using Global Positioning System technology (which is discussed in more detail later in this chapter). These companies are putting a GPS chip into their cellular handsets that will alert emergency personnel to the caller's location.

Not surprisingly, law enforcement is very interested in the growing capabilities of the cellular network to track the physical location of individual callers. In 1994, Congress passed the Communications Assistance for Law Enforcement Act (CALEA), which provides that the telecommunications industry must modify its equipment to enable the Federal Bureau of Investigations to continue its ability to monitor (i.e., wiretap) communications as new technologies are introduced. In August 1999, after a fruitless year of negotiations between the FBI and the telecommunications industry over how exactly to implement CALEA, the Federal Communications Commission stepped in and passed a number of regulations aimed at breaking the logjam. One new regulation requires that the telecommunications industry provide law enforcement with the "cell site at the beginning and termination of a mobile call," provided that an officer or FBI agent has obtained a warrant from a court before requesting the information. ^[9]

The fact that your cellular phone can show roughly where you are at any given time is disconcerting enough. More disturbing is the capability of such information to be tracked over a period of time, yielding a detailed history of your movements and habits. Law enforcement's interest in such information is unquestionably real: Five years ago, in Switzerland, the Sonn-tags Zeitung newspaper reported that authorities were able to recover the location of any mobile phone call made during the preceding six months. At roughly the same time, a London prosecutor cited the importance of cell phone records in tracking the movements of a drug dealer and convicting him. ^[10] Late last year, in Palo Alto, California, a man named Kenneth Fitzhugh was convicted of murdering his wife Kristine after a Verizon wireless engineer testified that signals received by the Verizon system from Fitzhugh's cell phone showed that it would have been impossible for him to have been far from the murder scene—his home—at the time of the murder.

For the time being, at least, the tracking capabilities of the cellular phone system apply to the phones themselves and not people (much like the infrared badge technology discussed earlier). But in large part because of the information that they can contain, PDAs and PDA-equipped cell phones are becoming an increasingly popular target for thieves. One recent survey concluded that at least one out of ten lost or stolen PDAs can give access to the owner's bank account. PDAs also offer fruitful possibilities for people engaged in corporate espionage or industrial spying. In order to protect such information and minimize the chances of misuse, various companies are working to incorporate biometric technology into cell phones and other portable devices.

A British company, Domain Dynamics, announced in 1999 that it had developed voice-recognition technology that could be incorporated into cell phones in order to prevent unauthorized calls. The more common approach, however, is the one being pursued by Veridicom, one of a handful of companies that is developing a fingerprint identification chip that can be incorporated into cell phones, PDAs, laptops, and other equipment. Veridicom, based in Santa Clara, California, is a joint venture between U.S. Venture Partners and Lucent Technologies, which developed the sensor on which the chip is based. The company's solid-state silicon sensors currently retail for fifty dollars each, and prices are expected to continue to fall; most analysts envision widespread implementation of fingerprint biometrics in mobile devices when per-unit prices drop into the ten to fifteen dollar range.

Obviously, one consequence of the incorporation of biometric security into wireless devices is that it will irrefutably tie you to the device. If your fingerprint or voice print is required to make a phone call on a cellular phone, then it will be extremely difficult to deny that you made the call, or that you were not in a particular location at a certain time.

The law enforcement uses of cellular phone tracking will garner the most attention and are most likely to wind up as a plot device on CSI or Law and Order. However, it's the commercial potential of such tracking information that poses the greatest threat to personal and workplace privacy. While the legislation signed by President Clinton in 1999 contained a provision that prohibited cellular phone tracking information from being released without the customer's permission, such permission has generally been easy to obtain from consumers directly (largely by offering discounts or some type of service in exchange) or through their employers, who can make such permission a condition of receiving a company cell phone.

^[9]"FCC Adopts CALEA Technical Standards," Federal Communications Commission press release (August 27, 1999). Available online at www.askcalea.net/pdf/fccrelease3.pdf. The Amercian Civil Liberties Union, the Electronic Frontier Foundation, and an assortment of other Internet privacy groups have sued the FCC over its regulations.

^[10]Peter Wayner, "Technology that tracks cell phones draws fire," The New York Times (February 23, 1998).