cross-posted from: https://infosec.pub/post/50218987
Karcher DAB radios are broadcasting an SSID for open Wi-Fi access. It doubles as an Internet radio, but AFAICT from the manual it’s only expected to act as a client.
So WTF is going on?
It seems like a really bad idea for consumers to connect this radio to their LANs to use to play Internet radio and podcasts when there is an always available Wi-Fi AP that enables anyone in proxity to connect to the radio. What’s the point? There is no way to disable the SSID broadcasting and it remains on even when the radio is “off” (but plugged in).
The manual shows that there is a remote control. Is the remote using wi-fi? I don’t have the remote so I have no way of verifying. In any case, this design seems like a recipe for disaster. Karcher should perhaps just stick to making pressure washers.
Google and Apple use Wi-Fi SSIDs for navigation. I boycott both companies. As such, I prefer not to have any wi-fi APs. And when I decide to run an AP, I ensure the SSID ends in
_optout_nomapto opt-out of giving uncompensated help to the nav systems of Apple and Google.Does this violate the GDPR? I cannot change the SSID, so it’s like I am being forced to share with the general public the fact that there is a Karcher radio in my home. That does not respect data minimisation.
Others? You mean the person who thinks data is only collected by product registrations? Who thinks “smart” devices have no GDPR relevance? And who thinks MAC addresses are not unique and who also thinks a MAC address on a DAB radio can be changed by consumers apparently without breaking an anti-reverse engineering terms of use? Who also thinks Karcher would become GDPR compliant through a MAC changing mechanism if it were to exist. Who then tried to establish credibility by claiming to endorse the GDPR. Indeed… not a good source.
You cannot really know what Google and Apple do with their data collection as opaque as they are. But the data is there. They have enough to link people to MAC addresses on a large scale in an automated fashion. The data collection is proven by Douglas Leith’s research.
At the same time, we need not rely on assumptions. I could unwittingly place my Karcher within view of my front window while my neighbors who know exactly who I am. I might also be the sole person in hundreds of meters who has a Karcher that emits a unique MAC address. Any arbitrary owner of a Karcher radio would not necessarily even be aware of the reckless emissions. My neighbor would realistically have a great degree of certainty that the MAC address relates to me as they can see the signal strength increase ast they approach my dwelling and decrease as they walk away from it.
To make this more interesting, replace “neighbor” with “stalker” in the above paragraph. Then when I move to get away from the stalker, the DBs of Apple or Google could reveal¹ my new location. Or the stalker can war drive if they know I didn’t move far.
¹ Note that research showed that Ukranian troops were trackable using Apple’s map tool that all ordinary Apple consumers have access to.
It’s all a bit thin mate.
You’re likening the ability of apple/Google to see devices moving around in Ukraine to someone figuring out who you are because you have a DAB radio transmitting an SSID and a MAC address - that only people within a hundred or so metres can see.
Again, I bring you back to the test laid out by the EDPB. For indirect identifiers like this to be considered personal data you have to consider the technical ability and the liklihood of someone converting that indirect identifier into something that actually identifies you as a natural person.
As a thought experiment I’ll concede that you might have a point. But in the real world, I don’t believe you do. You mention a stalker - a stalker isn’t going to find you by driving around using a WiFi scanner looking for a DAB radio. It just isn’t a realistic scenario which is something a data protection authority would need to consider as well.
Of course. Apple does not distinguish a DAB radio from a smartphone from an access point. It just blindly collects all SSIDs and MACs. Why do you think a soldier in Ukraine would get not only different treatment, but in fact more compromising treatment? That’s absurdly unrealistic. It costs Apple money to pay engineers to write tailored code and filters that then get deployed to all iOS devices at the risk of the exceptional logic doing the wrong thing. Of course iOS devices indiscriminantly send all data just the same.
The Ukraine soldier tracking was a scandalous embarrassment, so it stands to reason that adjustments have been made since then – and most likely by Ukraine not Apple. But if it were Apple, the change would obviously be to /not/ collect the compromising data of soldiers. A war fighter has a higher expectation for privacy than a DAB radio listener.
It’s not Apple who tracked the Ukrainian soldiers. The exploit was demonstrated by an end user who was simply making use of available data from Apple. IOW, some avg. Joe tinkering in their basement could do it. And they could do it with LESS information to start with. The person who demonstrated the tracking was much further than 100 meters. They were not even in Ukraine IIRC. They did not know where the soldiers were to begin with (IIRC). Unlike a Karcher scenario, where an adversary could very well have the victim’s starting location. It’s trivial track the victim from there in this case.
Do stalker victims have to prove the likelihood that their threat agent will attack? It’s already clear to me that the GDPR is mostly a failure. If judges and GDPR practitioners were to require proof that excessive data would likely lead to misuse as a precondition to corrective action against art.5-1© infringements, it would be yet another failure of the GDPR. The whole point to Art.5-1© (data minimisation) is to improve privacy generally without anticipation of particular threats. That’s the whole point of it. What you suggest is a purpose-defeating abuse of interpretation and discretion.
If I ever have a stalker, I hope they are as unmotivated and undevoted as you suggest. But I have to say you have a strangely optimistic or flippant view of the psychology of a stalker.