Mapping your life: Embedded data in photos could tip off criminals
February 3, 2011
BAMBERG, Germany -- When a Schweinfurt field artillery officer deployed to Iraq a year ago, he uploaded some photos and videos to several different social media sites.
In one instance, the videos and photos showed the officer preparing for a mission where his unit was transporting thousands of Iraqi dinar, which is the country's currency.
For many people, posting a photo of one's daily activities may seem like a pretty common thing to do in the world of Facebook, Flickr and with the use of smart phones.
However, not everyone sees it that way, said Tonya Heinbaugh, U.S. Army Garrison Bamberg security officer.
Geotagging is the process of adding geographical identification to photographs, video, websites and instant messages, said Staff Sgt. Dale Sweetnam, noncommissioned officer in charge of the U.S. Army's Online and Social Media Division, in a recent interview.
"It is the equivalent of adding a 10-digit grid coordinate to everything you post on the Internet," said Sweetnam, who wrote the report "Geotags and Location-based Social Networking."
Little did the Schweinfurt officer know that posting the photos could have given the exact grid coordinates of his mission, easily identifying to terrorists where his Soldiers and a large amount of money were located, Heinbaugh said.
"If we know this information, then our enemies know this information," she said.
The information such as the exact latitude and longitude of where the photo was taken are embedded in different types of media as part of the meta-data that accompanies each file. This information can't be seen by the casual observer.
However, this information can be seen with browser plug-ins or software programs to anyone who searches for it, Sweetnam said in his report.
Most digital cameras don't automatically geotag photos, but smart phones, cell phones that have a Global Positioning System, will automatically geotag photos or videos. The only way to not broadcast this information is to manually change the settings.
In addition to geotagging, photos and videos can also be tagged with a location manually in several social media sites such as Facebook, Twitter and Flickr. This can pinpoint a photo's exact location even if it wasn't taken with a smart phone. A recent quick search of "Afghanistan" on Flickr turned up thousands of photos taken by Soldiers.
"Geotagging has been around for a while, so have smart phones and location-based social networking platforms. So the threat has always been there," Sweetnam said. "The Army's Online and Social Media Division started becoming more proactive with its education campaign once the use of smart phones became so prolific."
This information could potentially be damaging to a mission if it got into the wrong hands, said Heinbaugh.
"You think you are anonymous when you post," she said. "When you geotag, you are letting everyone know exactly where you are."
Soldiers who tag their uploaded photos with a location are giving away vital information and they are putting their comrades at risk, Sweetnam said.
"They wouldn't post a sign with sensitive information on their front lawn, so they need to look at the Internet in the same way," he explained.
In addition, there are serious implications for not just Soldiers, but family members as well, Heinbaugh said.
If you snap a photo of an expensive item in your home with your smart phone in hopes of selling that item on a site such as Ebay or Craigslist, you are broadcasting the exact location of your home and that item to within one meter for any criminal to see.
Another potentially harmful thing to do is to "check in" on location-based social networking applications. This is where an application allows you to "check in" at various businesses and locations, allowing friends and followers to chart where you are throughout the day.
Facebook's "Places," SCVNGR, Gowalla or Foursquare are some common social media sites to do this. Foursquare alone has more than four million users, the Army report states.
This could potentially be dangerous because it establishes patterns and could identify where someone lives or works, Sweetnam said.
"Social networking applications can allow strangers to track your movements every day," he said. "If you watch someone long enough, they will know exactly when and where to find that person on any given day."
IMPLICATIONS OF GEOTAGGING
There are national security, operational security and even personal safety concerns with geotagging, Heinbaugh said.
If Soldiers are posting photos of their location or their environment, even if it looks innocent, enemies can find the exact location of those pictures and piece that information together with information they already have, she said.
"If that gets out, you could compromise your mission. Lives could be lost," Hainbaugh said.
"Something as simple as loading a photo of a bunk in Afghanistan, then geotagging it, can bring a mortar into your area of operation," the Army report stated.
The Federal Bureau of Investigation's Internet Crime Complaint Center, or IC3, has seen a spike in social media complaints during the last 10 years, said Bill Hinerman, IC3 unit chief.
When a person posts information such as a physical location that information can be hacked and lead to identity thefts or financial gains by a criminal, he said.
"When a user puts this type of information on a social media site, especially if the user is not careful with his or her security habits, it can have the same effect as posting it on an unsecured page of a public website, or in public media such as a telephone directory," Hinerman said. "It other words, they could be publicizing it without anticipating the negative consequences."
So what can you do to protect yourself'
The first step in protecting yourself begins with educating yourself about geotagging, Heinbaugh said. Know which social networking websites use geotag features and those that let you opt out of posting that information.
"Knowledge is power," she said. "Knowing risk, you might think twice about posting something."
Once you understand what you're posting, you need to learn how to stop that information from being embedded in the media file, Sweetnam said.
Soldiers, especially those conducting classified missions, should not use location-based social networking services, he said.
"These services will bring the enemy right to the Army's doorstep," Sweetnam said.
One of the simplest ways to avoid displaying too much information is to disable the geotagging function on smart phones.
Disabling the geotag function can be a complicated process at times, said Heinbaugh.
"You have to physically disable the function," she said. "It's easy to geotag, but not so easy to remove the geotag feature."
If you can't figure out how to disable the function, contact your smart phone provider, she said. The website www.icanstalku.com also has instructions for removing the geotag function on several different smart phones models.
For more on the potential dangers of geotagging and location-based social networking, as well as information on a variety of force protection, information assurance and operational security topics, visit the U.S. Army Europe "vigilance" web page at www.hqusareur.army.mil/vigilance.
More information is available about social media at http://www.slideshare.net/usarmysocialmedia. For more case studies and step-by-step ways to disable geotagging functions from many popular devices, go to www.icanstalku.com.