Wireless running sensor triggers privacy concerns

location based services


A running shoe sensor that transmits details of a user's performance to an iPod could also be used to covertly track their movements, researchers claim.
Computer scientists at the University of Washington, US, fashioned a cheap device capable of identifying someone using the Nike+iPod running kit from a distance of about 20 metres.
"It is easy for someone to use the Nike+iPod as a tracking device," says Scott Saponas, who carried out the research with colleagues Jonathan Lester, Carl Hartung, and Yoshi Kohno. "It's an example of how new gadgetry can erode our personal privacy."
The researchers hooked their tracking device up to software that automatically plots a runner's position on an online map, and sends an alert by email or text message to an operator, when the target comes within range. They fear that such equipment could be used by criminals to covertly follow a person's movements.
The Nike+iPod kit was launched in August 2006 and more than 450,000 have been sold so far, according to industry publication AppleInsider.
The kit consists of a small sensor that attaches to a runner's shoe and wirelessly transmits information about their performance to a receiver that connects to an iPod Nano carried by the runner.
Reverse engineering
When the iPod is synchronised with a computer, the stored data shows how far the user has run, how fast they ran and an estimation of the calories burned.
Saponas and colleagues found that the transmitter's radio signal can easily be picked up from a distance of about 20 metres. They used one kit to "reverse engineer" the radio protocol used and developed software to interpret the data received.
The researchers also developed matchbox-size mobile detectors, capable of tracking multiple sensors and relaying this tracking information to a central computer via WiFi. In tests, they used an array of these detectors, placed strategically around a city, monitor and log the movements of people using the Nike+iPod kit.
Each tracking system cost less than $300 (£154) to build. A technical paper authored by Saponas and colleagues is available online, and a University of Washington video shows the devices being used by the team.
The radio transmitter can be switched off, but it is activated by default and Nike's manual encourages users to add the sensor to their shoe and forget about it.
Cryptographic transmission
The researchers suggest that users of Nike+iPod should switch off the sensor unit when not using it, and suggest that cryptography could be used to secure transmissions from the sensor.
A spokesperson for Nike acknowledged the company was aware of the study but did not wish to comment. An Apple Europe spokesperson said they were not aware of the study.
"As more devices start to communicate wirelessly, there will be a growing need for user education around the privacy issues that may arise through their usage," says Ollie Whitehouse, a researcher at IT security firm Symantec, based in London, UK. "In the meantime, we would recommend common sense techniques, such as ensuring you turn the device off after use, to minimise your risk."
Whitehouse says, "it should be noted that we're already surrounded by, and happily live among, several similar technologies, including Bluetooth."