A Picture is Worth a Thousand Words, Including Your Location

At first blush, it seems obvious that a picture could reveal your location. A picture of you standing in front of the Golden Gate Bridge sensibly leads to the conclusion you’re in the San Francisco Bay Area when the photo was taken. But now that smartphones are quickly supplanting traditional digital cameras[1], and even traditional cameras now have wifi[2] built in, many more pictures are finding their way onto the web, in places like Twitter, Flickr, Google+ and Tumblr. In a span of 10 days, popular photo social network Instagram added 10 million new users[3] as a result of the release of its Android app and its acquisition by Facebook. And the location data hidden in these quick and candid pictures — even when your location isn’t as obvious as “standing in front of the Golden Gate Bridge” — is becoming another easy way for anyone, including law enforcement, to figure out where you are.

Take the case of “w0rmer,” a member of an Anonymous offshoot called “CabinCr3w,” for example. According to the federal government[4] (PDF), “w0rmer” broke into a number of different[5] law enforcement[6] databases[7] and obtained a wealth of sensitive information. In a Twitter post, “w0rmer” provided a link to a website that contained the sensitive information as well as a picture[8] of a woman[9] (NSFW) posing with a sign taunting the authorities. Because the picture was taken with an iPhone 4, which contains a GPS device built in, the GPS coordinates of where the picture was taken was embedded into the picture’s EXIF[10] metadata. The FBI was able to use the EXIF data to determine that the picture was taken at a house in Wantirna South, Australia. 

The FBI tracked down other online references to “w0rmer,” with one website containing the name Higinio Ochoa. The feds took a look at Ochoa’s Facebook account, which detailed that his girlfriend was Australian. Combined with the EXIF metadata, the government believed they had corroborated the identity of “w0rmer” as Ochoa, and in turn arrested him. 

1 2 3 4