Question

Since this is a website that is mainly used by people under 20, why is the GPS data left in images they post? I can find out where many people took photos with their iphones on here.

Answer 1

It is assumed that people know what they are posting. That is covered in the rules of the site. If they want to turn it off, they can.

http://icanstalku.com/how.php

Answer 2

@e.mccormick This site is populated by teenagers. As far as I can tell, most are in the 13 to 18 range. Do you think that they read the website rules? No. In fact, it has been suggested that reading even one program's EULA would eat up the time equivalent to 7,000 years, in just one day, if all the users read the EULA. No on reads these things.

It is easy to say "it is in the rules" and dump the problem on teenagers that most likely never read the rules of the site. The reality is that it would take minimal effort to fix this issue on OS's end. Many websites, such as Facebook and Twitter, already do so. If the time to write the code to automatically do this is too much, a warning should be added to the process of attaching the file.

I see no reason for this to not be addressed. This site is built for kids—specifically targeted at young adults, in school. Children deserve more protection than "covered in the rules of the site."

FYI, I older than 25 if anyone wants to know. I am on here not for help, but to help. I am a PhD candidate, in my last year, in Biology. I found this site one night and read a post that grossly misinterpreted the theory of Evolution and decided to join and help out.

MrDoldum

Answer 3

Oh, link to the EULA thing:

http://www.theregister.co.uk/2012/12/04/feature_tech_licences_are_daft/

Answer 4

Well i think @mrdoldum has a good point. He is correct on moral grounds !

Answer 5

The problem is in how the geotags are added, rather than them not being removed. It is assumed that the user knows they are geotagging and wants to. Also, there are not supposed to be lots of personal pictures on the site. Many of the pictures I do see on the site are links and those ones are not even something OpenStudy could deal with.

What the terms cover is that there is no responsibility for OpenStudy to mandatory edit things that are uploaded. They can do so. They can also choose not to.

Answer 6

i. Users are ushered to read the Code of Conduct and Terms of Service upon registering their profile.

ii. By agreeing to the aforementioned, any and all user profiles are assumed to have read these two documents.

iii. By not reading these documents and lying upon the agreement, you are in violation of the Terms of Service.

OpenStudy has no legal or moral obligation, whatever that superposes, to enforce these safety mechanisms. While the implications wouldn't hurt, they're necessity is void.

Answer 7

@e.mccormick I am not 100%, but my understanding is that Apple and many other companies do not make it clear that geotagging is turned on by default.

@compassionate Under the Computer Fraud and Abuse Act, violating the terms of service (ToS) of a website can easily be a federal felony in USA. Any user or company that houses a server, is headquartered in USA, or accesses servers in USA are subject to this law. The issue is that technically the ToS is a contract and violating that contract is illegal. Now, minors cannot legally enter into a contract.

Read this and notice it is from the FTC, an official body of the USA government:

http://www.business.ftc.gov/documents/0493-Complying-with-COPPA-Frequently-Asked-Questions#Geolocation%20Data


@Compassionate Now, again specifically you call into the question whether or not OS has any legal obligation. I refer to this portion of the ToS:

----
upload, post, transmit, share, store or otherwise make available any content that we deem to be harmful, threatening, unlawful, defamatory, infringing, abusive, inflammatory, harassing, vulgar, obscene, fraudulent, invasive of privacy or publicity rights, hateful, or racially, ethnically or otherwise objectionable;

AND

upload, post, transmit, share, store or otherwise make publicly available on the Site any private information of any third party, including, addresses, phone numbers, email addresses, Social Security numbers and credit card numbers;

----
Now, in several cases of the COPPA (which likely does not apply here as it deals with minors younger than 13) we can see that in at least some instances the government does not distguinsh between true address and information suffecient to find an address <source: http://www.business.ftc.gov/documents/0493-Complying-with-COPPA-Frequently-Asked-Questions#Geolocation%20Data >:

----
4. The geolocation information I collect through my app provides coordinate numbers. It does not specifically identify a street name and name of city or town. Do I have to notify parents and get their consent in this instance?

COPPA covers the collection of geolocation information “sufficient” to identify street name and name of city or town. It does not require the actual address identification of such information at the time of collection. One example where COPPA would be triggered is where an app takes the user’s longitude and latitude coordinates and translates them to a precise location on a map.

----

I would point out that the COPPA may apply if a website is determined to be directed at children, even if the website claims not to be. I do not think this is the case for OS, but it is possible.

Now, when all that is combined and we recognize the ToS of a legal contract, then users that post photos with GPS are in violation of the ToS and therefore, the law. So, whether OS likes it or not, it is already involved in legal responsibilities due to their own ToS.

I am not saying OS is legally responsible to do something about it, but technically anyone that posts photos with GPS that can result in an address is in violation of the ToS. I think it is likely, given the legal wording in COPPA, that when the ToS use "address" the law would not differentiate that from "GPS sufficient" to identify the address of the poster.

Besides, does OS really want to state that it does not care to protect the minors that use this site from posting information that can lead to real harm? Here is a story of extreme harm:

http://defensetech.org/2012/03/15/insurgents-used-cell-phone-geotags-to-destroy-ah-64s-in-iraq/

US soldiers posted photos that they did not know had GPS in the metadata. Iraqi insurgents used this info to destroy a few helicopters. Thankfully, I do not think anyone died.

Answer 8

@superhelp101 Post mentioned.

Answer 9

Yes, just recently I was on a biology question and for that question we had to answer using a punnet square. So show the user I took a picture of the punnet square I drew and sent it on the question. I was not aware that my GPS was on, on my phone ( I used my phone to take the picture). @mrdoldum was on the question and found out all of my information like my address, and the type of phone that I was using! Therefore, I decided to delete the picture of my work. This was definitely frightening, and I will be more careful next time for sure! I am so grateful that mrdoldum let me know!!!

Answer 10

we have a legal scholar here

Answer 11

@c0decracker @Preetha

Answer 12

Oh, and Mrdoldum, I forgot to mention. Yes, based on GPS. You not only could find out the location but exactly what degree I took the photo in. And the location in your house that the photo was taken in like in front, in the middle or in the back.

Answer 13

mrdoldum As you have pointed out, large chunks of COPPA do not apply to OpenStudy because users are not allowed to be below 13. And when account holders below 13 are found, their accounts are suspended. This also shows a large flaw in your argument.

You are using a COPPA definition, which does not apply, to prove a CFAA violation. That makes for an invalid argument.

You say that when people upload a geotagged picture that they are violating the site ToS. Then you quote a section of the ToS where it clearly says "content that we deem" at the start. So if OpenStudy has not deemed it one of those things, then that section does not apply. Then you quote the section about giving away information on third parties... but there is another catch there: the word "private." If a person has posted a picture with geodata, it is not private. If a person posts their own picture, it is not third party. In either case, it is not actually a violation.

Now, if posting your stuff is not a violation, why do we suspend people for posting their cell numbers? Simple. When you ask someone to text you, you are soliciting their information. Information collection on others is covered.

Where does all this put the site in relationship to laws? Is OpenStudy concerned about COPPA covered minors? Absolutely. That is why they don't want them on the site at all. Is OpenStudy concerned about the other COPPA like laws and other laws that protect minors that are 13 and above? Yes. That is why people are suspended for asking about nude pictures (child pornography laws,) posting nudes of any type (contributing to the delinquency of a minor laws,) requesting any personal information (there is an assortment of laws on this one,) and so on.

None of those actually cover someone 13 and above volunteering their own information without any prompting. As long as information posted can not be used as a method for soliciting the information of others, it is not a ToS violation either.

Answer 14

@e.mccormick I also pointed out that the ToS are a contract and bound by contract law. I can identify addresses of people based on GPS so that seems to violate the ToS.

I also said that though I am not sure, the COPPA can apply if the government determines that your site is likely to attract those younger than 13—even if the website says it does not target those under 13. Given that this is a site for study, it might be used by those under 13 as they are in school as well. It does not matter that you say 13 year old are not allowed if the government determines that the website would attract those younger than 13. However that may mitigate some legal responsibilities.

You are wrong about ToS violation. The user that post GPS that allows for an address let's me know the address of third parties (parents/siblings, etc).

I intend to bring this up beyond this posting because the reality is it does not matter what the two of you think unless you represent OS. I will be emailing the appropriate person. I think that any website that deals with so many minors does have a moral obligation to protect those minors, just as a day care should protect minors from potentially dangerous behavior. EG, if I had a kid in a day care that day care better stop my kid from talking to strangers. Essentially, anyone that posts GPS coords could be telling me where the live.

I still say OS would essentially be taking the stance that it does not care to protect the minors on its site if no changes are made. Something that I think could have a very negative effect on the operation and usage of OS.

Answer 15

Hi Mrdoldum, look forward to hearing from you!

Answer 16

Actually, the moderators have suspended a number of accounts based on the grade level of the material asked about. Compliance with 13+ is actually pretty high. The ones that lie about their age and never get caught, well, I am not foolish enough to say they do not exist. However, are they posting pictures with GPS data? Where are all the 12 and under people posting pictures that you keep talking about?

Answer 17

The two of us are representatives of OpenStudy, and we are only giving our opinions. You should email contact@openstudy.com or talk to Dr. Preetha Ram (Preetha) if you wish to address your concerns more appropriately.

Answer 18

@Preetha Sorry for the incredible delay. I had a mad rush to finish my portion of a research article for submission and I had field work to do.

I do not want to post specific information on here, even anonymized information; especially not without talking to the user and asking them to address the issue with the appropriate adults. However, if the address is correct (it likely is given exact location of GPS coords), then I can find land ownership of that house/land, all public records (may include water or sewer with full name of accounts), school district, number of individuals in house, average age of household members, when it was last sold, estimate mortgage, year house was built, # of bathrooms and bedrooms, etc

In fact, I have found more—much, much more. This took minimal effort. Literally, less then 5 minutes. I would like to be more specific, but I will hold off until stripping anything that could be useful to identify any person and to notify the user of what I was able to find via a simple search of an address.

mrdoldum

Answer 19

Lol, I remember when I had scrolled so far down that I found this post. Apparently it got bumped.

So.... Did the issue ever get resolved? Or can you still find out where people live?

Answer 20

Apparently I think that they should turn that GPS thing off.

Answer 21

@TheSmartOne To my knowledge, no. Nor did @Preetha ever respond to my messages despite saying she was looking "forward to hearing from you[me]". I will be asking about this and keeping it in the view of members, and, as I told Preetha I would, I will try to bring this to the notice of technology news sources.

It is a big issue, so I am concerned that no one in power appears to care. I am not kidding about what I found. With a single picture I was able to find the posters house, her father's name, the number of people in the house, the value of the house, the tax payment records for the house from when they bought it until the present. There is more. If I was willing to spend a bit of money I could probably find everything about them, criminal records, phone numbers, estimated income etc.

To anyone concerned I have already discussed all of this with the person who posted the picture and have been very open with her and offered to prove my identity to her and her parents.