A Picture is Worth a Thousand Words, Including Your Location | Electronic Frontier Foundation
Description: At first blush, it seems obvious that a picture could reveal your location. A picture of you standing in front of the Golden Gate Bridge sensibly leads to the conclusion you're in the San Francisco Bay Area when the photo was taken. But now that smartphones are quickly supplanting traditional...
Date: 2012-04-20T09:06:48-07:00

Skip to main content
Electronic Frontier Foundation
Donate
Electronic Frontier Foundation
Share on Twitter Share on Facebook Share on Google+ Copy link

# A Picture is Worth a Thousand Words, Including Your Location

DEEPLINKS BLOG
Legal Analysis by Hanni Fakhoury
April 20, 2012
Share on Twitter Share on Facebook Share on Google+ Copy link

At first blush, it seems obvious that a picture could reveal your location. A picture of you standing in front of the Golden Gate Bridge sensibly leads to the conclusion you're in the San Francisco Bay Area when the photo was taken. But now that smartphones are quickly supplanting traditional digital cameras, and even traditional cameras now have wifi built in, many more pictures are finding their way onto the web, in places like Twitter, Flickr, Google+ and Tumblr. In a span of 10 days, popular photo social network Instagram added 10 million new users as a result of the release of its Android app and its acquisition by Facebook. And the location data hidden in these quick and candid pictures -- even when your location isn't as obvious as "standing in front of the Golden Gate Bridge" -- is becoming another easy way for anyone, including law enforcement, to figure out where you are.

Take the case of "w0rmer," a member of an Anonymous offshoot called "CabinCr3w," for example. According to the federal government (PDF), "w0rmer" broke into a number of different law enforcement databases and obtained a wealth of sensitive information. In a Twitter post, "w0rmer" provided a link to a website that contained the sensitive information as well as a picture of a woman (NSFW) posing with a sign taunting the authorities. Because the picture was taken with an iPhone 4, which contains a GPS device built in, the GPS coordinates of where the picture was taken was embedded into the picture's EXIF metadata. The FBI was able to use the EXIF data to determine that the picture was taken at a house in Wantirna South, Australia.

The FBI tracked down other online references to "w0rmer," with one website containing the name Higinio Ochoa. The feds took a look at Ochoa's Facebook account, which detailed that his girlfriend was Australian. Combined with the EXIF metadata, the government believed they had corroborated the identity of "w0rmer" as Ochoa, and in turn arrested him.

Even for photos not taken with a smartphone and not embedded with GPS coordinates (for example, point and shoot or SLR cameras that do not geotag), it's still possible for the police to get location information through EXIF metadata. You can upload a picture here and see the metadata stored in a picture for yourself. Contained within that metadata is the camera's serial number. Armed with that information, the police can easily scour the internet for other pictures tagged with the same serial number. In Australia, a man whose camera was stolen was able to track it down using stolencamerafinder.com because the thief had taken a picture with the camera and uploaded it to Flickr, where he had listed his address. But even if the thief's Flickr site didn't contain his address, police could have subpoenaed Flickr - like law enforcement have attempted to do with Twitter - for information concerning a user's temporarily assigned IP address, as well as session times and logs, to eventually determine where a person uploaded a picture from. All of which can be used to piece together a snapshot of not only your movements, but as in the case of "w0rmer," potentially your identity. In the United States, police are being trained about the broader investigative (PDF) potential of this information.

It might be tempting to say the problem is overblown, because some social media sites, including Facebook and Twitter, strip the metadata out of photos uploaded by their members. But not all do. Twitpic's default is to use a picture's location tag unless you opt out. Flickr gives you the option to hide a photo's EXIF data, but many casual photographers tempted by the rapid growth of photo sharing may not understand what EXIF data is, and the implication of making it publicly available.

The bigger problem is that courts have been expanding the police's right to search digital devices without a warrant under the "search incident to arrest" exception of the Fourth Amendment. While many of the cases involve warrantless searches of cell phones, there has been at least one case in California (PDF) where the police used the "search incident to arrest" exception to search a juvenile's digital camera. And there are other reported incidents of photojournalists having their cameras confiscated and searched when covering political protests and rallies. If the cops have the physical camera (and thus the memory cards that store the photos), whatever scrubbing that happens when a photo is uploaded to the web is no obstacle.

So if you value your privacy, you should take steps to ensure the EXIF metadata in your pictures isn't an easy way for anyone on the Internet to figure out your location. If you're using a smartphone to take pictures, disable geotagging from your pictures. If you're uploading your pictures to a website like Flickr or Twitpic that defaults to automatically include EXIF data and location information, take the steps to turn it off. And if you're using a traditional SLR or point and shoot camera that doesn't geotag, but does contain a breadth of EXIF data, the make sure you scrub its metadata before you upload it on the Internet. There are free online tools that will help you do precisely that. These simple steps will help ensure that the thousand words a picture describes doesn't include your location.

W0rmer complaint.pdf

## Related Issues

Privacy
Cell Tracking
Locational Privacy
Search Incident to Arrest
Social Networks
Share on Twitter Share on Facebook Share on Google+ Copy link

## Join EFF Lists

### Join Our Newsletter!

Email updates on news, actions, events in your area, and more.
Email Address
Postal Code (optional)
Thanks, you're awesome! Please check your email for a confirmation link.
Oops something is broken right now, please try again later.

## Related Updates

Deeplinks Blog by David Ruiz | October 23, 2017

### FBI Director Wray is Wrong About Section 702 Surveillance

Newly-minted FBI Director Christopher Wray threw out several justifications for the continued, warrantless government search of American communications. He’s wrong on all accounts. In a presentation hosted by The Heritage Foundation, Wray warned of a metaphorical policy “wall” that, more than 15 years ago, stood between the U.S. government’s...
Deeplinks Blog by Ernesto Falcon | October 23, 2017

### How Silicon Valley’s Dirty Tricks Helped Stall Broadband Privacy in California

Across the country, state lawmakers are fighting to restore the Internet privacy rights of their constituents that Congress and the President misguidedly repealed earlier this year. The facts and public opinion are on their side, but the recent battle to pass California’s broadband privacy bill, A.B. 375, suggests...
Deeplinks Blog by Amul Kalia | October 19, 2017

### Expanding E-Verify is a Privacy Disaster in the Making

E-Verify is a massive federal data system used to verify the eligibility of job applicants to work in the United States. The U.S. Department of Homeland Security (DHS), U.S. Citizenship and Immigration Services (USCIS), and the U.S. Social Security Administration (SSA) administer E-Verify. Until now, the federal government has not...
Deeplinks Blog by David Ruiz | October 17, 2017

### Whistleblower Protections in USA Liberty Act Not Enough

The USA Liberty Act fails to safeguard whistleblowers—both as federal employees and contractors—because of a total lack of protection from criminal prosecution. These shortcomings—which exist in other whistleblower protection laws—shine a light on much-needed Espionage Act reform, a law that has been used to stifle anti-war speech and punish...
Deeplinks Blog by Jason Kelley | October 16, 2017

### Q&A with Professor Xiaoxing Xi, Victim of Unjust Surveillance

Professor Xiaoxing Xi, a physics professor with Temple University, was the subject of government surveillance under a FISA order. During September's Color of Surveillance Hill briefing, Professor Xi told his story of the devastating impact of government surveillance on his life.
Deeplinks Blog by Amul Kalia | October 12, 2017

### Victory! California Just Reformed Its Gang Databases and Made Them More Accountable

Gov. Jerry Brown has signed A.B. 90, a bill that EFF advocated for to bring additional accountability and transparency to the various shared gang databases maintained by the State of California. With a campaign organized by a broad coalition of civil liberties organizations—such as Youth Justice Coalition, National Immigration...
Deeplinks Blog by David Ruiz | October 6, 2017

### 58 Human Rights and Civil Liberties Organizations Demand an End to the Backdoor Search Loophole

EFF and 57 organizations, including American Civil Liberties Union, R Street, and NAACP, spoke out against warrantless searches of American citizens in a joint letter this week demanding reforms of the so-called “backdoor search” loophole that exists for data collected under Section 702. The backdoor search loophole allows federal...
Deeplinks Blog by Shahid Buttar, Amul Kalia | October 4, 2017

### LinkNYC Improves Privacy Policy, Yet Problems Remain

Since first appearing on the streets of New York City in 2016, LinkNYC’s free public Wi-Fi kiosks have prompted controversy. The initial version of the kiosks’ privacy policy was particularly invasive: it allowed for LinkNYC to store personal browser history, time spent on a particular website, and lacked clarity...
Deeplinks Blog by Andrés Arrieta | October 4, 2017

### iOS 11’s Misleading “Off-ish” Setting for Bluetooth and Wi-Fi is Bad for User Security

Turning off your Bluetooth and Wi-Fi radios when you’re not using them is good security practice (not to mention good for your battery usage). When you consider Bluetooth’s known vulnerabilities, it’s especially important to make sure your Bluetooth and Wi-Fi settings are doing what...
Deeplinks Blog by Adam Schwartz | October 3, 2017

### Stop the Border Surveillance Bills

UPDATE: EFF also opposes H.R. 3548. Like S. 1757, it would expand border surveillance with biometric, drone, and ALPR technologies. The bill, styled the Border Security for America Act, was introduced by Rep. McCaul in July. EFF opposes a new federal bill that would dramatically expand dragnet biometric...

## Pages

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- …
- next ›
- last »

JavaScript license information