Privacy & Compliance · Study deck

Mobile Wi-Fi and Sensing Privacy

Pseudonyms offer little protection when a short auxiliary sequence is rare enough to correlate. the Three auxiliary activity events are matched against pseudonymous sparse streams, reducing the candidate set from twelve to three to one diagram matches train, gym, and clinic windows against four representative sparse streams and shows the anonymity set collapsing.

Privacy Priya is your guide for this deck.

mobileprivwifi

Privacy Priya, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

explain how Wi-Fi and sensing signals can identify a person without message content
scope scans and keep sensing processing local to limit exposure
identify how identifiers, channels, and side channels leak information
Explain: P7 matches all three, while P12 loses the clinic event and P44 loses both later events.

Major section

Sensor Inference Through Activity-Stream Re-identification

P7 matches all three, while P12 loses the clinic event and P44 loses both later events.

The response panel works against that join by coarsening time, suppressing rare events, aggregating cohorts, processing locally, and limiting retention.
Removing names from a sensing dataset does not remove routines.
The adversary now has auxiliary sequence.

An auxiliary train-gym-clinic timeline sits above pseudonymous streams P7, P12, P44 and P83; match dots leave P7 unique after three events, followed by time coarsening, rare-event suppression, aggregation, local processing and retention limits. — Three auxiliary activity events are matched against pseudonymous sparse streams, reducing the candidate set from twelve to three to one.

Major section

Sensor Inference Through Activity-Stream Re-identification (continued)

Mobile activity streams are often high-dimensional and sparse: one person produces events across transport, location, motion, app, touch, and time dimensions, yet only a few events occur in each narrow combination.

That rarity makes a short correlated sequence behave like a quasi-identifier.
The anonymous release contains streams $S_1,\ldots,S_n$ keyed only by pseudonyms.
$score(S_k,A)=\sum_i w_i\,\mathbf{1}[match(a_i,S_k,\Delta_i)].$ .

Coarsen time and location

exact event alignment and impossible-path pruning

may reduce transport or safety-analysis utility

Suppress rare combinations

high-information quasi-identifiers

can erase minority patterns and bias results

Aggregate before release

person-level sequence construction

overlapping aggregates can still leak; small cells need thresholds

Major section

Sensor Inference Through Activity-Stream Re-identification (continued)

For each auxiliary event $a_i$ , define a match to stream $S_k$ when event type/location agrees and time is within tolerance $\Delta_i$ .

Weights should be larger for rarer events; an information-based choice is $w_i=-\log P(a_i)$ .
The target is singled out when one stream remains plausible and the gap to the next candidate is large enough.
A single train event may match hundreds of people; train then a particular gym schedule can reduce the anonymity set to one.
The safe question is not “did we delete the name?” but “how much outside knowledge is needed to single someone out?”.

Major section

Phoebe's Field Notes: Why "Limit Sampling Rate" Is Not Just A Policy Knob

The mathematical gist: A 5 GHz wave is 0.0600 m long.

A 10 Hz privacy limit instead folds that motion to about 3.33 Hz, while the chapter's stated breathing example produces only 0.628 Hz.

Deck summary

Key takeaways

P7 matches all three, while P12 loses the clinic event and P44 loses both later events.

Mobile activity streams are often high-dimensional and sparse: one person produces events across transport, location, motion, app, touch, and time dimensions, yet only a few events occur in each narrow combination.
For each auxiliary event $a_i$ , define a match to stream $S_k$ when event type/location agrees and time is within tolerance $\Delta_i$ .
The mathematical gist: A 5 GHz wave is 0.0600 m long.

Retrieval practice

Recall check 1 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q1Why is a phone that always uses the same Wi-Fi hardware (MAC) address when scanning a privacy risk, and how do modern platforms reduce it?

AA hardware address is random noise, so different locations cannot use it to recognize a device

BStable scan addresses enable tracking; randomized addresses break the link

CThe only risk is that the address reveals the phone's brand, which is harmless

DDisable app location access to prevent tracking through scan addresses

Show answer

Answer: B A persistent scan or hardware address lets sites recognize the same device over time and across places; randomized addresses break that linkage.

Retrieval practice

Recall check 2 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q2An IoT companion app needs to scan for a nearby Bluetooth accessory during pairing. On a platform that offers a dedicated nearby-devices permission, which choice best fits least privilege?

ARequest precise location for pairing because the phone needs coordinates to identify the nearby device.

BRequest background location to make later pairings quicker.

CRead raw radio results while bypassing the platform permission gate.

DRequest nearby-device scanning and state that pairing is not for location.

Show answer

Answer: D Using the dedicated nearby-devices scanning permission, and declaring the scan is not used to derive location, scopes access to the actual need.

Retrieval practice

Recall check 3 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q3A building automation vendor wants to detect room occupancy from Wi-Fi. Which approach best limits privacy exposure while still detecting presence?

ASend raw per-room channel measurements to cloud analysis.

BRecord stable device identifiers so occupants can be named.

CTreat Wi-Fi signals as private because they carry no app text.

DClassify occupancy locally and send an occupied-or-empty result.

Show answer

Answer: D Deriving the minimal result on device from signal data and discarding raw channel measurements keeps sensitive measurements from leaving the space.

Print reference

Answers

Answer key.

B · A persistent scan or hardware address lets sites recognize the same device over time and across places; randomized addresses break that linkage.
D · Using the dedicated nearby-devices scanning permission, and declaring the scan is not used to derive location, scopes access to the actual need.
D · Deriving the minimal result on device from signal data and discarding raw channel measurements keeps sensitive measurements from leaving the space.