Privacy & Compliance · Study deck

Mobile Wi-Fi and Sensing Privacy

Pseudonyms offer little protection when a short auxiliary sequence is rare enough to correlate. @fig-privacy-auxiliary-stream-match matches train, gym, and clinic windows against four representative sparse streams and shows the anonymity set collapsing.

Privacy Priya is your guide for this deck.

mobileprivwifi

Privacy Priya, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: Mobile activity streams are often high-dimensional and sparse: one person produces events across transport, location, motion, app, touch, and time dimensions, yet only a few events occur in each narrow combination.
Explain: A 10 Hz privacy limit instead folds that motion to about 3.33 Hz, while the chapter's stated breathing example produces only 0.628 Hz.
Explain: For each auxiliary event $a_i$, define a match to stream $S_k$ when event type/location agrees and time is within tolerance $\Delta_i$.
explain how Wi-Fi and sensing signals can identify a person without message content

Major section

Sensor Inference Through Activity-Stream Re-identification

Removing names from a sensing dataset does not remove routines.

Mobile activity streams are often high-dimensional and sparse: one person produces events across transport, location, motion, app, touch, and time dimensions, yet only a few events occur in each narrow combination.
That rarity makes a short correlated sequence behave like a quasi-identifier.

Three auxiliary activity events are matched against pseudonymous sparse streams, reducing the candidate set from twelve to three to one.

Major section

Sensor Inference Through Activity-Stream Re-identification (continued)

The adversary now has auxiliary sequence.

The anonymous release contains streams $S_1,\ldots,S_n$ keyed only by pseudonyms.
For each auxiliary event $a_i$, define a match to stream $S_k$ when event type/location agrees and time is within tolerance $\Delta_i$.
$$ score(S_k,A)=\sum_i w_i\,\mathbf{1}[match(a_i,S_k,\Delta_i)]. $$.

Major section

Sensor Inference Through Activity-Stream Re-identification (continued)

Weights should be larger for rarer events; an information-based choice is $w_i=-\log P(a_i)$.

The target is singled out when one stream remains plausible and the gap to the next candidate is large enough.
A single train event may match hundreds of people; train then a particular gym schedule can reduce the anonymity set to one.
The safe question is not “did we delete the name?” but “how much outside knowledge is needed to single someone out?”.

Major section

Phoebe's Field Notes: Why "Limit Sampling Rate" Is Not Just A Policy Knob

The mathematical gist.: A 5 GHz wave is 0.0600 m long.

A 10 Hz privacy limit instead folds that motion to about 3.33 Hz, while the chapter's stated breathing example produces only 0.628 Hz.

Deck summary

Key takeaways

Removing names from a sensing dataset does not remove routines.

The adversary now has auxiliary sequence.
Weights should be larger for rarer events; an information-based choice is $w_i=-\log P(a_i)$.
The mathematical gist.: A 5 GHz wave is 0.0600 m long.

Retrieval practice

Recall check 1 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q1Why is a phone that always uses the same Wi-Fi hardware (MAC) address when scanning a privacy risk, and how do modern platforms reduce it?

AA hardware address is random noise, so different locations cannot use it to recognize a device

BStable scan addresses enable tracking; randomized addresses break the link

CThe only risk is that the address reveals the phone's brand, which is harmless

DDisable app location access to prevent tracking through scan addresses

Show answer

Answer: B A persistent scan or hardware address lets sites recognize the same device over time and across places; randomized addresses break that linkage.

Retrieval practice

Recall check 2 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q2An IoT companion app needs to scan for a nearby Bluetooth accessory during pairing. On a platform that offers a dedicated nearby-devices permission, which choice best fits least privilege?

ARequest nearby-devices scanning and declare it is not for location

BRequest precise location because Bluetooth scanning has historically required it

CRequest background location so future pairings are faster

DSkip permissions and read raw radio data directly

Show answer

Answer: A Using the dedicated nearby-devices scanning permission, and declaring the scan is not used to derive location, scopes access to the actual need.

Retrieval practice

Recall check 3 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q3A building automation vendor wants to detect room occupancy from Wi-Fi. Which approach best limits privacy exposure while still detecting presence?

AStream raw channel measurements for every room to the cloud for analysis

BRecord the stable hardware identifier of every device seen so each person can be named

CAssume Wi-Fi signals cannot reveal anything because they carry no message content

DCompute occupancy locally and emit only occupied-or-empty

Show answer

Answer: D Deriving the minimal result on device from signal data and discarding raw channel measurements keeps sensitive measurements from leaving the space.

Print reference

Answers

Answer key.

B · A persistent scan or hardware address lets sites recognize the same device over time and across places; randomized addresses break that linkage.
A · Using the dedicated nearby-devices scanning permission, and declaring the scan is not used to derive location, scopes access to the actual need.
D · Deriving the minimal result on device from signal data and discarding raw channel measurements keeps sensitive measurements from leaving the space.