GPS S.O.S: Making GPS technology safer

GPS tracking is now a part of our daily life - in our smartwatches, smartphones, pet trackers, vehicles satellite navigation and more. GPS tracking technology can be bought by anyone quickly and easily online for a reasonable price.

How does GPS technology work?

A GPS tracker is a navigation device that uses the Global Positioning System (GPS) network of satellites in orbit above Earth to determine a device’s movement and its geographic position. Locations are then stored in a tracking unit or transmitted to an Internet-connected device using the cellular network, radio, Wi-Fi or satellite modem embedded in the unit. GPS tracking is also used by the military, security and police forces for tracking down stolen high-value goods or vehicle thefts. Tracker data can be displayed in real time, on maps, and through websites and applications such as Google, Bing and Apple maps.

While the technology is widely used for good, there is a growing number of incidents where GPS devices are being used for illicit activities such as using GPS trackers to stalk individuals by tracking their movement.

Mapping the security risks

Our research team recently analysed just one example of GPS technology being used to target individuals after being contacted by a member of the public following the discovery of a GPS tracker on their vehicle. The discovery was immediately reported to the police as potential evidence in an ongoing harassment case. The police officer overseeing the case informed the individual that neither their CSI forensic teams or digital download teams had the capability to extract information from the device and so as a last resort, they reached out to us.

Our team opened the device and documented the internal contents to identify the onboard flash memory chip - the place where all the tracker’s collected data is stored. This allowed the identification of the likely method used to collect and store the positioning information on the device. By extracting the exact longitude and latitude information and date and time we were able to identify the location where the device was purchased, and thanks to the overlay function in Google maps, the name of the supplier. We were also able to identify the route it took following its likely purchase to its delivery point, the likely purchaser of the unit and the route it took to the location where it was fitted to the vehicle it was tracking.

Nearly 7,000 records were extracted and converted using a specialist piece of code written specifically for this purpose. The daily routines of the individual were uncovered and routes which appeared to show the device being collected and taken back to the location of the end of the original journey it took on day one. This is likely to have been a third party who was tracking the device, potentially a Private Investigator (PI).

We were able to corroborate many of the locations by asking the individual on whose vehicle the tracker was found, however the locations they did not know were noted and added to a report as locations of interest for the third party.

What can you do to keep yourself and your devices safe?

Devices can be kept secure with strong passwords, and regular checks to make sure no suspicious software has been downloaded.

GPS and location sharing services should also be turned off when not in use, and users should delete their location history frequently from all their devices such as smartphones, satellite navigation systems and maps. You can also ask a mechanic to check for physical GPS tracking devices during annual checks of your vehicle and carry out your own regular checks for anything suspicious.

What should you do if you suspect you have been targeted?

If you suspect that you have been targeted by GPS abuse, the first thing to do is to check your vehicle for any devices that don’t belong there.

Tracking devices are typically small, three-to-four-inch boxes with a magnetic side, and flashlights, electronic sweepers and telescopic mirrors can all help with doing a thorough search. Individuals or mechanics should check the exterior of the car such as in the wheels, undercarriage, behind the bumpers and under the hood. Inspect the interior of the car: a tracker could be plugged into the data port under the driver’s dashboard, or a device could be concealed in the trunk, under and around the seats, or in the glove box. You can also ask a professional or private investigator to help you identify a GPS device in your vehicle if you are still concerned.

GPS tracking devices can easily be removed by the relevant authorities. It is not right or acceptable to be monitored without consent, and fitting GPS trackers to people’s vehicles, or accessing GPS data relating to their whereabouts in any way without consent is a breach of human rights. If a device is being used to violate an individual’s privacy, then the data stored in the tracker can be used to see where the wrongdoer has been and bring them to justice.

Anna Reedman, security consultant at NCC Group