Advertisers Can Geo-Locate Users With IP Tricks

While Apple, Google and other mobile operating system makers are hauled across the coals for geo-locating users without permission, a research team is claiming that desktop computers make their users almost as vulnerable.

A team from the University of Electronic Science and Technology of China (UESTC), Northwestern University in Chicago, and Microsoft Research has shown how a computer with a wired connection can be, on average, geographically placed within 690m (750 yards) of its actual position.

The technique builds on existing geo-location methods for wired IP addresses but gains 10 to 100 times greater accuracy by using local businesses, government agencies, and educational establishments as fixed landmarks.

Inferences, Probabilities, Statistics And Sociology

The methodology employed is not simple but online marketeers will probably investigate ways to automate the processes employed by research leader Yong Wang of UESTC and his team.

Wang used statistics to combine data from 163 public ping servers and 136 traceroute servers to get a reliable estimate of the geographical location of a computer linked to a specific IP address. Despite casting such a wide net to gain the figures, the team claims that results can be obtained in a couple of seconds, at most.

The four-step process, over an optical network, first pings the target IP from multiple servers in known locations. The time taken is then translated into distance by using the speed of light and an adjustment for online delays. This results in the ability to multilaterate a likely zone in which the IP address is located. Multilateration is similar to trilateration or triangulation but uses more than three fixed points.

The results give a radius for a circle of the distance travelled from each server. This can be used in step two which maps the circles and translates the crossover areas into postal codes. Online sources in these zones, such as schools, businesses, government buildings and other public buildings, can be found on the Internet and their IP addresses ascertained. The physical locations of these “landmarks”can be discovered by Website scraping for street addresses, disregarding sites whose hosting sites may be proxied or located away from the organisation’s actual building.

The third step uses the results considered more reliable from step two to discover Internet backbone routers by sending diagnostic traceroute requests. This diagnostic tool displays the route of the traceroute packets and measures transit delays. Packets are sent from as many known-location servers as possible, both to the landmarks thought to be nearby the target and to the target IP itself. Comparing these trace results enables routers that are connected to both the target IP and the landmark IP to be discovered.

Finally, the return times of the pings from the most likely landmarks and the target are measured and converted to distance, disregarding results that may be due to congested routers. These figures allow a more fine-grained set of circles to be drawn which locates the target IP to within a few hundred metres.

A Legal Loophole For Geo-Location

From a privacy law viewpoint, this method does not rely on any real interaction with the client – other than pinging. No software or cookies need to be installed on the target computer so permission of the owner does not have to be sought.

Combining location with the typical socioeconomic status for the location would allow an advertiser or agency to tie in a local business to find potential customers who live within walking distance of their outlet, without breaking any privacy laws.

Communications from the pizza palace round the corner or the jeweller down the road is just a few hundred pings away.