The DataMap Pinpoints Where Spyware Shares

Harvard researchers compile a frightening portrait depicting how much big companies know about us

A baby wearing an electronic tracker in a British hospital. Where will whatever it learns end up? (Photo: Christopher Furlong/Getty Images)

A baby wearing an electronic tracker in a British hospital. Where will happen to the data compiled by the device? (Photo: Christopher Furlong/Getty Images)

We all have a vague sense that mobile apps and websites are taking notes about our activities, but what exactly are they doing with that information? Does it stay inside the company or are they sharing it (or selling it) with companies we have never heard of?

Researchers at Harvard believe there are ways to find out, but there’s no one, simple trick. The team is doing it with detective work, and when dots get connected, TheDataMap documents it. The site shows, for example, how real estate companies get access to hospital discharge data, possibly to correlate disease with land values.

The map was one of the 17 projects just funded in the Knight Foundation News Challenge, including another project tracking traffic stops by police. The project is led by Latanya Sweeney, a Harvard professor and former chief technology officer at the U.S. Federal Trade Commission. The funding will help the project to scale by providing incentives to the public to find innovative new ways of illuminating data paths.

Right now, it’s a lot of elbow grease.

Harvard's Prof. Latanya Sweeney talks about TheDataMap. (Photo: Courtesy of Harvard's Institute for Quantitative Social Science)

Harvard’s Prof. Latanya Sweeney talks about TheDataMap. (Photo: Courtesy of Harvard’s Institute for Quantitative Social Science)

“There is no one secret sauce, but a bit of a smorgasbord. Often companies share information online about what they are doing with other companies as part of company-to-company marketing, for example. By ferreting out this documentation, we can use it to document flows of data,” Ms. Sweeney explained in an email to the Observer. “We have also used records requests, whistle blowers and breach notices to document who is holding personal data and how they got it.”

For example, the project purchased a set of hospital discharge data. It randomly selected 81 newspaper stories in which people were hospitalized and found it could match 35 stories to specific health records in the dataset, allowing the team to connect those records to real names.

At least one app that collects data by listening through your mobile’s microphone.

Consumer data is big business, as ProPublica previously reported. Web users might be surprised to know that there are Chrome extensions tracking every single website they visit and sending it to multiple repositories. We know of at least one app that collects data by listening through your mobile’s microphone.

That said, it’s not as if trackers can’t be tricked.

“Data remains open until it gets into the hands of private corporations, who keep what they do with the data hidden. We have no way of knowing to whom they share or sell personal data and and the harms that may result,” Ms. Sweeney wrote. “Those empowered to protect us—regulators, advocates, and journalists—have no way of knowing where the data goes.”

“The winning projects reveal new ways to shape and deliver information through data—showing how it can be used to build stronger more informed communities, while inviting people to explore and innovate,” John Bracken, a Knight Foundation vice president, wrote in a statement.

Between successful Freedom of Information Act requests and hacked data, the public is slowly accumulating a sense of what big companies know about us. TheDataMap is a way to build a global view of those individual stories.

The DataMap Pinpoints Where Spyware Shares