We swear we’re not walking the streets wearing tin foil helmets (honestly, we’re way more into DIY hair bows), but hear us out: It seems like everyone we talk to has recently encountered the same creepy situation — you’re brunch-picnicking with your friends, innocently debating the merits of different donut flavors, and a few hours later, there’s a targeted ad in your Instagram feed for Krispy Kreme’s birthday cake donuts (yes, those are real, and yes, they are delicious). It’s easy to assume that your phone is somehow listening to your conversations, but how likely (and lawful?) is that? We needed to know exactly what’s going down with our digital devices, so we talked with tech security experts Joe Jerome at Center for Democracy & Technology and Rapid7’s research director Tod Beardsley to learn the truth, and what we can do to protect ourselves.
bottom line — Instagram isn’t listening, it’s Just scary smart
They’re called targeted ads for a reason. “Just to be clear,” Beardsley says, “Facebook and Instagram do not sell your information. They offer access to their users,” so any connection you see between your recent conversations and social media ads isn’t the result of a company listening to you — but it’s not a crazy coincidence. It’s just that companies like Amazon, Facebook, and Instagram have insanely accurate and wide-ranging “buckets” that they put consumers into, and then “advertisers pay Facebook and Instagram to run ads to people that fit those specific categories,” Beardsley explains. He further describes how these companies can even create profiles on you using information based on your friends and groups, all in an effort to identify your periphery interests. If you’re curious, Beardsley says you can “go into your advertising settings and get a glimpse of what sort of profile you’re presenting to advertisers.” Noted.
Listening in would be super expensive. Even if they could listen in, it would be cost prohibitive. Beardsley says, “it’s not cheap or easy to store endless amounts of audio recordings at the moment. If you look at how something like Amazon Echo works, it may be ‘always listening’ for a user to say ‘Alexa’ and wake it up, but it’s not always recording.” It just doesn’t make dollar sense for these companies to try and store all that data for information they can get from you in much simpler (and less expensive) ways.
Facebook and Instagram say no way. There’s also the fact that companies like Facebook have publicly and definitively said they’re not listening to you through your cell phone microphone. Which brings us to our next point…
It’s probably illegal (and would be a PR nightmare). Beardsley says, “In the long run, ubiquitous microphones and lots of storage combined with machine learning probably will make it attractive for someone to try to capture everything and use it for advertising, but I think that would result in a pretty big privacy backlash, especially if it’s done surreptitiously in any way.” He goes on to remind us that “recording without clear permission can raise issues with wiretapping laws and could be unfair and deceptive business practice. Accessing a device’s microphone is almost always a big deal, and users are prompted for permission. Again, look at devices like Echo, and you have lights that indicate when it’s recording and a big mute button when you want to turn it off completely.”
5 ways to Keep your cell phone secure
With all that said, it’s still a good idea to stay on top of your cell phone security, even if no one is listening to your dinner conversations — and there are lots of easy ways to do it. Jerome reminds us, “If I own your phone, I own you; it only takes a minute or two to totally compromise an individual if that person’s phone is unlocked and in the hands of an attacker,” so take care to follow the suggested privacy settings and steps to keep your data secure.
1. Keep your passwords fresh. And this starts with the unlock code for your phone. Jerome says, “Most online accounts are a mere “I forgot my password” button click away,” since most of us keep our email account apps open on our phones. “So, the unlock code to a smartphone should be reasonably secure — no “1234” or “1111,” please,” he says. Jerome also says it’s imperative you change it at least once a year (along with your other passwords), since “falling in love with a favorite password is a mortal information security error.”
2.Forget WiFi networks. While it may be a pain in the butt, don’t allow your phone to automatically connect to WiFi networks without asking permission first. Jerome says it’s super easy for scammers to set up “rogue” networks with common names like “xfinitywifi” or “linksys” that they can use to access your private information once you’re connected. Additionally, Jerome says it’s a good idea to “routinely prune old networks that are unlikely to be joined again, such as rarely visited hotels or restaurants. In fact, get in the habit of disabling WiFi and Bluetooth automatic association entirely when not in a familiar location.”
3. Don’t get hooked by a phisher. Phishing scams prompt you to click on a link via email and can be as easy as a phisher sending an email posing as an app asking you to reset your password. Jerome suggests that “unless you have *just* requested a password change in the last couple of minutes, do not ever click on links in an email to change passwords, and avoid third-party marketplaces for app downloads.” Basically, if it feels sketchy, it probably is — so react appropriately!.
4. Be stingy with your permissions. Beardsley suggests that “if you want to make sure no one’s listening in on you, you should regularly review the list of apps that have access to your microphone,” and don’t just hand out permissions to apps for your location, microphone, or contacts.
5. Grab a RF shielding phone case. Okay, so we may be headed into tin foil territory here, but if you’re truly worried about your security (and radiation levels), Jerome says you can buy special radiation-shielding phone cases with built-in copper mesh pockets that basically render your cell phone un-attackable. But Jerome also says this kind of protection is really only necessary for those who “believe they are being actively targeted by well-funded adversaries with access to unpatched vulnerabilities,” and since we’re not in Homeland, we’re pretty sure you don’t have to worry about this one!
Have you ever experienced this freaky phenomenon for yourself? Tweet us @BritandCo and tell us your story!
(Photo via Getty)
