US Congressman Edward Markey has raised questions about the location data collected by Apple from iPhone users. He sent a letter to Apple CEO Steve Jobs asking him about Apple's data collection, storage and disclosure practices. Markey cited a recent story in The Guardian entitled "iPhone Keeps Record of Everywhere You Go", which claims that Apple's iOS 4 collects customers' location data, stores it on the user's iPhone and iPad, backs it up when synched with another device, and could leave it unprotected. In particular, the letter asks the company about compliance with Section 222 of the Communications Act, a provision that Markey authored, that requires companies to get express authorization from their customers for use, disclosure or access to location information for commercial purposes. US Senator Al Franken has also written to Apple, saying he was concerned about the risk of third parties being able to access the unencrypted data on iPhones. Franken cited research by O'Reilly Radar, which disclosed at the Where 2.0 conference findings that claim Apple is collecting the location data and storing it in a hidden file on the iPhone. They said the data is unencrypted and unprotected, and it's on any machine with which an iOS 4 device is synched. The researchers contacted Apple's security team, but have yet to hear back. The issue has also spread to phones running Google's Android OS. Security analyst and former hacker Samy Kamkar told the Wall Street Journal that an HTC Android phone collected its location every few seconds and transmitted the data to Google at least several times an hour. It also transmitted the name, location and signal strength of any nearby Wi-Fi networks, as well as a unique phone identifier. The WSJ hired an independent consultant, Ashkan Soltani, who confirmed Kamkar's findings. Google declined to comment. The Guardian cites research by Swedish programmer Magnus Eriksson showing that Android devices keep a record of the locations and unique IDs of the last 50 mobile masts with which they communicated, and the last 200 Wi-Fi networks that it has "seen". These are overwritten, oldest first, when the relevant list is full. It is not yet known whether the lists are sent to Google. That differs from Apple, where the data is stored for up to a year.
