NWA-PCUG Newsletter Article, March 2011
Possible Personal Security Issue with Digital Photos
By Ira Wilsker, Radio Show Host,
Columnist, College Professor and deputy sheriff
iwilsker@sbcglobal.net
(click to email author)

WEBSITES:
http://abclocal.go.com/wabc/video?id=7621105
http://www.orcopug.org/pdf/nov2010.pdf
http://www.examiner.com/iphone-in-national/how-to-turn-iphone-gps-on-and-off
http://icanstalku.com
http://icanstalku.com/how.php#disable Disable GPS function
http://en.wikipedia.org/wiki/Exif http://www.irfanview.com
http://www.google.com/earth

Many of us take a lot of digital photographs. One of the many advantages of digital photography is the ease at which they can be emailed to others, and posted to social networking sites such as Facebook, Twitter, and MySpace. What many users are unaware of is that many of the newer cell phones and digital cameras have a GPS location feature that records the precise location of the camera at the instant the photo is taken, often with an accuracy within 15 feet. While this "GeoTagging" offers the user the benefits of knowing precisely where the picture was taken, there are now cases where GeoTagged images were used for illicit purposes, such as by stalkers and pedophiles to locate targets for their illicit behavior.

New York's WABC-TV documented the case of Adam Savage, one of the star characters of the Discovery Channel hit "MythBusters", who posted a digital photo of his car on Twitter (abclocal.go.com/wabc/video?id=7621105). The digital photo was taken outside of his house, and contained what is known as EXIF data embedded in the photo; if the camera or smart phone has a capable GPS in the device, it dutifully records that information into the photo. Most image viewers can display that EXIF data, and even display the precise location on a high resolution Google Earth map. In the Adam Savage case, the precise location of his home could have been used by a stalker or other miscreant to do him harm.

Exchangeable image file format, better known as EXIF, is automatically recorded by most modern digital cameras, including dedicated units (just a standard digital camera), and the cameras built in to most of today's cell phones and almost all smart phones. EXIF is imbedded into JPEG images, most TIFF images, and WAV files. EXIF data is not recorded in JPEG 2000, PNG, or GIF formatted images. EXIF records a lot of useful information, including the date and time the photo was taken, the make and model of the camera or digital device, the exposure, F-stop, ISO rating, dimensions of original photo, flash, focal length of lens, and other technical information about the image and the camera. If the digital device has a GPS, then the EXIF information also contains the latitude and longitude accurate to six decimal places (one-millionth of a degree). As long as the file format is one of those that support EXIF, this information is included by default, unless the user has selected to turn off all or parts of the EXIF writing function of the camera, On most cameras that support EXIF coded images, the degree of difficulty of controlling the EXIF data displayed varies by camera make and model, although many of the GPS equipped devices have the ability to turn off the GPS function. With the GPS thus disabled, the location of the camera when the image is made will not be recorded, and the remaining EXIF information is relatively innocuous, and does not pose any significant threat to the user. It is up to the user to determine if the GPS information should be recorded, and many photographers regularly use the GPS data embedded in the EXIF information to document and record the location of the image. If the user wants the GPS information embedded in the photo, leave the GPS in the device turned on; this is typically the default setting. If the user is concerned about privacy, or the potential threat that posting the location of the image may create, then the user should check the camera or device instructions about disabling the GPS function. If the camera or other digital device offers the user the option of file formats, choosing the universally compatible GIF image format will provide a degree of safety in that a GIF formatted image generally does not contain the EXIF information.

It is amazingly simple to display the embedded latitude and longitude in a JPEG (.jpg) image if that photo was taken by a GPS equipped camera. I went to my Twitter page (which I rarely use), and opened some of the photos that were linked by my friends on Twitter. Using my internet browser, I right clicked on the image and selected "Save Image As", and saved the image to my hard drive. Using my preferred image viewer, the popular free universal viewer IrfanView (http://www.irfanview.com), the EXIF information was very easy to display, if it was embedded into one of the compatible image formats. Opening the image in IrfanView obviously displayed the image, but clicking on either IMAGE - INFORMATION, or the blue circle with the lower case "i" displayed the information about the image. If there is EXIF information embedded in the photo, a radio button labeled "EXIF info" appears on the bottom right corner of the information display; clicking on this button opens the EXIF window, with all of the embedded information displayed. If there is a recorded latitude and longitude, another button appears labeled "Show in Google Earth" which will open Google Earth (http://www.google.com/earth) if it is installed on the computer, and display a high resolution satellite or aircraft photo showing the precise location of the camera at the instant the photo was taken. Google Earth can link directly to Google Maps, and display a street map with the location highlighted, and then create driving directions to that precise location. If someone wanted to do harm to the subject of the photo, with this information, the potential victim may be easy to locate, especially if the photo was taken near a home, public park, or other readily accessible location. In addition to Google Earth, IrfanView can also display the location using several other mapping utilities by clicking on the "Show in Geo-Hack Wiki". I tried this by opening a JPEG photo of my car in my driveway taken with my smart phone, clicking on the Geo-Hack Wiki, and then selecting the "OpenStreetMap" option; instantly a detailed street map appeared, with a red icon noting the location of my driveway! If I posted that photo on the web, any miscreant could easily find my house.

IrfanView is not the only image viewer that can display EXIF information, as I tried several of the image viewers that I have installed on my computer, and almost all displayed the same information. IrfanView and the other image viewers are not the problem, as they are only displaying what the camera recorded, just as they display the image taken by the camera. If the user wants that image location recorded, he should be entitled to do so, as there are many legitimate uses for that information. As can be done with many things that are legal, legitimate, and useful, they can also be abused by those with crime in their hearts. It is this risk that the user must consider if he decides to record the GPS information with his photo. If the photo is to be kept for strictly personal use, then there is no harm in using that information, but if that image is to be posted on the internet, such as on a web site or on a social network service such as Facebook, MySpace, or Twitter, then he must decide if he wants the GPS information included, which may be much the same as posting his home address on the internet along with his photos. There are several free and commercial utilities that can edit or remove EXIF data from images, and the user should search for these utilities, and consider removing or editing the EXIF data on images to be posted on the web. Likewise, there are several websites that have the instructions for deactivating the GPS feature on most smart phones and digital cameras.

The choice is strictly yours; I choose not to include my GPS data on personal images that I post on the net. Play it safe, and do the same.

Click here to return to top



==================================================================