Fact-check: geolocation accuracy and "2000 Mules"

The so-called "GPS" from phones doesn't give the accuracy the movie seems to imply

Recently, Trump supporters produced a movie called “2000 Mules” which claims that Democrats had an illegal “ballot harvesting” operation during the 2020 election. They purchased information from “data brokers” about people’s mobile locations, and found thousands of people who seem to visit dropoff boxes for a few minutes — long enough to stuff in the ballot's they’d harvested.

The film’s producer (Dinesh D’Souza) claims that geolocation data from phones can locate somebody within six feet, allowing him to precisely place a person at a ballot box.

Dinesh D'Souza @DineshDSouza

Is geotracking as imprecise as the fact checkers” of #2000Mules claim? Of course not. The CDC is geotracking people nationwide to see if they are social distancing. For this to work, geotracking must be accurate to WITHIN SIX FEET. Otherwise it would be useless for this purpose

Fact-check: No, mobile phones cannot locate people this accurately. Depending upon the source of the data, it’s usually more like 30 feet (from phones) or 1000 feet (from cell towers). The CDC doesn’t have a geotracking program for social distancing.

You can verify this yourself

On my evening walk, I tested this myself. I walked to the local library and stood at the location of the ballot collection box that was placed here during the 2020 election. I then opened the “Find My” app on the iPhone to see what it believed was my location.

I was standing on the red circle (that I drew) in the map below. The blue circle is where the phone thought I was.

As you can see, there’s an intersection nearby. During rush hour, cars get stuck at that intersection (pull up Google maps tomorrow and you’ll see the angry red lines showing stalled traffic).

Thus, during traffic jams, many cars will falsely show what the movie detected: people loitering for a few minutes at ballot collection box, just long enough to stuff in harvested ballots.

The location shown by “Find My” on the iPhone is the most accurate possible. There is no better geolocation of phones.

Where data brokers get their geolocation data

The film’s producers bought data from a “broker”. It’s unclear exactly what type of data they were given. However, there are fundamentally only two types of data:

• location info from the phone (like that used by the “Find My” app)

• location info from mobile towers

Phones have GPS built-in, but that doesn’t give an accurate location. Instead, the most accurate measurements come from WiFi. Google (Android) and Apple (iOS) repeatedly scan the world for the location of WiFi access-points, then “triangulate” the location of the phone based upon nearby WiFi. GPS is unreliable in town because it’s blocked by buildings (conversely, WiFi is rare in rural environments, where GPS is more accurate).

Your phone (Android, iPhone) tracks your location. Apps on the phone can request this data from the phone.

There are several companies that build “libraries” for making phone apps, where they insert code that records this information. App builders use these libraries for other reasons, such as advertising, or being able to track this info themselves. Other times, the app developer doesn’t know this is happening.

You can easily turn off all this tracking on the phone. Your phone as features specifically designed to make it easy to turn off all this evil tracking. But enough people install apps using these libraries that they get millions of people’s data.

These companies then sell this data to third parties, or sell “analytics” based upon this data. They do some minimal work to anonymize it, but not a lot.

I think I’ve turned off all the location tracking by apps on my phone, and thus, they would have nothing tracking me. But if I failed, then they’ll be able to de-anonymize by looking for a person who regularly walks by the library in the morning or early evening. It’s not perfect, I see about 20 regular faces on my walk, but they’ll know I’m one of them.

Note that Google and Apple also record this information for their own use, such as building their maps. There are separate things you can do to stop them from tracking you. However, they don’t sell this data to anybody.

This location information accurate to only about 30 yards, depending on circumstances. But it’s the most accurate location information you can get.

Brokers also buy location information from the phone companies (AT&T, Verizon, T-Mobile, Sprint, etc.). These companies don’t get your location from your phone, but from their cell towers. They have historically sold that info to data brokers.

It’s not nearly as accurate what your phone knows. The 4G technology uses “phased arrays” to steer radio signals to the phone. For this technology to work, it needs to know roughly in which direction from the tower you are located, and roughly how far away you are (due to speed of light delay, which is around 1-millisecond).

This angle and distance from the tower can locate you within about 50 yards, assuming you have a clear line-of-site to the tower. If you are blocked by buildings, this can be a mile away.

I tested this with AT&T “Family” features where parents are able to locate the phones of their children. I used a second “feature phone” that had no WiFi or GPS, and no ability to determine it’s own location. I then used AT&T’s service to “find” the phone. Here is the sort of result it gave, based solely on cell tower information. The circle of accuracy says 56 yards. In several tests, sometimes I got a little better than this, sometimes I got a lot worse, with AT&T claiming I was a half mile away.

As you can see, cell towers do a much worse job than the phone itself. There is no other source of geolocation information.

It’s unclear which source was used in the film. Some sources suggest CSLI (“cell site location information”). Others suggest “GPS” (which really means WiFi) location from the mobile phone. Either way, it’s not accurate enough to support the film’s conclusions, but CSLI is so wildly inaccurate that we’d have to go to extra lengths to mock the film.

What about CDC geotracking for social distancing

The CDC doesn’t track geolocation for social distancing. This is some weird made up thing.

I’m going to guess at D’Souza’s misconceptions here. First, he seems have confused “social distancing” with “contact tracing”, then he assume this is tracked by geolocation.

The CDC does, sorta, have an interest in contact tracing, to notify people when they’ve been in contact with somebody who has gotten sick. This sounds similar to social distancing, which is also about when people are close to each other. The CDC has no interesting in tracking social distancing.

But the two subjects are kinda related, knowing when people are near each other. Thus, it appears that D’Souza has made the assumption that they are essentially the same thing. They really aren’t.

Second, D’Souza assumes that contact tracing (or monitoring social distancing) is done by recording a person’s location. It doesn’t. Instead, it’s done via Bluetooth transmissions, which are picked up by nearby phones.

The technique was developed by Google (for Android) and Apple (for iPhone) to make such information anonymous and encrypted. Only if you use a contact tracing app and register the fact that you’ve been infected does your phone transmit the keys to decrypt those messages, so that the service can then notify people you’ve been in contact with.

The encryption is important. Until you transmit the decryption keys, the service can’t be used to track your contacts or location.

Even though people are ignorant privacy (and let all these apps track them), they are paranoid about the government or a Google/Apple tracking them. Thus, the contact tracing service was designed this way to keep you anonymous.

It’s like after getting black out drunk we wake up in a hotel room together. We don’t know where we are, but we certainly know we are in contact with each other. The contact tracing apps don’t know your location, only your contacts, and only when you deanonymize them. The location isn’t use to know contact, it’s just nearby Bluetooth transmissions (though some apps also transmit/receive ultrasound, but it’s the same principle).

Thus, D’Souza appears to confuse social distancing with contact tracing, and assumes that regardless which it is, that it’d be monitored by location info rather than local transmissions.

The CDC doesn’t actually have any programs like this. Sure, it funds various researchers, and those researchers may buy location data from these same data brokers to track some feature of covid. But everyone still has the same limitations on the accuracy of this data.

This story contains a list of various research projects. It does list “social distancing” among the items, but it also mentions “vaccination rates”. No, geolocation won’t tell you either of such things — but location trends (like school closures) might be combined with other observations that do include social-distancing and vaccination observations.

Google does have a program for tracking people during covid. They produce anonymized mobility reports showing how often people visit the grocery store, local parks, the drug store, and and so. These have the same location limitations as above, they only need to know people’s locations to within 100 feet for them to work.

But it knows where I parked my car!

Some measurements are accurate. Some look accurate. We can’t tell which ones are which (at least, not well).

Maps do tricks to make things look more accurate than they really are, such as guessing that if you are walking you probably aren’t in the middle of the street, or that if you are driving, you probably aren’t on a sidewalk.

Tracking movement is especially tricky — even if it loses your accurate location, it can estimate speed and direction from the last accurate location. This is why fitness trackers show more accuracy, it’s often extrapolating your current position (which is technically unknown) from your motion from the last known position. It’s lying about the accuracy, but it lies really well.

WiFi location can be very accurate, when your phone has clear line-of-site to nearby WiFi access-points without intervening walls.

There are undoubtedly some ballot collection boxes in that movie’s dataset where their locations are known, and nearby WiFi gives 3-foot accuracy. But it would be difficult to know which ones.

You know when the Apple/Google Maps are accurate when you look at your phone, comparing it’s claimed location to your surroundings. But Apple and Google don’t know which of their measurements are accurate and which ones aren’t. They can make some guesses of accuracy, but they are guesses.

Conclusion

None of the data from the movie is yet public, so the correct debunking of the film is simply that it’s “unsubstantiated”.

However, the movie does make claims that appear false. The most important of which is geolocation of cell phones. It’s simply not as accurate as the movie claims, as I tested above.

Questions

Didn’t they arrest Jan 6 people based upon geolocation data? Yes — data that was only accurate to around 100 feet. That’s the point of this article, it’s not accurate enough to place people at ballot drop boxes, even if it’s accurate enough to place somebody inside the capitol. Here is an example case:

Notes

This link show location of drop-boxes in Georgia from that election. Note that the locations in this link are also not geolocated, it says it’s at the local library, but not where at the local library (the entrance).