OPENPATHS: EMPOWERING locative media and data visualization that would allow the release of these PERSONAL GEOGRAPHIC DATA practices that do not address the political datasets to the individuals who generated Brian House, Department of Music, implications of their technological un- them, let alone to user-endorsed third- Brown University, Providence, RI, USA. derpinnings [2]. Recently, the disclosure party research programs. As Natasha E-mail: . * of the PRISM initiative of the United Singer of the New York Times reports, States' National Security Agency pro- Abstract vides a dramatic confirmation of the ...when I called my wireless provid- ers, Verizon and T-Mobile, last week OpenPaths, created by the New York Times Com- danger of centralized data gathering and in search of data on my comings and pany R&D Lab, is a platform that demonstrates the the collusion of state and corporate inter- goings, call-center agents told me collective value of personal data sovereignty. It was developed in response to public outrage regarding ests in tracking individuals [3]. that their companies didn’t share the location record generated by Apple iOS devices. customers’ own location logs with them without a subpoena [7]. OpenPaths participants store their encrypted geo- Nevertheless, there is great potential for graphic data online while maintaining ownership the tracing to serve the public interest. In and programmatic control. Projects of many kinds, Location data are commonly generated from mobility research to expressive artwork, peti- 2006, Mark Hansen and colleagues at the in three ways. Network operators find tion individuals for access to their data. In the con- Center for Embedded Networked Sens- text of locative media practice, OpenPaths expands the position of a device by the triangula- ing at UCLA introduced the term “par- the notion of the tracing to address the components tion of its signal strength to nearby cell of an ethical implementation of crowd-sourced ticipatory sensing” [4]. Recognizing the geographic systems in the age of “big data”. towers. Additionally, most contemporary ubiquity of mobile phone users and the smartphones are equipped with a GPS devices’ capacity to gather data, they Keywords sensor, by which it may locate itself in proposed that individuals might opt-in to locative media, big data, data visualization, privacy latitude and longitude via signals from ad hoc sensor networks to address issues geosynchronous satellites [8]. Finally, a in “urban planning, public health, cul- device may note the identifiers of nearby The “tracing” as a mode of locative me- tural identity and creative expression, cell towers and Wi-Fi nodes and infer its dia art practice was established through and natural resource management”. They position from a database that lists the projects such as Amsterdam Realtime note that “we know something about coordinates of these signals. Apple's [1]. Conducted in 2002, participants what distributed sensing can be used for iPhone uses this latter method together were given Global Positioning System in the sciences, industry and the military. with GPS in what is known as “hybrid (GPS) devices to carry as they traversed We know much less about its function positioning” [9]. Originally, Apple leased the city in the course of their everyday and utility in the public sphere when the their database from Skyhook Wireless, lives. The result was a compelling dis- components are owned and operated by but in 2010 implemented a system to play of the collective routes, a tracing of everyday users”. Personal geographic generate their own [10]. Essentially, Ap- the urban topology through which, mo- data in this context might be used to ple employs the iPhone-carrying public ment to moment, the city was given observe mobility patterns and identify as a giant “wardriving” [11] sensor net- form. At the time, such work was specu- opportunities for improving public trans- work – the location of novel Wi-Fi nodes lative, anticipating mobile phone net- port or to allocate social services. Such and cell towers detected by are works. Yet Amsterdam Realtime already research is appealing as, due to the pene- logged and sent back to Apple to con- hints at the eeriness of a city inhabited tration of device ownership, the potential tribute to an extensive map of the topol- solely by disembodied, moving coordi- reach is vastly larger than what would be ogy of wireless signals across the world nates, and the centralization required to possible with traditional methods. [12]. pull off the project demonstrates the involvement of commercial or military Yet this potential remains untapped, even In April of 2011, researchers Pete War- infrastructure in tracing and its potential as vast datasets are gathered for com- den and Alasdair Allan publicized a fact use for surveillance. Such concerns fuel mercial purposes. iPhone and Android already known in digital forensics cir- a broad critique of much subsequent users, which as of June 2013 make up cles. Beginning in April of 2010, the data 56% of the adult US population [5], have collected by individual iPhones and at least two corporations tracking and for Apple's database were stored in Fig. 1. Amsterdam Realtime storing where they are at all times. This © 2002 Esther Polak a cache file automatically synced to the is the network operator, such as AT&T, users' computers via iTunes. By default, who by definition knows your location in this file was not encrypted, and it could the course of delivering cellular service, be readily examined by anyone with and the software provider, such as Apple, access to the computer [13]. Though who actively monitors your location to Apple stated that “The iPhone is not enhance their applications. The result, logging your location. Rather, it's main- for these companies, is so-called “big taining a database of Wi-Fi hotspots and data”, a buzz word signifying both data- cell towers around your current location” bases of a magnitude that requires spe- [14], in practice the distinction was cialized computational techniques as somewhat semantic, as the file clearly well as an epistemological approach that reflects location history spanning a year's places an absolute value on emergent time. The result was dubbed “Location- patterns [6]. However, despite, or be- gate”, a scandal which indicated that cause of, its value, these corporations do users were uncomfortable at how such not have interfaces or policies in place data were being collected. Senator Al

* Brian House was Creative Technologist at the Research and Development Please reference as: Brian House (2013) “OpenPaths: Empowering Personal Geographic Data” Lab at the New York Times Company, 2010-2012. The views expressed here in Kathy Cleland, Laura Fisher, Ross Harley (Eds.) Proceedings of the 19th International Sym- are the author's and do not necessarily reflect those of the New York Times posium of Electronic Art, ISEA2013, Sydney. Company. Page numbering begins at 1 at the start of the paper. Franken demanded that Apple explain themselves [15], 27,000 Koreans sued the company for violation of privacy [16], and even weighed in [17]. As Kord Davis puts it, “The deci- sion to use that technological method had clear and direct ethical consequences in the real world” [18].

However, there is a certain irony in the outrage, as consumers were agitating for Apple to restrict access to what was in essence the largest publicly accessible Cartesian document in human history – a year's worth of data for over 50 million iPhone users. Locationgate came to an end on May 4th, 2011, when Apple re- leased iOS version 4.3.3, which no longer logged location data to a cache file. But while users can no longer access these data, Apple certainly continues to collect them. Further, Apple shares indi- vidual portions of those data with appli- cations – a large percentage of apps for both iOS and Android request access to a user's location via a confirmation box with the options “Don't Allow” and Fig. 2. OpenPaths homepage, © 2012 The New York Times Company “OK” that lacks subtlety. An approved app may collect continuous personal effort was designed to salvage as much ing the key (which is generated from the geographic data. Yet this infrastructure historical data as possible before they user password), the service maintains a lacks the means for the user to know were deleted or overwritten by updates, remote infrastructure without reserving exactly what data have been collected or and approximately 4000 datasets were any privileged access to the data them- how they will be used, and unless an collected in this way. selves (nor is access ceded to the hosting application developer has built an inter- provider, in this case Amazon). This face to do so, there is no way for users to We designed the OpenPaths server as a straightforward technological feature is access their own data for their own pur- data “locker” of sorts, one that would simply a literal interpretation of our user poses. So while Locationgate helped embody the idea of “personal data sover- agreements, which state that you own raise public awareness about the nature eignty”. Generally, “data sovereignty” is your data, and that your data cannot be of personal data, in the end the discus- a business term that acknowledges, mar- accessed without your express permis- sion fell short of asking what rights indi- keting language about “clouds” aside, sion and participation. The shift that we viduals should have over their location that data lives on physical machines and hope to exemplify is that by leaving out histories, what might be done with the are hence subject to the local laws in the ability to mine or sell data, the user is data as a public resource, and what a which the data centers are located [19]. no longer an asset in that regard – collec- more ethical implementation for collect- This is a liability for corporations if tive value for OpenPaths users is pro- ing data might be. valuable assets are stored by a third- duced by mutual participation, as we party hosting service, such as Amazon explain below. In response to the discussion around iOS S3, that may be subpoenaed by a state cache files, in May of 2011 the New power, such as the US government under Public interest in the project motivated York Times Company Research and De- PRISM. Personal data sovereignty ex- us to provide a means for individuals to velopment Lab launched OpenPaths tends this concept to the level of the in- continue to collect their data on an ongo- . Initially, the plat- dividual – it is an alternate model of data ing basis without the cache files. Our form consisted of two components. First, collection that empowers that individual solution was apps for iOS and Android we wanted to create a tool that would with control over the data they generate designed for the single purpose of col- allow non-technical users to locate that is not site-based, but access-based. lecting location data and uploading them SQLite location databases within their There are technological and legal aspects to the OpenPaths server with as little iTunes backup directories. Our tool, built of the implementation. From a techno- friction as possible. The primary techni- in Python for both OS X and Windows logical perspective, we propose that data cal challenge was to ensure that the apps machines, searched the archives of all are under your control either when they could run continuously in the back- devices that had been synced with the are stored on a machine to which you ground without causing undue battery computer in question, as well as any physically restrict access or when they drain. This largely precludes the possibil- connected backup disks. Once presented are encrypted with a key that only you ity of using GPS sensing, which is to the user, the files could then be up- have. The basic concept of OpenPaths is power-intensive – we use the iOS and loaded to the OpenPaths server. Since that by encrypting your data but not stor- Android location services that provide Apple's “fix” was already released, this updates when “significant location but populate the representation with your without advanced computational tools. change” [20] events occur based on cell- personal experience. There is, in other The workshops are intended both to in- tower and Wi-Fi-node triangulation. The words, a meaning in the data beyond the crease literacy as to the potential of loca- resulting data are similar in resolution to encoding, and OpenPaths has been used tion data (and the subsequent privacy Apple's original location caches, with a by individual artists applying a variety of implications) as well as to further dem- topography that suggests a trail of bread- tools to produce a wide range of inter- onstrate that the data are not inert and are crumbs rather than an uninterrupted GPS pretive pieces. These include a Process- subject to narrative and interpretation. path. Likewise, it is of higher quality in ing sketch by Bert Balcaen that recreates dense urban areas with well-documented a month in New York as a dance of parti- We feel that this is an important exercise WiFi – noise is frequently present in cle systems [22]; a 3D representation of in the era of big data. Kord Davis writes, suburban locales. Regardless, the apps Chris Woebken's path that he printed are effective in tracing individual move- with a MakerBot (Fig. 4); and a laser-cut Any context we create to turn data into information automatically as- ments, with a total of ~10000 active us- necklace showing a network of signifi- signs new characteristics to it, caus- ers as of this writing. cant points by Michael Massie com- ing data itself to become less anony- memorating a trip to Zurich [23]; my mous and more meaningful. And if own work, Quotidian Record, which we have enough data, we can corre- Fig. 3. The author’s path at ISEA2013 late, extrapolate, query, or extract Map data © 2013 Google maps 365 days of location data to 365 some very useful new information by rotations worth of music on a vinyl re- understanding the relationships be- cord [24]; a tool by the team at CartoDB tween those characteristics ... while that estimates total carbon consumption the value of that utility is growing by mode of transport [25]; and Wes exponentially in our time, so too is the unknown potential for unin- Grubbs’s workshop code (for Eyeo Fes- tended consequences... [28] tival, 2013) for finding the distance be- tween two people over the course of Hence a fundamental respect for the their travels, an exercise which proved individual is necessary when aggregating most compelling when applied to the personal data, as the resulting computa- data of two supposed strangers. tional models are tethered to pieces of the real world that carry personal weight. After Sue Huang's phone was stolen in From the standpoint of both pedagogy July of 2011, it continued to report its and practice, we need to cultivate empa- location to OpenPaths. With her assis- thy for the people involved in systems Participants access their data through the tance, we interpolated positions between [29]. OpenPaths website. Once you are logged each point and pulled the corresponding in, the platform is able to decrypt your Google Street View tiles, creating a “Participatory” implies individuals who location history and provide access in a video showing a point of view as if Goo- are supplying personal data from a per- variety of ways. CSV, JSON, and KML gle was driving the getaway car, which sonal device to a study or project be- formats can be directly downloaded, and we called Joyride [26]. This project cause they have an investment or interest an OAuth API [21] allows the system to points at the fiction of representation in the result. The population of Open- be polled for updates. Our intent is to woven by our media platforms with data, Paths users is constantly collecting data a provide a minimum viable feature set – and the estrangement possible when priori of any particular study, which cre- however, we do include a basic tool to personal data are separated from the ates the possibility of assembling ad hoc explore your data on a map. person. In fact, part of the pedagogical datasets for larger investigations. Open- purpose of OpenPaths is to ask what Paths includes the infrastructure for With this interface, you can watch an inhabits the tension of that abstraction. “projects” conducted by third parties. animation of your travel unfold. Viewing Project proposals are not curated by the one's geographic tracing is undeniably a To that end, we have conducted Open- platform admins, but are sent directly to compelling framework for personal nar- Paths workshops at Rhode Island School individual OpenPaths users who then rative. When you look at a map of your of Design, Eyebeam Art and Technology decide whether or not to contribute their activity, you see stories, and cannot help Center, and the School of Visual Arts in personal data. Proposals must include New York, following a model initially information on how the data will be proposed by design educator Daniel Fig. 4. 3D print of Chris Woebken’s path used, how they will be kept secure, and Photo © 2012 Brian House Goddemeyer [27]. Participants use how the project will benefit the Open- OpenPaths for a week to generate data- Paths community or the public at large. sets and then anonymously trade with On average, this opt-in model has pro- someone else in the group. Each partici- duced response rates typically around pant develops a presentation on what can 600 participants (6%) per project. This is be inferred from the data based on cross- small from a commercial standpoint, but examining them with other information significant for epidemiological or artistic together with personal knowledge and initiatives. intuition. Finally, this report is compared with testimony from the actual subject. Maintaining the encryption model of We have found, unsurprisingly, that a OpenPaths while allowing third-party tremendous amount can be learned about access requires what we think is an inno- an individual through this process, even vative security system. We employ an ent nature, and, in contrast, is an inten- tionally political body.

Mark Tuters and others have identified a post-locative practice that shifts empha- sis away from the tracing of individuals to the networks of interactions between objects [34]. Projects like MIT's Trash Track initiative [35] or Christien Mein- dertsma's Pig 05049 (2008) [36] exem- plify the proposition of theorists such as Latour to consider perspectives beyond the human subject [37]. Yet the post- locative should not ignore the human trace, given its ineluctability, and should seek to interrogate the nature of its data. In other words, the communication pro- tocols, encoding schemes, and user inter-

Fig. 7. “Mapping Habitual Geographies” Fig. 5. OpenPaths security model, © 2012 The New York Times Company © 2012 The New York Times Company exchange of revokable tokens, a simpli- patterns with the spread of the tiger fication of which is as follows. First, mosquito [31], and the “Science of Get- project owners (who must be registered ting Lost” [32]. Critically, OpenPaths OpenPaths users) request participation. does not curate or otherwise exclude This produces a request token for each project proposals, other than to verify user that is a hash of the researcher's key their completeness and legibility. Fur- and the participant identifier. If the par- ther, the platform supplies participants' ticipant approves the request, their key, unfiltered data to projects – there is no which is not otherwise stored in the sys- provision to attempt degrees of ano- tem, is encrypted with the request token nymization, as such a process is likely to to produce an access token. Meanwhile, fail [33]. This puts the onus on the par- the request token is eliminated. When the ticipants to make informed choices about researcher logs in to retrieve the data, the how their data should be used. request token is re-created and used to faces by which location information is unlock the access token, recover the A collective tracing of New York City, formed are not given – Google Maps, for participant's key, and decrypt the data. produced daily via participants in the example, may be the de facto standard This happens in parallel across all par- New York Times Company Research and on Android, but it is a system with de- ticipants. The platform facilitates the Development Lab's own “Mapping Ha- signed biases and can be contested as exchange of data but does not store them bitual Geographies”, has much in com- such. unencrypted and so does not maintain for mon with Amsterdam Realtime. It is a itself any privileged access. portrait of a city defined by its transitory OpenPaths seeks to inhabit this inflection dynamics. Yet where the earlier work point where the collection of location The result has been myriad projects in operates aesthetically and carries with it data creates a context in which to assess mobility research, art, urban planning, a certain foreboding, OpenPaths projects personal data in general, even while ac- self-tracking, data visualization, and are characterized by a situated politics. knowledging the particularly vital con- entrepreneurialism. Highlights include a First, the data mirrors that which have nection of the geographic tracing with “re-mapping” of China via longboard already been collected by the network the personal narrative about how it came [30], a comparison of human mobility operator and software provider, and sub- to be. We suggest that the erasure of sequently by unknown corporate or gov- context that comes with the encoding of ernment entities. As such, they already data can be restored through an actual, Fig. 6. OpenPaths commuting patterns, hold presumed utility from a commercial functional relationship with the individ- © 2013 Niamh ual via a respectful infrastructure. Our Rabbit, Trinity College Dublin or surveillance perspective, but that util- ity is restated, in an act of détournement, hope is that what we have proposed with in terms of scientific or artistic value as OpenPaths will serve as one model for the participants see fit. Secondly, the how the ethical exchange of data is both dataset held by AT&T, for example, possible and necessary. comprises an unwitting collective formed solely by consumer habits and/or the practical necessity of using a cell- phone. The voluntary and informed for- mation of a group of participants in an OpenPaths project has a markedly differ- References and Notes 15. Al Franken, letter to (April 20, 33. Nate Anderson, “‘Anonymized’ data really isn’t 2011), —and here’s why not”, Ars Technica (September 8, , accessed June 28, 2013. , accessed June ecrets-live-online-in-databases-of-ruin/>, accessed 28, 2013. 16. Jun Yang, “IPhone Users in South Korea Sue June 28, 2013. Apple for Collecting Data Without Consent”, 2. Mark Tuters and Kazys Varnelis, “Beyond Loca- Bloomberg.com, (August 17, 2011), 34. Mark Tuters, “Forget Psychogeography: The tive Media: Giving Shape to the Internet of Things”,

7. Natasha Singer, “If My Data Is an Open Book, 22. Bert Balcean, “35 days in NYC” (September Why Can’t I Read It?”, New York Times (May 25, 2012), blog post 2013). , accessed June 28, 2013. 8. “Global Positioning System”, Wikipedia: The Free Encyclopedia (Wikimedia Foundation Inc., 23. Michael Massie, “Geo2Jewelry” (November 14, updated July 3, 2013, 19:09 UTC), 2012), blog post , accessed June , accessed June 28, 2013. 9. “Hybrid positioning system”, Wikipedia: The Free Encyclopedia (Wikimedia Foundation Inc., 24. Brian House, Quotidian Record (2012), media updated June 27, 2013, 13:36 UTC), artwork, , ystem>, accessed June 28, 2013. accessed June 28, 2013.

10. Brian X. Chen, “Why and How Apple Is Col- 25. See . lecting Your iPhone Location Data”, WIRED (April 21, 2011), 26. Brian House, Joyride (2011), media artwork, , accessed hone-tracking/>, accessed June 28, 2013. June 28, 2013.

11. “Wardriving”, Wikipedia: The Free Encyclope- 27. Daniel Goddemeyer, Amit Pitaru, Noa Younse, dia (Wikimedia Foundation Inc., updated June 27, “Data Narratives”, workshop 2013, 18:31 UTC), , , ac- accessed June 28, 2013. cessed June 28, 2013. 28. Davis [18], p. 35. 12. Chen [10]. 29. Jer Thorp, “Make Data More Human”, TED 13. Alasdair Allan and Pete Warden, “Got an iPhone (November 2011), online lecture, or 3G iPad? Apple is recording your moves”, , accessed June 28, 2013. , accessed June 28, 2013. .

14. “Apple Q&A on Location Data”, Apple Inc., 31. See press release (April 27, 2011). .

32. See .