"A coordinate is a confession. I know where you sleep, where you pray, and which side street you take to avoid your ex. And a $30 radio can convince me you are somewhere you have never been."
An Omniscient AI Agent
The Big Picture
Every technique earlier in this chapter turned radio signals into a position estimate. This section studies what happens when that estimate becomes a liability rather than an asset. Location data is uniquely dangerous on two fronts at once. It leaks: a trajectory is a near-unique biometric that resists anonymization and exposes home, work, health, and belief. It lies: the civilian GNSS signals your device trusts are unauthenticated and roughly \(10^{16}\) times weaker than a terrestrial transmitter, so an adversary can overwrite them with a spoofed reality. A sensory-AI system that ingests position without treating both risks builds surveillance and accepts hijacked inputs. You need the ideas here whether you are shipping a fitness tracker, an autonomous vehicle, or a drone.
This section assumes you understand how a position fix is formed from pseudoranges (Section 25.1), how RF fingerprints identify a location (Sections 25.2 and 25.3), and how inertial dead reckoning provides an independent motion estimate (Chapter 24). It also draws on the leakage-safe dataset discipline from Chapter 5 and the probability primer in Chapter 4. We advance the deploy verb: making localization trustworthy enough to ship.
Why a trajectory is a biometric, not a data point
What is the privacy problem? People assume that stripping names from a location log makes it anonymous. It does not. A trajectory has enormous entropy. The classic result from de Montjoye and colleagues showed that in a de-identified dataset of 1.5 million people, four approximate spatiotemporal points were enough to uniquely single out 95% of individuals. Two points still isolated more than half. Human mobility is that idiosyncratic.
Why does this happen? Two points dominate the identification: the most-visited nighttime cluster (almost always a home) and the most-visited daytime cluster (usually a workplace). The home-work pair alone is close to a fingerprint. Formally, the re-identification risk of a released trajectory set scales with the number of quasi-identifier points \(p\) an attacker holds. Empirically the fraction of uniquely identifiable users \(u\) rises steeply with resolution and with \(p\):
$$u(p) \approx 1 - (1 - \varepsilon)^{\,\alpha p}$$where \(\varepsilon\) captures spatial-temporal resolution and \(\alpha\) the population sparsity. Coarsening the grid lowers \(\varepsilon\), which is why aggregation helps, but only slowly: uniqueness decays as a power law of resolution, so you must throw away a lot of precision to buy a little privacy.
How is this exploited in practice? Data brokers buy raw ad-SDK location feeds, join them against public voter files or property records at the home cluster, and resell named movement histories. Visits to a specific clinic, place of worship, or protest become inferable attributes. This is the biometric-privacy thread that runs through the whole book (see Chapter 34); location is arguably the most re-identifiable modality of all because it is continuous and self-labeling.
Key Insight
Anonymization of location data is not a checkbox you apply at export; it is a property you must prove against an attacker model. "We removed the user ID" defends against nothing when the trajectory itself is the identifier. Design for the assumption that any raw coordinate stream you store or transmit can and will be re-linked to a named person.
Defenses that actually change the risk
Three families of defense move the needle, in increasing strength. Spatial cloaking and \(k\)-anonymity report a region containing at least \(k\) users rather than a point; cheap, but broken by repeated queries and by the home-cluster attack above. On-device processing keeps the raw trajectory on the phone and emits only derived, non-invertible features (step count, geofence-crossing events), which is the federated-learning philosophy of Chapter 64. Differential privacy (DP) gives a provable guarantee: a mechanism \(M\) is \(\epsilon\)-differentially private if for adjacent datasets \(D, D'\) and any output \(S\),
$$\Pr[M(D) \in S] \le e^{\epsilon}\,\Pr[M(D') \in S].$$Geo-indistinguishability adapts DP to space by adding planar Laplace noise scaled to a privacy budget per query, so nearby locations are statistically indistinguishable within a radius you choose. Apple and Google both deploy DP-style perturbation for aggregate mobility statistics. The engineering catch is the privacy-utility curve: a navigation app cannot tolerate kilometers of noise, so DP fits aggregate analytics far better than real-time routing.
Practical Example: the fitness heatmap that mapped a war zone
In 2018 a consumer wearable company published a global "heatmap" of aggregated running and cycling routes. The aggregation looked safe: no names, billions of points, just glowing lines of popular paths. But in remote regions the only people wearing GPS watches were foreign soldiers, so the heatmap traced the perimeter, internal roads, and jogging loops of otherwise-secret military bases. Aggregation had not destroyed the signal; it had concentrated it. The lesson for any sensory-AI product: privacy risk is contextual and adversarial, and a defense that works for a dense city can fail catastrophically for a sparse subpopulation. Suppressing low-density cells (a minimum-count threshold) was the missing control.
Spoofing and jamming: when the signal itself lies
What is the integrity problem? Civilian GPS (the L1 C/A code) is public, unencrypted, and unauthenticated. A receiver believes any signal that correlates with the known code and yields a consistent navigation solution. Two attacks follow. Jamming raises the noise floor with broadband RF so the receiver loses lock; it is a denial of service, obvious because the fix disappears. Spoofing is worse: the attacker transmits counterfeit satellite signals, slightly stronger than the real ones, and walks the victim's solution smoothly away from the truth. Done well, the receiver never reports an error; it reports a confident, wrong position.
Why is it feasible? The received power from a GPS satellite at ground level is around \(-160\ \text{dBW}\), weaker than the thermal noise floor. A software-defined radio a few hundred meters away can dominate that by tens of decibels with milliwatts. Open-source spoofing stacks and sub-$300 hardware have made this a hobbyist-grade attack, which is why it graduated from a research curiosity to a routine hazard for maritime and aviation traffic near contested regions.
How do you defend at the algorithm level? You never trust GNSS alone. The defenses form layers, and most are cheap consistency checks a model can run:
- Physical-consistency gating. Cross-check the GNSS position and velocity against an independent inertial estimate (Chapter 23). A jump that implies impossible acceleration is a spoof, not a maneuver. This is the same innovation-monitoring logic used in the Kalman fusion of Section 25.5 and generalized in Chapter 68.
- Signal-level anomalies. A sudden, uniform jump in carrier-to-noise ratio \(C/N_0\) across all channels, or an automatic-gain-control drop, betrays an over-powered transmitter.
- Cryptographic authentication. Galileo's OSNMA signs the navigation message so a receiver can verify the data was minted by the constellation, defeating message-replay spoofers.
- Angle-of-arrival checks. Real satellites arrive from many directions; a single spoofer arrives from one, which a controlled-reception-pattern or multi-antenna array can detect.
Right Tool: consistency checks you do not hand-roll in production
The innovation-gating spoof detector below is about 20 lines of NumPy for teaching. In a shipped estimator you fold the same test into a robust filter: filterpy exposes the Kalman innovation and its covariance directly, so a Mahalanobis gate plus a chi-squared threshold is roughly 3 lines instead of 20, and it inherits the tuned process and measurement noise you already maintain. The library handles the covariance bookkeeping, the numerically stable inverse, and the per-update residual you would otherwise recompute by hand.
The snippet below implements the physical-consistency idea directly: it flags a GNSS fix whenever the implied jump from the last inertial-propagated position exceeds what the platform's dynamics allow, expressed as a Mahalanobis distance against the fused uncertainty.
import numpy as np
def spoof_gate(gnss_xy, pred_xy, cov, chi2_thresh=13.8):
"""Flag a GNSS fix inconsistent with the inertial-predicted state.
gnss_xy, pred_xy: 2D positions (m). cov: 2x2 predicted-position
covariance (m^2). chi2_thresh: 0.999 quantile of chi-square, df=2.
Returns (is_spoof, mahalanobis_d2)."""
innov = np.asarray(gnss_xy) - np.asarray(pred_xy) # residual
d2 = float(innov @ np.linalg.solve(cov, innov)) # Mahalanobis^2
return d2 > chi2_thresh, d2
# Honest fix: within 1 sigma of the dead-reckoned prediction
pred = np.array([100.0, 50.0])
P = np.array([[9.0, 0.0], [0.0, 9.0]]) # 3 m std each axis
print(spoof_gate(pred + [2.5, -1.0], pred, P)) # (False, ~0.9)
# Spoofed fix: a smooth 40 m pull the dynamics cannot explain
print(spoof_gate(pred + [40.0, 0.0], pred, P)) # (True, ~177)
Notice the tuning tension echoed from Section 25.6: too tight a threshold rejects honest fixes during real dynamics; too loose lets a slow "walk-off" spoof through under the gate. The right threshold is a per-platform decision informed by the dynamics model, not a universal constant, which is why calibrated uncertainty (Chapter 18) matters as much here as it does for any learned model.
Key Insight
Jamming attacks your availability; spoofing attacks your integrity. Availability failures announce themselves (the fix vanishes). Integrity failures are silent by design: a confident wrong number is more dangerous than a missing one. Every localization system that can affect the physical world must therefore carry an independent check that answers "should I believe this position at all?" before it answers "where am I?"
Threat modeling location for a real product
When do you invest in which defense? Match the control to the consequence. A step counter that never leaves the wrist needs on-device processing and minimum-count aggregation, and can ignore spoofing entirely. A ride-hailing backend that stores millions of trajectories needs DP for its analytics exports and strict retention limits, because its dominant risk is the biometric-leak class, not the RF-attack class. An autonomous vehicle or a delivery drone inverts the priority: a spoofed position can drive it into traffic, so multi-sensor consistency gating, signal-authentication where available, and a safe-stop fallback are non-negotiable, while the privacy of its own pose matters less. Write the attacker down first (who, what capability, what payoff), then pick defenses; a control chosen without a threat model is theater.
Exercise
Take a public taxi-trajectory dataset (for example the Porto or NYC taxi logs). (1) Keep only the first and last GPS point of each trip and measure what fraction of trips become uniquely identifiable by that pair alone; compare against using two random interior points. (2) Snap all points to a 500 m grid and re-measure. Plot the uniqueness-versus-grid-size curve and estimate the resolution needed to push uniqueness below 10%. (3) Simulate a walk-off spoof by adding a linearly growing offset to one trip's coordinates, then tune the chi2_thresh in the snippet so your gate catches it before the offset exceeds 25 m without firing on honest GPS noise.
Self-Check
1. Why does removing user IDs from a location dataset fail to anonymize it, and which two clustered points carry most of the re-identification power?
2. Distinguish jamming from spoofing in terms of which security property each attacks and which one a receiver can detect more easily on its own.
3. A colleague proposes protecting a turn-by-turn navigation app with differential privacy by adding 500 m of planar Laplace noise to every fix. Why is this the wrong defense for that product, and what would you use instead?
Lab 25
fuse GNSS and inertial readings for a smoother, drift-corrected trajectory.
Bibliography
Location privacy and re-identification
The landmark result that four spatiotemporal points re-identify 95% of individuals; the quantitative backbone of the "trajectory is a biometric" argument.
Adapts differential privacy to geographic space with the planar Laplace mechanism; the formal basis for provable location perturbation.
Introduced spatial-temporal cloaking and location k-anonymity; the baseline defense whose limits motivate stronger guarantees.
GNSS spoofing, jamming, and authentication
The foundational demonstration of a practical portable civilian-GPS spoofer; defined the walk-off attack this section defends against.
Psiaki, M. L. and Humphreys, T. E. (2016). GNSS Spoofing and Detection. Proceedings of the IEEE.
Comprehensive survey of spoofing mechanisms and detection strategies, including C/N0, angle-of-arrival, and consistency-based methods.
The deployed cryptographic navigation-message authentication scheme; the reference for signal-level anti-spoofing at constellation scale.
Regulation and reference software
European Parliament (2016). General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
Establishes location data as personal data with purpose-limitation and minimization duties; the legal frame every location product ships under.
Labbe, R. (2018). FilterPy: Kalman and Bayesian Filters in Python.
Reference filtering library exposing the innovation and its covariance, turning the spoof-gate of this section into a few maintained lines.
What's Next
In Chapter 26, we shift from where a person is to what they are doing. Human activity and behavior recognition turns the same inertial and location streams into labels like walking, cycling, or falling, and it inherits every privacy lesson from this section: a rich activity trace is as re-identifying as a trajectory, and the models that read it must be as robust to spoofed inputs as they are accurate on honest ones.