place originates with 20th century German philosopher Martin Heidegger who described human existence in terms of dasein, a German word that can be translated as “human existence,” or perhaps more helpfully as “being there.” The important thing for us here is to understand that dasein is always in the world.k As humans we enter a preexisting world of things and other people and develop our sense of self by (and only by) interacting with them. According to Heidegger, an in-authentic existence is one in which the individual fails to distinguish him or herself from the surrounding crowd and its priorities.

Humanistic geographers have taken up the concept of dasein, using it to explore the role of place in human existence. In his 2007 book Place and Experience: A Philosophical Topography, Jeff Malpas invoked dasein and related concepts of spaciality and agency to show that place is primary to the construction of meaning and society.l, 19

Using these concepts, this article now aims to characterize the potential impact of LBA, the objective of which is to alter the ever-present, ongoing human process of interaction with the immediate surroundings. LBA attempts to shift intentionality, diverting consciousness from an experience of the immediate surroundings to the consumption of advertised goods. In Heideggerian terms, LBA interferes directly with the individual’s project of crafting an authentic existence.

Consider the following situation, developed in two stages: A family is seated at their dining room table enjoying dinner together, but there is an exception—the father, a relentless worker, is reading texts and email messages instead of joining the conversation. One could say he is no longer present. He has left the place. Or to turn it around, as far as the father is concerned, the dinner table is no lon- k This concept has had profound influence on the field of artificial intelligence; for example, Philip Agre explicitly applied Heideggerian thought in moving the practice of computational psychology away from cognition and toward action in the world. 2

ger a “place” with familial meaning but merely a location for eating. Now, to complete the example, assume that someone who wants to communicate with the father from afar knows when he is at the table and chooses that time to send texts. The texter now has the ability to disrupt the father’s relationship with the family dinner, a relationship often filled with a strong, even defining, sense of meaning.

The dinner table is a natural example for the author,m but one might consider a walk through one’s hometown, visiting an old high school, or attending a play. LBA has the potential to detract from the experience of these familiar and meaning-filled environs. One’s surroundings may thus lose their “ pla-ceness” through LBA, including their meaning, and become merely a path to be traversed. As places become locations, meaning is lost to the individual. That is, we lose some of ourselves, as well as one of the critical processes through which we become a self.

 

Location Anonymity
Having established the importance of
location privacy, is it necessary to for-
go the benefits of LBS and LBA? Fortu-
nately the answer is no, but it needs to
be clear to data collectors that it is not
sufficient to simply scrub names and
phone numbers from location traces.
As AOL15 and Netflix21 have learned,
supposedly anonymous datasets are
often susceptible to correlation at-
tacks in which datasets are associated
with individuals through comparison
of the datasets to previously collected
data. Netflix is particularly instructive;
in 2006 it issued a public challenge
to develop a better movie-recommen-
dation system. 22 As part of the chal-
lenge, it released training data consist-
ing “of more than 100 million ratings
from over 480,000 randomly chosen,
anonymous customers on nearly 18
thousand movie titles.” Within weeks,
computer scientists Arvind Narayanan
and Vitaly Shmatikov had showed the
data was not as anonymous as Netflix
might have thought. Narayanan and
Shmatikov devised an elegant algo-
rithm that correlated the NetFlix data
with other publicly available data and
m He would never be allowed to behave like the
father in the example.

thus identified a number of users in the Netflix training data. 21 Along the way, they developed rules of thumb for such correlation attacks, noting such attacks work well when they emphasize rare attributes and that the winning match should have a much higher score than the second-place match. The first can be understood intuitively; a marketer would learn more from the knowledge that someone has purchased the author’s most recent text on error-control coding than from finding that someone has purchased a Harry Potter book. The second rule is equally intuitive, as it is intended to avoid false positives.

Here, these rules are useful for developing a Shannon-theoretic model for correlation attacks on supposedly anonymized location traces. In his 1949 paper “Communication Theory of Secrecy Systems,” 24 Claude Shannon defined unicity distance as the minimum amount of ciphertext needed before uncertainty about a piece of plaintext could be reduced to zero. The translation to the de-anonymization of location traces is clear; the continued accumulation of location data may reach a point where a marketer can uniquely match an anonymous location trace to a named record in a separate database.

The goal in this article is not a specific number as a cutoff for data accumulation or an all-encompassing framework into which all de-anonymizing attacks have a place. Rather, it develops an example model and evaluates its dynamics—how the structure of the model changes as the amount of location data increases—in order to craft design rules for anonymous LBS.

A Shannon-theoretic approach to location anonymity. Let a marketing database S consist of a collection of binary preference vectors {Xi} of length n, where the index i indicates a specific user. The individual vectors have the form

 

xi = (xi,0,xi, 1,xi, 2,…,xi,n– 1); xi,j ∈ {0, 1,e} Each coordinate xi,j is a binary indicator representing the user i’s preference with regard to some specific item, belief, or behavior; for example, xi,0 might indicate whether the user likes cats (yes or no), and xi, 1 might