Yeah, I linked to an Ars story about Franken, just didn't spell it out, and I do share some amusement in him being a senator now. Will be interesting to see the response this time, since the
one provided to Markey last summer was a handy quick summary into what Apple was doing location wise, and much easier to parse then the full
EULA.
Someone posted this on reddit
I figure this thread is as good a place as any to brain dump on this. I went to WWDC last year where the new Core Location system was discussed in great detail. If you went as well, or have the videos, look at the video for session 115, "Using Core Location in iOS". Skip to around 13:45 for the discussion of "Course Cell Positioning" where they discuss the cache in detail.
The purpose of this is offline GPS. Normally, each cell tower has an identifier and Core Location sends that identifier to Apple and asks for the lat/lon for that tower. This requires a data connection, and the use of data. Since cell towers don't move, however, it's inefficient to keep going back to Apple for that information so they cache it. Now if a tower appears with the same ID as the cache, tada! you have a cache hit and a faster fix with no data use. Which also means you can get a "course location" (as in rough) if you are near known towers and don't have a data connection.
That's all this is. It's a cache of identifiers (cell and wifi), locations, and their age (it's a cache, after all). Someone made the decision to never clean it out so they would have more and more information about those GPS "assists" (you know, A-GPS) and so they'd use less and less power and data over time for the places you frequent. It's a great idea, technically.
Practically, yes, you can track location over time. The file is readable only by root and you're free to encrypt your backups for now. I'm sure Apple will either encrypt the file or truncate the data in a future update (I would prefer encryption as I think it's technically sound, but I know many will disagree). I'm also sure someone is considering a toggle for the feature or a button to clear the database. Both are great ideas.
This isn't nefarious, this isn't being sent anywhere, and this isn't as bad as everyone is making it. This is a real feature with a major oversight. That's it.
The EULA does point out on page one how to disable anything location wise, and I'd assume it includes the population of the local cache. Will have to test myself if it is wiped if the switch is turned off, or just frozen at that point. Noone seems to be clear on that.
Location Data. Apple and its partners and licensees may provide certain services through your iPhone that rely upon location information. To provide these services, where available, Apple and its partners and licensees may transmit, collect, maintain, process and use your location data, including the real-time geographic location of your iPhone. The location data collected by Apple is collected in a form that does not personally identify you and may be used by Apple and its partners and licensees to provide location-based products and services. By using any location-based services on your iPhone, you agree and consent to Apple's and its partners' and licensees' transmission, collection, maintenance, processing and use of your location data to provide such products and services. You may withdraw this consent at any time by not using the location-based features or by turning off the Location Services setting on your iPhone. Not using these features will not impact the non location-based functionality of your iPhone. When using third party applications or services on the iPhone that use or provide location data, you are subject to and should review such third party's terms and privacy policy on use of location data by such third party applications or services.
The current iOS 3.2 implementation (it shipped on the iPad 1 first) was known about for a while, and the previous implementation has also been known about. More on it can be found
here, written by Alex Levinson, one of the people who first started investigating it.