Life under 24/7 GPS surveillance - A GPS ankle tag experiment

GPS ankle tags are used around the world in the criminal justice and immigration enforcement sectors, to monitor people's location 24/7. How do these tags work? What's the impact on people made to wear them? We've tested some to find out.

Long Read
Photo of a GPS ankle tag on someone's leg

Copyright: Bail for Immigration Detainees and Privacy International

With the introduction of GPS tracking of people on immigration bail, the UK has recently put GPS ankle tags, and their potential privacy and security issues, under the spotlight. PI has exposed the intrusive nature and shortcomings of these devices through technical explainers and complaints to the UK data protection and forensic science regulators.
But, what better way to understand the risks associated with a device than to actually use one? In order to further consolidate our understanding of GPS tags and expose their problematic features, PI procured two GPS tags and tested them in real conditions.
This investigation has given us a unique insight into the problems that can arise from using such devices and the consequences they can have in a real life situation. In this article we'll show concretely what using a GPS tag looks like, explore the features offered by the devices we tested, expose the issues we've encountered and how they could negatively impact the wearer. We hope this experiment will shine a more concrete light on the harms they can create and provide useful understanding of their functioning, for anyone seeking to challenge the use of GPS tags by authorities around the world.
In this experiment we acted both as controller and wearer of the device - so whenever we refer to what an "authority" can do, we mean whoever controls the device.

Disclaimer: This experimentation was led in a controlled environment by PI staff members who gave their consent for their data to be collected, processed and used within PI's work. Should you want to reproduce this experiment we recommend carefully assessing the security features and terms of use of the device.

A quick overview of the tags used

Much like any connected device today, GPS tags come in many shapes and forms. While access to models used by governments is usually limited and only available through public procurement contracts, it's possible to obtain alternative products with similar specifications. To get a better understanding of what different models can offer, PI procured two GPS tags: the Megastek Technologies MT60X and the ThinkRace TR40. Despite offering fairly similar features, the differences between those devices are significant.

Megastek Technologies - MT60X

The MT60X only offers GPRS connectivity (or 2.5G, an older and slower standard than 3G or 4G to connect to the internet through cellular network) and IP67 rating (meaning it can be used in a shower but not submerged - note that none of the devices were tested under water). It offers a fairly short battery life which translated into 20 hours of use between charges. This is in part because of its much smaller 750mAH battery but also possibly because we used it with a much shorter communication interval (i.e. the time interval at which it shares location information with the server) of 30 seconds. Charge time is about 2 to 3 hours. The MT60X comes with a charging base attached to a USB A cable of about 1 meter.

A presentation photo from the manufacturer of the MT60X with its charging base and tool to open

ThinkRace - TR40

In comparison, the TR40 is generally bigger and heavier, has an IP68 rating (making it theoretically waterproof and submergeable) and offers a much longer battery life that translated into 2-4 days of use between charges with charging time between 2 and 3 hours. This in part due to its 4000mAH battery but also because of its longer communication interval is 3 minutes, which means the device consumes less energy. On the communication side, it is capable of 3G and 4G meaning it can connect to the internet using different standards depending on availability (for example rural areas are more likely to only offer 3G). The TR40 comes with a magnetic charging connector, similar to Apple's "MagSafe" connectors. The supplied cable length is about 50cm. The device itself appears to run Android, as connecting the two data-lines on the magnetic connector presents an Android Phone to a computer.

Screenshot of Thinkrace's website presentation of the TR40

Both devices came with a secure strap and the tools necessary to open the strap and remove the device (which of course aren't provided to people tagged in the criminal justice or immigration enforcement systems). Both devices are capable of sending an alert to the authority in charge of the device if the strap is opened or tampered with. They both offer a dedicated physical SOS button, low battery alert, real-time tracking and geofencing alerts.
The MT60X comes equipped with a microphone and allows the authority in charge of the device to call the device (silently) to listen to the environment without the wearer being aware. This microphone is also used for the SOS feature, enabling the wearer to speak to the authority - without being able to hear back due to the lack of speaker. The TR40 has full two way communication with both a microphone and speaker. Depending on how many times the SOS button is pressed, it can call up to 3 different numbers at the operator's discretion.
The straps on both devices are hardened (and on the TR40, rubberised) to make cutting and tampering with difficult. Both have pre-cut holes for tightening the strap (and completing a circuit). Once the strap is connected neither device can be turned off locally - the TR40 can be turned off remotely.
| Feature | MT60X | TR40 |
| --------------------------- | ------ | -------- |
| Connectivity | GRPS | 3G/4G |
| Weight | 147g | 600g |
| Battery size | 750mAH | 4000mAH |
| Charging time | 2-3h | 3h |
| Battery life | 20h | 2-4 days |
| Communication interval set | 30s | 3 minute |
| IP rating | IP67 | IP68 |
| Microphone | Yes | Yes |
| Speaker | No | Yes |
| SOS function | Yes | Yes |
| Can be powered off locally | No | No |
| Can be powered off remotely | No | Yes |
| Real time location tracking | Yes | Yes |

Setup and features

Setting up the devices is pretty straightforward. It requires a few basic tools as well as a universal SIM card that will be used to communicate with the server. The SIM card needs to be able to access the internet. In this case, we used prepaid cards. SIM/Network selection is important due to the requirement of network coverage. The MT60 using the older GPRS also requires a network that still supports this protocol. The TR40 uses 4G (LTE), along with 3G for mobile coverage. Additionally the TR40 has a WIFI a/b/g/n 2.4 GHz receiver.

A GPS tag processes GPS signal to determine its location and then connects to the internet to share this data with a given server. The authority can then access this server and see the current location of the device and its location history. You can read more about how GPS tags function in our explainer.

Hardware - MT60X

The MT60X separated from the strap/charging part with the special tool needed for this operation
The main compartment can be opened with a 3mm hex nut screwdriver
The insides of the MT60X - on the right side we can see the battery, left side shows the SIM slot, SOC and rest of the components

Software - MT60X

Once the SIM card is installed the device needs to be configured via SMS, like the TR40. This is the only way to set up the device. Sending a specially crafted message to the SIM card allows the authority to change different settings.

Extract from the MT60X documentation explaining how to set the authorised number
Setting up the device, the first SMS defines the Access Point Name (APN) and the server the device will send data to. The second SMS defines the authorised number (the number allowed to change settings on the device and to call the tag) and communication

Using the same method we can set up the device to do geo-fencing (send an alarm when the tag leaves or enters a defined zone), define the communication interval (how often the tags send its geolocation), time zone, change tracking mode (the MT60X offers three tracking modes which define when the device should share location data depending on whether it receives new information or is moving - we used it in "vehicle mode", meaning it shares data at all times, even when not moving), etc. The authority can also send a request for the current location if the tag doesn't have access to the internet. Finally, the device will automatically send an SMS to the authority to share certain information such as if the belt is disconnected or if the battery is low.

Messages sent by the device to the authority. The message includes a status information (here that the belt is disconnected), date, time, and the real time location via a link to Google Maps.

Once the device is set up, the authority can access the real-time location and location history through a dedicated portal, using the tag ID and a defined password.

Hardware - TR40

The TR40 comes apart by removing the pentagonal screw on the tag's face, releasing the strap
Removing the battery (silver rectangle), and a black interposer (a barrier to water ingress), exposes the internal circuitry and the USIM slot
From North, clockwise: pickup for the strap (triggers alarm if circuit is broken), the main logic board with the USIM slot, to the right: battery connector (soldered), furthest South LTE/4G modem with black antenna, above this, black circular speaker, fin

Software - TR40

The TR40 can be configured in two ways, however initially it needs to be configured via SMS to reach internet connectivity. From there it can be configured using the manufacturer's dashboard.

Screenshot of TR40 SMS interface

Once the device has internet connectivity, it is far easier to configure the device online using the manufacturer's portal, which we will discuss further below.

More intrusive than your smartphone

From a technical standpoint, those devices are fairly close to a modern smartphone or smartwatch in terms of capabilities. They connect to the network using a SIM card, have a GPS chip, a speaker, a microphone... The similarities are such that some even consider the success of tracking devices as "luxury surveillance".
But there are key differences that make a GPS tag a much more invasive device. To start with the obvious, GPS tags are locked onto a limb, usually the ankle, and can only be removed by the authority that installed it. This can create serious discomfort as well as limit the wearer's ability to engage in certain activities such as running or swimming. It has also been shown to lead to physical and mental health issues. Second, only the authority has control over the device and its capabilities. This means the wearer does not have access to the data and cannot know how it is interpreted, isn't informed if the behaviour of the device changes (e.g. sends data more frequently), and in the case of the MT60X, isn't aware if the authority is listening to them at any given time.
We've all grown accustomed to having our smartphone with us at all times, but we're also confident that only we, and on rare occasions people we trust, have access to the device and the information it captures. Imagine yourself with your smartphone strapped to you at all times, but with no knowledge of what data it is collecting and sharing - that might give you a sense of what wearing a GPS tag feels like.

Using the tag on a daily basis

Using the tag on a daily basis was a different experience depending on the device. With the MT60X, the poor battery quality meant we needed to charge the tag at least once a day. Because of the short length of the cables provided with the charging bases, this means the wearer needs to have access to either a computer or a charging brick and stay very close to the charging source. Given the 2-3h for a full charge, the wearer would need to be physically locked to the power source for that amount of time. The short cable also makes charging at night difficult without a power cord extension. Under such circumstances, charging was mostly done when sitting at a desk near a computer, or on a couch.
These conditions are obviously highly constraining both during the day and while sleeping at night and can become very problematic if the wearer needs to be present somewhere at a given time (say for an official appointment). This is particularly problematic as the device only informs the wearer if battery levels falls under 15%. The MT60X does so through a LED, which means the wearer must keep an eye on it to avoid running out of battery.
In addition to the unpractical aspect of charging, wearing an ankle tag comes with physical discomfort. Our experience with the TR40 is that the strap is a little tight on one connection point, but too loose on the next - unfortunately due to the weight and size of the control unit it is more comfortable tight than flopping around. With a smaller unit and a more adjustable strap, the MT60 is easier to fit, but the strap is plastic rather than silicon as on the TR40, so doesn't feel as comfortable.

Accessing the data

From the authority's point of view, administrating the tag is relatively straightforward. Through a dedicated portal and using the device's ID and a password, we can access the data collected by the tag. Let's explore what the interfaces have to offer.

MT60X

For the MT60X, the landing page is a map showing where the tag is currently located, as well as status information such as battery percentage, GPS accuracy, network strength etc... The interface allows to manage multiple tags and view their location simultaneously.

Details provided for each data point

By clicking on "History", we can see the movements of the device over a specific period of time. We can see where the wearer was at a given time, identify frequently visited locations, and see all trips made on any given day. We can click on any given point of a trip to see detailed information such as battery percentage, network strength but also speed and whether the belt is on.

Example of a data point in a trip

TR40

The TR40 has a complete management portal, that is designed to be white-labelable by whomever the tag belongs to - i.e. the branding and look and feel are customisable by the authority running the tracking program. Furthermore, the TR40 is one of a number of tags compatible with Thinkrace's online system (they also produce smartwatches, vehicle trackers and personal alarms), all of which can be managed and assigned within one central portal. The portal itself has tiered access control so that different devices can be assigned to different operators, companies and/or subdivisions.

This screen allows you to see an overview of all devices and who they are assigned to, along with direct links to each tag for live tracking and looking at historical data.
This screen gives an overview of a specific tag and where it is at a given point in time. There are sections for heart rate and temperature monitoring, however our specific device didn't have these features.
Zooming in and out of the map allows the authority to see how often locations are visited in aggregate, which avoids having to look through the entire dataset to see if or how often a tracked individual has been to a certain location.
The data can however be played back with granularity if desired - in the example above you can see that at the time this data point was taken, the user was traveling at 10.3km/h and had traveled 76.69km on that day.
Here is an example of the data being captured by WiFi instead of using GPS (because it's on a known WiFi network)
Setting geofencing is easily configured in the web interface, by drawing an area on the map, and selecting whether to notify of entry, exit or both. As many geofenced areas can be created as the operator desires.

Settings

There are two different settings areas in the administrative interface, one dedicated to the tag itself and the other to settings about the tagged individual.

This is the device settings pane, where the authority can configure device settings, similar to the options available over SMS.

There are a few extra commands available here, such as being able to remotely turn off the device and "locate" the device (which makes it play a tune so the device can be found). Finally the operator can choose the communication interval and what numbers the SOS button is authorised to contact.

In this pane, the operator can configure the information about the tracked individual.

Setting the Location field also adds the individual's "home" address allowing for the tag to know when the user is at that address (e.g. for the purposes of facilitating curfew monitoring).

When technology betrays you

You may think - and that's what authorities think as well - that GPS data is an accurate representation of the wearer’s whereabouts. But believing that a satellite-based technology with an accuracy of 5-10 meters is capable of providing such a reliable picture of reality is quite a leap of faith.
Being in a position where we had access to both the data and the actual location of the wearer, we were able to identify a number of instances where the location recorded was less than accurate, up to the point where the wearer was marked in a different street than its actual location. The location data could even be inaccurate when the wearer was at home, not moving. In this situation, the tag had already determined its location and didn't update it because of the lack of movement, leading to the wrong location being recorded for 6 hours. That error made the data look like the wearer wasn't home but was rather on the next street for that period of time.

Example of a wrong location point

Data accuracy can be impacted by other factors. Limited network access for example can be problematic. While both tags have an internal memory and are capable of storing the location when no network is available, disappearing from the map for a few minutes could trigger an alarm and alert the authority. This is a behaviour we observed both when using the subway and in certain concert venues. In both instance, no GPS data was actually recorded in that time because of the lack of connectivity (GPS relies on line of sight, which translated to a lack of data).
All those issues would be annoying at best with a smartphone, but they can become dramatic when this data is used to assess whether someone is complying with their bail conditions.

Inferring is everything

Ultimately the main problem with GPS tags when used in a criminal justice or immigration enforcement context is how data is inferred. Technical issues will always amplify these problems but even in a best case scenario, no perfectly accurate data will ever be able to actually translate what the person wearing the tag is going through or doing.
Trail data can be interpreted in many different ways to draw conclusions about an individual’s lifestyle – that is, the meaning or significance of a particular movement or activity will likely be interpreted in widely divergent ways by different people. In an immigration enforcement context, this can lead to significant decisions being taken on the basis of subjective interpretations of an individual’s movements and activities. Combined with issues of accuracy, this can lead immigration authorities to make fundamentally wrong assumptions about an individual’s movements and activities.
For example, regularly going to a corner shop late at night can easily be interpreted as someone buying alcohol, when they're actually getting food. Regularly visiting a religious or political location can be interpreted as activism or extremism. Going to an unregistered office space regularly for a couple of weeks could mean illegal work. We make data say whatever we want with the wrong intentions. And inaccurate data can only help make the case. Why weren't you home for 6 hours but in the next street? Why did your signal disappear for a few hours? Did you put your tag in a faraday cage? We cannot possibly rely on location data alone to give us an accurate picture of a person's behaviour.

From an experiment to the real world

Throughout our experiment, we were always free to take the tag off, whether because it was too inconvenient to wear, because we had to go to an important meeting, because the battery level was too low, or just because we were doing this experiment as part of our job and wanted a break from it. That's a privilege that people tagged by immigration authorities or the criminal justice system don't have - they are forced to deal with all the inconveniences the device brings.
While for us, wearing the tag in public felt stigmatising and introduced and a certain level of internalisation of wrongdoing or being under suspicion of wrongdoing, we were still in a position of willing wearers with total control over the device and the data it collected. As such, we acknowledge we are not the best placed to talk about perceived or actual stigma of wearing a tag.
Nonetheless, these impressions are consistent, to a lesser degree, with testimonies collected from people who have been forced to wear GPS tags. Being constantly monitored and knowing that each and every one of your movement could be used against you puts wearers in a situation of stress that exacerbates the already vulnerable situation they're placed in. Studies like BID's report on the mental and physical health impacts of tags or Monish Bhatia's research on Racial surveillance and the mental health impacts of electronic monitoring on migrants have demonstrated the serious psychological trauma that tagging can lead to. These studies expose the anxiety, stress, discomfort, and pain experienced by GPS tag wearers, and report increased feelings of social stigmatisation, isolation and avoidance of public spaces and activities.

Conclusion

UK immigration authorities present GPS tagging as a way to prevent migrants absconding or breaching their immigration bail conditions - but the scheme also allows them to use location data to make substantive decisions on individual asylum and immigration applications. Originally confined to cohorts of "very high harm offenders", the UK has now rolled out GPS tags to monitor people who arrive to its shores by "unnecessary and dangerous routes".
Our tech experiment showed that GPS tags are physically burdensome - they're simply uncomfortable and can hurt, and all their charging requirements makes life difficult. Wearing them brings up a sense of stigma. On the data side, the tags' various features and settings have a significant impact on how much data is collected and whether it's accurate, but authorities in the UK have never been transparent about what features they use nor settings they set. And, the 24/7 constant surveillance is profoundly intrusive - something we did not experience, since in our experiment we were both subject and controller, but seeing the amount and granularity of the data our tags produced was scary.
Using such an intrusive and imperfect technology to surveil and control people in vulnerable situations, and to make life-changing decisions about them, is concerning. We've previously made a legal complaint about its data protection and privacy implications, and are calling on immigration authorities to stop the practice altogether.