When you say “breach”, this implies legal noncompliance which depends on where you are. In Europe the data collection you describe would be a breach. In the US, it’d be a lawful attack on your privacy.

Is location sensitive?

Of course your timestamped realtime location history is sensitive information. If you think having your realtime whereabouts tracked doesn’t matter then you most likely have little interest in privacy in the first place¹. In which case I’d say fair enough, but then what are you doing in the cybersecurity magazine?

Boycotts are a thing, not just privacy

Some of us boycott surveillance capitalists (#GAFAM). There’s a lot of data that we might not give a shit if they collected in the absence of our boycott (though not location tracking- that’s sensitive anyway). Boycotting does not just mean not paying them. It means not recklessly disclosing profitable data to them. In principle I don’t give a shit if Microsoft records my favourite color. But if MS figures out how to profit from that info in some way, then I’m interested in witholding it from MS. And indeed that’s still a privacy matter nontheless because #privacy is about control.

footnotes (TL;DR: why location history is sensitive info)

1. Further elaboration: Everyone decides for themselves what info is sensitive to their operations which then serves as input to the threat model. It’s not for you to speak for everyone in saying “info X is not sensitive”. Some people who live quite simple lives may not regard time and location history as sensitive, but this flies in the face of those who deem it sensitive. You should first consider the obvious cases which trivially disprove your claim: Bin Ladin, Edward Snowden, anyone wanted by law enforcement. But to be clear, you need not be high profile or even be a refugee/undocumented immigrant for realtime location to matter. Someone might be an abortion client whose location was recorded in the parking lot of an abortion clinic in a state that has banned it. Someone’s location might be that of where their extramarital affair takes place. There are countless examples. Let me know if you need more.

(edit)
Know your audience

I fixated on your #falseAnalogy fallacy and overlooked this:

because it’s the users themselves that have chosen to use WiFi and to broadcast the SSID

Even if you do not broadcast your #SSID it’s still publicly available. It’s in that air traffic Google was caught overcollecting. If someone chooses to hide their SSID, you could say that’s an expression of intent & collection of that data is thus a breach. Even in the US, if someone uses a weak WEP they still at least get legal protections from intrusions. Generally, legal protections in the US kick in when expression of intent or authority is disclosed.

Most importantly, you’ve missed the thesis. The article is not for those who are happy to disclose their SSID & all the associated tracking of their phone then searching for that SSID wherever they are. The article is for those who specifically opt not to disclose. You are using the intent of audience A to falsely imply intentions of audience B. Audience A would have skipped this article just based on the title alone.

Good to know. I think I have an old no-name one in storage I might dig out & try at some point. But that effort is worse than buying one. So for the moment I’m stuck with attempting reverse tethering.

I love the swiss-army-knife that #openVPN could have been, had they not tried to nanny users by forcing encryption.