Remove from EXIF: geo info if too close to home

[jayvdb]

A privacy protecting EXIF stripper was mentioned on #97. Most important is removing

1. real name from copyright field, if the camera adds it and the user wishes to remain pseudonomous, or
2. geo info if it geolocates the person fairly accurately.

An external app to perform this isnt very helpful, as most users will want to keep EXIF on the media on their device, but upload to Commons without some of the EXIF, and possibly only remove it for some media. The user doesnt want to create a separate set of images before uploading.

E.g. I am not pseudonomous, so name doesnt bother me. And the internet knows roughly where I live and that is ok. However if I upload lots of images, I will likely have a large cluster of uploads nearer where I live and deductions could easily be made. To avoid that, I would prefer less specific geo info, creating an empty area within my upload geo infomation. Where I am living now, I would appreciate the geo being removed if it is within ~2kms of my home. However I have lived in places where there are only a few homes within 10km, so I would want geo removed for a wider region. Each person will have their own privacy considerations.

[jayvdb]

Also external apps tend to remove as much EXIF as possible, while Commons wants as much EXIF as possible.

[nicolas-raoul]

Related: http://softwarerecs.stackexchange.com/questions/1925/android-picture-privacy-filter-via-share-intents

[jayvdb]

http://softwarerecs.stackexchange.com/questions/1925/android-picture-privacy-filter-via-share-intents adds an interesting use-case that has been discussed a few times on Commons that I know of: endangered & protected species . Identifying their geolocation is problematic, but again the decisions should be per-image. While a rhino moves around a bit, a photo identifying a water hole with geo information is begging for the rhino to be poached. And the same problems exist for rare plants - an endangered herb doesnt move at all. Depending on its value, someone interested can look over a wide radius to find it, and they can do it methodically - time is on their side.

That thread mentions https://guardianproject.info/apps/obscuracam/ as a possible solution, which appears to be mostly about obscuring faces, and doesnt allow customisation of what EXIF data is removed from what I can see from a quick use of the app.

[nicolas-raoul]

Yes, that softwarerecs thread has no satisfying answers for now, I have just put it here for reference.

For the poaching, your input would be welcome at #182

[nicolas-raoul]

So, the app should let the user set the latitude/longitude of their home, and the app would reduce the precision of the GPS coordinates if too close, for instance 143.3245537653 becomes 143.32

[neslihanturan]

Actually I woudn't want to give my home latitude/longitude to an app. So what about adding a button on upload screen as "reduce precision of GPS coordinates" and even more user can choose the amount of it lets say up to 20km. And we of course should prepare an explanation text for the purpose of this.

[ilgazer]

I'm working on this.

[misaochan]

Copying over the discussion at #1712 . Let us continue it here. :)

misaochan:

I am very sorry that I missed the conversation at #181 - I personally disagree with reducing accuracy by 20km or even 10km. IMO, if the user is very concerned about anonymity, they should be encouraged to choose "Remove all location data", not to submit data that is up to 20km off. Because, I think, it is better to submit a picture with no geotag to Commons than one with such a markedly wrong geotag. Also, it seems that @jayvdb 's suggestion in that issue was to REMOVE the geotag if it fell within a certain range of home, not to modify it to a different geotag.

However, switching to the "remove if near home" method would be very time-consuming and this PR is already complete. Also, 100m or even 1km would be within the usual error range of GPS so the geotag might still be useful. So I would propose removing the 5km, 10km and 20km options from the Setting, and only letting the user choose 100m or 1km. @neslihanturan @nicolas-raoul @VojtechDostal What do you think?

@VojtechDostal :

I think we should be really careful with submitting deliberately imprecise coordinates. What does the Wikimedia Commons community think about that? Even 100m could be controversial. Some tools display Commons images as pins on a map. 100m shift will place the pins to a completely different position on a map. I'd rather add no coordinates than imprecise coordinates (or, if we decide to submit imprecise coordinates, we should be explicit about that and warn potential users using a tag or a template parameter).

@nicolas-raoul

I agree with @misaochan Unlike @VojtechDostal I am sure Commons prefers 100 meters error to no coordinates at all, because the biggest problem on Commons is pictures with no geographical information at all. Actually, many pictures are actually more than 100 meters from the subject.

@VojtechDostal

Then we should be more open about that and specify the precision used to fill in the template.

[Ayan-10]

@misaochan @nicolas-raoul @neslihanturan As recently a location picker is implemented to modify coordinates of already uploaded media PR: #4418, we are using it for editing location while uploading too PR: #4475.

1. So if user doesn't want to share the exact location of any picture, user can modify it using the coordinates modifier, by this, they can put any location they want to share for that picture.
2. A new button can be implemented in the location picker for totally removing coordinates from an upload. I think this will fulfill the need for issue #4495.
3. As we are getting suggestions about reducing the precision of GPS coordinates, that can be done too. But I think point 1. is resolving the need of reducing the precision of GPS coordinates.

[nicolas-raoul]

Allowing the user to either:

• Modify the picture's location using the location picker UI
• Completely remove the picture's location

... would indeed be enough, I think.

I suggest this workflow:

• If the pic has no coordinates: Suggest to the user to pick coordinates and open the location picker. (you have implemented this part already)
• If the pic has coordinates too close to home: Tell the user This picture's coordinates are close to your home. We suggest you modify the location or even remove it and open the location picker.
• If the pic has coordinates not too close to home: Do nothing special.

How does that sound?

[Ayan-10]

@nicolas-raoul So that means I have to implement a button in the location picker for removing the coordinates from UploadItem and another thing I think we don't know the user's home location, so we have to ask for it to the user. Is that ok?

And also if we already know the user's home location. why not automatically reduce the precision no matter what user does after seeing This picture's coordinates are close to your home. We suggest you modify the location or even remove it this dialog. By decreasing precision, I mean As you said in an earlier comment

for instance 143.3245537653 becomes 143.32

[brierjon]

@nicolas-raoul With the objectives of providing an uploader control over the privacy of their sensitive locations and trying to keep value for Commons. We should not be creating a tool that introduces error even with good intentions. From the way I'm reading this, the options should be:

• Maintain coordinates as recorded by EXIF - maintains the accuracy as captured when photographed. (can be modified on WikiCommons, but record of changes occur)
  

• Remove Coordinates, but tag with a broad Commons Geographic Category for the region ie [https://commons.wikimedia.org/wiki/Category:Marietta,_Ohio](https://commons.wikimedia.org/wiki/Category:Marietta,_Ohio) - gives the uploader privacy, but provides some value for Commons while exact coord is removed, but when uploading the selection of the category is a good indicator it is in an intended region not introduced after upload 
  

• Completely remove the picture's location - does not introduce location error, maximum privacy on upload, least value for commons
  

I don't agree "Modify the picture's location using the location picker UI" should be an option as it is deliberately introducing error to Commons unless it was flagged as this location was modified for privacy. We are better off not having the coordinates or flag for privacy as it removes the introduced errors and removes disclosing why coordinates were modified. Users could modify an image's EXIF in a separate program so this is not impossible, but the Commons App would not be lowering the effort to introduce the error.

@Ayan-10 If all photos for a location one wants to keep private are modified, if enough photos are uploaded the location is disclosed by the void or distortions when all coordinates are removed or one starts to notice all images in a region are modified over the normal GPS errors. If we don't collect the user's home region and let them choose this would mean less sensitive information captured by the app and still affording user's choice when to obscure. The lack of automation might also mean variation between users in when and where they choose to enforce EXIF modifications and make these locations more difficult to detect.

[jayvdb]

The "tag with a broad Commons Geographic Category" should probably do one of two things:

• Identify the broadness required to avoid being PII. A very good proxy for this would be - how many images are already in the category. If it is low, the category is too narrow to avoid being self-idenifying.
• Give the user a few options of categories to choose, from narrow to broad, with state/province as the broadest level that is reasonable. If this approach is taken, obviously inform the user that narrow is better and that they should pick the broadness based on their level of personal privacy concerns, probably preselect the most narrow, or the most likely sensible granularity of category.

[jayvdb]

If this is a wizard interface, perhaps a first step is asking if the image potentially geo-locates them in a way that makes the feel uncomfortable. If not, dont show any confusing options about reducing the precision of the image metadata.