On Monday, the AP dropped a big scoop about a rising Republican star who has been using taxpayer money and campaign funds to finance personal trips around the country. The AP journalists said the source for the takedown was Instagram:
"The AP tracked [Illinois Rep. Aaron] Schock's reliance on the aircraft partly through the congressman's penchant for uploading pictures and videos of himself to his Instagram account. The AP extracted location data associated with each image then correlated it with flight records showing airport stopovers and expenses later billed for air travel against Schock's office and campaign records."
The AP journalists "extracted location data" using the Instagram API, but you can also do this at home by looking at a user's Instagram photo map. By default, Instagram strips metadata — including location coordinates — off photos that are uploaded to the network, but users can elect to add location information when they post, which then displays those geo-tagged photos on a map. (If a phone's privacy settings are such that they don't record location when they take a photo, the location that gets displayed is where the phone is when the photo gets uploaded, not necessarily where the photo was actually taken.) It's this information that got Schock busted.
Schock's free-wheeling Instagram account is not the first time location information from the social network has fueled a news story. Last year, when Russia claimed it hadn't invaded Ukraine, Buzzfeed discovered that a selfie-posting Russian soldier had included location information on his Instagram photos that revealed that he and his unit were in Ukrainian territory.
Location display on Instagram photos is "off" by default, but if you decide to toggle the "add to photo map" switch to blue—a.k.a. "yes, share my whereabouts!"—it stays that way until you toggle it back to the "no" position. So if you forget you turned it on one time, you may be leaving behind a trail of geolocation info that you don't actually want exposed to the world.
I took a stroll through some famous people's Instagram accounts and discovered that a few of them seem to be unintentionally attaching location information to their photos.
The list includes Michelle Obama, whose recent photos have all been geotagged, but who might not necessarily want to reveal her whereabouts for security reasons. Many of her photos were uploaded from the White House (obviously), but quite a few—including one of the Obama dogs in front of the White House—were uploaded from the Adams Morgan neighborhood, which may reveal where the social media person running her account lives or works:
The White House press office did not respond to an emailed request for comment.
Oscar nominee Reese Witherspoon is also leaking location information from her Instagram account. Photos taken on Sunday night before, during and after the awards ceremony were uploaded from all over Los Angeles, and may reveal where she—or the person who runs her account—live or work. These photos were uploaded on the spot from right around the Dolby Theater where the Oscars were held:
But these other photos from the night—including one with fellow nominee Robert Duvall at the Vanity Fair Oscar after-party —were uploaded later from a location on Venice Beach, far away from the festivities:
Maybe Witherspoon—or her Instagram handler—wants the public to know where she's uploading photos, but it seems like a surprising decision from someone so high-profile. The Instagram location tagging is incredibly granular, down to revealing what house you are in when you upload a photo:
Witherspoon's publicist did not respond to email and phone requests for comment. Update: After this post was published, Witherspoon removed the location information from her Instagram account.
Justin Bieber has included his location on just one Instagram post—a video of himself dancing as a Power Ranger last Halloween at what appears to be a club in the outskirts of Toronto.
Even Queen Beyonce has let her location slip in Instagram posts. This post from October 2013 of her on the beach with her daughter…
… was uploaded from the middle of Brooklyn.
Beyonce has since turned off location on her photos. If she wanted to actually remove the locations from the photos, she could go into her photo map and edit the location data off.
Like Bey, Miley Cyrus tagged her photos with locations for a brief period about a year ago before stopping.
Other celebrities are less generous about sharing their locations. Channing Tatum, Taylor Swift, Kim Kardashian West, and LeBron James, for example, have never uploaded location information, meaning the "location" button that would lead to their photo maps is a lighter color of gray and unclickable.
Kim Kardashian should talk to her sister Khloe, though, who is including her location in Instagram photos. A photo of her in lingerie may lose a little bit of its sex appeal when you see it was uploaded from a Mexican restaurant … unless lace combined with guacamole is your kind of thing. As you can see here, if you zoom in on any of the photo maps in Instagram, the location information gets pretty granular:
Digital security is hard! These celebrities may actually be comfortable revealing where they (or their Instagram account managers) are when they post these photos, but it seems doubtful. Given how many ways we can unintentionally leak information about ourselves in the digital age—and the desperation of obsessed fans—it seems like every celebrity should have a digital security consultant to make sure their information is locked down and not accessible to creepy stalkers. And of course, it always helps if platforms remind you when you're leaking information. Instagram may want to remind people to check out their photo maps from time to time to remind them how much they're revealing.
In the meantime, I hope Rep. Schock's troubles serve as a warning about the potential danger lurking in that little blue button and documenting your whereabouts for the world — and pesky journalists — to see.
*This story was corrected to clarify that AP journalists used the Instagram API to pull Schock's location coordinates and to say that Instagram users can remove location data from their photos retroactively. H/T for latter: @lainnafader