GoKawiilThe FBI has confirmed to the Senate it is once again buying data which can be used to track the locations of US citizens. That may have surprised the people who thought the precedent in Carpenter v. United States prohibited it. But while that case examined if it was legal for law enforcement to obtain location data from mobile networks without a warrant, here the FBI and other agencies have found a way to skirt the Fourth Amendment entirely. Over the last few years, they have taken to just buying location data from the same companies which power the enormous online advertising ecosystem.
Where does this data come from?
When your phone is connected to the internet, it broadcasts about itself, and so do the apps and platforms you use. That information includes your IP address and device type, as well as your longitude and latitude if your device has GPS. This data, known as Bidstream, alongside any third party cookies tied to your device, enables the process of Real Time Bidding (RTB) . RTB is the process where your attention is auctioned off to the highest bidder in the milliseconds after you’ve loaded a page. In order to make the auctions work, these platforms need to know as much about you as they can.
As I explained in depth back in 2021 , data such as your location and IP address is broadcast over the ad networks. This information can also be aggregated, licensed or sold to data brokers who can pair this with any “deterministic data” available. For instance, if you sign up to a platform and tell them your name, email address and annual income, that data could be licensed to a data broker. Even banks looking for new revenue streams are planning to license anonymized customer data to these companies. Data brokers can easily combine the two streams of information to build out a fairly extensive picture of you as a person, and what advertisers will be the most interested in you. Unfortunately, it’s extremely difficult to opt out of this and, even if it were, it would be even more difficult to destroy the data already in circulation.
Advertisement Advertisement
In 2018 French company Vectaury, which acted as an ad sales intermediary for mobile apps, was inspected by the French data protection regulator. Officials found the company had built a database containing the personal data of 67.6 million people without proper consent.
Data brokers don’t just harvest and hoard this data to make online ad sales, however, they will also license and sell its databases to others. Lawmakers believe that these brokers have sold this data to rival nations looking for ways to spy on US citizens .
How are law enforcement agencies getting it?
In January, 404Media revealed the US Immigration and Customs Enforcement Agency (ICE) bought access to tools supplied by cybersecurity company Penlink. Specifically, it purchased access to tools named Tangles and Webloc, which can be used to surveil large numbers of people at once. The latter tool reportedly has the power to identify smartphones in a given area and time, and can then follow them on their journey through the day and back to their home at night.
Given the secretive nature of its business, Penlink does not reveal much about how its tools operate. A since-removed marketing page says Webloc automatically analyzes “location based information” available in “endless digital channels from the web ecosystem.” And 404Media’s report says these tools access “commercially available smartphone location data,” supplied by third-party data brokers. Forbes reports the system can also pull together data from a variety of sources, including social media, to offer a real-time view of an event. The Texas Observer says Webloc can use this information to enable “warrantless device tracking.”
... continue reading