DEA Ditches Location Data Vendor Currently Being Investigated By Congress

from the convenient-corrective? dept

The Supreme Court ruled that law enforcement agencies needed a warrant to obtain cell site location info. The ability to turn third parties (like telcos) into proxy long-term tracking devices concerned the court, which decided this wasn't permissible under the Fourth Amendment. Every American carries a cellphone. But just because they do doesn't mean they agree the government should be able to track their movements with them.

No problem, said federal law enforcement agencies. We'll just get the same data from new sources -- ones not specifically mentioned in the Carpenter decision. Data brokers harvesting location data from phone apps sell access to government agencies, allowing them to bypass the warrant requirement.

This new source of data location has become a concern for some legislators, which have demanded answers from agencies like the IRS and CBP about their acquisition and use of this data. One company -- Venntel -- is currently facing a Congressional investigation of its data selling practices. This hasn't stopped CBP from buying data to track immigrants. But it has perhaps led to one agency -- one with a long history of bulk collection violations -- to ditch its contract with Venntell. Joseph Cox fills in the details at Motherboard.

The Drug Enforcement Administration abruptly cancelled its contract with Venntel, a U.S. contractor that sells location data harvested from ordinary apps installed on people’s phones around the world.

The news signals that although Venntel's smartphone location data may be popular with some federal agencies, including Customs and Border Protection (CBP) which Motherboard found spent nearly half a million dollars to access the data, other law enforcement bodies may have less use for such technology.

As Cox's report suggests, this may not be an indicator of reluctance to engage with a vendor currently under investigation. Instead, it may indicate some agencies find the harvested data less useful than others. The data CBP accesses allows it to track people's movements on both sides of the border, which is far more useful than scattershot data that may not deliver anything of value to DEA agents seeking to make a drug bust.

The DEA's cancellation was rather abrupt, suggesting it didn't feel like paying for something it didn't see itself using.

Keith Chu, communications director for the office of Senator Ron Wyden, described to Motherboard a conversation that his office had with the DEA.

"On DEA, they told our office: '[The Venntel contract was] terminated on our end before the first 30 days of the one year period of performance after determining it would not fit our needs,'" Chu said.

Then again, the DEA may have just cancelled this contract temporarily. The company is being investigated by Wyden and the senator has asked a lot of questions agencies may not feel like answering. Perhaps the DEA may re-engage when the heat dies down. Or it may seek to obtain this data from a different broker -- one not currently targeted by a Congressional investigation. Given the restraints on collecting location data from service providers, any parallel source of data is still preferable to seeking a warrant.

If it's not useful now, there's a chance it will be in the future. That's why Congress needs to act. And if it doesn't, the courts need to examine this data collection under the constraints of the Carpenter decision and decide whether it's ok for law enforcement to dodge warrant requirements that would seem to apply to ANY tracking of individuals, even if the data is sourced from third party data brokers.

Filed Under: 4th amendment, cbp, congress, dea, irs, location info, privacy
Companies: venntel

CBP Is Still Buying Location Data From A Company Currently Being Investigated By Congress

from the dodging-oversight-from-two-other-branches dept

Earlier this year, the Wall Street Journal revealed that ICE and CBP were buying location data from third-party data brokers -- something that seemed like a calculated move to dodge the requirements of the Supreme Court's Carpenter decision. There's a warrant requirement for historical cell site location data, but the two agencies appear to believe gathering tons of "pseudonymized" data to "help identify and locate" undocumented immigrants isn't a Fourth Amendment problem.

At this point, they're probably right. They may not be correct but they don't have court precedent telling them they can't do this. Not yet. So, they're doing it. It may not be immediately invasive as approaching a cell service provider for weeks or months of location data related to a single person, but this concerted effort to avoid running anything by a judge suggests even the DHS feels obtaining data this way is quasi-legal at best.

In late June, the House Committee on Oversight and Reform opened an investigation into Venntel's sale of location data to ICE and CBP. The Committee asked Venntel to hand over information about its data sales, whether or not it obtained consent from phone users to gather this data, and whether it applied any restrictions to the use of data by government agencies. The answers to the Committee's questions were due in early July. So far, Venntel has yet to respond.

Venntel's business hasn't slowed despite being investigated by Congress. Joseph Cox reports for Motherboard that CBP has just signed another deal with the data broker.

Earlier this month U.S. Customs and Border Protection (CBP) paid nearly half a million dollars to a company that sells a product based on location data harvested from ordinary apps installed on peoples' phones, according to public procurement records reviewed by Motherboard.

[...]

CBP paid just under $476,000 for "Venntel Software" on August 5, according to the public procurement record.

Venntel's data collection does have limitations that makes it more useful for these agencies than others that have tried it.

The office of Senator Ron Wyden found that the criminal investigation unit of the Internal Revenue Service (IRS) tried to use Venntel data to identify and track potential criminal suspects. The IRS failed to locate any targets of interest during the year-long contract.

The Venntel data is more useful for tracking "herds of people," the second former worker told Motherboard. The Wall Street Journal's February report mentioned agencies have used Venntel data to identify border crossings and then arrest people.

But even with these limitations, it's still powerful enough to be of concern, especially when it appears federal agencies are willing to buy data from brokers rather than approach service providers with subpoenas and warrants. Venntel's "product" comes from cellphone apps that collect location data. Venntel generates its own identifiers for each device to tie location data together. Customers like ICE can either ask for all data gathered at certain locations or search by identifier to collect all data tied to that device.

And it's not just about securing the border. ICE and CBP are also authorized to use Venntel's data to assist in "law enforcement operations." Venntel claims it doesn't sell access to local law enforcement agencies, but it appears CBP and ICE have the capability -- and presumably the willingness -- to perform proxy searches for agencies Venntel won't sell to.

If it's questionable for a private company to sell data to the federal government while under investigation from another branch of that same government, it's doubly questionable for a federal agency to continue doing business with a company being investigated by Congress. But people without papers must be caught, I guess, even if some rights must be violated (or evaded) to do it.

Filed Under: 4th amendment, cbp, data brokers, dhs, ice, privacy, warrant
Companies: venntel