The FCC Hasn't Done A Damn Thing To Seriously Police Wireless Location Data Scandals

from the ill-communication dept

While Facebook (usually justly) gets the lion's share of privacy criticism, wireless carriers haven't been too far behind. In the last few years we've learned that they're frequently hoovering up your daily location data and then selling it to a long chain of often dubious companies. More recently they've been busted even selling access to E-911 location data, which is increasingly even more accurate in tracking users than traditional GPS. We've noted repeatedly that lax ethical standards result in this data often being abused by dubious third parties, or used illegally by law enforcement or those pretending to be law enforcement.

Throughout these evolving scandals, the Pai FCC hasn't done much of anything to ensure the public this is being adequately looked into. There's been no critical statement about this practice issued by the FCC, and no meaningful investigation launched (at least publicly). And while wireless carriers have insisted they've stopped collecting and selling this data (which they've been doing for the better part of the last decade without anybody in either party much caring), their promises historically haven't been worth all that much when it comes to the subject of privacy.

To truly address the location data scandal(s), carriers need to voluntarily or by force make it transparently clear they've stopped collecting and selling this data (which in several instances like E-911 data is against the law). Hoping to add a little fuel to the fire, FCC Commissioner Jessica Rosenworcel this week ramped up her criticisms of the practice and the FCC's apathy:

As part of that push, Rosenworcel sent new letters to each of the big four wireless carriers demanding more evidence supporting their claims that they've stopped this behavior, and asking what happens to the data that's already been collected (which is, curiously I think, the first time I've even seen this question asked). The problem of course that given the Pai FCC majority is effectively a rubber stamp for industry at this juncture, it's going to be hard to get a majority vote forcing these companies to be transparent and confirm they've stopped engaging in this behavior. Carriers like Verizon, for what it's worth, insist they've learned the error of their ways:

"Verizon has led the industry in working to end agreements with location aggregators. We were first to take action when these issues surfaced last Summer. We followed through with our pledge and have fully terminated our location aggregator arrangements. We're happy to talk about what we've done in this area with the Commissioner."

Which again, might mean something if this was an industry that had any credibility on this subject. But Verizon in particular has a long history of collecting and monetizing user data without being transparent about it. And trying to downplay the scope of the problems with its behavior. And of course working tirelessly to scuttle every attempt at new privacy guidelines, no matter how modest. You know, like the fairly basic FCC privacy rules Verizon convinced Congress to quickly scuttle in 2017 that would have gone a long way in preventing these exact location data scandals in the first place.

And on the rare occasion the company is actually punished, the fines are often a tiny, tiny fraction of the money gleaned by whatever shady behavior they were engaged in, which does nothing to deter future bad actions (in fact it in some ways encourages it). And with Pai having just effectively neutered a lot of the FCC's authority over ISPs at their lobbyists' behest, it's going to be harder than ever to force a serious reckoning on this subject should carriers prove uncooperative and non-transparent.

Filed Under: ajit pai, fcc, location data, privacy

Wireless Carriers Busted Sharing User 911 Location Data

from the bottomless-well-of-dysfunction dept

Recent scandals involving companies like Securus and LocationSmart made it clear that cellular carriers are collecting and selling an ocean of user location data without any meaningful oversight. Several reports have highlighted how that data is then being routinely abused by everybody from ethically dubious local Sheriffs to bounty hunters. Subsequent investigations have shown how easy it is for bounty hunters and others to access this data, and how the FCC under several administrations has failed utterly to hold cellular carriers and data brokers accountable for any of it.

This week, Motherboard exposed another location data scandal with a report highlighting how cellular carriers are also selling private user A-GPS data with companies that aren't supposed to have access to it. A-GPS, or assisted GPS, involves using a device's onboard GPS chip as well as cellular network data to more quickly and precisely determine a user's location. Wireless industry filings with the government indicate this data can pinpoint a user's location indoors up to 50 meters; more precisely if a device's MAC and Bluetooth data are also utilized.

Motherboard's investigation focused specifically on a now-defunct location data broker by the name of CerCareOne, which had been selling cellular user location data -- including A-GPS data-- as recently as 2017. As with the other scandals, this scandal involves a universe of shady middlemen who buy and sell an ocean of such data, often without carriers understanding (or bothering to understand) how widespread the practice had become:

"Like with the companies involved in Motherboard’s previous investigation, CerCareOne’s real-time location data trickled down first from telecom companies, and then to a so-called location aggregator called Locaid. From there, Locaid sold that data access to a number of different companies, including CerCareOne, which in turn sold it to its own clients. Locaid was purchased by a company called LocationSmart in 2015 . The documents Motherboard obtained indicate that LocationSmart continued to sell data to CerCareOne after it obtained Locaid, and LocationSmart confirmed that to Motherboard."

The scale of the data collection was... not subtle:

"CerCareOne’s phone tracking service was not a one-off tool for bounty hunters and bail agents. A list of a particular customer’s phone pings obtained by Motherboard stretches on for around 450 pages, with more than 18,000 individual phone location requests in just over a year of activity. The bail bonds firm that initiated the pings did not respond to questions asking whether they obtained consent for locating the phones, or what the pings were for.

Another set of data is more than 250 pages long and covers around 10,000 phone pings. Another list of a different bounty hunter’s activity includes nearly 1,000 phone location requests in less than a year; a third details more than 4,500 pings."

The irony in this instance is that the FCC had crafted rules to specifically address this problem. Back in 2015 as the FCC was contemplating some new rules for enhanced 911 services, a coalition of privacy and consumer groups (including Public Knowledge, the EFF, and the ACLU) had written the agency warning that A-GPS and other granular data specifically used to aid in pinpointing 911 caller location (especially indoors) created the potential for some major privacy issues:

"The development of highly-precise location technologies designed to comply with the new regulations will raise a host of privacy concerns that have not been sufficiently addressed in the E911 proceeding. Public safety should not come at the expense of consumer privacy—nor should it have to."

The FCC obliged, and in 2017 finalized rules with carrier approval that specifically stated that this kind of A-GPS data should never be used for any purpose other than tracking user location for emergency services:

"CMRS providers must certify that they will not use the NEAD or associated data for any non-911 purpose, except as otherwise required by law."

Many carriers claim to have completely stopped sharing this and other forms of location data entirely with data brokers or anybody else. But it's going to take a comprehensive investigation to not only confirm that, but also to confirm that they're not currently engaging in even worse behavior. Especially since every time we think we've gotten to the bottom of this scandal, the floor drops out revealing countless additional layers beneath.

Even with Ajit Pai's efforts to neuter FCC authority over ISPs, I've spoken to at least four telecom and privacy experts who say the FCC very clearly has the authority and responsibility to stop this sharing of private data, they've just chosen not to -- despite the fact the agency had the foresight to craft rules specifically designed to stop this from happening.

Filed Under: 911, a-gps, bounty hunters, e-911, enforcement, fcc, location data, privacy
Companies: cercareone

These Wireless Location Data Scandals Are Going To Be A Very Big Problem For Ajit Pai

from the get-your-popcorn-ready dept

It took the press the better part of a decade to finally realize that cellular carriers have been routinely hoovering up and selling your daily location data to every nitwit on the planet with zero meaningful ethical guidelines or oversight. And while this stuff is certainly nothing new, the recent Motherboard report showing how cavalierly your private data is bought and sold along a massive chain of shady operators seems to have finally woken everybody up on the subject.

Whether we actually do something about it is another issue entirely.

Pressure has started to mount on FCC boss Ajit Pai in particular. Why? While people rightfully obsessed on Pai's attacks on net neutrality, the repeal itself effectively involved neutering most FCC oversight of ISPs and wireless carriers, then shoveling any remaining authority to an FTC that lacks the authority or resources to really police telecom. This neutering of already tepid oversight was always the telecom lobby's plan, and unless you've got a severe case of denial, it's obvious the Pai FCC acted as a mindless rubber stamp in helping the industry's biggest players achieve this goal.

Of course the GOP helped as well, by quickly kowtowing to telecom sector lobbyists and, in March of 2017, voting to kill some fairly modest FCC privacy rules before they could take effect. Those rules, in addition to some other requirements, would have given consumers far more power over how their location data is shared and sold among what, in some instances, has been proven to be a chain that in at least one case was some 70 companies long.

The problem for Pai is he now has to go before Congress and explain how demolishing the FCC's ability to actually police this problem serves the common good. And, as Gizmodo notes, how he worked very closely with industry to specifically ensure these companies can't be seriously held accountable for a long, long history of really dubious behavior:

"To put it another way, the feckless ineptitude displayed by Pai since this phone-tracking scandal first broke nine months ago is not unintentional but reflects the precise level of power major telecoms wanted him to wield and no more. This circumstance, under which virtually anyone can pay money to physically locate the owner of a mobile phone, was engineered—as was the crippling of the agency that, under the former administration, would have had complete authority to pursue and punish those responsible."

Pai likely realizes the bad optics of this perfect storm. Under Pai, the FCC has largely ignored media requests for comments from reporters over the last few years, unless they were coming from outlets unwilling to criticize the agency (The Daily Caller comes quickly to mind). That changed this week however, when Pai was literally forced to directly answer the FCC press mailbox to assure everybody he'd be getting to the bottom of the location data scandal just as soon as the government re-opens:

It's going to take a thorough investigation to explore the scope of the problem and ensure carriers are living up to their promises to cease this data collection and sale. The problem: you'd be pretty hard pressed to find a lawyer that believes the FCC has enough remaining authority to actually do anything about this, thanks in large part to Pai's efforts to neuter the agency at carrier lobbyist request. The FCC does have some remaining authority under Customer Proprietary Network Information (CPNI) rules (expanded in 2005 to include location data), but it's far from clear that's enough, or that Pai would act anyway.

While Pai is busy trying to tapdance around those questions, the lawsuit over net neutrality will also be heating up, showcasing how Pai's FCC engaged in all manner of dubious behavior from concocting a DDOS attack to blocking inquiries into comment fraud to try and downplay massive backlash to his assault on net neutrality. On top of the fact his agency made up tons of data to justify the extremely unpopular decision. None of this is going to be a particularly enjoyable ride for Mr. "internet freedom," whose post-FCC political ambitions couldn't be more obvious.

Filed Under: ajit pai, fcc, location, location data, privacy

Ajit Pai Refuses To Brief Congress On What He Plans To Do About Wireless Location Data Scandals

from the thanks-but-no-thanks dept

So last week yet another location data scandal emerged for the wireless industry, highlighting once again how carriers are collecting your location data, then selling it to a universe of sometimes shady partners with little to no oversight or accountability. Like the Securus and LocationSmart scandals before it, last week's Motherboard report highlighted how all manner of dubious dudebros (and law enforcement officers) have been abusing this data for years, and the Ajit Pai FCC has yet to so much as mention the problem, much less spend a single calorie addressing it in any meaningful way.

Shortly after the scandal broke last week, Frank Pallone, the Chair of the House Committee on Energy and Commerce, asked Pai (pdf) to brief Congress on the steps the agency was taking to address the wireless sector's long-standing failure to adequately address location data abuse. Pai's response? Yeah, no thanks.

In a statement issued by Pallone, he says Pai's office claimed that since the location data scandal wasn't putting lives at risk, Pai could not attend such a briefing during the government shutdown:

"Today, FCC Chairman Ajit Pai refused to brief Energy and Commerce Committee staff on the real-time tracking of cell phone location, as reported by Motherboard last week. In a phone conversation today, his staff asserted that these egregious actions are not a threat to the safety of human life or property that the FCC will address during the Trump shutdown.

While the FCC's working on a skeleton crew right now due to the shut down, there's nothing actually stopping Pai from wandering down the road to answer a few questions, something Pallone was quick to highlight in his statement:

"There’s nothing in the law that should stop the Chairman personally from meeting about this serious threat that could allow criminals to track the location of police officers on patrol, victims of domestic abuse, or foreign adversaries to track military personnel on American soil. The Committee will continue to press the FCC to prioritize public safety, national security, and protecting consumers."

Granted Pai wasn't doing much about this problem when the government was open, either.

Academics and other privacy experts have told me this could easily be addressed using the FCC and FTC authority we already have (read: we don't even need a new privacy law), we've just chosen to kowtow to telecom lobbyists instead. In fact the FCC's privacy rules would have addressed the issue by giving consumers more control of how their location data is shared and sold, but sector lobbyists made quick work of those rules back in 2017. Even having Pai publicly state that this behavior is unacceptable might go a long way toward addressing the issue, though he's yet to do even that.

Pai has made it fairly clear by now that he sees government consumer protection oversight as largely unnecessary, and all criticism of his unpopular policies as entirely political in nature, therefore making it OK to ignore (the myopia of that belief system most obviously exemplified by his attacks on net neutrality). As a result, you should expect the FCC to continue to do little to nothing about location data scandals. At least until there's enough scandals of this type to push public outrage past the breaking point, finally making it clear that doing absolutely nothing is no longer an option. So, 2025 or so?

Filed Under: ajit pai, congress, e&c, fcc, frank pallone, house energy & commerce committee, location, location data, privacy, shutdown

Another Day, Another Massive Cellular Location Data Privacy Scandal We'll Probably Do Nothing About

from the ill-communication dept

We've noted a few times now that while Facebook gets a lot of justified heat for its privacy scandals, the stuff going on in the cellular data and app market in regards to location data makes many of Facebook's privacy issues seem like a grade-school picnic. That's something that was pretty well highlighted by the recent Securus and LocationSmart scandals, which showcased perfectly how cellular carriers and location data brokers routinely buy and sell your daily travel habits with only a fleeting effort to ensure all of the subsequent buyers and sellers of that data adhere to basic privacy and security standards.

This week, Joseph Cox at Motherboard dropped yet another bombshell report on this subject, noting how he was easily able to pay a bounty hunter $300 to obtain the (supposedly) private location data collected by his cellular provider (T-Mobile). Much like the Securus scandal, the problem once again is the countless location data brokers and third party vendors which are being sold this data, then doing pretty much whatever they'd like with it. In this instance, his data was collected by T-Mobile, shared with brokers and aggregators like Microbilt and Zumingo, then in turn shared with bail bond outfits and private investigators:

"Microbilt buys access to location data from an aggregator called Zumigo and then sells it to a dizzying number of sectors, including landlords to scope out potential renters; motor vehicle salesmen, and others who are conducting credit checks. Armed with just a phone number, Microbilt’s “Mobile Device Verify” product can return a target’s full name and address, geolocate a phone in an individual instance, or operate as a continuous tracking service."

Cellular carriers make a small fortune collecting and selling this data, and there's virtually no oversight of the practice. Consumers often sign one privacy agreement with their cellular provider, which in turn is then broadly interpreted as a green light down a long road of companies which then collect and sell that data in turn. As we saw with the Securus scandal (when a local Sheriff was busted snooping on the private cellular location data of Judges and fellow law enforcement officers), everybody in this chain of dysfunction likes to play stupid when the problem repeatedly comes to light. The same thing occurred here:

“We take the privacy and security of our customers’ information very seriously and will not tolerate any misuse of our customers’ data,” A T-Mobile spokesperson told Motherboard in an emailed statement. “While T-Mobile does not have a direct relationship with Microbilt, our vendor Zumigo was working with them and has confirmed with us that they have already shut down all transmission of T-Mobile data. T-Mobile has also blocked access to device location data for any request submitted by Zumigo on behalf of Microbilt as an additional precaution.”

When the NY Times broke the Securus scandal story last year, cellular carriers all played stupid, insisted they'd ceased the sale of such data, and breathlessly assured everybody that this behavior wouldn't happen again. When Senator Ron Wyden complained, you might recall that T-Mobile CEO John Legere took to Twitter at the time to insist he'd learned the error of his ways:

Apparently not.

Needless to say, Wyden, who has been pushing new privacy legislation, isn't particularly impressed:

If you were an industry hoping to avoid government regulation of your business, you'd think you'd be a little more cautious in the way you treat private data. But as we've noted countless times, this kind of cavalier treatment of private data is the norm for telecom. From hoovering up your clickstream data to covertly modifying data packets to track you around the internet, telecom has long played fast and loose with consumers' private data. Some have even flirted with the idea of only seriously respecting your privacy if you pay an additional fee, effectively making consumer privacy a luxury feature.

So while broadband giants will surely whine incessantly during the looming quest to pass some meaningful rules of the road, it's worth remembering they had ample opportunities, over decades, to avoid stricter government intervention by adopting better, more ethical business practices. It's also worth reminding folks that ISPs lobbied furiously to convince the GOP to kill some fairly basic privacy protections at the FCC that would have required ISPs clearly inform users who is buying and selling this data, giving users a little more control over how it was shared.

And it's also worth noting that even without legislation or those rules, the FCC still has Section 222 authority to police this kind of behavior. While the FCC's privacy rules were killed, mobile carriers are still subject to CPNI rules for voice calls, which were expanded in 2005 to include subscriber location information. The bottom line is that the Ajit Pai FCC could easily address this problem using the authority it has now, they've just chosen not to because it might just hurt telecom revenues. The FTC could also probably ding T-Mobile for being "unfair and deceptive" under Section 5 of the FTC act, yet has been similarly mute as carriers bullshit their way around their failures on this front.

All of that said, there's countless folks who think they're taking meaningful steps to protect their privacy by deleting Facebook (or on-phone apps), yet are oblivious to the perils of walking around with a stock carrier phone in their pocket. It might be time to stop being quite so collectively naive about US privacy practices if we're going to have a serious (and undeniably difficult) adult conversation on what privacy rules of the road should look like. One thing we can probably mostly agree upon: this practice of hoovering up your every move and selling it to an ocean of companies with little to no real attempt to protect it is behavior we need to change, one way or another.

Filed Under: bounty hunters, john legere, location data, mobile operators, privacy, ron wyden, selling data
Companies: at&t, microbilt, sprint, t-mobile, verizon, zumingo

Mobile Location Scandals Keep Making Facebook's Privacy Flubs Look Like Child's Play

from the ill-communication dept

We've noted a few times now that while Facebook gets a lot of justified heat for its privacy scandals, the stuff going on in the cellular data and app market in regards to location data makes many of Facebook's privacy issues seem like a grade-school picnic. That's something that was pretty well highlighted by the recent Securus and LocationSmart scandals, which showcased perfectly how cellular carriers and location data brokers routinely buy and sell your daily travel habits with only a fleeting effort to ensure all of the subsequent buyers and sellers of that data adhere to basic privacy and security standards.

Over the weekend, the New York Times had an interesting read that offers some fresh insight into just how commonly your daily location data is traded and shared without much in the way of meaningful protection or oversight. There's a certain naive shock by both the Times authors and its subjects as they suddenly realize that apps on mobile devices routinely hoover up users' daily movement patterns, often without anything in the way of real consent or transparency, then sell that valuable data to every Tom, Dick, and Harry in a bid to monetize it:

"The app tracked her as she went to a Weight Watchers meeting and to her dermatologist’s office for a minor procedure. It followed her hiking with her dog and staying at her ex-boyfriend’s home, information she found disturbing.

“It’s the thought of people finding out those intimate details that you don’t want people to know,” said Ms. Magrin, who allowed The Times to review her location data.

The Times investigation found that at least 75 companies routinely receive anonymous, precise location data from apps that collect location data but fail to clarify how that data is used. Several of the firms tracked by the Times note they routinely collect data on more than 200 million mobile devices; data that in many instances is so granular it's updated as many as 14,000 times a day. Of course if you've been paying attention, location data has been a gold mine for cellular carriers (and everybody in the chain) for the better part of the last decade as it's sold to everyone from city planners to shopping malls.

And while carriers and those handling this data routinely insist there's no harm because this data is "anonymized," reports have repeatedly shown that this kind of data isn't really anonymous, especially if it can be linked with other private data (obtained by hackers, leaked, or already in the wild). That's something you can feel the Times reporters realizing as the story proceeds:

"Businesses say their interest is in the patterns, not the identities, that the data reveals about consumers. They note that the information apps collect is tied not to someone’s name or phone number but to a unique ID. But those with access to the raw data — including employees or clients — could still identify a person without consent. They could follow someone they knew, by pinpointing a phone that regularly spent time at that person’s home address. Or, working in reverse, they could attach a name to an anonymous dot, by seeing where the device spent nights and using public records to figure out who lived there."

Curiously, the Times doesn't even mention the cellular carriers' role in this problem, insisting that location data sales "began as a way to customize apps and target ads for nearby businesses." In reality, cellular carriers have been tracking and selling your location data before the concept was even a twinkle in many app makers' eye, and as the recent LocationSmart scandal (which exposed the personal data of nearly every mobile customer in North America) made very clear, this data is sold to dozens of third-party location data brokers and their sales partners -- without much, if any, effort to ensure it's being protected down the chain.

In other words, app location data sharing is just a smaller part of a massive problem. A problem that started with telecom operators and our total unwillingness to hold them accountable for similar behavior. Politically powerful cellular carriers who repeatedly insisted we didn't need any meaningful privacy rules of the road because "public shame" would keep the industry honest. That promise has never really worked out that well.

Multiple ISPs were accused years ago of collecting and selling consumer clickstream data. When they were pressed for details, many simply either denied doing it or refused to respond. Collectively, we decided that was fine. As more sophisticated network gear like deep-packet inspection emerged, ISPs began tracking and selling online browsing habits down to the millisecond, some even charging users extra if they wanted to protect their own privacy. Wireless only made things worse, some carriers even going so far as to modify your very data packets to glean additional insight without your knowledge or consent.

That initial attitude has subsequently infected every other ecosystem on the network as countless industries ran toward the location data cash cow, utterly apathetic to the slow but steady erosion of consumer trust and privacy. There's an endless list of points of failure here by self-interested companies eager to prioritize growth over all things, from the carriers themselves to the app store approval process. As such, the focus specifically on apps--or Facebook--tends to miss the bigger picture: that this sort of behavior is now the norm across all of tech, not some errant anomaly.

That said, the Times piece is still full of some entertaining revelations on app privacy specifically, like the fact that even some of the companies involved don't understand why the hell they even have access to all of this customer location data:

"To evaluate location-sharing practices, The Times tested 20 apps, most of which had been flagged by researchers and industry insiders as potentially sharing the data. Together, 17 of the apps sent exact latitude and longitude to about 70 businesses. Precise location data from one app, WeatherBug on iOS, was received by 40 companies. When contacted by The Times, some of the companies that received that data described it as “unsolicited” or “inappropriate.'

Currently, outside of a week of bad press that's quickly forgotten (see: Equifax), there's really no penalty for even the most mammoth of privacy abuses (aside from the occasional wrist slap for violating kid specific privacy laws like COPPA). This apathy and incompetence was rooted in the cellular and telecom industry, and has since spiraled outward, infecting every app and internet ecosystem as numerous industries ran to feed at the unsupervised trough. The fact that we're still so collectively naive to the scope of the problem a decade or two later is utterly mind boggling in and of itself.

Filed Under: location data, mobile apps, privacy

Wireless Carrier Abuse Of Location Data Makes The Facebook, Cambridge Scandal Look Like Amateur Hour

from the we-need-outrage-symmetry dept

As we've noted a few times now, however bad the recent Facebook and Cambridge Analytica scandal was, the nation's broadband providers have routinely been engaged in much worse behavior for decades. Yes, the Cambridge and Facebook scandal was bad (especially Facebook threatening to sue news outlets that exposed it), but the behavior they were engaging in is the norm, not the exception. And watching people quit Facebook while still using a stock cellphone (which lets carriers track your every online whim and offline movement) was arguably comedic.

As the recent Securus and LocationSmart scandal highlights, wireless carriers pretty routinely sell your location data to a laundry list of companies, governments, and organizations with only fleeting oversight. And while some lawmakers are pressuring the FCC to more closely investigate the scandal (which resulted in the exposure of wireless location data of some 200 million users in the U.S. and Canada), few expect the same FCC that just killed net neutrality to actually do anything about it.

When the previous FCC tried to pass some pretty modest privacy protections last year requiring that ISPs be more transparent about all of this, ISPs quickly took advantage of a cash-compromised Congress to scuttle those protections before they could even take effect:

This collective apathy to routine telecom sector privacy abuses has been going on for decades. You might recall that multiple ISPs were accused years ago of collecting and selling consumer clickstream data. When they were pressed for details, many simply either denied doing it or refused to respond. As more sophisticated network gear like deep-packet inspection emerged, ISPs began tracking and selling your online browsing habits down to the millisecond, some even charging users extra if they wanted to protect their own privacy.

But things got immeasurably more profitable once wireless carriers began tracking user location data, which they now sell to everyone from urban planners to government agencies. Companies like Verizon Wireless were subsequently caught covertly modifying wireless user data packets to track users around the internet without telling them. It took security researchers two years to even discover this was happening and another six months of public shame before Verizon even provided an opt out option (a more powerful version of the tech is now being used by Verizon's Oath advertising brand).

And yet even in the wake of the LocationSmart fracas, which literally exposed the private data of nearly everybody in America, we're still somehow only seeing a fraction of the media, regulatory or public outrage we saw during the Facebook and Cambridge kerfuffle:

"You might think that the major wireless carriers would be facing intense pressure to account for their lax handling of customers’ data. You might think the story would be all over newspapers’ front pages and cable news. You might think their CEOs would be hounded by the media, as Facebook’s Mark Zuckerberg was after the Cambridge Analytica story broke. You might think they’d be dragooned into testifying before Congress.

You might think that, if you expected a reaction commensurate to the one that accompanied the Cambridge Analytica revelations. And it’s conceivable that it will still happen. But so far, there has been none of that."

It remains odd that the press and public still don't realize how deep this particular rabbit hole goes. And whereas the Cambridge scandal made headlines for months, the location data scandal has barely registered a fraction of the collective outrage in media coverage or in DC. Meanwhile, wireless carriers are effectively refusing to even acknowledge they work with companies like LocationSmart, and there's little to no indication accountability is heading their direction anytime soon.

Filed Under: location data, privacy, wireless carriers
Companies: cambridge analytica, facebook, locationsmart, securus

Nearly Everyone In The U.S. And Canada Just Had Their Private Cell Phone Location Data Exposed

from the Whoops-a-daisy dept

A company by the name of LocationSmart isn't having a particularly good month.

The company recently received all the wrong kind of attention when it was caught up in a privacy scandal involving the nation's wireless carriers and our biggest prison phone monopoly. Like countless other companies and governments, LocationSmart buys your wireless location data from cell carriers. It then sells access to that data via a portal that can provide real-time access to a user's location via a tailored graphical interface using just the target's phone number.

Theoretically, this functionality is sold under the pretense that the tool can be used to track things like drug offenders who have skipped out of rehab. And ideally, all the companies involved were supposed to ensure that data lookup requests were accompanied by something vaguely resembling official documentation. But a recent deep dive by the New York Times noted how the system was open to routine abuse by law enforcement, after a Missouri Sherrif used the system to routinely spy on Judges and fellow law enforcement officers without much legitimate justification (or pesky warrants):

"The service can find the whereabouts of almost any cellphone in the country within seconds. It does this by going through a system typically used by marketers and other companies to get location data from major cellphone carriers, including AT&T, Sprint, T-Mobile and Verizon, documents show.

Between 2014 and 2017, the sheriff, Cory Hutcheson, used the service at least 11 times, prosecutors said. His alleged targets included a judge and members of the State Highway Patrol. Mr. Hutcheson, who was dismissed last year in an unrelated matter, has pleaded not guilty in the surveillance cases."

It was yet another example of the way nonexistent to lax consumer privacy laws in the States (especially for wireless carriers) routinely come back to bite us.

But then things got worse.

Driven by curiousity in the wake of the Times report, a PhD student at Carnegie Mellon University by the name of Robert Xiao discovered that the "try before you buy" system used by LocationSmart to advertise the cell location tracking system contained a bug, A bug so bad that it exposed the data of roughly 200 million wireless subscribers across the United States and Canada (read: nearly everybody). As we see all too often, the researcher highlighted how the security standards in place to safeguard this data were virtually nonexistent:

"Due to a very elementary bug in the website, you can just skip that consent part and go straight to the location," said Robert Xiao, a PhD student at the Human-Computer Interaction Institute at Carnegie Mellon University, in a phone call. "The implication of this is that LocationSmart never required consent in the first place," he said. "There seems to be no security oversight here."

The researcher notes that one of the APIs in the portal was not properly validating the consent response, making it "trivially easy" to skip the portion where the API sends a text message to the end user attempting to obtain consent (Brian Krebs, who first reported the vulnerability, has also confirmed the problem). Given the New York Times story had been making headlines since its May 10 publication, it's obviously possible that others discovered the vulnerability. LocationSmart has since pulled their location data tracking portal offline.

Meanwhile, none of the four major wireless carriers have been willing to confirm any business relationship with LocationSmart, but all claim to be investigating the problem after the week of bad press. That this actually results in substantive changes to the nation's cavalier treatment of private user data is a wager few would be likely to make.

Filed Under: brian krebs, leaks, location data, privacy, robert xiao
Companies: locationsmart

Prison Phone Monopoly Securus Under Fire Again, This Time For Doling Out Everybody's Private Phone Location Data

from the don't-pass-go,-don't-collect-$200 dept

For years now we've noted how a company by the name of Securus has managed to obtain a pretty cozy, government-supported monopoly over prison phone and teleconferencing services. Like any monopoly, this prison monopoly has pretty traditionally resulted in not only sky high rates upwards of $14 per minute for phone calls, but comically poor service as well. It's something advocates (like outgoing FCC staffer Mignon Clyburn) have been trying to rectify for years, only to have Trump FCC boss Ajit Pai completely deflate those efforts last year.

But Securus' monopoly -- and the government pampering and cronyism that helped create it -- has other additional costs as well. Interstate inmate calling service (ICS) companies effectively buy their privileged positions from local governments, who then expect some favors in return. For example, Securus was recently accused of routinely spying on privileged inmate attorney communications, information that was only revealed after Securus was hacked in late 2015. Given the generalized apathy for prison inmates and their families ("Iff'n ya don't like high prices, don't go to prison son!") reform on this front has been glacial at best.

Meanwhile, the problems caused by these government-sanctioned monopolies continue to pile up. A recent court case has also exposed how some law enforcement officials also make routine use of a Securus service that helps track people’s cellphones without court orders. While the service is marketed to government as a way for law enforcement to track fleeing drug treatment or even Alzheimer's patients, zero oversight means it's routinely abused. In this case, the law enforcement official used the Securus service to not only track members of the general public, but Judges and other law enforcement officials as well:

"The service can find the whereabouts of almost any cellphone in the country within seconds. It does this by going through a system typically used by marketers and other companies to get location data from major cellphone carriers, including AT&T, Sprint, T-Mobile and Verizon, documents show.

Between 2014 and 2017, the sheriff, Cory Hutcheson, used the service at least 11 times, prosecutors said. His alleged targets included a judge and members of the State Highway Patrol. Mr. Hutcheson, who was dismissed last year in an unrelated matter, has pleaded not guilty in the surveillance cases."

In addition to being another warning about the threat of government-pampered monopolies, the scandal again highlights how our nonexistent to lax consumer privacy laws (especially for wireless carriers) routinely come back to bite us. In this instance, Securus was easily able to buy cell carrier location data, then upload it to a company portal. Law enforcement officials can then easily plug in a cell phone number to track its location, provided they supply an "official document giving permission." Overview of the validity of these documents appears to be half-assed at best.

We've long noted that wireless carriers routinely sell browsing, location and other data to absolutely everyone, and while these companies insist that "anonymizing" the data protects user identities (it doesn't), the rules governing the use of such data are laughable at best. Efforts to then pass more meaningful privacy protections then get quickly and repeatedly scuttled by influential lobbyists, as companies fight tooth and nail against any measures that could possibly hamstring user data monetization efforts.

As you might expect, Securus took no ownsership of the scandal or the routine abuse of private data:

"Securus requires documentation and reasonably relies on the professionalism and integrity of our law enforcement customers and their counsel. Securus is neither a judge nor a district attorney, and the responsibility of ensuring the legal adequacy of supporting documentation lies with our law enforcement customers and their counsel."

Senator Ron Wyden, meanwhile, has fired off a letter to FCC boss Ajit Pai (pdf), lamenting the fact that the oversight of this entire process is the glorified equivalent of a "pinky promise":

"I recently learned that Securus Technologies, a major provider of correctional-facility telephone services, purchases real-time location information from major wireless carriers and provides that information, via a self-service web portal, to the government for nothing more than the legal equivalent of a pinky promise. This practice skirts wireless carrier's legal obligation to be the sole conduit by which the government conducts surveillance of Americans' phone records, and needlessly exposes millions of Americans to potential abuse and surveillance by the government."

Securus is the perfect storm created by lax privacy rules, rampant cronyism, the government's tendency to pamper and embolden monopolies, and the routine skirting of wiretap and privacy law by corporations and law enforcement alike.

Filed Under: ajit pai, fcc, law enforcement, location data, prison, prison phone calls
Companies: securos

It's Grindr's Turn In The Barrel As America Finally Decides To Care About Consumer Privacy

from the standard-operating-procedure dept

Whatever you think about the Facebook Cambridge Analytica kerfuffle, it's pretty obvious that the scandal is causing a long overdue reassessment of our traditionally lax national privacy standards. While most companies talk a good game about their breathless dedication to consumer privacy, that rhetoric is usually pretty hollow and oversight borders on nonexistent. The broadband industry is a giant poster child for that apathy, as is the internet of very broken things sector. For a very long time we've made it abundantly clear that making money was more important than protecting user data, and the check is finally coming due.

While it may only be a temporary phenomenon, the Cambridge Analytica scandal is finally causing some much-needed soul searching on this front. And given how deep our collective privacy apathy rabbit hole goes, being sloppy with consumer data may actually bear witness to something vaguely resembling accountability for a little while. Case in point is gay dating site Grindr, which this week was hammered in the media after it was revealed that the company was sharing an ocean of data with app optimization partner companies, including location data and even HIV status.

Norwegian nonprofit SINTEF was commissioned to dig into the problem on behalf of Swedish public broadcaster SVT, which first broke the story. According to SINTEF, Grindr was also sharing its users’ precise GPS position, "tribe" (their preferred gay subculture), sexuality, relationship status, ethnicity, and phone ID with third-party advertising companies. And, because even "anonymized" data can never be truly considered anonymous, they concluded it isn't hard to identify these users based on this data.

Many were surprised that such a popular company would have such a casual disregard for its consumer privacy:

"Grindr is a relatively unique place for openness about HIV status,” James Krellenstein, a member of AIDS advocacy group ACT UP New York, told BuzzFeed News.

“To then have that data shared with third parties that you weren’t explicitly notified about, and having that possibly threaten your health or safety — that is an extremely, extremely egregious breach of basic standards that we wouldn’t expect from a company that likes to brand itself as a supporter of the queer community."

But again, this casual treatment of data isn't errant behavior on Grindr's part -- it's the norm. And in this case, many are correct to point out that in addition to it being problematic that users didn't know this data was being shared outside of the Grindr community, the exposure of the HIV data (which again was only with two app optimization companies) could potentially have placed people living in homophobic areas at risk of violence:

To its credit, Grindr wound up announcing that it would stop sharing HIV data with third parties, but not before the company issued a statement tinged with the usual lamentations about "misinformation." Several statements were made of the "everybody does it," flavor which didn't help the company's case. Grindr security chief Bryce Case also got defensive in comments to Axios about how the company was being "unfairly" singled out due to the Cambridge Analytica scandal:

"I understand the news cycle right now is very focused on these issues," Case said, but added, "I think what’s happened to Grindr is, unfairly, we’ve been singled out..."It’s conflating an issue and trying to put us in the same camp where we really don’t belong."

But nobody accused Grindr of doing what Cambridge Analytica did. They did however accuse the company of what's now fairly standard privacy apathy across countless industries, including overlong terms of service that don't make it clearer what data is being shared with whom, the sharing of some of private consumer data in unencrypted plain text (you know, like your television probably does), and sharing extremely-sensitive HIV status data that pretty clearly wasn't necessary for "app optimization":

"But some security experts say that this argument about whether the data was being sold to a third party for nefarious purposes or not misses the point: that HIV data is highly sensitive, and that sharing it with any outside companies is a move away from the security of its users.

"There was no reason for them to be storing that data with these analytics companies in the first place," Cooper Quintin, senior staff technologist and security researcher at the Electronic Frontier Foundation, told BuzzFeed News. "Grindr should be taking extra steps to secure this sort of very personal data."

It's understandable that Grindr doesn't want to be lumped in with Cambridge Analytica, and it's obvious that there's a vast chasm between sharing some data with ad optimization partners and using unauthorized data to disrupt elections. Still, companies like Grindr are lucky that this come to Jesus moment in consumer privacy didn't arrive years ago.

Assuming this concern for privacy isn't just a temporary fashion trend, Grindr's certainly not going to be the last company caught in the crossfire of what should be seen as a cultural learning process. And hopefully, some of the truly terrible players on this front (like the telecom sector) will ultimately witness their time in the barrel as well. Especially since what many wireless carriers have routinely been up to makes Grindr's privacy missteps look like child's play, and the government's response so far has been to make it easier than ever to violate consumer privacy.

Filed Under: data sharing, hiv status, location data, privacy
Companies: grindr