Private Companies Gathering Plate Data Are Selling Access To People's Movements For $20 A Search

from the lojacking-humans dept

License plate readers are everywhere. Their existence is predicated on the assumption that traveling on public roads strips drivers of their privacy. To a certain extent this is true. But automation allows government agencies to reconstruct peoples' lives and movements by simply typing in a plate number and accessing the billions of image/location data records stored by ALPR manufacturers like Vigilant.

But it's not just a government thing. The new market for plate readers is residential neighborhoods, with purchases being made by home owners associations and others who feel they have a right to know who's traveling in and out of "their" neighborhoods.

Prior to this, though, ALPRs were already being utilized extensively by private entities. Insurance companies and repossession firms have been using plate readers for years, using them to track down vehicles after missed payments or those suspected of insurance fraud. Unlike the databases compiled by law enforcement agencies, these private databases can be accessed by nearly anyone for any reason.

That's exactly what Motherboard did. It found someone willing to offer up their license plate as a lab rat to see how much data was being harvested by a repo company's plate readers and ran a search.

Armed with just a car's plate number, the tool—fed by a network of private cameras spread across the country—provides users a list of all the times that car has been spotted. I gave the private investigator, who offered to demonstrate the capability, a plate of someone who consented to be tracked.

It was a match.

The results popped up: dozens of sightings, spanning years. The system could see photos of the car parked outside the owner's house; the car in another state as its driver went to visit family; and the car parked in other spots in the owner's city. Each was tagged with the time and GPS coordinates of the car. Some showed the car's location as recently as a few weeks before. In addition to photos of the vehicle itself, the tool displayed the car's accurate location on an easy to understand, Google Maps-style interface.

Unlike government databases, there are no rules protecting citizens from misuse or limiting long-term storage of plate photos. All that's preventing abuse is the limited language of each company's terms of service -- something these companies don't seem to spend too much time enforcing. Digital Recognition Network's (DRN) offering is "crowdsourced" from thousands of cameras mounted on hundreds of repo men's vehicles. It's a persistent, long-term database of vehicle movements controlled by a single company -- one that law enforcement also has access to, as if government agencies needed any more access to plate data.

It's also surprisingly cheap. $15,000 gets drivers a four-camera setup and access to the DRN database. Searches go for $20 per and paying $70 for a search provides the searcher with live updates when a searched plate is snagged by a plate reader. Customers love it. So do repossession outfits, whose drivers earn bonuses for racking up plate photos. And DRN loves the data it collects, which it packages for sale through other programs, like one specifically marketed to private investigators.

The potential for abuse is real. The Motherboard report notes that members of a closed Facebook group for private investigators was filled with messages asking others to run plates for them. DRN's official line on abuse prevention is pretty much a jargon-filled shrug.

Notably, DRN does not immediately ban someone for abusing the service, according to the contract. It reads that if DRN determines or suspects that the user has used the data for personal or non-business purposes, "Licensor [DRN] shall notify Licensee in writing of the alleged breach and give Licensee an opportunity to cure any curable breaches within 30 days of Licensee's receipt of such notice; thereafter Licensor may take immediate action, including, without limitation, terminating the delivery of, and the license to use, the Licensed Data."

There may be no "expectation of privacy" in driving on public streets. But I think most Americans would consider their privacy violated by the existence of a product that reconstructs their lives for the low, low price of $20 a search. Given that these companies are also selling access to law enforcement, they may yet find a way to trip over the Fourth Amendment. But until a company like DRN does, it's just another company doing what so many tech companies do best: harvest and sell data.

Filed Under: alpr, bounty hunters, license plates, location data, privacy

EFF Hits AT&T With Lawsuit Over Sale Of User Location Data

from the ill-communication dept

We've noted a few times now that while Facebook gets a lot of justified heat for its privacy scandals, the stuff going on in the cellular data and app market in regards to location data makes many of Facebook's privacy issues seem like a grade-school picnic. That's something that was pretty well highlighted by a wave of massive scandals showing how your daily location data has long been collected by cellular data companies, then sold to a laundry list of dubious individuals and organizations. Outfits that have repeatedly failed to prevent this data from being abused by everyone from law enforcement to stalkers.

The Ajit Pai FCC has yet to lift a finger or so much as scold the companies for their cavalier treatment of private user data. And while cellular giants like AT&T, Verizon, Sprint, and T-Mobile say they've stopped the practice in light of these scandals, nobody has actually bothered to confirm this fact. Given the billions to be made, it's certainly possible these companies may have just made a few modest changes to what's collected, who they sell this data to, and what they call this collection, but are still engaged in monetizing your daily location habits in some fashion.

Enter the EFF, who this week filed a new class action lawsuit against AT&T (pdf). The suit seeks an injunction to ensure that AT&T can no longer collect and sell this data. The class action represents several California AT&T users who say they were never informed, nor gave consent, for their location data to be used in this fashion:

"Defendants’ practices allow Plaintiffs and other AT&T customers to be tracked and targeted by unknown third parties without their knowledge. AT&T leverages the technology embedded within a customer’s phone and its own network infrastructure to locate its customers without any indication that AT&T is tracking them in order to sell their precise location to third parties for non-911 purposes. Indeed, AT&T’s practices were only publicly exposed after an FBI investigation revealed that a sheriff in Missouri had used carrier location data to stalk a Circuit Court Judge and fellow law enforcement officers without their knowledge or consent and without any legal authority to do so. This highly sensitive data has also been used to harass AT&T customers and bypass the rights afforded by the Fourth Amendment."

The lawsuit also demands that AT&T delete the oceans of data that the carrier has collected and sold over the last decade (a bit tricky given the number of companies this data has long been shared with). It also alleges that AT&T violated the Federal Communications Act by not protecting location data, and California's Unfair Competition Law and the Consumers Legal Remedies Act by misleading consumers as to the sale of this data. The EFF also states that both the cellular carriers and proxy aggregator companies violated the California Constitutional Right to Privacy.

In a statement to Motherboard, AT&T unsurprisingly promised to fight the lawsuit, and again insisted it had already ceased selling location data to third-party aggregators:

"While we haven’t seen this complaint, based on our understanding of what it alleges we will fight it. Location-based services like roadside assistance, fraud protection, and medical device alerts have clear and even life-saving benefits. We only share location data with customer consent. We stopped sharing location data with aggregators after reports of misuse."

Having covered AT&T for the better part of several decades, I can promise you that AT&T's not going to give up this multi-billion dollar market without some form of shenanigans, and that an objective third-party audit confirming AT&T's claims will be essential in putting these scandals to rest.

Filed Under: ajit pai, bounty hunters, fcc, location data, oversight, privacy
Companies: at&t, eff

It's Apparently Easy To Pretend To Be A Cop, Grab Location Data From Cellular Carriers

from the ill-communication dept

While Facebook tends to get the lion's share of (deserved) criticism, the telecom sector continues to make its case for being the absolute worst when it comes to protecting your private data. Scandal after scandal have highlighted how wireless carriers routinely collect and store your daily location data, then sell that data to a universe of shady middlemen with little to no oversight as to how the data is used. Users sign one overlong privacy policy with their wireless carrier, and that policy is being read to mean consumers sign off on the practice, which they certainly haven't.

This week journalist Joseph Cox again highlighted the problems on the location data front, reporting how many stalkers and debt collectors are able to get access to this data without paying for it. How? By pretending to be law enforcement officers:

"...bounty hunters and people with histories of domestic violence have managed to trick telecommunications companies into providing real-time location data by simply impersonating US officials over the phone and email, according to court records and multiple sources familiar with the technique. In some cases, these people abuse telecom company policies created to give law enforcement real-time location data without a court order in “exigent circumstances,” such as when there is the imminent threat of physical harm to a victim.

In addition to cellular tower location data, carriers were also recently busted selling A-GPS data, which is supposed to be protected by FCC data rules. Despite significant reporting on this subject and carrier promises to stop collecting and selling this data, this practice is still ongoing. Like Facebook, these are companies that are staring down the barrel of looming regulation -- and still somehow can't seem to find the motivation to behave. Regulators at the Ajit Pai FCC have also sat on their hands and have yet to issue so much as a warning to cellular carriers.

At least one skiptracer told Motherboard that wireless carriers remain several steps behind in trying to crack down on the practice:

"So many people are doing that and the telcos have been very stupid about it. They have not done due diligence and called the police [departments] directly to verify the case or vet the identity of the person calling,” Valerie McGilvrey, a skiptracer who said she has bought phone location data from those who obtained access to it, told Motherboard. A skiptracer is someone tasked with finding out where people, typically fugitives on the run or those who owe a debt, are located."

In many instances the third parties are exploiting telecom company procedures for "exigent circumstances," allowing them to request and receive real-time location data by fabricating law enforcement data request documents telecom operators aren't properly verifying. Of course as the New York Times noted more than a year ago, law enforcement officers have also been busted abusing this system to spy on judges and other law enforcement officers.

Like so many sectors, wireless carriers were so excited by the billions to be made selling your daily habits, they forgot to actually protect that data. As reporters like Cox continue to dig deeper, you have to think that many cellular carriers are scrambling hard to clean up their mess as inevitable class action lawsuits and regulatory investigations wait in the wings. This scandal is getting so ugly, even the carrier-cozy Trump FCC may, at some point, be forced to actually do something about it.

Filed Under: bounty hunters, data sharing, debt collectors, exigent circumstances, impersonation, law enforcement, location info, privacy, stalkers, telcos

Wireless Carriers Busted Sharing User 911 Location Data

from the bottomless-well-of-dysfunction dept

Recent scandals involving companies like Securus and LocationSmart made it clear that cellular carriers are collecting and selling an ocean of user location data without any meaningful oversight. Several reports have highlighted how that data is then being routinely abused by everybody from ethically dubious local Sheriffs to bounty hunters. Subsequent investigations have shown how easy it is for bounty hunters and others to access this data, and how the FCC under several administrations has failed utterly to hold cellular carriers and data brokers accountable for any of it.

This week, Motherboard exposed another location data scandal with a report highlighting how cellular carriers are also selling private user A-GPS data with companies that aren't supposed to have access to it. A-GPS, or assisted GPS, involves using a device's onboard GPS chip as well as cellular network data to more quickly and precisely determine a user's location. Wireless industry filings with the government indicate this data can pinpoint a user's location indoors up to 50 meters; more precisely if a device's MAC and Bluetooth data are also utilized.

Motherboard's investigation focused specifically on a now-defunct location data broker by the name of CerCareOne, which had been selling cellular user location data -- including A-GPS data-- as recently as 2017. As with the other scandals, this scandal involves a universe of shady middlemen who buy and sell an ocean of such data, often without carriers understanding (or bothering to understand) how widespread the practice had become:

"Like with the companies involved in Motherboard’s previous investigation, CerCareOne’s real-time location data trickled down first from telecom companies, and then to a so-called location aggregator called Locaid. From there, Locaid sold that data access to a number of different companies, including CerCareOne, which in turn sold it to its own clients. Locaid was purchased by a company called LocationSmart in 2015 . The documents Motherboard obtained indicate that LocationSmart continued to sell data to CerCareOne after it obtained Locaid, and LocationSmart confirmed that to Motherboard."

The scale of the data collection was... not subtle:

"CerCareOne’s phone tracking service was not a one-off tool for bounty hunters and bail agents. A list of a particular customer’s phone pings obtained by Motherboard stretches on for around 450 pages, with more than 18,000 individual phone location requests in just over a year of activity. The bail bonds firm that initiated the pings did not respond to questions asking whether they obtained consent for locating the phones, or what the pings were for.

Another set of data is more than 250 pages long and covers around 10,000 phone pings. Another list of a different bounty hunter’s activity includes nearly 1,000 phone location requests in less than a year; a third details more than 4,500 pings."

The irony in this instance is that the FCC had crafted rules to specifically address this problem. Back in 2015 as the FCC was contemplating some new rules for enhanced 911 services, a coalition of privacy and consumer groups (including Public Knowledge, the EFF, and the ACLU) had written the agency warning that A-GPS and other granular data specifically used to aid in pinpointing 911 caller location (especially indoors) created the potential for some major privacy issues:

"The development of highly-precise location technologies designed to comply with the new regulations will raise a host of privacy concerns that have not been sufficiently addressed in the E911 proceeding. Public safety should not come at the expense of consumer privacy—nor should it have to."

The FCC obliged, and in 2017 finalized rules with carrier approval that specifically stated that this kind of A-GPS data should never be used for any purpose other than tracking user location for emergency services:

"CMRS providers must certify that they will not use the NEAD or associated data for any non-911 purpose, except as otherwise required by law."

Many carriers claim to have completely stopped sharing this and other forms of location data entirely with data brokers or anybody else. But it's going to take a comprehensive investigation to not only confirm that, but also to confirm that they're not currently engaging in even worse behavior. Especially since every time we think we've gotten to the bottom of this scandal, the floor drops out revealing countless additional layers beneath.

Even with Ajit Pai's efforts to neuter FCC authority over ISPs, I've spoken to at least four telecom and privacy experts who say the FCC very clearly has the authority and responsibility to stop this sharing of private data, they've just chosen not to -- despite the fact the agency had the foresight to craft rules specifically designed to stop this from happening.

Filed Under: 911, a-gps, bounty hunters, e-911, enforcement, fcc, location data, privacy
Companies: cercareone

Another Day, Another Massive Cellular Location Data Privacy Scandal We'll Probably Do Nothing About

from the ill-communication dept

We've noted a few times now that while Facebook gets a lot of justified heat for its privacy scandals, the stuff going on in the cellular data and app market in regards to location data makes many of Facebook's privacy issues seem like a grade-school picnic. That's something that was pretty well highlighted by the recent Securus and LocationSmart scandals, which showcased perfectly how cellular carriers and location data brokers routinely buy and sell your daily travel habits with only a fleeting effort to ensure all of the subsequent buyers and sellers of that data adhere to basic privacy and security standards.

This week, Joseph Cox at Motherboard dropped yet another bombshell report on this subject, noting how he was easily able to pay a bounty hunter $300 to obtain the (supposedly) private location data collected by his cellular provider (T-Mobile). Much like the Securus scandal, the problem once again is the countless location data brokers and third party vendors which are being sold this data, then doing pretty much whatever they'd like with it. In this instance, his data was collected by T-Mobile, shared with brokers and aggregators like Microbilt and Zumingo, then in turn shared with bail bond outfits and private investigators:

"Microbilt buys access to location data from an aggregator called Zumigo and then sells it to a dizzying number of sectors, including landlords to scope out potential renters; motor vehicle salesmen, and others who are conducting credit checks. Armed with just a phone number, Microbilt’s “Mobile Device Verify” product can return a target’s full name and address, geolocate a phone in an individual instance, or operate as a continuous tracking service."

Cellular carriers make a small fortune collecting and selling this data, and there's virtually no oversight of the practice. Consumers often sign one privacy agreement with their cellular provider, which in turn is then broadly interpreted as a green light down a long road of companies which then collect and sell that data in turn. As we saw with the Securus scandal (when a local Sheriff was busted snooping on the private cellular location data of Judges and fellow law enforcement officers), everybody in this chain of dysfunction likes to play stupid when the problem repeatedly comes to light. The same thing occurred here:

“We take the privacy and security of our customers’ information very seriously and will not tolerate any misuse of our customers’ data,” A T-Mobile spokesperson told Motherboard in an emailed statement. “While T-Mobile does not have a direct relationship with Microbilt, our vendor Zumigo was working with them and has confirmed with us that they have already shut down all transmission of T-Mobile data. T-Mobile has also blocked access to device location data for any request submitted by Zumigo on behalf of Microbilt as an additional precaution.”

When the NY Times broke the Securus scandal story last year, cellular carriers all played stupid, insisted they'd ceased the sale of such data, and breathlessly assured everybody that this behavior wouldn't happen again. When Senator Ron Wyden complained, you might recall that T-Mobile CEO John Legere took to Twitter at the time to insist he'd learned the error of his ways:

Apparently not.

Needless to say, Wyden, who has been pushing new privacy legislation, isn't particularly impressed:

If you were an industry hoping to avoid government regulation of your business, you'd think you'd be a little more cautious in the way you treat private data. But as we've noted countless times, this kind of cavalier treatment of private data is the norm for telecom. From hoovering up your clickstream data to covertly modifying data packets to track you around the internet, telecom has long played fast and loose with consumers' private data. Some have even flirted with the idea of only seriously respecting your privacy if you pay an additional fee, effectively making consumer privacy a luxury feature.

So while broadband giants will surely whine incessantly during the looming quest to pass some meaningful rules of the road, it's worth remembering they had ample opportunities, over decades, to avoid stricter government intervention by adopting better, more ethical business practices. It's also worth reminding folks that ISPs lobbied furiously to convince the GOP to kill some fairly basic privacy protections at the FCC that would have required ISPs clearly inform users who is buying and selling this data, giving users a little more control over how it was shared.

And it's also worth noting that even without legislation or those rules, the FCC still has Section 222 authority to police this kind of behavior. While the FCC's privacy rules were killed, mobile carriers are still subject to CPNI rules for voice calls, which were expanded in 2005 to include subscriber location information. The bottom line is that the Ajit Pai FCC could easily address this problem using the authority it has now, they've just chosen not to because it might just hurt telecom revenues. The FTC could also probably ding T-Mobile for being "unfair and deceptive" under Section 5 of the FTC act, yet has been similarly mute as carriers bullshit their way around their failures on this front.

All of that said, there's countless folks who think they're taking meaningful steps to protect their privacy by deleting Facebook (or on-phone apps), yet are oblivious to the perils of walking around with a stock carrier phone in their pocket. It might be time to stop being quite so collectively naive about US privacy practices if we're going to have a serious (and undeniably difficult) adult conversation on what privacy rules of the road should look like. One thing we can probably mostly agree upon: this practice of hoovering up your every move and selling it to an ocean of companies with little to no real attempt to protect it is behavior we need to change, one way or another.

Filed Under: bounty hunters, john legere, location data, mobile operators, privacy, ron wyden, selling data
Companies: at&t, microbilt, sprint, t-mobile, verizon, zumingo