A social media and phone surveillance system ICE bought access to is designed to monitor a city neighborhood or block for mobile phones, track the movements of those devices and their owners over time, and follow them from their places of work to home or other locations, according to material that describes how the system works obtained by 404 Media.\u00a0Commercial location data, in this case acquired from hundreds of millions of phones via a company called Penlink, can be queried without a warrant, according to an internal ICE legal analysis shared with 404 Media. The purchase comes squarely during ICE\u2019s mass deportation effort and continued crackdown on protected speech, alarming civil liberties experts and raising questions on what exactly ICE will use the surveillance system for.\u00a0\u201cThis is a very dangerous tool in the hands of an out-of-control agency. This granular location information paints a detailed picture of who we are, where we go, and who we spend time with,\u201d Nathan Freed Wessler, deputy project director of the American Civil Liberties Union\u2019s (ACLU) Speech, Privacy, and Technology Project, told 404 Media.This week, the Department of Homeland Security (DHS) started deploying as many as 2,000 officers to Minneapolis, including from ICE\u2019s deportation arm. On Wednesday, an ICE official repeatedly shot and killed a woman, Renee Nicole Good, 37, when she was turning around her car.\u00a0\ud83d\udca1Do you know anything else about this tool? Do you work for ICE, CBP, or another agency? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.In September, 404 Media reported on ICE\u2019s planned purchase of the technology, consisting of two Penlink products called Tangles and Webloc. 404 Media has now obtained material that explains in greater detail how the system works.The material shows Webloc users can search its databases of mobile phone data in various ways. Users can perform a single perimeter analysis to search a specific area for mobile phones across a certain time period. They can draw the target area with a rectangle, circle, or polygon. They then select the maximum number of results the system should display, and the maximum number of devices to return.\u00a0Once a Webloc user has identified a device of interest, they can get more details about that particular phone, and, by extension, its owner, by seeing where else it has travelled both locally and across the country. Users can click a route feature which shows the path the device took. The material suggests that if users look at where the device was located at night, they might find the person\u2019s possible home, and during the day, the person\u2019s possible employer.The software can also do a multi-permiter analysis, which monitors multiple locations at once to see which devices have been present at two or more specific places.A results page then displays the list of discovered devices. This includes whether the phone is an Android or iOS device; the number of days the device visited a given location; the average amount of time a device stayed at the location; and the total number of pieces of location data for that phone.A screenshot of Penlink marketing material. Available here.The material does not say how Penlink obtains the smartphone location data in the first place. But surveillance companies and data brokers broadly gather it in two different ways. The first is from small bundles of code included in ordinary apps called software development kits, or SDKs. SDK owners then pay the app developers, who might make things like weather or prayer apps, for their users\u2019 location data. The second is through real-time bidding, or RTB. This is where companies in the online advertising industry place near instantaneous bids to get their advert in front of a certain demographic. A side effect is that companies can obtain data about peoples\u2019 individual devices, including their GPS coordinates. Spy firms have sourced this sort of RTB information from hugely popular smartphone apps.\u00a0The Webloc material says users can filter devices by their unique Apple and Android advertising identifiers, which are often collected by surveillance companies. The material also says users can filter location data by GPS, WiFi, or IP address.\u201c\u200b\u200bIt’s dangerous for ICE or any government agency to be vacuuming up this type of sensitive data in bulk and absent checks. This type of surveillance dragnet will enable draconian policing and\u00a0abuse,\u201d Jake Laperruque, deputy director of the Center for Democracy & Technology’s Security and Surveillance Project, told 404 Media.Senator Ron Wyden, whose office has repeatedly investigated the location data industry, told 404 Media, \u201cUnder Trump, ICE has terrorized American cities with zero regard for due process or the wishes of the people who live there. In the hands of Trump\u2019s shock troops, location data could do tremendous harm to people who have done nothing wrong.\u201d<\/p>\n
ICE paid nearly $2 million for access to Tangles in September, Forbes reported. The agency then bought additional licenses in December for another $312,500, according to public procurement data. The purchase was on behalf of ICE\u2019s Homeland Security Investigations (HSI), which traditionally has focused on criminal investigations, but has recently been roped into ICE\u2019s mass deportation effort, according to data obtained by the CATO Institute.A document ICE previously published signalling its intent to buy the products explicitly mentioned Webloc. Webloc isn\u2019t a unique capability in the location data industry. A former employee of a similar company called Babel Street previously told me users can draw a shape on a map to see all devices Babel Street has for that location, then see where else that device has been. But the ICE document indicated the agency chose Penlink over its competitors because the company provides an \u201call-in-one\u201d tool for searching both masses of location data and information from social media.A government official told 404 Media commercial location data can be less useful than other types of location information, such as that from telecoms. 404 Media granted the official anonymity as they weren\u2019t permitted to speak to the press. One glaring issue for government users is if a target\u2019s device happens to be in the sold dataset or not. For example, the IRS previously tried to use location data from Venntel to find where targets lived, but were unsuccessful because the people the agency were looking for weren\u2019t included in that particular dataset.\u00a0Location data has been used to identify groups, or movements, of people. When the Wall Street Journal first revealed the sale of commercial location data to government agencies, it reported Customs and Border Protection (CBP) used the data to look for phone activity in unusual places along the Mexican border. The report also said ICE had used the data to help identify immigrants who were later arrested.A screenshot of the internal ICE legal analysis. Available here.The ACLU obtained an internal ICE legal analysis on the use of smartphone location data through a Freedom of Information Act (FOIA) lawsuit. At the time it was written it was discussing data from another location broker. But it provides insight into ICE\u2019s legal justification to not seek a warrant when using such data. 404 Media has uploaded a copy of the document here.\u201cUnder longstanding Supreme Court precedent, an individual has no reasonable expectation of privacy under the Fourth Amendment in information voluntarily disclosed to third parties,\u201d the analysis says, referring to data collected by location data companies and sold to the government. The rationale is that the phone\u2019s owner has provided this information willingly because they could, theoretically, remove apps gathering their location data or turn off location services altogether. (In multiple investigations into the location data industry, I\u2019ve found apps did not always disclose how their location data might be used or sold, and in some cases apps still collected data even when people opted-out, meaning users could not have meaningfully consented.)\u201cThe government\u2019s justifications are tremendously self-serving. The government tries to satisfy privacy concerns by noting that this tracking data is attached to a phone\u2019s AdID number instead of a phone number, but that\u2019s a meaningless distinction,\u201d Wessler from the ACLU continued. \u201cThis data allows precise tracking of millions of people\u2019s phones, revealing granular detail about us that can be easily linked to our identities. Nobody expects that by carrying a phone, they are somehow consenting to let the government make a record of their every move. That\u2019s a chilling power. The government\u2019s scrabbling about for legal loopholes can\u2019t cover for the massive privacy violation that this technology enables.\u201dIn 2018 the Supreme Court ruled in the landmark Carpenter v. United States case that authorities need a warrant to access historical cellphone location data sourced from telecoms. The ICE legal analysis suggests that the agency does not think the same protection extends to commercially available smartphone location data.\u201cBy claiming the power to buy access to this information with no judicial oversight, ICE can track any of us or all of us for as long as it wants at an agent\u2019s mere whim. Anyone can become a suspect, and there\u2019s no meaningful safeguard against abuse. And of course, in a time of rampant racial profiling by ICE agents, members of immigrant communities and communities of color are likely to suffer particularly acute harms,\u201d Wessler added.Senator Wyden added, \u201cThe Federal Trade Commission made clear in multiple settlements that selling location data from apps and online ads\u2014including to the government\u2014is a violation of federal law unless users receive clear notice and consent to selling their data to the government. But now that the FTC is effectively a wing of the White House, data brokers have continued to sell data to ICE and other agencies with impunity. The abuse of Americans\u2019 personal data won’t stop until Congress or states pass clear laws that give users an easy way to block the sale of their data, or to ban the sale of personal data altogether.\u201dThe Department of Homeland Security (DHS) did not respond to a series of questions about ICE\u2019s legal analysis or its use of Webloc.ICE, CBP, and the Secret Service all broke the law when using commercial location data, a government report found in 2023. That included a CBP official using the technology to track the location of coworkers with no investigative purpose, and the agencies not having enough formal guardrails in place. At the time, the Inspector General recommended that ICE stop using commercial location data until it obtained the necessary approvals. ICE declined to do so. \u201cCTD [Commercial Telemetry Data] is an important mission contributor to the ICE investigative process as, in combination with other information and investigative methods, it can fill knowledge gaps and produce investigative leads that might otherwise remain hidden. Accordingly, continued use of CTD enables ICE HSI to successfully accomplish its law enforcement mission,\u201d the agency\u2019s response read.404 Media also obtained material related to Tangles, the social media monitoring product ICE bought access to. That shows users can detect faces in an image and then attempt to identify them; perform sentiment analysis on a target\u2019s posts; and add specific social media accounts to a \u201cwatch list.\u201d Independent journalist Jack Poulson previously reported on Tangles material showing how the tool could be used to monitor protesters, including the Black Lives Matter movement.A Penlink spokesperson told 404 Media in an email, \u201cThe tools we provide to the government exclusively use publicly or commercially available data and are used to advance criminal investigations and save lives. They enable law enforcement to spot threats faster and use evidence more efficiently.\u201dIt added, \u201cPenlink operates under strict compliance, due diligence, and responsible-use standards. PenLink is committed to transparency, legality, and integrity in every aspect of our work.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"