Originally published at: Exposé Reveals Ongoing Smartphone Location Tracking Threats - TidBITS
Five years ago, the New York Times published an exposé on the location data tracking industry, which we covered in “The New York Times Reveals How Completely Our Every Move Is Tracked” (19 December 2019). Little has changed since then. At 404 Media, Joseph Cox now writes about Locate X, a tool from location broker Babel Street:
The demonstration, performed by a group of privacy advocates that gained access to the tool and leaked videos of it to 404 Media and other journalists, shows in the starkest terms yet how Locate X and other tools based on smartphone location data sold to various U.S. government law enforcement agencies, including state entities, could be used to monitor abortion clinic patients. This comes as more states contemplate stricter or outright bans on abortion.
…
The videos also show that while Apple and Google have taken steps either to stymie the flow of location data in general, or remove sensitive locations like abortion clinics from their own banks of data, the highly sensitive movements of visitors to clinics or essentially any other location are still exposed on a massive scale and finding their way into tools used by U.S. law enforcement. Through a complex data supply chain involving apps or ads on a phone, peoples’ movements are included in Locate X as a side-product of the mobile advertising system.
It’s not just law enforcement. The privacy advocates gained access to Locate X merely by saying they were “contemplating some government contract work,” and a private investigator source told 404 Media that similar capabilities are available in his industry.
Although Cox chose to focus on the hot-button topic of tracking people seeking or assisting with abortions, the privacy advocates exposing Locate X’s capabilities also showed it identifying devices belonging to jurors by linking them to a reserved parking lot, finding devices that appeared repeatedly at a synagogue in Los Angeles and a mosque in Dearborn, and collecting location data on children at a Philadelphia school. By tracking a particular device to known locations, Locate X could be used to stalk individuals.
According to Brian Krebs of KrebsOnSecurity, the privacy advocates confirmed this stalking capability by working with the consent of several individuals, including police officer Justyna Maloney. She faced online and physical harassment after interacting with a social media personality who posted a selectively edited video of the encounter. Her iPhone had nearly 100,000 hits in Locate X’s database, all seemingly triggered by an app from the department store Macy’s, which uses geolocation to provide “an enhanced shopping experience.” Macy’s said it has no direct relationship with Babel Street but shares the data with “a limited number of partners,” at least one of whom shared the data with Babel Street.
As much as we desperately need legislation to bury this industry, Apple and especially Google must do more to protect users, including their employees. How many devices in Locate X’s database can be tracked to Apple Park and the Googleplex?
