Easy Access to Phone Data Gets Thorny for Agencies

"WASHINGTON -- The Federal Bureau of Investigation this past week acknowledged having bought precise geolocation data derived from mobile-phone advertising in the past before backing away from the practice in the face of thorny legal issues and public controversy.

The precise location of millions of mobile devices and automobiles is increasingly available for sale by commercial vendors, sometimes offering a nearly real-time look at how a phone or vehicle moves around the world. Several government agencies, including the U.S. Department of Homeland Security, have bought access to this kind of commercial information such as the geolocation of phones without court authorization, something the FBI says it no longer does.

The different tacks show the difficulties of applying established legal standards and internal procedures to a new world awash in data.

In an appearance before the Senate Select Committee on Intelligence on Wednesday, FBI Director Christopher Wray said the nation's top federal law-enforcement agency now seeks court orders when obtaining phone data from commercial vendors. Such data can often reveal detailed information on the movement and behavior of individuals.

"We do not currently purchase commercial database information that includes location data derived from internet advertising. I understand that we previously -- as in the past -- purchased some such information for a specific national security pilot project. But that's not been active for some time," Mr. Wray said in response to a question from Sen. Ron Wyden (D., Ore.).

Several years ago, a branch of the U.S. military called the Joint Special Operations Command created a program designed to take advantage of modern digital-advertising networks, aimed largely at tracking terrorists overseas, people familiar with the matter said. For a short time, the FBI participated in the military-led effort, one of those people said, testing the data's usefulness in some domestic matters, including the 2017 mass shooting in Las Vegas and a 2018 missing-person case, before pulling out.

The FBI also purchased a license to a commercial service called Venntel, which allows phone tracking through advertising data, before letting the contract lapse in 2021, according to federal spending records. When the FBI put out a request for proposal last year for a vendor to help monitor social-media chatter, it told bidders that no location-based data feeds should be included in any product sold to the bureau.

U.S. Special Operations Command, which oversees JSOC, declined to comment. The FBI declined to comment beyond Mr. Wray's remarks. The Department of Homeland Security and its components, U.S. Customs and Border Protection (CBP), and Immigration and Customs Enforcement, didn't respond to requests to comment.

CBP acknowledged in 2020 buying access to Venntel's data but said in a statement at the time: "It is important to note that such information doesn't include cellular phone-tower data, is not ingested in bulk and doesn't include the individual user's identity."

In the years since the JSOC-led effort, the use of commercially purchased advertising data for tracking has trickled down from the military to federal, state and local police forces in some cases. Such agencies are increasingly accessing bulk data sets from commercial vendors to acquire information, usually without court authorization.

Civil-liberties groups and privacy activists have been sharply critical of such government purchases.

"FBI Director Wray's admission that the FBI secretly purchased Americans' location data 'derived from internet advertising' is both shocking and further proof of the need for Congress to take immediate action to rein in mass surveillance," said Sean Vitka of Demand Progress, a group that advocates online privacy and digital rights.

The commercial availability of such data raises new questions for agencies. A warrant is required to track a phone through the cell networks or install a GPS tracking device on a car, the Supreme Court has ruled. To obtain such a warrant, police need to show probable cause of a crime.

But the sheer amount of data now available for sale offers a broad avenue to acquiring personal data from phones or cars without a warrant by paying for it, raising new legal questions about how and when the government should be permitted to buy it.

Phone apps and digital display advertising networks often collect geolocation data from phones and resell it through data brokers, who can also collect internet protocol (IP) addresses as consumers browse the web, pinpointing a user to a specific location.

In-car vehicle-security or infotainment systems also collect and sell vehicle locations, and governments and private sector companies alike are amassing large databases of license plate scans.

Personal information such as names and phone numbers are stripped from such data sets but information such as where a car parks at night or where a phone is located in the evening can be cross-referenced against other data sources that include names, addresses and property-ownership records to link a device or vehicle to an individual or family." [1]

1. U.S. News: Easy Access to Phone Data Gets Thorny for Agencies
Tau, Byron.  Wall Street Journal, Eastern edition; New York, N.Y. [New York, N.Y]. 11 Mar 2023: A.5.