AT&T says it’ll stop selling location data amid calls for federal investigation
AT&T says it’ll stop selling location data amid calls
for federal investigation
by Hamza Shaban and Brian Fung, Updated: January 10,
2019- 8:40 PM
AT&T said Thursday that it will stop selling its
customers' location data to third-party service providers after a report this
week said the information was winding up in the wrong hands.
The announcement follows sharp demands by federal
lawmakers for an investigation into the alleged misuse of data, which came to
light when Motherboard revealed a complex chain of unauthorized information
sharing that ended with a bounty hunter successfully tracking down a reporter's
device.
AT&T had already suspended its data-sharing
agreements with a number of so-called "location aggregators" last
year in light of a congressional probe finding that some of Verizon's location
data was being misused by prison officials to spy on innocent Americans.
AT&T also said at the time that it would be maintaining those of its
agreements that provided clear consumer benefits, such as location sharing for
roadside assistance services.
But AT&T's announcement Thursday goes much further,
pledging to terminate all of the remaining deals it had - even the ones that it
said were actively helpful.
"In light of recent reports about the misuse of
location services, we have decided to eliminate all location aggregation
services - even those with clear consumer benefits," AT&T said in a
statement. "We are immediately eliminating the remaining services and will
be done in March."
In characteristic fashion, T-Mobile CEO John Legere
tweeted Tuesday that his firm would be "completely ending location
aggregator work" in March. Verizon said in a statement Thursday that it,
too, was winding down its four remaining location-sharing agreements, which are
all with roadside assistance services - after that, customers would have to
give the company permission to share their data with roadside assistance firms.
A Sprint spokeswoman didn't immediately respond to a request for comment.
The announcements reflect a major victory for privacy
advocates who have slammed corporate America over its handling of consumers'
personal information, often to their personal and economic expense.
“Carriers are always responsible for who ends up with
their customers' data - it’s not enough to lay the blame for misuse on
downstream companies,” said Sen. Ron Wyden (D., Ore.) in a statement. “The time
for taking these companies at their word is long past. Congress needs to pass
strong legislation to protect Americans' privacy and finally hold corporations
accountable when they put your safety at risk by letting stalkers and criminals
track your phone on the dark web.”
Other critics said Americans have an "absolute
right" to their privacy of their data.
“I’m extraordinarily troubled by reports of this system
of repackaging and reselling location data to unregulated third-party services
for potentially nefarious purposes,” Sen. Kamala Harris (D., Calif.) said in a
statement after the Motherboard report was published. “If true, this practice
represents a legitimate threat to our personal and national security.”
Harris called on the Federal Communications Commission to
immediately open an investigation.
Motherboard reported that major U.S. wireless carriers
T-Mobile, AT&T, and Sprint have been selling the location data of their
customers in an unregulated market in which Americans' personal information
travels through several layers of third-party entities that buy the location
data but are not authorized to handle such information.
After the report was released, FCC Commissioner Jessica
Rosenworcel said on Twitter, "The @fcc needs to investigate. Stat."
In a subsequent post in which she agreed with Harris and others calling for an
investigation, Rosenworcel added: "It shouldn't be that you pay a few
hundred dollars to a bounty hunter and then they can tell you in real time
where a phone is within a few hundred meters. That's not right. This entire
ecosystem needs oversight."
The FCC did not immediately respond to requests for
comment; the agency's operations are limited because of the ongoing government
shutdown.
The sharing of the phone location data at the center of
the report began at T-Mobile, which shared it with a "location
aggregator," who shared it with a phone location service, which shared it
with a bounty hunter, who shared it with a source, who ultimately sent the
phone's location to Motherboard, according to the report.
As Motherboard reported, there are legitimate uses for
the sharing of location data, including detecting financial fraud or locating
motorists who need roadside assistance. But according to the report, in some
cases the sensitive information was resold without authorization for purposes
that violated data-sharing policies and without the knowledge of the phone
company and its third-party partners.
Wyden has called on the FCC to investigate the
relationship between wireless carriers and data brokers. He sees the new report
as another urgent motivation for government action, including an investigation
by the Federal Trade Commission. "Major carriers pledged to end these
practices, but it appears to have been more empty promises to consumers,"
Wyden said on Twitter. He said Congress should advance his legislation that
would grant the FTC greater authority to safeguard consumer data and fine
companies for privacy and security violations.
Sprint said in a statement: "Protecting our
customers' privacy and security is a top priority, and we are transparent about
that in our Privacy Policy. We do not knowingly share personally identifiable
geolocation information except with customer consent or in response to a lawful
request such as a validated court order from law enforcement."
Responding to the report, AT&T said in a statement:
"We only permit sharing of location when a customer gives permission for
cases like fraud prevention or emergency roadside assistance, or when required
by law. Over the past few months, as we committed to do, we have been shutting
down everything else."
Sen. Mark Warner (D., Va.), who has criticized the
privacy practices of Facebook and other companies that collect massive
quantities of user data, said the report highlights how customers and
policymakers “have been kept in the dark” about the ways personal information
is gathered, repackaged and sold.
“Responsible federal agencies and the U.S. Congress
should continue to hold hearings to shine a light on these practices, and look
at regulations to ensure companies are actually upfront with consumers about
whether and how their sensitive data is being used and sold,” Warner said in a
statement.
Posted: January 10, 2019 - 8:40 PM
Comments
Post a Comment