Big Telecom Sold Highly Sensitive Customer GPS Data Typically Used for 911 Calls
Big Telecom Sold Highly Sensitive Customer GPS Data
Typically Used for 911 Calls
A Motherboard
investigation has found that around 250 bounty hunters and related businesses
had access to AT&T, T-Mobile, and Sprint customer location data.
Feb 6 2019, 2:11pm This is a breaking news piece. You can read
our full investigation here.
Around 250 bounty hunters and related businesses had access to
AT&T, T-Mobile, and Sprint customer location data, according to documents
obtained by Motherboard. The documents also show that telecom companies sold
data intended to be used by 911 operators and first responders to data
aggregators, who sold it to bounty hunters. The data was in some cases so
accurate that a user could be tracked to specific spots inside a building.
The news shows not only how widely
Americans’ sensitive location data has been sold through the overlooked and
questionable data broker market, but also how the ease-of-access dramatically
increased the risk of abuse. Motherboard found that an individual company made
more than 18,000 data location requests through a data broker; other companies
made thousands of requests. The full details of our investigation are
available here.
“This scandal keeps getting worse.
Carriers assured customers location tracking abuses were isolated incidents.
Now it appears that hundreds of people could track our phones, and they were
doing it for years before anyone at the wireless companies took action,” Oregon
Senator Ron Wyden said in an emailed statement after presented with
Motherboard’s findings. “That’s more than an oversight—that’s flagrant, wilful
disregard for the safety and security of Americans.”
A screenshot obtained by Motherboard
of a phone being located via its GPS data. Motherboard has blurred and cropped
parts of the image to protect individuals’ privacy. Image: Motherboard
Between at least 2012 until it closed
in late 2017, a now-defunct data seller called CerCareOne allowed bounty
hunters, bail bondsmen, and bail agents to find the real-time location of
AT&T, T-Mobile, and Sprint mobile phones. The company would sometimes
charge up to $1,100 per phone location, according to a source familiar with the
company. Motherboard granted a number of sources in this story anonymity to
provide details about a controversial industry practice.
Some of the data available to
CerCareOne customers included a phone’s “assisted GPS” or A-GPS data, according
to documents and screenshots of the service in action provided by two
independent sources. A-GPS is a technology that is used by first responders to locate
911 callers in emergency situations. A letter to the Federal Communications
Commission from a T-Mobile lawyer in 2013 noted that “A-GPS is reasonably the
foundation of wireless [emergency] 911 location for both indoor and outdoor
locations.”
“Oftentimes A-GPS provides location
information about where someone is inside a
building,” Laura Moy, executive director at the Center on Privacy &
Technology at Georgetown University Law Center, told Motherboard in an email.
Blake Reid, associate clinical professor
at Colorado Law, told Motherboard in an email that “with assisted GPS, your
location can be triangulated within just a few meters. This allows constructing
a detailed record of everywhere you travel.”
“The only reason
we grant carriers any access to this information is to make sure that first
responders are able to locate us in an emergency,” Reid added. “If the carriers
are turning around and using that access to sell information to bounty hunters
or whomever else, it is a shocking abuse of the trust that the public places in
them to safeguard privacy while protecting public safety.”
Both Reid and Moy said this was the
first instance of a telco selling A-GPS data they had heard of.
A Sprint spokesperson did not directly
answer whether the company has ever sold A-GPS data. When asked if T-Mobile has
sold A-GPS data, a company spokesperson told Motherboard in an email “We don’t
have anything further to add at this stage.” AT&T did not respond to a
request to clarify whether it sells or has ever sold A-GPS data.
A list of a particular customer’s use
of the phone location service obtained by Motherboard stretches on for around
450 pages, with more than 18,000 individual phone location requests in just
over a year of activity. The bail bonds firm that initiated the requests—known
in the industry as phone pings—did not respond to questions asking whether they
obtained consent for locating the phones, or what the pings were for.
“The scale of this abuse is
outrageous,” Eva Galperin, director of cybersecurity at campaign group the
Electronic Frontier Foundation, told Motherboard in an email.
Comments
Post a Comment