Ads You See Online Are Now Police Surveillance

Kind: captions Language: en Everyone knows the police need a warrant to track your movements. That's the Fourth Amendment, right? Well, not anymore because the app you checked for tomorrow's forecast just sold the government a map of everywhere you've been, including where you slept last night. Ben Renick, a world-renowned exotic snake breeder, was found dead in his Missouri reptile facility in 2017, a pool of blood surrounding. Police thought that one of his prized snakes had attacked and killed him until they looked closer and they found a shell casing. With few leads, investigators turned to a surveillance tool that harvests location data from popular phone apps. They searched for every phone that was near the property at the time of the murder and one device stood out, the babysitter's. Investigators spent weeks reconstructing its movements all without a warrant or its owner's knowledge. To track [music] her, the police didn't need a judge's approval. They just needed access to an ad [music] tech database and the subscription that reportedly starts at $7,500 a year. Except she was totally innocent. Right now, somewhere in America, a detective can open a web browser, draw a box on a map, choose a date, and then click search. Seconds later, they'll see every phone that entered the area and up to 90 days of where those phones traveled afterwards, all thanks to Fog Reveal. It's the product of a Virginia company called Fog Data Science, founded by two former senior officials from the Department of Homeland Security. Their platform pulls location data from the advertising systems embedded into the apps you use for navigation, shopping rewards, and local weather. It then feeds it all into a searchable database. Law enforcement agencies can log in and find out which phones were inside the perimeter of their interest on [music] a specific date and what the tool's call a pattern of life analysis. The phrase came straight from the intelligence community. It's the same methodology the NSA uses to profile terrorism suspects. By [music] 2022, investigative reporters at the Associated Press and the Electronic Frontier Foundation had uncovered the scope of the program through Freedom of Information Act requests. Fog Data Science had sold around 40 contracts to law enforcement agencies across the country. The list included state highway patrols, county sheriffs, municipal police departments, and federal agencies. [music] Some smaller departments share access with neighboring jurisdictions to split the cost. It's a tool that can track a quarter of a billion devices for less than the cost of a used police cruiser. And Missouri wasn't an exception. When the nurse Sydney Sutherland disappeared while jogging outside Newport, Arkansas in 2020, her phone [music] was found in a ditch and police had almost nothing to go on. A local prosecutor shared his agency's Fog Reveal access with the US Marshal Service and investigators [music] used the tool to identify which devices had been in the area when Sutherland was last seen. That data helped lead to the arrest of a local farmer for her assault and murder. Fog's use was not documented anywhere in the court record. That is the part that should stop you cold. In two separate investigations, a surveillance tool was used to identify suspects. In neither case was its existence disclosed to the defense. Bennett Cyphers, a senior advisor at the EFF, who led the public records investigation, described it as a mass surveillance program on a budget. He noted there had been no previous record of companies selling this kind of granular data directly to local law enforcement. "We're seeing counties with less than 100,000 people," he said, "where the sheriff is using this extremely high-tech, invasive, [music] secretive surveillance tool to chase down local crime." Fog Reveal is different from the surveillance tools you're probably imagining. It doesn't tap cell towers or go to Apple or Google or your carrier or require a subpoena or any contact with the company that made your phone work. The data it uses was never officially collected by law enforcement at all. Instead, it was collected by the apps people freely use. The data is then sold to the brokers for the highest bid. It's aggregated and repackaged until it lands in a web portal that a county sheriff can access from a laptop. The broker sitting at the center of that supply chain is called Ventel, a subsidiary of a company called Gravy Analytics. Ventel's confirmed government clients include the IRS, the Department of Homeland Security, Immigration and Customs Enforcement, Customs and Border Protection, the DEA, and the FBI. Ventel claims to source its data from over 80,000 different apps. The developers of most of those apps almost certainly have no idea where their users' location data ends up, which is problematic. How is any of this legal? The Fourth Amendment was supposed to protect you from exactly this kind of warrantless government surveillance. Yet, here we are. The Fourth Amendment says the government can't search your private life without a warrant. That's the deal. Police need probable cause, a judge's signature, and a specific description of what they're looking for to get in the door. It's been that way since 1791. So, how, you ask, is a company selling your location history to federal agencies without any of that? How does that not violate the most foundational privacy protection in American law? Easy. They make the data disappear from the Constitution before they take it. Here's how it works. The moment you share your information with a third-party app, a bank, or a phone company, the law says you are voluntarily surrendering your reasonable expectation of privacy with it. Not to that company specifically, to everyone, including the government. Once it's in someone else's hands, the Fourth Amendment stops following it. The government doesn't need a warrant to get it from the third party because, legally, it's not your information anymore. You gave it away, and you assumed the risk. This is what's known as third-party doctrine, and it's been the law since the 1970s. If you thought the Supreme Court invented the enabling of mass surveillance after [music] a mass terror event like 9/11, you're wrong. It actually came out of a mundane robbery case in Baltimore in 1976 where the suspect kept calling his victim afterward to threaten her. Police wanted to prove it was him, so they went to the phone company and they asked them to record which numbers he was dialing from his home phone. And they had no warrant, but the court said it was fine. The suspect, they argued, had voluntarily shared those numbers with the phone company by dialing them. Therefore, he had no reasonable expectation that they would stay [music] private. >> But the logic the court used was so broad, so cleanly transferable, that it became the master key for nearly every form of digital surveillance that followed. Supreme Court Justice Thurgood Marshall saw it coming in his dissent to the case. He warned that the ruling gave the government unchecked power to monitor patterns of association. He was outvoted 5-3 and largely ignored for four decades. Then in 2018, the Supreme Court blinked. In 2018, the Supreme Court heard a case called Carpenter v. United States. >> It centered on a string of armed robberies in Detroit. In a 5-4 decision, the court ruled that police violated the Fourth Amendment by collecting 127 days of a suspect's cell phone records from his carrier without a warrant. Chief Justice John Roberts wrote that tracking a phone amounted to near-perfect surveillance as if it had attached an ankle monitor to a phone's user. [music] He said it gave the government a window into a person's familial, political, professional, religious, [music] and sexual associations. >> It had to stop. Privacy advocates celebrated his stance. The government, more broadly, just took notes and nodded. Carpenter v. United States protected location data held by your cell carrier, the company whose towers your phone pings just by being switched on. That narrow category of data now needs a warrant. Everything else is still wide open. That includes every piece of location data you hand to an app, [music] which then sells it to a broker, who then sells it to another broker who sells it to the government. That entire chain powers Fog Reveal, as well as VenTel's confirmed clients at ICE, the DEA, and the FBI. It currently sits in the gap that Carpenter deliberately didn't close. When you tapped allow on that weather app's location prompt, you shared your data with a third party, >> [music] >> and the third party doctrine took things from there. The Constitution stopped following your location at the exact moment you let an app see it. What the government buys from brokers is legally speaking, data you already gave away. Kevin Metcalf, the Arkansas prosecutor who used Fog Reveal in the Sydney Sutherland case, said people need to decide whether they want all this free technology. His position is that you can't have free apps and privacy. You need to pick one. What he left out is that nobody taught you that was the choice. Have you ever seen a disclosure that said, "Tap allow and law enforcement agencies can purchase a 90-day map of your movements without ever speaking to a judge?" Of course not. You got a push notification, and you tapped yes, and that was the transaction. Here's something worth knowing about the internet advertising business. It all started as a pretty sensible concept. Back then, Master Villain's operations were still just a remote Orwellian pipe dream. If you were reading a fishing website in 1998, you got fishing ads. Advertisers matched that ad to the content, and it was a sure fire way to reach someone who's actually interested in your wares. And at that point, your identity was irrelevant to the transaction. Nobody needed to know who you were. All they needed to know is where you were reading. Then, the smartphone arrived. The moment a GPS-enabled computer went into everyone's pocket, someone in an office somewhere had this thought that we didn't know we were dreading. What if the ad didn't follow the content? What if it followed the person? Because location, as it turns out, is the most important thing about you. Even more than your search history, or your purchase history, or anything you consciously typed into a box. It is the one thing that gets transmitted [music] even if a service is disabled on a smartphone. Where you go tells a story about who you are that you would never volunteer to a stranger. It shows where you sleep, where you pray, whether you're at an oncologist or a divorce attorney or a methadone clinic. It shows your politics, your vices, your health, your relationships, all in ways you would never openly verbalize. Advertisers figured that out fast, and they built an industry around it. The technical name for what they built is a software development kit or SDK. It's a small package of code that app developers can drop into their apps, usually in exchange for revenue sharing. You've never seen it, and the app developer often barely even thinks about it, but every time you open an app with one embedded, it wakes up and it starts harvesting. It notes your device's advertising ID, it records your location, timestamps it, and sends it upstream to whoever owns the SDK. Eventually, a government contractor is waiting to collect it. Martin Gundersen, a journalist at Norway's national broadcaster NRK, decided in 2020 to find out exactly how this worked in practice. He installed a navigation app from a company called Sygic and an app called the Funny Weather on an Android phone, granting them both location permissions. Then, using Europe's GDPR privacy law, which gives citizens the right to know who holds their data, filed access requests with every company he could find in the chain. What came back was a map of a supply chain nobody had ever fully traced before. Sygic sent his data to a broker called Predeo. Predeo sold it to Gravy Analytics. Gravy Analytics passed it to its subsidiary Ventel. Ventel informed Gundersen that his data had been shared with their customers, who uses it for purposes including federal law enforcement and national security. They declined to say which agency specifically. Gundersen did a simple Google search of his own name and address. He found himself immediately. The data Ventel held on him was just a device ID and just over 75,400 location records. >> [music] >> Anyone with access to that data and a search engine could have identified him in about 30 [music] seconds. The developer of Funny Weather, when contacted by NRK, said they weren't familiar with Ventel and they wouldn't comment on their practices. >> [music] >> Sygic said that they couldn't confirm their data had been involved. None of the apps had mentioned Ventel anywhere in their privacy policies. The people who built the apps had no idea where their users data ended up. And that is the smartphone trap. A single app doesn't tend to be malicious in isolation. The developers are still trying to build something useful and make money while they do it. So, they drop in an SDK, they agree to some terms they don't fully read, either, and they move on. The data leaves their hands and enters a supply chain so long and so opaque that nobody in the middle knows where it ends up. The person at the fishing website at least understood that they were looking at a fishing ad. You have no idea that the navigation app you used to find a parking spot 3 months ago helped the government contractor build a file on your movements. When ads stopped selling products, they started selling lies. Today, your life is worth just a fraction of a cent. Every time an ad loads on your phone, something happens. Something that takes about as long as a camera flash to finish. Your device sends out a packet of data, something known as a bid request, to an advertising exchange. That packet contains information about you. It knows what app you're using, what you were looking at on that app, and where you were when you were looking at it. The exchange broadcasts that packet simultaneously to hundreds, sometimes thousands of companies. Each of those companies decides in a fraction of a second whether to bid to show you an ad. One of them wins, and so their ad loads, and usually you just scroll past it without looking. Every company that received that packet, including all of the ones who lost the bid, already had your data. They received it the moment the broadcast went out. There are, according to the advertising industry's own documentation, no technical measures to control what happens to the data once it's been broadcast. The losing bidders are not required to delete it, and most of them don't. This system is called real-time bidding, and it runs behind every ad on every app and every website you visit. The Irish Council for Civil Liberties, or ICCL, spent 30 days analyzing it and published their findings in 2022. The headline number claimed that the average American has their online activity and location exposed 747 times per day by the RTB industry. That is once every 2 minutes during your waking hours. If every bid request were a text message, your phone would be physically unusable. And that figure, the ICCL notes, is a conservative estimate. It excludes Facebook and Amazon, whose RTB operations they couldn't fully measure. To understand the scale of who receives that data, consider that Google alone allows almost 4,700 companies to receive RTB data about people in the United States. [music] Microsoft's ad platform sends data to over 1,600 companies. That is a $117 billion industry. >> [music] >> Those numbers are just the ones those two companies admit to, not the total count of companies in the RTB system as a whole. >> [music] >> The ICCL estimates that across the US, location and behavioral data is broadcast 107 trillion times per year. Consider who's on the receiving end of all of that, since it's not only advertisers. In January 2025, a hacker breached Gravy Analytics, the government contractor selling location data to ICE, the DEA, and the FBI. The hacker claimed to have stolen 17 terabytes of data and posted samples on a Russian cybercrime forum to prove it. Researchers who analyzed those samples found precise location records for devices that had been inside military installations. That include Fort Bragg, devices near the White House, the Kremlin, and the Vatican. The same surveillance infrastructure that a data broker built to sell shoe ads had assembled one of the most comprehensive maps of human movement on the earth, including the movements of American military personnel and government officials. They stored it on servers that a single stolen key could unlock. A former employee at a location data firm that sells to US law enforcement said, "I don't think people understand just to what degree your location tells you everything you need to know about someone's life. Just how invasive that is." The people running those companies understood that just fine, and that was the whole point. The free apps populating your phone are data collection terminals that also happen to show you a rain forecast or see what live events are occurring in your city next weekend. The brokers who buy the end product, your data, tell you not to worry because none of it has your name on it. It's all anonymous, they claim it's completely safe. That is technically true and functionally meaningless. We've known that since 2013. That year, MIT researchers published a study in Nature Scientific Reports analyzing 15 months of mobility data from 1 and 1/2 million people. The names were all stripped, the data only contained device IDs and locations. They wanted to know how much information you'd actually need to identify someone from a supposedly anonymous data set. With four data points, four approximate locations at four approximate times, it was generally enough to identify 95% of the 1 and 1/2 million people in the data set. The researchers concluded bluntly that even coarse data sets provide little anonymity, which was at the time only slightly alarming. Law enforcement knew that. A St. Louis County officer, after a Fog Reveal briefing, wrote in an internal email, "There is no personal information linked to the ad ID, but if we are good at what we do, we should be able to figure out the owner." One EFF attorney called it child's play. The method they use is called dwell time analysis. If a device consistently appears at the same address between 10:00 p.m. and 7:00 a.m., it sleeps there. That's the home address. If you cross-reference a public property record or a voter roll, you have a name. And suddenly, that anonymous device just became an all-seeing eye providing a known address and 90 days of movement history for any given person. Fog's own marketing materials describe the service's ability to identify where the device owner sleeps, works, studies, worships, and associates. It's basically a company casually dismantling its own anonymity claim in a sales brochure. The most striking demonstration of how powerful this technology is didn't come from law enforcement. It came from a small Catholic media outlet called The Pillar. >> [music] >> In 2021, it bought commercially available location data from a broker, and it hired an independent analytics firm. The data set contained no names, yet investigators were still able to identify Monsignor Jeffrey Burrill, the general secretary of the US Conference of Catholic Bishops, essentially the top administrator of the American Catholic [music] Church. The data showed his device emitting signals from Grindr on a near daily basis over 2 years at his office, his residence, and during official