Slashdot Mirror
US Telcos Are Selling Access To Their Customers' Location Data, and That Data Reaches Bounty Hunters and Others Not Authorized To Possess It (vice.com)
T-Mobile, Sprint, and AT&T are selling access to their customers' location data, and that data is ending up in the hands of bounty hunters and others not authorized to possess it, letting them track most phones in the country, an investigation by news outlet Motherboard has found. From the report: Nervously, I gave a bounty hunter a phone number. He had offered to geolocate a phone for me, using a shady, overlooked service intended not for the cops, but for private individuals and businesses. Armed with just the number and a few hundred dollars, he said he could find the current location of most phones in the United States. The bounty hunter sent the number to his own contact, who would track the phone. The contact responded with a screenshot of Google Maps, containing a blue circle indicating the phone's current location, approximate to a few hundred metres. [...] The bounty hunter did this all without deploying a hacking tool or having any previous knowledge of the phone's whereabouts. Instead, the tracking tool relies on real-time location data sold to bounty hunters that ultimately originated from the telcos themselves, including T-Mobile, AT&T, and Sprint, a Motherboard investigation has found. These surveillance capabilities are sometimes sold through word-of-mouth networks.
[...] Motherboard's investigation shows just how exposed mobile networks and the data they generate are, leaving them open to surveillance by ordinary citizens, stalkers, and criminals, and comes as media and policy makers are paying more attention than ever to how location and other sensitive data is collected and sold. The investigation also shows that a wide variety of companies can access cell phone location data, and that the information trickles down from cell phone providers to a wide array of smaller players, who don't necessarily have the correct safeguards in place to protect that data. "Blade Runner, the iconic sci-fi movie, is set in 2019. And here we are: there's an unregulated black market where bounty-hunters can buy information about where we are, in real time, over time, and come after us. You don't need to be a replicant to be scared of the consequences," Thomas Rid, professor of strategic studies at Johns Hopkins University, told Motherboard.
Ron Wyden, a senator from Oregon, said in a statement, "This is a nightmare for national security and the personal safety of anyone with a phone."
[...] Motherboard's investigation shows just how exposed mobile networks and the data they generate are, leaving them open to surveillance by ordinary citizens, stalkers, and criminals, and comes as media and policy makers are paying more attention than ever to how location and other sensitive data is collected and sold. The investigation also shows that a wide variety of companies can access cell phone location data, and that the information trickles down from cell phone providers to a wide array of smaller players, who don't necessarily have the correct safeguards in place to protect that data. "Blade Runner, the iconic sci-fi movie, is set in 2019. And here we are: there's an unregulated black market where bounty-hunters can buy information about where we are, in real time, over time, and come after us. You don't need to be a replicant to be scared of the consequences," Thomas Rid, professor of strategic studies at Johns Hopkins University, told Motherboard.
Ron Wyden, a senator from Oregon, said in a statement, "This is a nightmare for national security and the personal safety of anyone with a phone."
Aldous Huxley, George Orwell and even Ray Bradbury predicted the world that we are steaming in to. Even Max Headroom is to some extent surpassed.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Having worked for one of these Telco's (admitedly before LTE) I can tell you how it's likely done.
Your cell phone must register with a tower, so the "contact" inside the wireless telco looks up the customer's phone number directly in the switching system so that they leave no fingerprints in the CRM system. So the HLR will say where the mobile device is presently located by the tower's id number, and then you cross reference that with the actual geographic location of the tower.
That's how it's done, and customers, pre-smartphones who have had their devices lost or stolen have routinely called in to ask where their device is and at best, the rep can say it's somewhere near X (where the HLR says it was last seen) often by using a tool designed to check if the phone is roaming. If the phone is roaming on another carrier's tower, then the carrier will actually have more information available since the roaming database on the phone will only try to connect to certain towers it's been authorized to. So if your phone is in Dallas, which has a lot of cell sites, its much easier to figure out where someone is because one tower might only serve an area of 300ft, where as a tower out in Anchorage, might literately serve half the city, so the precision is much lower.
The on-device A-GPS is more accurate because it can use multiple cell sites and actual GPS line-of-sight to determine where it is. But this information isn't typically relayed back to the cell carrier unless the carrier provides A-GPS service in the first place. LPP (LTE Positioning Protocol) is some fancy level of A-GPS that utilizes multiple sources. If the carrier has A-GPS, then yes, the carrier knows within 100ft of where the phone is.
The question is how much data does the carrier actually need though? If you turn A-GPS off, which you typically can't do without turning all location services off entirely, then you're stuck.
If you turn location services off, you can still be found as long as the phone is powered on since it's still registered in the HLR. Just it can only be narrowed down to the last tower seen for the most part.
It's part of the TOS you sign with your carrier.
If a couple of criminals get burned by their phones' location, I'm not going to cry any rivers.
Until you become a criminal by violating some unfair or unconstitutional law and they track you down....
The problem here is that it's illegal to track down a criminal using this data without a warrant. That folks can do this and bypass the need for a warrant may not be a problem to you now, but the camel's nose is in the tent if we let this happen w/o complaint and you may wish you'd said something.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Warning to telecoms: if you don't like being regulated, don't invent reasons to get regulated.
Get together and come up with a mutual industry agreement on when and how to share customer data in a way that's not confusing or misleading to customers. Sign the agreement and hold each other accountable. The alternative is that the gov't will do such for you after you play fast and loose for short-term profits and bungle it one day.
Table-ized A.I.
I lived with a gal for 3 years, came home early from work one day and found her vigoursly giving head to another guy. I gave her the key and said I would be back for my stuff... When I returned she was physically threatening, hitting kicking, yelling, screaming at me for dumping her... You do not have to be the cheater to have a psycho come looking for you.
"Governments have been dominated by the corporate entities and citizens have ceased to matter in public policy" true in
If nothing else, this article shows how easy it is to manipulate people's views.
Had this article been about how anyone, such as a connected stalker, could for a few hundred dollars, track your location through your phone, there would have been almost universal outrage in the comments.
But because it is framed in terms of bounty hunters catching bad guys, there are an awful lot of comments in support of this capability. Even if it is illegal and can be used by anyone with the dollars to buy the services.
Does not give hope for the future.
Check your premises.