WASHINGTON — The Federal Bureau of Investigation admitted this week that it had a history of purchasing accurate geolocation data obtained from cellphone advertising before backing away from the practice amid thorny legal issues and public controversy.
The precise location of millions of mobile devices and cars is increasingly being put up for sale by commercial vendors, sometimes providing near real-time insight into a phone or vehicle’s movement around the world. Several government agencies, including the US Department of Homeland Security, have bought access to this type of commercial information, such as phone geolocation, without court approval, which the FBI says is no longer the case.
The different approaches underscore the difficulties in applying established legal norms and internal processes to a new world full of data.
Appearing before the Senate Select Committee on Intelligence on Wednesday, FBI Director Christopher Wray said the nation’s top state law enforcement agency now seeks court orders when it receives phone data from commercial providers. Such data can often contain detailed information about the movement and behavior of individuals.
Subscribe to Newsletter
What’s new
Catch the headlines, understand the news and make better decisions, every day for free in your inbox.
“We do not currently purchase commercial database information containing location data derived from Internet advertising. As far as I know, in the past, as we have in the past, we have purchased such information for a specific national security pilot project. But that hasn’t been active for some time,” Mr. Wray responded to a question from Sen. Ron Wyden (D., Ore.).
A few years ago, a US military branch called the Joint Special Operations Command developed a program aimed at taking advantage of modern digital advertising networks, aimed primarily at tracking down terrorists abroad, people familiar with the matter said. For a short time, the FBI got involved in the military-led effort, one of those people said, testing the data’s usefulness in some domestic affairs, including the 2017 Las Vegas mass shooting and a 2018 missing person case, before pulling out.
The FBI also acquired a license for a commercial service called Venntel, which enables phone tracking through advertising data before the contract expires in 2021, according to federal spending records. When the FBI published a request for quotations last year for a vendor to help monitor social media chatter, it told bidders that location-based data feeds should not be included in products sold to the FBI.
FBI Director Christopher Wray attended a Senate Intelligence Committee hearing this week. Photo: Al Drago/Bloomberg News
The US Special Operations Command, which oversees the JSOC, declined to comment. The FBI declined to comment beyond Mr. Wray’s remarks. The Department of Homeland Security and its components, US Customs and Border Protection and Immigration and Customs Enforcement, did not immediately respond to requests for comment.
CBP admitted in 2020 that it bought access to Venntel’s data, but said in a statement at the time: “It is important to note that such information does not include cell tower data, is not ingested in bulk, and does not include that of the individual user Identity.”
In the years since JSOC’s efforts, the use of commercially acquired advertising data for tracking in some cases has migrated from the military to federal, state, and local police forces. Such authorities are increasingly accessing bulk datasets from commercial providers to obtain information, usually without court approval.
SHARE YOUR THOUGHTS
What parameters, if any, should be set for the FBI’s use of personal information? Join the conversation below.
Civil rights groups and privacy activists have sharply criticized such government purchases.
“FBI Director Wray’s admission that the FBI secretly acquired location data from Americans ‘obtained from Internet advertising’ is both shocking and further evidence that Congress must take immediate action to curb mass surveillance,” said Sean Vitka of Demand Progress, a group campaigning for online privacy and digital rights. “We should have the right to choose when and how our personal information is shared.”
The commercial availability of such data raises new questions for government agencies. A warrant is required to trace a phone over the cellular networks or to fit a GPS tracker to a car, the Supreme Court has ruled. In order to obtain such a search warrant, the police must demonstrate a probable cause for a crime.
But the sheer volume of data now up for sale offers a wide opportunity to acquire personal data from phones or cars without a search warrant by paying for it, raising new legal questions about how and when the government can buy it , particularly as this relates to domestic criminal investigations.
Phone apps and digital display networks often collect geolocation data from phones and resell it through data brokers, who may also collect Internet Protocol (IP) addresses when consumers browse the web to locate a user to a specific location.
The precise location of millions of mobile devices is increasingly being offered for sale by commercial providers. Photo: Kori Suzuki for The Wall Street Journal
Vehicle security or in-car infotainment systems also collect and sell vehicle locations, and governments and private sector companies collect large databases of license plate scans when motorists use public roads.
Personal information such as names and phone numbers are removed from such records, but a person’s movement through the world is highly unique. Information such as where to park at night or where to find a phone at night can be matched with other data sources that include names, address histories, and proof of ownership to tie a device or vehicle to an individual or family.
According to people familiar with the matter, numerous FBI field offices and other departments of the FBI have accessed commercially available data without court approval in the past. Sometimes agents requested voluntary cooperation from companies that had access to data, people said. In other cases, they bought software licenses or subscriptions that allowed them to query commercial datasets, they said.
In 2018, the U.S. Supreme Court ruled in a landmark cell phone tracking case, Carpenter v. United States, that the government needed a search warrant — and therefore probable cause for a crime — to prosecute suspects for extended periods of time based on Cell phone data to track carriers. This type of data is distinct from the advertising data referenced by Mr. Wray, which is collected in other ways and is available for purchase as a commercial product.
Although the court ruling in the Carpenter case did not specifically address data purchased or derived from phone apps, it sparked legal debate within government agencies, including the FBI, about how to deal with commercially available cell phone data. The FBI is now seeking a subpoena or other court order, based both on Mr. Wray’s comments and a review of court records.
Other federal agencies, such as the military, intelligence agencies, and the Department of Homeland Security, continue to use such data both domestically and internationally, according to federal contract documents and people familiar with the matter. Advocacy group Electronic Frontier Foundation received records last year showing local and state police departments also using commercially acquired data.
Congress has debated proposals for a comprehensive privacy law, which the US currently lacks. Several states, including California, Colorado, Connecticut, Utah and Virginia, have enacted state-level consumer privacy laws for information collected about residents.
A bipartisan group of House and Senate lawmakers last year introduced a proposal that would designate consumer-derived geolocation data as sensitive and restrict the use of such data by the private sector. The proposal sparked a wave of lobbying from data brokers, including those responsible for law enforcement.
Separately, a bipartisan group of lawmakers has approved a bill called the Fourth Amendment is Not for Sale Act that would prevent law enforcement from buying access to geolocation data without a warrant.
Write to Byron Tau at [email protected]
Copyright ©2022 Dow Jones & Company, Inc. All rights reserved. 87990cbe856818d5eddac44c7b1cdeb8
