The Global Free-for-All in Cellular Advertising Surveillance – Krebs on Security

In the not-too-distant past, the notion that governments could remotely surveil an individual’s daily activities by monitoring their home address, workplace, or place of worship was considered a pernicious power reserved for nation-states alone? As a constitutional battle unfolds in New Jersey, a recent lawsuit highlights the vulnerability of users’ privacy, as companies freely access data collected by ubiquitous mobile apps and websites, rendering the concept of private information virtually obsolete.

Based in Delaware, the company assists clients in safeguarding their personal information by separating it from the grasp of client knowledge brokers. Supported by thousands of dollars in litigation financing, Atlas has pursued legal action against 151 data brokers representing over 20,000 New Jersey law enforcement officers enrolled in its services this year alone.

According to Atlas, the alleged knowledge brokers have consistently disregarded repeated alerts that they are breaching a New Jersey statute allowing for the complete removal of data belonging to law enforcement, authorities personnel, judges, and their families from commercial data brokers. In 2020, Daniel’s Legislation was passed following the tragic death of a 20-year-old individual, whose fatal attack on a federal judge’s mother sparked nationwide outrage.

In the final week, Atlas invoked Daniel’s Law in a lawsuit against a little-known expertise firm incorporated in Reston, Virginia. Babel Avenue’s flagship product enables customers to pinpoint a digital perimeter around any global location on a map, coupled with a slightly delayed (typically only a few days) time-lapse history of mobile devices entering or exiting that area.

Babel Avenue’s platform also enables clients to track individual mobile users by their IMEI or ICCID numbers, unique identifiers embedded in all Google Android and Apple mobile devices.

Babel Avenue can provide real-time monitoring capabilities by leveraging aggregated location data and machine learning algorithms, which collect and process information from numerous websites, broadcasting it to dozens or even hundreds of ad networks eager to bid on displaying their ads to a specific user.

In an interview, Atlas revealed that a personal investigator they hired was provided with a free trial of Babel Avenue software, which the investigator was eager to utilize to locate the home addresses and daily activities of multiple New Jersey law enforcement officials whose families had already faced significant harassment and death threats.

The investigator’s encounter with Babel Avenue occurred while testing numerous knowledge dealer instruments and services to determine whether private customer data was being compromised. By seamlessly integrating people-search providers, the platform allows customers to effortlessly pinpoint specific devices.

The investigator reached out to Babel Avenue regarding the potential procurement of property addresses in select regions of New Jersey. Following a comprehensive sales presentation for Babel Avenue, the investigator’s interest piqued, they were informed that Babel Avenue exclusively caters its services to either the federal government or contractors working directly with the government.

The investigator candidly discussed his intention to secure a government contract, either immediately or in the future, when he received guidance from the Babel Avenue sales representative who assured him, “That’s fine” and “They don’t actually check,” according to Atlas’ email to reporters.

KrebsOnSecurity was among the five media outlets invited by Atlas to assess display screen recordings generated during a two-week trial of their LocateX service, utilizing an investigator’s evaluation. References and hyperlinks to reporting by various publications are scattered throughout this narrative.

As digital surveillance capabilities have become increasingly accessible, a market has emerged where anyone can assemble sophisticated eavesdropping tools capable of monitoring the daily activities of hundreds of millions of people worldwide?

The lawsuit filed by Atlas against Babel Avenue highlights the potential consequences of utilizing cellular location data to track individuals, which could have far-reaching implications for sensitive issues such as monitoring suspected undocumented immigrants or women seeking abortions, while also potentially subjecting public servants to harassment and intimidation due to baseless conspiracy theories and increasingly hostile political rhetoric towards government officials.

WARRANTLESS SURVEILLANCE

The Atlas report reveals that the Babel Avenue trial interval granted investigators unparalleled access to information about individuals visiting high-risk locations, including mosques, synagogues, courtrooms, and abortion clinics. An Atlas investigator remotely accessed cellular devices observed in a New Jersey courthouse parking lot designated for jurors, then followed the phone activity of one likely juror to their home address over several days.

While investigators with access to the Atlas trial account on Babel Avenue were able to observe numerous plaintiff-related units, including those specifically named in the lawsuit, their ability to gather information was significantly enhanced by this privilege. To create this unique insight, they overlaid a digital boundary around each individual’s workspace, focusing exclusively on the units that regularly passed through those specific addresses on Babel Avenue’s platform.

Babel Avenue’s unique feature allows users to switch to a “nighttime” mode, making it remarkably easy to locate an individual’s home within a short distance of just a few meters, as their phone is often nearby.

The Atlas family, comprising seasoned law enforcement officials with the Rahway, New Jersey Police Division, reside alongside their two youthful offspring. In April 2023, Scott and Justyna faced a barrage of intense harassment and death threats when Officer Justyna responded to a routine incident involving a man filming people outside the Motor Vehicle Fee office in Rahway.

The Motor Car Fee is a social media personality known for precipitating police interactions, then publicly disputing their handling of the situation while citing constitutional protections.

Officer Justyna’s interaction with the individual was remarkably calm and uneventful, ultimately concluding without any notable issues arising from the encounter. Despite a selectively edited video of the encounter going viral, the couple’s home address and previously unlisted cellphone numbers were subsequently posted online. As soon as their tormentors discovered Scott’s dual identity as both a victim and a law enforcement officer, specifically a sergeant, the couple began to receive a barrage of menacing text messages, including chilling death threats.

Upon receiving notification of the Atlas lawsuit, numerous messages were dispatched to Mr. Maloney made a menacing demand for payment, issuing a chilling threat: if his demands weren’t met, his family’s blood would be the price. Sgt. Maloney claimed that subsequently, he obtained a video in which a masked individual aimed a rifle at the camera, menacingly telling him that his family’s heads would be “cut off.”

Just days after the incident, a vigilant neighbour spotted two individuals clad in ski masks lingering a block removed from Maloney’s residence, prompting an immediate alert to law enforcement. New security footage obtained from adjacent residences shows a group of individuals, their faces obscured by masks, repeatedly circling around the Maloney residence. Two male suspects were apprehended by responding officers and taken into custody for the illegal possession of a firearm, which they had possessed while armed.

Despite Atlas’s investigator lacking the capability to definitively locate Scott Maloney’s iPhone on the Babel Avenue platform, they were successful in finding Justyna’s device. Over several months, Babel Avenue’s 100,000+ hits on Justyna’s cellphone allowed Atlas to compile a detailed portrait of her daily routines and interactions.

A forensic examiner reviewed the evidence on Justyna’s iPhone at the Maloneys’ residence and identified a single app utilizing its geolocation capabilities: an app from the department store chain.

Macy’s noted in a written statement that its mobile application features an opt-in option for geolocation, allowing customers to enjoy an enriched shopping experience tailored to their precise location.

Macy’s explicitly stated that they do not retain any customer location data. “We partner with geolocation experts to leverage their knowledge and expertise in developing an enhanced version of our app.” Moreover, with no reference to Babel Avenue, it seems.

Justyna’s expertise underscores a sobering reality about the widespread accessibility of cell phone location data: even if the individual you’re searching for remains anonymous on platforms like Babel Avenue, there is likely to be at least some traceable connections to their associates or acquaintances. It’s often straightforward to infer the location of a single device simply by identifying another nearby.

The phrases of service for Babel Avenue’s Find X service explicitly caution that the product “should not be used as the basis for any authorized course of in any nation, including as the premise for a warrant, subpoena, or any other legal or administrative action.” Nevertheless, Scott Maloney expressed his satisfaction with their expertise, stating that even law enforcement agencies should not have access to this functionality without a warrant.

“As a law enforcement officer, I would need to decide whether to issue a warrant to trace someone’s location during a felony investigation once we’ve identified a potential suspect.” Maloney stated in an interview. “It’s profoundly unsettling that knowledge brokers are tracking my family and me without our permission, solely to monetize our data, despite our repeated requests to stop.”

Mr. Maloney’s regulation enforcement colleagues in other states might perceive challenges from distinct perspectives. By August, Pennsylvania state police anticipate investing more than $5 million in a contentious surveillance tool called “PenLink” provided by tech firm PenLink. Tangles is a pioneering AI-powered network platform that extracts valuable insights from the open, deep, and dark web, boasting a cutting-edge feature known as Geofence Pro, which enables real-time location tracking of mobile devices.

Regulation enforcement agencies across suburban Southern California and rural North Carolina have been employing a lesser-known mobile phone surveillance tool, often utilized without warrants, which grants them the ability to track individuals’ activities dating back several months.

Can Babel Avenue effectively clarify the process by which it secures a surplus of cell phone location data for distribution to its platform users? The corporation remained silent after multiple inquiries seeking comment.

Pursuant to a Freedom of Information Act request, Babel Avenue has obtained (PDF) data from the Industrial Cellphone Monitoring Agency under the Department of Homeland Security’s Science and Technology directorate.

The Substack publication on Monday revealed that authorities have launched an investigation into Venntel and its parent company, Gravy Analytics.

Allied Supply’s venture capital arm, Venntel, has also partnered with Fog Knowledge Science, a police surveillance contractor notorious for offering “mass surveillance at scale.” “According to reports, Venntel served as a primary information source for the contentious ‘Find X’ smartphone tracking tool developed by American tech conglomerate Babel Avenue.”

MAID IN HELL

The Cellular Promoting ID, also known as MAID, is a unique alphanumeric code assigned to each cellular device, designed to identify individual users without relying on personally identifiable information like phone numbers or email addresses.

Despite this, some corporations prioritize building vast databases of MAIDs, embellishing each entry with personal and historical information about the individual.

Atlas found that its investigators needed to determine if they would uncover enriched marketing intelligence data on their law enforcement clients in New Jersey; soon, they discovered numerous ad knowledge brokers willing to sell it.

Distributors often limited their data provisions to a mere few knowledge fields, typically including the first and last names, MAID number, and email address. Brokers provided in-depth company histories alongside their Marketing and Advertising Inventory Data (MAID), which included exhaustive information on each topic’s social media presence, precise geographic coordinates, and potential customer classification.

Advertisers and knowledge brokers are leveraging various methods to gain access to an abundance of data, including Various sources of MAID knowledge include mobile apps akin to those found on cellphones, such as, and, which aggregate and showcase your MAID data, facilitating promotion to brokers.

When consumers access websites featuring ads using their smartphones, their MAID profiles and placement data are frequently shared as a direct result. In a fleeting window before advertisements appear, the website dispatches a “bid request” to multiple ad exchanges, where advertisers compete to display their ads to users matching the targeted audience profiles they seek. Incorporating an overabundance of information can compromise the clarity of a bid request, potentially overwhelming stakeholders.

The challenge lies in the fact that anyone can access the “bidstream” information disseminated through supposedly secure networks, since the data is simultaneously broadcast in plain sight to hundreds of entities worldwide.

The outcome is that numerous marketing companies have gained access to and deal with this cellular location data. In December of last year, renowned German media outlet acquired a massive bidstream dataset comprising over 3.6 billion data points, subsequently partnering with the prominent daily newspaper to share the findings. Using a complimentary trial, they successfully acquired information enabling them to precisely model motion profiles for .

Lately, reports of startling cases have emerged from universities in New Hampshire, Kentucky, and several other states, with students displaying unusual behavior. Here’s a revised version:

By confirming that the acquired cellular marketing knowledge enabled them to link visits from SEC investigators to insiders who promoted stock before the investigations became publicly available.

Researchers noted that they did not employ uniform methods to identify regulatory representatives from various organizations, yet suggested that anyone could adapt their approach.

A distinguished fellow at Georgetown Law’s Center for Privacy and Technology characterized the study as “a stunning demonstration of how corporations can freely collect Americans’ geolocation data and sell it at their discretion.”

“Politicians should recognize how they, their staff, and public officials are imperiled by the commodification of private information—and constituent groups must comprehend that discussions around ‘knowledge controls’ or ‘best practices’ are a corporate ploy to deflect attention from the true issues and superior privacy and security solutions.”

A BIDSTREAM DRAGNET?

As the specter of Orwell’s dystopian world descends upon modern cellular marketing networks, a chilling threat emerges to erode women’s reproductive autonomy, with multiple states poised to criminalize abortion within their jurisdictions. The landmark 2022 Supreme Court decision in Dobbs v. Jackson Women’s Health Organization effectively overruled Roe v. Wade and allowed individual states to regulate or prohibit abortion as they see fit, sparking a national debate about reproductive rights and healthcare access. The Supreme Court’s ruling abolished the federal right to abortion, prompting 14 states to subsequently enact stringent abortion bans.

Pro-life groups are leveraging cellular marketing strategies to further their cause. In May 2023, an anti-abortion group in Wisconsin utilized exact geolocation data to target advertisements at women they suspected were seeking abortions.

Because data persists in real-time, anti-abortion groups may not hesitate to purchase bidstream information or secure access to platforms like Babel Avenue, thereby enabling them to geofence abortion clinics and potentially expose all mobile devices traversing those areas.

According to Atlas, its investigator utilised geofencing technology to track the daily routine of individuals associated with an abortion clinic, including pinpointing a specific employee’s movements as they went about their daily commute to and from home.

Last year, Idaho became the first state to ban “abortion trafficking,” which is defined as recruiting, harboring or transporting a pregnant minor to obtain an abortion or abortion-inducing medication without parental permission. Tennessee has also enacted a similar law, and Republican lawmakers in five other states introduced abortion trafficking bills that did not advance this year, according to The Sun.

According to Atlas, investigators tracked a person’s journey from their home in Alabama, where abortion has become illegal, to a nearby clinic in Tallahassee, Florida, using Babel Avenue as reference points to observe and determine their movements. And then, before the dust had settled, they were back inside the house for the second time within mere hours. Proponents of reproductive rights are seeking to shield individuals who help patients travel out of state to access abortion services from potential prosecution, arguing that such actions do not constitute illegal activities.

The executive director of cybersecurity at the Electronic Frontier Foundation, a non-profit digital rights organization, expressed deep concern regarding mass surveillance efforts targeting individuals crossing state lines to obtain abortions.

“Moreover, Republican officials from states where abortion has been prohibited have emphasized their focus on targeting individuals who travel to nearby jurisdictions to access the procedure, as well as intensifying efforts to deter those seeking abortions from venturing into neighboring states,” Galperin noted. “It’s unlikely that states would take such a step.”

APPLES AND GOOGLES

For a modest investment of $10,000 to $50,000 annually, brokers can provide access to tens of billions of data points covering vast segments of the US population and the rest of the world?

By leveraging the vast information sets Atlas acquired, primarily comprising legacy MAID data, they project identifying approximately 80% of Android-based devices and around 25% of Apple iPhones. While Google refers to its Mobile Ad ID as simply AAID, Apple dubs theirs Identifier for Advertisers.

The significant divergence in Android and Apple device diversity is primarily attributed to the disparate market shares of these operating systems. In April 2021, Apple released iOS model 14.5, introducing the App Tracking Transparency (ATT) framework, which mandates that apps obtain explicit user consent before monitoring individuals through their Identifier for Advertisers (IDFA) or any other unique identifier.

When Apple introduced Attention Tracking Technology (ATT), it swiftly and profoundly impacted the advertising market, prompting Facebook to predict just over a year later that the iPhone’s privacy feature would reduce its 2022 revenues by approximately $10 billion.

Google dominates the world’s largest advertising marketplace, commonly referred to as. According to eMarketer, a leading authority on digital marketing trends and insights, Google’s dominance in online advertising is substantial, with its ad market share in the United States standing at approximately 47% as of the latest estimates. market and 56 % globally.

With the latest statistics indicating a significant lead, Google’s Android operating system is poised to become the dominant force in the global cellular landscape, boasting a commanding 72% market share. In the United States, despite the presence of numerous other smartphone brands, iPhone users still dominate the market, accounting for approximately 55% of all mobile phone sales, according to recent statistics.

Google clarified that it neither sends actual time-based bidding requests to Babel Avenue nor discloses precise location information within such bid requests. The corporation clarified that its insurance policies unequivocally prohibit the disclosure of knowledge derived from real-time bidding, with the sole exception being its intended purpose: advertising and promotion.

According to Google, the MAIDs assigned to users are pseudorandomly generated numbers that do not incorporate Internet Protocol (IP) addresses, Global Positioning System (GPS) coordinates, or any other type of location information, with its advertising methods never sharing anyone’s precise location data.

“Google maintains transparent controls enabling users to manage app access to device location, as well as reset or delete their advertising identifier.” “If we identify a violation of our policies by someone, regardless of their industry or role – whether it’s an app developer, adtech firm, or any other entity – we will take swift and appropriate action.” We facilitate effective collaborations between legal and business stakeholders to mitigate the adverse impacts of certain knowledge practices on the entire cellular ecosystem, encompassing all operational methods.

Apple announced that location sharing services should not be enabled by default on its devices, according to a statement released to journalists. Reasonably, customers should consent to allowing Location Companies to access their location data, granting permission for each app or website that requires it. Customers retain the right to turn off location tracking by Location Companies at any moment, with the ability to modify permissions for app access to their location information at will. The consumers’ choices encompass precise versus Approximate location data, coupled with a one-time grant of location access permission from the app.

“Apple firmly believes that privacy is a fundamental human right, and as such, we meticulously design and implement robust privacy safeguards across all our products and services to empower users with control over their personal data.” “We minimize private data accumulation and, where feasible, restrict processing of user information solely to their devices.”

Serving as a seasoned senior menace analyst at the cybersecurity agency, this expert has devoted meticulous attention to the intricacies of the placement knowledge business. Edwards claimed that Google and Apple cannot sustain their pretence, given that millions of devices broadcasting unique identifiers are rendering the majority of people easily traceable.

“The privacy vulnerabilities persist until Apple and Google discontinue their mobile advertising ID initiatives and acknowledge publicly that these technologies have underpinned the global data broker ecosystem.”

STATES ACT, WHILE CONGRESS DITHERS

Between 2019 and 2023, the number of threats made against federal judges has more than doubled, according to available data. As political discourse becomes increasingly polarized and conspiracy theories spread about law enforcement agencies, a growing number of states are considering laws to shield police officers from malicious and unfounded attacks.

Last month, a retired police officer turned to Whitepages, a people-search service, after discovering their personal information was listed without consent, violating a 2021 state statute mirroring Daniel’s Law.

In May 2024, Maryland renamed the courthouse after Judge Alexander R. Brasher, a county circuit court judge who was fatally shot by a litigant involved in a divorce case before his bench. Under the regulation, existing and retired members of the Maryland judiciary are permitted to submit a request that their personal information not be disclosed to the public at large.

Private information under Maryland regulation may comprise a home address; phone number, email address; Social Security number or federal tax identification number; checking account or credit card number; license plate or other distinctive vehicle identifier; birth certificate or marriage document; child’s name, school, or daycare information; place of worship; and place of employment for a spouse, child, or dependent.

As of the first quarter of 2024, a total of 37 states have either initiated discussions or formally adopted legislation aimed at safeguarding judges and law enforcement officials involved in regulatory enforcement efforts.

According to Atlas, after requesting information about New Jersey’s regulatory enforcement actions affecting its customers, the data broker allegedly responded by freezing the credit scores of approximately 18,500 individuals and falsely identifying them as identity theft victims.

Concurrently, Atlas revealed that LexisNexis started issuing failure codes, signifying the absence of records for these individuals; consequently, police attempts to refinance loans or establish new financial accounts were consistently met with denials.

The information industry has responded by successfully transferring over 70 Atlas lawsuits to federal court, challenging the constitutionality of the New Jersey statute as unduly broad and violative of the First Amendment.

Lawyers for the information broker company contended that “there is no First Amendment doctrine that immunizes a content-based restriction from strict scrutiny merely because it has some connection to privacy concerns.”

The attorneys for Atlas countered that the private information about New Jersey law enforcement officers shielded under Daniel’s Law, a state regulation, is not constitutionally protected as free speech. While defending against similar litigation, the data broker industry has maintained that home addresses and phone number information are not considered “communications”.

“While knowledge brokers cannot credibly assert that data such as addresses do not constitute ‘communications’ merely to justify their protectability,” “No matter what changes may occur, the fundamental truth remains that sensitive information should never be shared.”

The decision maker overseeing this issue is expected to render a ruling on the motion to dismiss within the coming few weeks. The outcome of the decision is more probable to be taken up to the highest level, ultimately reaching the U.S. Supreme Court. Supreme Court docket.

While regulatory experts express concern that adopting Daniel’s Law across various states may imperil journalists’ ability to hold public officials accountable by restricting their access to public information, potentially allowing authorities to disseminate similar types of public records that fuel the people-search industry.

Oregon’s congressional representative accused lawmakers of neglecting their role in overseeing knowledge brokers, while the administration’s reluctance to support bipartisan legislation limiting law enforcement access to sensitive information has contributed to the ongoing privacy crisis.

“Location data is being exploited to out individuals as closeted homosexuals or track those seeking reproductive healthcare across state lines, all for a few dollars,” Wyden said in a statement shared with KrebsOnSecurity, 404 Media, Haaretz, NOTUS, and The New York Times.

Sen. Senator Wyden contends that Google should also share responsibility for its refusal to abide by Apple’s precedent of removing companies’ ability to track phones.

Senator Wyden accused Google of laying the groundwork for a surveillance economy, enabling ad companies to exploit users’ data, by uniquely monitoring Android customers.

Georgetown Law’s Justin Sherman said that the information broker and mobile ad industries claim that safeguards exist to anonymize cellular location data and bar access to it, further asserting that limitations are in place to prevent intrusive inferences being drawn from such information. The information dealer’s business also touts the value of cellular location data in combating retail fraud, he claimed.

“By inference, various issues can arise from this knowledge, including individuals targeted by abusers or those with specific health conditions or religious beliefs,” Sherman said. Observe jurors, law enforcement officials conducting visits to suspect properties, and naval intelligence personnel meeting with their sources. It’s absurd to suggest that the proliferation of this information prevents harm and fraud, considering its actual impact: empowering criminals to refine their cyber attacks, or facilitating the discovery of personal secrets for extortion purposes.

WHAT CAN YOU DO?

According to privacy experts, deactivating or erasing the Mobile Advertising ID (MAID) from a device has little effect on its overall functionality, apart from potentially leading to more targeted advertisements being displayed on that device.

On an Android device, any applications that request permission to access your location should be listed when navigating to the Settings app, followed by Location and then App Permissions. Here is the rewritten text:

The most permissive setting is “Allowed on a regular basis”, which shares similarities with “Allowed solely while in use,” “Ask each time,” and “Not allowed.”

Android customers can delete their advert ID completely, by opening the Settings app and navigating to Privateness > Adverts. Tap “Delete promotional ID,” and confirm by tapping it again on the next page. In response to the Electronic Frontier Foundation (EFF), disabling this feature ensures that no app on your mobile device can access the unique advertising identifier at any point in time.

Apps on Apple’s iOS platform are initially required to seek user consent before accessing the device’s Identifier for Advertisers (IDFA). When you install and configure a brand-new application on your device, the software may request access to track your location. When you’re prompted to take action by an app, select the “Do Not Allow” or “Don’t Allow Tracking” option to prevent it from monitoring your activity. To prevent apps from requesting permission to track your location, Apple customers can toggle the “Permit apps to request to trace” setting to “Off”.

Apple maintains a distinct, targeted advertising framework that operates independently of the IDFA-enabled third-party tracking. To prevent targeted advertising on your Apple device, navigate to Settings, then scroll down to Privateness, and select Apple Advertising. Ensure the “Customized Ads” toggle is set to the off position.

For readers serving as informal technical support for family or friends, consider configuring their devices to disengage tracking features and disabling apps that share location data in real-time, ensuring a reasonable balance between convenience and privacy.

By fostering a sense of community and social responsibility, the gadget proprietor benefits from increased customer loyalty and positive word-of-mouth marketing, ultimately driving profits through repeat business and referrals. Since gadgets are unlikely to be instantly traceable through marketing efforts, opting them out of stated tracking can significantly reduce the likelihood of being tracked simply because of physical proximity to those who possess them.