October 23rd, 2024

The global surveillance free-for-all in mobile ad data

Atlas Data Privacy Corp. is suing Babel Street for violating New Jersey's privacy law, highlighting risks of mobile location data tracking for law enforcement and raising ethical concerns about commercial data brokers.

Read original articleLink Icon
The global surveillance free-for-all in mobile ad data

A recent lawsuit highlights the growing concern over the accessibility of mobile location data, which has become a tool for surveillance beyond government use. Atlas Data Privacy Corp. is suing Babel Street, a technology company that provides services allowing users to track mobile devices based on location data collected from various apps and websites. This tracking capability raises significant privacy issues, particularly for individuals in sensitive positions, such as law enforcement officers. The lawsuit stems from allegations that Babel Street's services violate New Jersey's Daniel’s Law, which protects the personal information of law enforcement and government personnel. Atlas's investigation revealed that Babel Street's platform could track individuals' movements, including those of police officers and their families, leading to harassment and threats. The case underscores the risks posed by commercial data brokers who aggregate and sell mobile advertising data, enabling almost anyone to conduct surveillance on others. The implications of this technology extend to various societal issues, including the tracking of vulnerable populations and the potential for misuse in politically charged environments. The lawsuit also raises questions about the legality and ethics of using such data without consent, particularly in law enforcement contexts.

- Atlas Data Privacy Corp. is suing Babel Street for violating New Jersey's privacy law.

- Babel Street's services allow tracking of mobile devices using location data from apps and websites.

- The lawsuit highlights privacy risks for law enforcement personnel and their families.

- The case raises concerns about the broader implications of commercial data brokers in surveillance.

- The use of mobile advertising data for tracking poses ethical and legal questions.

Link Icon 21 comments
By @janalsncm - 4 months
We can go back and forth on whether police should have access to this data and what regulations should be put on how/why it should be accessed. I think reasonable people can disagree about details, and cultural expectations around privacy and safety probably means there isn’t a single best answer.

But I don’t think anyone can honestly say the right amount of regulation is zero, which is what we have now. It is absolutely bonkers to me that anyone off the street should be able to gather such highly granular data about any other person as long as they can pay.

By @reaperducer - 4 months
The first time I ran into the concept of having my mobile phone data sold to a third-party was in 2003, when I went to the Czech Republic.

Right after I crossed the border from Austria, my U.S. cell phone started lighting up with spam SMS messages. At first, it was from the local cell phone carrier welcoming me to .cz. A few minutes later, a message from T-Mobile letting me know I was roaming in another new country. Then a few minutes after that, SMS spam for hotels, then restaurants, then casinos. All of this in a time before "smart" phones.

I'm not surprised to see it's gotten so much worse.

By @JohnMakin - 4 months
> One unique feature of Babel Street is the ability to toggle a “night” mode, which makes it relatively easy to determine within a few meters where a target typically lays their head each night (because their phone is usually not far away).

There are very few reasons in my mind that anyone, especially law enforcement, would need this "feature" and they're all pretty dark.

By @TechDebtDevin - 4 months
Use and Configure Pi-Hole[0]

[0]:https://jeffmorhous.com/block-ads-for-your-entire-network-wi...

Also a video for those more YT inclined: https://www.youtube.com/watch?v=eCA24qJBG8Q

By @jmward01 - 4 months
I had a discussion with someone that worked on some of google's ad stuff and he swore that this type of tracking wasn't in use there. I suspect that even within these companies they try to hide the level of tracking they engage in. The only way we are going to stop this is to hold companies accountable for the things that happen as a result of the data they collect. I don't care if it is sold, stolen or given away, if data that is collected by a company gets used inappropriately then the company that collected it should face consequences.
By @analog31 - 4 months
I think that over time, it will become more apparent that the only solution is to criminalize possession of the data, with a process for collecting statutory damages upon discovery. A precedent exists in the recording industry, where sharing of copyrighted songs results in automatic damages without the need to quantify the actual harm. That process already has fair provisions for willful and accidental use.

This in turn would lead to an industry that hunts for evidence on a contingency basis.

By @tdullien - 4 months
Xoogler here (2011-2018). At some point I proposed making it easy for people to "lie" to an app (if it asks for location, provide fake data etc.). This would preserve true customer choice about anonymity.

The reaction to that idea taught me a lot about incentives.

By @drawkward - 4 months
Advertising is a virus that eventually infects all ecosystems.
By @CatWChainsaw - 4 months
If the insane micromanagey level of tracking were legally designated by its proper practical result, which is stalking, it would be a crime. And since the modern zeitgeist is ruled by the Ruthlessness Gap, anyone who works in "advertising"/tracking ought to have their personal information and whatever they used their surveillance techniques to snoop on gets broadcast in a public database. That could be one great application for Google Glass... watching the watchers.
By @pnw - 4 months
Can someone explain how this works on iOS post Apple's removal of IDFA? The advertising ID (MAID) in any specific app is relevant only to that app, so it seems like it would be useless for profiling? I don't see how apps can access any other identifiers on iOS. Even the wifi MAC address is randomized.

If you've gone one step further and disabled location access for apps and disabled the global ad id, it would seem difficult to do the searches described.

The article refers to "25 percent of Apple phones". Is that just legacy phones running older versions of iOS prior to removal of IDFA?

By @Intralexical - 4 months
Related discussion:

Location tracking of phones is out of control (arstechnica.com)

https://news.ycombinator.com/item?id=41930818

Related comment:

  486sx33 8 hours ago | next [–]
  About 2 years ago, an isp we use for one of our operations in Canada called R… which is also a media company and an advertising company… came to us and said hey! We have this amazing new technology , all you do is geofence your competitors and then we will retarget anyone who visits their location with your web ads for as long as you want! Since they are also the isp for mobile data , they just force replaced ads for the targets web browser. (Basically they inject ads)
  They also made it clear their system is not at all dependent on your phone location services or even your advertiser ID, since they are the isp and the cell provider they just use your SIM ESN to track you. ( cell towers know where their users are, with better accuracy than ever now )
  It worked, but it’s darn scary. This has been around for awhile.
By @sandworm101 - 4 months
Many worry about how these tools will be used to persecute people such as women seeking reproductive medical services. That is a problem. But what will people think of those same tools being used to enforce protection orders, to spot parole violators? I know where my opinions fall, but I also realize that the bulk of the population would trade in their privacy for any perception of increased safety.
By @vmaurin - 4 months
I worked 12y the ad-tech industry, and 3y in a company using this kind of data to measure performance of "drive to store" campaigns: doing online campaign, then seeing if people visit the actual real store based on geo data. The company was actually controlled by the CNIL (French regulator) according GDPR, so we were "anonymizing" data, meaning hashing one way the IFA (unique phone id for advertiser) and storing location within a 300mx300m square I put some quote around anonymizing because geo data from your phone in the evening/night is enough to know where you live (with 300m precision). The rest of the industry in France and Europe was still a far west though (around 2020)
By @mdaniel - 4 months
> such as AccuWeather, GasBuddy, Grindr, and MyFitnessPal that collect your MAID and location and sell that to brokers.

Welp, that's the final straw I needed to nuke that fucking GasBuddy app from my phone. Goddamn I hate them so much

By @Kim_Bruning - 4 months
The combination of everyone in the synagogue + knowing where they sleep is particularly chilling.

People used to risk their lives to try to erase much less data.

eg. https://en.wikipedia.org/wiki/1943_bombing_of_the_Amsterdam_...

By @aucisson_masque - 4 months
> they estimate they could locate roughly 80 percent of Android-based devices, and about 25 percent of Apple phones.

And that's why I gave my mother my iphone and went back on the wasteland that is Android.

She, as a normal person, doesn't understand all of these and go with the default settings. With apple it means she has 75% chance of being protected, with Google 80% chance of being tracked.

Me, as a nerd, i know about advertising id and I even root my phone to have afwall firewall.

This is why Google is just bad, they always technically allow you to do the right thing but it's buried under a ton of sub menu and convoluted settings. On purpose of course, their goal is to make money.

By @amarcheschi - 4 months
If I use an ad id on android, is this id the identifier I can use to make a gdpr request to brokers regarding accessing and deleting my data? I don't have an ID but I'd be curious about doing that, in a similar way to xandr with its uuid2 (although xandr does just looks bad and not this terrible)
By @cookiengineer - 4 months
Additionally to an OpenWRT [1] Wi-Fi router or Adguard Home [2] DNS proxy that you can run for yourself, there's also this excellent app firewall project called NetGuard [3].

The developer got kicked out of the Play Store for bogus reasons, and had to continue to develop it as an externally funded effort. Support him, buy a pay what you want license, and give him a couple bucks for it if you value open source software like this.

(I'm not affiliated with the project, I just love the app and it runs on all my degoogled devices)

Additionally, degoogle your phone by installing an open source ROM like GrapheneOS [4] or LineageOS [5], and install only the most essential apps on your phone.

There's also App Warden [6] which audits installed apps, by scanning them for malicious libraries and adtrackers. It's based on the dataset provided by Exodus Privacy [7] where you can search for Apps or their APK identifiers and find out what kind of fingerprinting libraries they're using. For example, this is what the Facebook App uses behind the scenes [8].

Don't install gapps and neither the google play services. If you want an app store for the convenience of updates of open source apps, there's also f-droid [9], a libre app store for Android.

Additionally you should keep in mind that every app that needs google play services to run is spyware, by definition of what these services offer as APIs. Websites that require you to install their app to "verify" you are usually spying on your activity.

[1] https://openwrt.org/toh/start

[2] https://openwrt.org/docs/guide-user/services/dns/adguard-hom...

[3] https://netguard.me/

[4] https://grapheneos.org/

[5] https://wiki.lineageos.org/devices/

[6] https://gitlab.com/AuroraOSS/AppWarden

[7] https://reports.exodus-privacy.eu.org/en/

[8] https://reports.exodus-privacy.eu.org/en/reports/com.faceboo...

[9] https://f-droid.org/

By @ToucanLoucan - 4 months
This turned into a hell of a rant, I apologize but I'm still kind of proud of it.

--

We made surveillance capitalism the default method of financing every free-at-point-of-use service on mobile devices before we understood what that meant, and people now have zero perception of the worth of mobile-based software. People happily pay for desktop software but the decades of everything on a phone being free by default despite the economics of that making no sense have made it borderline impossible to sell software to people for their phones.

At the same time government has been completely asleep at the fucking wheel with regard to any regulation to protect consumers. Consumers shouldn't have to know the "tradeoffs" of free software, they shouldn't need to vet vendors of software on app stores for privacy policies. People should be protected by default. This "informed consumer" garbage is why we can't get anything done in a regulatory sense because these companies will make the argument that users consented when talking to any layperson user of MyFitnessPal will have you understand they really did not within 5 goddamn minutes.

Could people read terms of service? Yes. Do they? No, because people have shit to do and nobody aside of an activist or someone with an interest in it is going to read 110 pages of terms of service each from the 50 services they're currently using and it's unreasonable to suggest that they should, and that's JUST the reading, even if they read it, do they understand it? Because most people according to a stat I saw recently about the United States read at about a sixth grade level, which is going to be a struggle to get through any legal document. And 4% apparently are completely illiterate.

I don't mean to rant here but this pisses me off so much. Our entire society is constructed around a set of assumptions about people who are at least some level of educated, with decent english literacy, who have the time and energy to dedicate to managing these various things, and yeah, if you're that theoretical person, you can probably do quite well for yourself in the United States. But what if you aren't?

What if you're one of the millions who have to work three fucking jobs to survive and don't have time to read the terms of service for twitter, and just want to relax? What if you're illiterate? What if you're disabled in some way that impedes your ability to read, or your ability to understand what data harvesting is or means? Does your inability to meet the standard I've outlined above just mean you're fodder for the scummy business alliance, ready to be taken advantage of at every single turn by everyone who can, because it's more profitable that way even if it means you will be broke, exposed, and/or otherwise exploited at every single turn and probably have a pretty miserable life?

I am long tired of living in a society that is clearly, bluntly, at every turn designed for companies to live and thrive in and not people. I'm tired of people being hung out to dry because "freedom." Nobody needs or wants the freedom to be recklessly and hopelessly exploited to the ends of the goddamn earth, and I'm sick of pretending there's no way for us to know that difference.

/rant

By @alexashka - 4 months
Banning advertising would fix it the corporate level.

Philosopher kings would fit it at the political level.

By @idunnoman1222 - 4 months
The ad knows nothing more than my ip, not exactly accurate location data. Not sure what android gives out wrt gps