Privacy Concerns Over Ad Tech Giving Police Greater Power to Track Phones

Technology | The Big Take Ads in Popular Apps Give Police a Powerful Tool to Spy on Users In presentations prepared last year for international law enforcement agencies, representatives of US digital intelligence company Penlink showed off their flagship technology, Webloc. They demonstrated the system tracking people as they walked down Fifth Avenue in New York City, visited the European Central Bank in Frankfurt, and moved close to the UK Parliament in central London. The presentations said that Webloc, originally developed by an Israeli startup, Cobwebs, can track hundreds of millions of mobile phones across the world. For law enforcement, that’s a powerful capability — made more so by the fact that in the US it can be used without the need for any kind of search warrant or judicial authorization. Documents reviewed by Bloomberg News, including training materials and company presentations, as well as interviews with seven current and former employees of Penlink and Cobwebs, who spoke on condition of anonymity because they weren’t authorized to speak with the media, show the incredible reach of Webloc — and how it works. The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps. It can build a detailed picture of where a smartphone has been over the past 12 months, and update the data hourly, showing the movements of people on a near real-time basis. Law enforcement officers can use Webloc to zero in on a map and look at all phones that were present at a specific place and time, analyzing “billions of location data points,” according to company documents reviewed by Bloomberg. The Supreme Court ruled in 2018 that law enforcement agencies must obtain a warrant from a judge to obtain location data from telecommunications companies. But the Justice Department has since argued that the principle does not apply to location data that agencies purchase from commercial sources, and Webloc users now include US Immigration and Customs Enforcement, at least two branches of the US military, and more than a dozen American police forces. It’s also been acquired by authorities in the UK, Saudi Arabia, the United Arab Emirates, Singapore, the Netherlands, Germany, Austria and Hungary, according to sales records and people familiar with the company’s operations, who declined to be identified in order to discuss confidential business. Nathan Freed Wessler, deputy director with the American Civil Liberties Union’s Speech, Privacy, and Technology Project, said the evidence showed there had been a “ridiculous expansion of these tools” in recent years, which raise “tremendous concerns” due to the lack of legal oversight around their use. “It means that people are going to be investigated who the government has no business investigating,” he said. A Penlink spokesperson declined to comment on specific customers and said Webloc was only provided to clients in support of law enforcement and national safety efforts. “We believe that strong privacy protections and lawful access to data must coexist, and we agree that technology should be used responsibly, lawfully, and effectively. Likewise, we are committed to complying with applicable laws and regulations, as our customers are required to do, and we update our practices as those laws change,” they said. How Webloc Works Penlink was founded in 1986 in Lincoln, Nebraska. Over decades, the company built up a trusted relationship with law enforcement agencies in the United States, providing surveillance technology that is used to collect and analyze wiretapped phone calls and internet data that is gathered during the course of investigations. Penlink’s customers have included the FBI, the Drug Enforcement Administration, the US Marshals, Secret Service, the Department of Homeland Security and scores of state and local police departments, according to sales records reviewed by Bloomberg News. Cobwebs was founded in 2015 by three veterans of Israeli special forces, who developed Webloc for use in counterterrorism, according to people familiar with its development, who declined to be identified as they weren’t authorized to speak to the media. The company managed to establish itself internationally, including in the US, but not without controversy. In 2021, Meta Platforms Inc. banned about 200 accounts that it accused Cobwebs of using on its social media platforms Facebook and Instagram to trick people into revealing personal information. Meta said Cobwebs was involved in “targeting of activists, opposition politicians and government officials in Hong Kong and Mexico” and said that the company had customers in countries including Bangladesh, Hong Kong and Saudi Arabia. After Meta’s report, Cobwebs ceased selling a product called Trapdoor, which it had used to infiltrate social media pages with fake accounts, according to the people familiar with the matter. The company instead began focusing its development and sales efforts on Webloc and a related product called Tangles, which is designed to carry out surveillance of social media activity, monitoring what people post online and analyzing connections between suspects. In 2022, the New York private equity firm Spire Capital acquired Penlink, and then in 2023 acquired Cobwebs in a deal worth about $200 million, joining the two companies together. Spire Capital appointed one of its own operating partners, Peter Weber, as Penlink’s Chief Executive Officer. Under Weber’s stewardship, Penlink has pushed to sell Webloc in global markets, and to expand its use from large national law enforcement and intelligence agencies to include local law enforcement departments and private security companies, according to people familiar with the company’s business. Penlink customers who purchase Tangles can acquire Webloc as an add-on. Licenses for the technology start from around $100,000 per year, with the price rising depending on the number of users and amount of Webloc location data requested, according to documents reviewed by Bloomberg. Sean White, a partner at Spire Capital, said that Webloc had been “materially changed” after Cobwebs’ acquisition. The product is only available to law enforcement and public safety agencies, and “in rare instances, through authorized government contractors acting on their behalf,” White said, and not offered to enterprise customers. Webloc has been used “to find missing children and return them to their families, identify suspects at the scene of a crime like a bank robbery, and identify human and drug trafficking organizations operating in the United States,” White said. “We understand and respect the debate on law enforcement's ability to use commercially available data for its investigations,” he said. “We believe that law enforcement’s ability in the US to purchase access to commercially available data is still an open question as none of the recent court decisions address that issue.” According to US government procurement records, US Immigration and Customs Enforcement spent around $9 million between 2022 and 2026 on four contracts with Cobwebs and Penlink, which included licenses for Webloc. Amid concerns about ICE’s mass deportation campaign, a group of more than 70 Democrat lawmakers wrote to the Department of Homeland’s Security’s inspector general in March, seeking information about how the agency was using Webloc. They questioned whether ICE was using location data to “investigate Americans for engaging in constitutionally protected activities.” Representatives for the lawmakers said they had not yet received any response. Internationally, the company has provided the technology to London’s Metropolitan Police, and it has contracts with authorities in Saudi Arabia, Singapore, Mexico, Israel, the United Arab Emirates, the Netherlands and Germany. A spokesperson for the Department of Homeland Security said: “ICE does not purchase illegal information. ICE only utilizes tools it has legal authority to use. We are not going to disclose law enforcement sensitive intelligence and methods. DHS law enforcement methods abide by the US Constitution, including the Fourth Amendment.” State and local law enforcement across the US have also obtained the technology, including the Texas Department of Public Safety, police in Los Angeles, Dallas, Baltimore, Tucson, Durham, the City of Elk Grove in California and Arizona’s Pinal County, according to a report published in April by researchers at Citizen Lab, a technology research unit at the University of Toronto, which analyzed public procurement contracts. In September 2023, a Tucson police official explained in an internal report that the agency had used the tool to identify a suspect behind thefts of cigarettes at two Circle K stores and burglaries of two bars, tracing the perpetrator to an apartment block near the stores. The Tucson police also deployed the technology to help identify suspects involved in attacks on overhead communication lines and in an investigation into the abduction of a female University of Arizona student, according to the report, which was obtained by the Electronic Frontier Foundation, a digital rights group. The force had originally acquired Webloc using border security funding to aid in sex trafficking investigations, it said, but had ended up using it for a wider range of applications. Officer James Horton, a spokesman for Tucson Police Department, said in a statement that the force’s license for the technology had since expired and had not been renewed. “This is a powerful mass surveillance tool that’s trickling down from military and intelligence agencies to federal law enforcement and then to state and local police,” said Wolfie Christl, a researcher at Citizen Lab. Internationally, the company has provided the technology to London’s Metropolitan Police, and it has contracts with authorities in Saudi Arabia, Singapore, Mexico, Israel, the UAE, the Netherlands and Germany, according to sales records reviewed by Bloomberg News, and people familiar with the matter, who declined to be identified in order to discuss sensitive information. Penlink has also sold Webloc to security agencies in Hungary and El Salvador, and agreed to a €1.85 million ($2.1 million) deal to provide it to Austria’s government, according to media reports in those countries. The Metropolitan Police, the German Federal Police and the Dutch intelligence agencies declined to comment. Authorities in Saudi Arabia, Singapore, Mexico, Israel, the UAE and El Salvador did not respond to requests for comment. The Hungarian Special Service for National Security said it cannot comment on the tools it uses. The Austrian Interior Ministry said it “does not employ surveillance tools for indiscriminate mass surveillance. Relevant specialized applications are used exclusively for the targeted and individual performance of duties in specific cases involving security policing, criminal investigation, and the protection of the constitution.” Penlink representatives have shown its law enforcement customers how the tool can be used to track and identify protesters involved in pro-Palestinian demonstrations, monitor the movements of suspected Iranian spies and Serbian militia groups, and also track down members of motorcycle gangs such as the Hell’s Angels, according to the documents reviewed by Bloomberg News and people familiar with the company’s operations. Penlink’s spokesperson said it “does not publicly discuss specific customers or confirm customer lists,” and that it “does not provide US location data to foreign governments.” The spokesperson added that when the company trains customers on Webloc, it uses “public-safety and investigative use cases” that are relevant to the agencies being trained, often based on examples requested by those agencies. “The use of a training scenario should not be understood as Penlink endorsing any political, unlawful, or improper use of the platform,” the spokesperson said. Company documents reviewed by Bloomberg show that Penlink planned to market a version of Webloc, known as Safeloc, to private sector corporations, including banks, security companies and retailers, which could be used to carry out “location-based investigations” as part of fraud detection and credit risk assessments. The Penlink spokesperson said that the company “does not offer a product called Safeloc” and added that materials referencing Safeloc were “likely created as part of a product evaluation.” Earlier this year, a security consultant for Moët Hennessy, luxury goods giant LVMH Moët Hennessy Louis Vuitton SE’s wines and spirits division, demonstrated that Webloc could be used to aid an investigation into thefts at its warehouse in western France, French news organization Mediapart reported in August. Alexandre Hollander, founder of Paris-based security consultant Amarante International, said in a statement to Bloomberg that it had shared a “commercial use case” of Webloc with LVMH, but that LVMH had decided not to use it. White, the Spire Capital partner, acknowledged that Penlink had an agreement with Amarante International, but said the company had not sold Webloc to Moët Hennessy or LVMH, and added that the technology was “available only in support of law enforcement and national security efforts.” As Webloc, and technologies like it, proliferate, privacy advocates and lawmakers are becoming increasingly concerned about a lack of oversight of law enforcement’s use of private data services. The marketplace for location data has boomed in recent years. In 2023, Bloomberg Businessweek reported that an Israeli company named Rayzone was repurposing advertising data to help governments track individuals through their mobile phones. Other companies operating in the sector include American firms Venntel and Gravy Analytics, which in December 2024 the Federal Trade Commission accused of unlawfully collecting and using consumers’ location data without obtaining full consent. The FTC banned both companies from selling location data deemed sensitive — such as data revealing visits to health-related locations and places of worship — except in cases involving national security or law enforcement. Jason Sarfati, chief privacy officer of Venntel and Gravy Analytics parent company Unacast, said the company had agreed with the FTC’s decision to implement privacy protections. But he added that location data still had a “critical role” to play “in legitimate public-interest applications, including locating missing children, combating human trafficking, emergency planning, and evacuation efforts.” Penlink’s spokesperson said the company had taken the FTC’s action into account and that the data providers it works with “obtain user consent for location data sharing and filter out sensitive locations — such as hospitals, schools, or places of worship — from their datasets.” App users whose data is being collected, however, may not be aware that they could be subject to this kind of surveillance. Even the developers of the apps themselves may not know that the third party trackers that they use for advertising or monetization purposes ultimately sell location data to companies like Penlink, such is the opaque nature of the supply chain. When users install an app containing one of the trackers, there will usually be information in the terms and conditions that outline that the app developer may sell or share location data with third parties, but few people read the terms closely and, either way, they do not provide information about the specific end users of the data. “I've yet to come across anyone who has explicitly consented to these private companies handing over data for surveillance purposes,” says Thorsten Wetzling, a digital rights expert at Berlin-based think tank Interface. “What we are seeing here represents a very serious dearth of effective regulation and oversight.” Documents reviewed by Bloomberg News show that Webloc has previously gathered location information from weather apps available on Android and iOS devices, such as Accuweather; from a prayer app, Muslim Pro, which has been downloaded more than 100 million times in the Android Play Store, and games including Multi Maze 3D, available for both Android and iOS devices. A spokesperson for Muslim Pro owner Bitsmedia said it hasn’t had any commercial relationship with Penlink, and hasn’t provided it with user location data. “We are unaware of any arrangement between Penlink and any third-party technology provider involving location data originating from Muslim Pro,” they said. An Accuweather spokesperson said it had “absolutely no relationship, commercial or otherwise, with Penlink” and added that it did “not share data without our users’ expressed consent.” CrazyLabs, maker of Multi Maze 3D, also said it has no relationship with Penlink, and that it is “not aware of any of CrazyLabs’ SDK providers having any relationship with Penlink or having provided data from ‘Multi Maze 3D’ to Penlink.” Penlink’s spokesperson said that the company’s “data partners provide data from their own SDK relationships and represent that they obtain consent through their app partners; they do not provide Penlink with a comprehensive list of those app partners.” Some location data previously harvested by the Webloc system was sourced from an Israeli company named Start.io, which works directly with app developers, offering them a chance to make money by embedding its SDKs inside their apps. Start.io has placed SDKs in more than 500,000 apps that have collectively been downloaded more than 25 billion times, according to company documents reviewed by Bloomberg, and former employees of Start, who declined to be identified in order to discuss sensitive company information. Start’s marketing materials boast that the company can reach 2.4 billion devices globally, including 300 million in the US alone. It says its SDK can provide “a 360-degree view of consumers,” gathering information about the apps people use, their location, cell network, and other details. More than 4,400 apps have previously been identified as containing a tracker linked to Start, according to Exodus, a platform that audits Android apps and identifies the trackers they contain. Penlink’s spokesperson denied the company had purchased data from Start.io, but said Cobwebs, prior to its acquisition by Penlink, had conducted “a trial” using data acquired from Start. Penlink acquires its location data from a variety of “data partners,” the spokesperson said, who each gather information from SDKs that they operate. A spokesperson for Start.io said that the company wouldn’t comment on specific commercial counterparties. “The agreements we sign include a contractual restriction limiting use of the data to advertising purposes,” they said. The spokesperson said that most of the location data it obtains is not “precise” and that figures describing the number of times its apps have been downloaded are “theoretical” and “not measurements of data collection.” There have been some attempts to limit the use of private surveillance data in the US. Last year, Montana became the first US state to ban law enforcement from purchasing location and other personal data from commercial vendors without a search warrant or investigative subpoena issued by a court. A handful of other US states — including Oregon, Maryland, New Jersey and Virginia — have banned the sale of precise location data. Penlink’s spokesperson says it’s stopped acquiring location data on people in those places. “It is going to be very difficult for oversight bodies and the public to disentangle the kind of mesh that has been created.” In March, a group of 17 Democrat state attorneys general called on Congress to introduce new laws requiring law enforcement agencies to close the loophole. They cited Webloc as a technology of particular concern. “Without additional statutory protections and policies imposing limits,” they warned, “we will fail to keep pace with the surveillance capabilities of our times.” A bill that would curb the trade in personal data in 2024 won bipartisan approval in the House of Representatives and was incorporated in a bipartisan surveillance reform bill introduced in the Senate in March, which has not yet been voted on. In June, the Bureau of Alcohol, Tobacco, Firearms and Explosives canceled a contract it had with Penlink for a pilot of Webloc. The move came after pressure from Rep. Michael Cloud, a Republican from Texas, and Sen. Ron Wyden, a Democrat from Oregon, who had questioned the ATF about the legality of its use of the surveillance tool. But elsewhere, digital rights experts are concerned that the technology is moving faster than the law, as law enforcement agencies and intelligence services expand their use of commercial services for private data. “It’s becoming this momentous private-public co-production of surveillance,” Wetzling from Interface said. “And it is going to be very difficult for oversight bodies and the public to disentangle the kind of mesh that has been created there.”