In 2019, technologist Mike Yeagley warned US national security agencies that location data from apps like Grindr could reveal sensitive information about government employees.
Yeagley showed how he could use geofencing to identify devices likely belonging to Pentagon and intelligence agency staff by tracking their movements to and from sensitive facilities. This highlighted the massive privacy risks from vast troves of location data gathered by mobile advertising companies.
Yeagley was familiar with these risks because he had previously helped bring advertising location data into government use. While working for defense contractor PlanetRisk, Yeagley developed a tool called Locomotive in 2016 which allowed tracking of device locations worldwide using commercial data. Locomotive was later renamed VISR and provided to special forces for intelligence work. Other government agencies also began using advertising location data.
The key insight was that while device IDs are anonymized, the specificity of individual movement patterns means identities can be uncovered. Vast volumes of location data are gathered from bid requests made when mobile apps request ads. Companies like UberMedia sell this commercially, often with little oversight of buyers. Intelligence agencies realized they could simply purchase rich geospatial data rather than try to intercept it.
UberMedia and similar firms can track device locations over time with frequently updated data, in some cases nearing real-time. PlanetRisk found they could even identify phones likely belonging to Vladimir Putin's entourage by watching their coordinated movements with him. They also spotted US special forces gathering at a previously secret Syrian base.
Social Engineering Bonanza
Other governments’ intelligence agencies have access to this data as well. Several Israeli companies—Insanet, Patternz and Rayzone—have built similar tools and sell it to national security and public safety entities around the world, according to reports. Rayzone has even developed the capability to deliver malware through targeted ads, according to Israeli newspaper Haaretz. Think about the highly targeted social engineering risks here.
This availability of highly sensitive location data to anyone willing to pay is an immense privacy threat. Intelligence agencies globally make use of it for surveillance. But it also risks revealing personal information about private citizens, with almost no transparency or control over how that data is used. it makes you want to buy a Faraday Bag for your phone... :-(
Full WIRED STORY