The American Civil Liberties Union (ACLU) has released thousands of pages of documents revealing how the Department of Homeland Security (DHS) is buying access to the location data of millions of US citizens' cellphones .
See also: Is the Greek government spying on citizens through Predator spyware?
The warrantless purchase by various Homeland Security departments, including Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE), was first reported by the Wall Street Journal in 2020.
In response to the news, the ACLU filed a request with DHS, ICE, and CBP, followed by a corresponding lawsuit.
While the legal battle is still ongoing, the association has decided to release the records that have been provided to date by CBP, ICE, the U.S. Secret Service, the U.S. Coast Guard, and several offices at DHS headquarters.
Records show that DHS has used millions of taxpayer dollars to purchase access to cellphone location information from two data brokers: Venntel and Babel Street .
According to documents obtained by the ACLU, Venntel collects more than 15 billion location points from more than 250 million cell phones and other mobile devices every day.
See also: Tesla USA: Non-Tesla EVs will soon be able to use the Supercharger network
According to the company's marketing brochure, law enforcement can use this data to "identify devices observed at points of interest, repeat visitors, locations frequented, locate known associates," and "discover lifestyle patterns."
An internal DHS document from 2018 also raised concerns about the privacy of people living near the U.S. border. It suggested using Venntel’s location data to “identify patterns of illegal immigration.”
And another request to Homeland Security from a local police department in Cincinnati requested an analysis of location data on opioid overdoses in its jurisdiction.
Worryingly, both proposals are based on the premise that law enforcement can indiscriminately collect sensitive information about people simply going about their daily lives.
In the face of the obvious privacy implications, data brokers have tried to downplay their actions.
First of all, the documents characterize the phone's location data as a simple "digital exhaust," which does not contain personally identifiable information (PII), but is attached to a numerical identifier.
See also: Maui ransomware: US government warns of attacks!
This hides the fact that phone numbers are linked to identity information — not to mention how much data you're sharing just by signing in to Google.
Second, data brokers claim that phone users themselves voluntarily reveal their location when they consent to GPS data permissions.
This is the perfect gray area that data services and government agencies can exploit.
Users don't always know how many apps on their phone collect GPS information, or (reasonably) don't expect that this data will be sold to governments for surveillance.
