US Telcos Are Selling Access To Their Customers' Location Data, and That Data Reaches Bounty Hunters and Others Not Authorized To Possess It (vice.com) 128
T-Mobile, Sprint, and AT&T are selling access to their customers' location data, and that data is ending up in the hands of bounty hunters and others not authorized to possess it, letting them track most phones in the country, an investigation by news outlet Motherboard has found. From the report: Nervously, I gave a bounty hunter a phone number. He had offered to geolocate a phone for me, using a shady, overlooked service intended not for the cops, but for private individuals and businesses. Armed with just the number and a few hundred dollars, he said he could find the current location of most phones in the United States. The bounty hunter sent the number to his own contact, who would track the phone. The contact responded with a screenshot of Google Maps, containing a blue circle indicating the phone's current location, approximate to a few hundred metres. [...] The bounty hunter did this all without deploying a hacking tool or having any previous knowledge of the phone's whereabouts. Instead, the tracking tool relies on real-time location data sold to bounty hunters that ultimately originated from the telcos themselves, including T-Mobile, AT&T, and Sprint, a Motherboard investigation has found. These surveillance capabilities are sometimes sold through word-of-mouth networks.
[...] Motherboard's investigation shows just how exposed mobile networks and the data they generate are, leaving them open to surveillance by ordinary citizens, stalkers, and criminals, and comes as media and policy makers are paying more attention than ever to how location and other sensitive data is collected and sold. The investigation also shows that a wide variety of companies can access cell phone location data, and that the information trickles down from cell phone providers to a wide array of smaller players, who don't necessarily have the correct safeguards in place to protect that data. "Blade Runner, the iconic sci-fi movie, is set in 2019. And here we are: there's an unregulated black market where bounty-hunters can buy information about where we are, in real time, over time, and come after us. You don't need to be a replicant to be scared of the consequences," Thomas Rid, professor of strategic studies at Johns Hopkins University, told Motherboard.
Ron Wyden, a senator from Oregon, said in a statement, "This is a nightmare for national security and the personal safety of anyone with a phone."
[...] Motherboard's investigation shows just how exposed mobile networks and the data they generate are, leaving them open to surveillance by ordinary citizens, stalkers, and criminals, and comes as media and policy makers are paying more attention than ever to how location and other sensitive data is collected and sold. The investigation also shows that a wide variety of companies can access cell phone location data, and that the information trickles down from cell phone providers to a wide array of smaller players, who don't necessarily have the correct safeguards in place to protect that data. "Blade Runner, the iconic sci-fi movie, is set in 2019. And here we are: there's an unregulated black market where bounty-hunters can buy information about where we are, in real time, over time, and come after us. You don't need to be a replicant to be scared of the consequences," Thomas Rid, professor of strategic studies at Johns Hopkins University, told Motherboard.
Ron Wyden, a senator from Oregon, said in a statement, "This is a nightmare for national security and the personal safety of anyone with a phone."
I'm not surprised. (Score:5, Insightful)
Aldous Huxley, George Orwell and even Ray Bradbury predicted the world that we are steaming in to. Even Max Headroom is to some extent surpassed.
Re: (Score:1)
Re:I'm not surprised. (Score:5, Informative)
Bullshit.
You are not that important. Unless you are a criminal, on the run from the police, there are no bounty hunters looking for you.
Bounty hunters aren't the only potential users of this "service." How about abusive spouses? Stalkers? terrorists?
Re: I'm not surprised. (Score:5, Insightful)
Political Rivals, or anyone ever thinking of running for office or holding a public office or with a modicum of influence or power (journalists included).
Just think of the dirt that can be used for influence if money doesnt talk.
Re: I'm not surprised. (Score:3, Insightful)
It's not even that. It's people using private investigators that are the worst problem. They can do a lot more than just geotracking, they can also remotely access phones without the restrictions regular law enforcement face. So long as they don't get caught red handed, they can and do just about anything they want.
Know someone who went through a nasty divorce and whose spouse is claiming has a lot more money and/or stuff they can sell to raise money, but can't find it? Congratulations, your connection to t
His NAME was HARRY BUTTLE (Score:1)
Re: (Score:2, Insightful)
Idiots who think that so long as you do nothing wrong, no harm will come to you are going to be rudely awakened when they find out just how insanely wrong they are.
Hiding money during a divorce is wrong.
Defaulting on credit is wrong.
I think your problem may be your understanding of right and wrong.
Re: (Score:2)
Re: (Score:3)
Speaking of politics, could somebody locate Ruth Bader Ginsburg's phone and see if it's at home, in the hospital, or already in the morgue. Inquiring minds would like to know.
You perhaps meant it as a joke. However, recently the NY Times posted a map of everywhere the mayor of NYC had traveled during the previous day, as a way of showing the risks of this technology. They did it by tracking an aide who travels everywhere with him.
Re:I'm not surprised. (Score:4, Insightful)
How about your boss ?
You know, that day you called in sick so you could go to the ballgame instead ?
How about your insurance company ?
Let's take a look at where you've been eating for the past year. . . .
Re: (Score:3)
How about your insurance company ? .
Let's take a look at where you've been eating for the past year. . .
When I eat out with my daughter, she insists we go to the vegan salad bar. So I am looking forward to a reduction in my insurance rates.
Re: (Score:3)
Bounty Hunters? How about...
You are not that important: even though YOU are at the center of YOUR universe, you're not at the center of everyone ELSE'S. That needs to be hammered into the heads of a few people, preferably with a Smart Hammer (Google and Amazon enabled.)
OTOH, you ARE the center for a few caring people: your spouse, your pet. The Repo Man. Flo, who likes you SO MUCH she wants to know where you are Every Single Second While You're Moving. (speed=d/t)
Terrorists, not so much. The whole point there is to get people
Re:I'm not surprised. (Score:5, Funny)
Sidenote: I installed Life360, an Android location and overall helpful app for my (now-ex) girlfriend so we could easily locate each other. I talked to her beforehand
Needing to know each others' location at any time is at least one of the contributing problems.
Re: (Score:3)
Re: (Score:2)
wait for a cell phone call from within your house. Now I have your cell number.
How can a common thief get my phone number by parking in front of my house?
A thief is not going to have access to a Stingray. Even if he did, it is difficult to distinguish a phone call from one house from another next door or across the street,
Re: (Score:2)
Your theories about hackers using high-tech crime and the dark web to steal your 500$ TV are only making the OP's point.
Re: (Score:1)
Give them a break, slashdot readers aren't educated enough to understand that "Bounty Hunter" is a type of private detective, with special permission from the government to track down and apprehend people wanted by the government.
They think it means a professional kidnapper, like Boba Fett.
The problem isn't that "Bounty Hunters" (a type of bail bondsmen) can get this information, the problem is that the information is totally unprotected, and people who are not "Bounty Hunters" can presumably also get it. G
Re:I'm not surprised. (Score:5, Funny)
They think it means a professional kidnapper, like Boba Fett.
Bullcrap. Boba Fett was working within the legal jurisdiction of the Empire. He was just as legitimate as any other bounty hunter.
Re: (Score:3)
At his time of death his work was legal in the eyes of the empire, granted.
But that only means that he was a Privateer for the baddies instead of a Pirate; it doesn't mean he wasn't a "professional kidnapper."
Historically when such actions were legal, a person would still be "kidnapped" and "held hostage" until a "ransom" was paid!
But like any Privateer, his work takes him outside the jurisdiction of the people granting his license, and the actions are often not legal in the jurisdiction they're actually op
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
came home early from work one day and found her vigoursly giving head to another guy.
Can you post her name and phone number? No need for her address (according to TFA).
Re: (Score:3)
You don't even have to have a relationship with someone - or even know who they are - for them to stalk you.
Re: (Score:1)
At which point the proper reply is, if I have you committed until you calm down for your own good, then doesn't that protect me from you killing me and prevent you from ruining your life and ending up in prison for life?
Re: (Score:2)
Show me a psychiatrist or other mental health professional that has successfully treated a narcissist.
Re: (Score:1)
https://www.psycom.net/personality-disorders/narcissistic/ [psycom.net]
Treatments do exist.
Re: (Score:1)
You should get them the help they need to not be that way.
https://www.psycom.net/personality-disorders/narcissistic/ [psycom.net]
Re: (Score:1)
Funny, that link I provided gives you a number of things you can do about a narcissist. I think you're just giving up.
Re: (Score:1)
And that is where involuntary commitment by a spouse comes into play.
Re: (Score:1)
I thought we were talking about divorce. Murder kind of sidesteps that, but so does involuntary spousal commitment.
Re:Not seeing an issue here (Score:5, Insightful)
It's part of the TOS you sign with your carrier.
If a couple of criminals get burned by their phones' location, I'm not going to cry any rivers.
Until you become a criminal by violating some unfair or unconstitutional law and they track you down....
The problem here is that it's illegal to track down a criminal using this data without a warrant. That folks can do this and bypass the need for a warrant may not be a problem to you now, but the camel's nose is in the tent if we let this happen w/o complaint and you may wish you'd said something.
Re: (Score:1)
Then site back and enjoy the show!
Re: (Score:2)
So if your a criminal, trap a wild animal such as a mountain lion. Tranquilize the animal and attach your phone to it (nice heavy duty leather collar or something). Wait for the animal to wake up and run away.
What if you're not a criminal but don't want to be tracked anyway? There just aren't enough mountain lions for everyone.
Re: (Score:1)
If you in the urban jungle, then just strap it to a school bus or random taxi.
I can see the news at 11 footage now. The swat team surrounds a bus of children and takes them off one by one at gun point only to find a cell phone belonging to a criminal strapped to the under carriage. Heck, you might get one of those catholic buses with nuns, or ev
Re: (Score:2)
Bears, Alligators, Cougars, Wolverines, Coyotes,
I fear that I'm too old to catch myself a cougar now.
Re: (Score:1)
Re: (Score:3)
No it is not. A search warrant is required to search someone's property. But if you obtain evidence through other means no warrant is required. Maybe you are thinking of how a search warrant is required to put a GPS on a car. Or how a search warrant or a subpoena is required to compel the phone company to release your locayion to them. But if a company is selling the info or releasing it for free no special process is required.
Really, the police could start displaying banner ads on facebook and they ha
Re: (Score:2)
You might also say: "I don't care about income tax - I'm unemployed!" or "I don't care about free speech - I've nothing to say!" or "I don't care about affordable health care - I'm healthy!"
When the situation changes for you and you suddenly start caring - it'l be too late.
Re: (Score:2)
It's part of the TOS you sign with your carrier.
If a couple of criminals get burned by their phones' location, I'm not going to cry any rivers.
According to the article they don't have to be criminals. It could be creepy Steve from the night club tracking where that hottie Denise is living. Denise regretted not coming up with a fake number at the time... she's going to regret it even more when creepy Steve shows up at her door unannounced.
Re: (Score:2)
It's part of the TOS you sign with your carrier.
Not to mention the TOS you probably signed with your bail bondsman. When you're skipping bail, I don't think you enjoy the same rights to privacy as everyone else. Why are bounty hunters specifically "unauthorized" to access this data? It seems to me they do have a legitimate use for it.
Re: (Score:3)
It's part of the TOS you sign with your carrier.
Not to mention the TOS you probably signed with your bail bondsman. When you're skipping bail, I don't think you enjoy the same rights to privacy as everyone else. Why are bounty hunters specifically "unauthorized" to access this data? It seems to me they do have a legitimate use for it.
If it was only ever used to track down people who skipped bail that wouldn't be a problem. The problem is that anyone can purchase the information- and use it to track anyone, not just people who jump bail.
Re: (Score:2)
part of the TOS
Even better: As of 1996 (I think), legislation changed the ownership of subscriber metadata from the customer to the telecom. It's not your data anymore, so just get over yourself.
Can be done even cheaper. (Score:5, Informative)
As long as you can find out in which mobile network that phone is registered, you can take a SIM from the same provider, pop-it into a mobile modem, enable basic network tracing and call that number. As soon as the called number begins to ring, you'll get a packet back from the network listing among other stuff the CELLID where that phone is registered.
And there are a bunch of websites where you can plug a CELLID which will show that "hunder meter circle" where that cell's antenna has coverage.
Re: (Score:2)
Re: (Score:2)
If you have that modem dialing out to automatically play a sound file of "You have been approved for medical insured pain relief press one to talk to a operator ..." if the other party manages to pick up - then yes, you can do that. :-)
But expect your SIM to get disconnected and the IMSI of your modem blocked the next day (if the mobile operators are smart enough to count the number of "debug" messages running over the network and report on that)
Re: (Score:1)
Or even cheaper yet, just record their checkins from facebook.
Re: (Score:2)
Citation needed ... it seems unlikely.
Re: (Score:2)
Not in the default response. :) The trick was to pay attention to the cell tower servicemen and see what phone models they were using.
As i said - you need to send some extra bits to enable debug responses. Those are documented in the cell's documentation and may differ from cell manufacturer to manufacturer... But there's like five of them anyways so you can try them all.
Some old Motorola phones had them built in - you just punch a really long star code and the screen fills up with interesting numbers
How it's done (Score:3, Insightful)
Having worked for one of these Telco's (admitedly before LTE) I can tell you how it's likely done.
Your cell phone must register with a tower, so the "contact" inside the wireless telco looks up the customer's phone number directly in the switching system so that they leave no fingerprints in the CRM system. So the HLR will say where the mobile device is presently located by the tower's id number, and then you cross reference that with the actual geographic location of the tower.
That's how it's done, and customers, pre-smartphones who have had their devices lost or stolen have routinely called in to ask where their device is and at best, the rep can say it's somewhere near X (where the HLR says it was last seen) often by using a tool designed to check if the phone is roaming. If the phone is roaming on another carrier's tower, then the carrier will actually have more information available since the roaming database on the phone will only try to connect to certain towers it's been authorized to. So if your phone is in Dallas, which has a lot of cell sites, its much easier to figure out where someone is because one tower might only serve an area of 300ft, where as a tower out in Anchorage, might literately serve half the city, so the precision is much lower.
The on-device A-GPS is more accurate because it can use multiple cell sites and actual GPS line-of-sight to determine where it is. But this information isn't typically relayed back to the cell carrier unless the carrier provides A-GPS service in the first place. LPP (LTE Positioning Protocol) is some fancy level of A-GPS that utilizes multiple sources. If the carrier has A-GPS, then yes, the carrier knows within 100ft of where the phone is.
The question is how much data does the carrier actually need though? If you turn A-GPS off, which you typically can't do without turning all location services off entirely, then you're stuck.
If you turn location services off, you can still be found as long as the phone is powered on since it's still registered in the HLR. Just it can only be narrowed down to the last tower seen for the most part.
Re: (Score:2)
Well ... the "HLR boys" can send a few network commands to force that phone to try and register with another tower ... then another one ... if they have your EIRP from at least 3 tower locations, you're triangulated to about ~15m (down to ~5m in cities with lots of towers).
Hint: if you see the signal bars on your phone jumping up and down for a minute or two without a reason ( phone idle, no apps downloading data, no high movement of devices in network (rush hour or concert) ) - then guess what just happene
Re:How it's done (Score:5, Interesting)
I believe you are mostly correct about the HLR/VLR, but I think the cell company has more information than just what tower you are hitting or which MSC you happen to be in. (BTW, it's really the MSC's VLR that has this information, the HLR is where your handset is registered and it knows what MSC you are in so inbound calls can be routed to the right MSC to be delivered to your handset. The local MSC to your handset has a VLR (Visitor Location Register) which is about where your handset happens to be right now so when that call arrives they know what cell gets the call so they can assign a slot and deliver it to your phone.
These days they have quite a bit more information about the handset's location, including a signal strength and apparent direction from the cell tower, from which they can make a pretty good estimate of your location. They need this information to more accurately transmit and receive from your handset at the higher data rates while not consuming excessive expensive spectrum space. These days cell towers have electronically steerable arrays for antennas, so they can better use their available spectrum space to service more phones at higher data rates.
Re: (Score:2)
These days cell towers have electronically steerable arrays for antennas, so they can better use their available spectrum space to service more phones at higher data rates.
They've had that for at least 15 years.
Re: (Score:2)
IIRC, A-GPS can be turned back on remotely by the carrier. Theoretically, it's supposed to happen in response to something like a warrant.
(Or at least I've read articles that make this claim)
Hey tony, we gotta get in on dis (Score:1)
Hey tony, we gotta get in on dis...thinks of the people we might finds that owes ya money.
Testing their boundaries (Score:5, Insightful)
Warning to telecoms: if you don't like being regulated, don't invent reasons to get regulated.
Get together and come up with a mutual industry agreement on when and how to share customer data in a way that's not confusing or misleading to customers. Sign the agreement and hold each other accountable. The alternative is that the gov't will do such for you after you play fast and loose for short-term profits and bungle it one day.
Re:Testing their boundaries (Score:4, Insightful)
Your logic is bad.
If your solution to problems that businesses have is to run to regulators to solve them then you are going to lose. Or have you not looked at the past Century of the FCC itself? One hardly needs to look at only that industry either to see the same effect.
The correct "free-market" control on capitalist monopoly is for the "consumers" to refuse to buy these product and to start up competing businesses... o wait... sorry you effectively prevented that proper "control" by letting the regulators do that for you and subsequently allowed them to be bought off by the industry to put in regulations that make it very difficult for you to challenge incumbents with new services making it difficult for even super rich businesses to compete.
People like you are the exact reason why Google Fiber failed and the problem is that you don't know why or how that is and when you are told how or why you start calling it victim blaming. Well if you help create support an institution that is oppressing you, you are not exactly a victim.... more like someone getting their comeuppance for being taken for a fool. You can't walk off a cliff and legitimately bitch about gravity pulling you to your doom!
In no uncertain terms... They will buy your "regulators" and "own you" as you "grin from ear to ear" thinking you put them in their places with so called "regulation". It has happened so many time they now tell you to your face how they are going to take advantage of you and you don't even believe it! Even if you substitute capitalism for socialism or even communism they will still be ruling over you, no exception, no mistake. The history is there for everyone to see! The poor endlessly whine about the bourgeoisie ruling over them and what is the first thing the poor do when a problem occurs? They run to the bourgeoisie that control their lives over here and ask them to control their lives over there.
Re: (Score:2)
So what is your answer? Let them run unchecked?
Let me guess, you think we need a wall to protect us don't you?
No, we need a wall to protect us from him and others like him Without regulation you’d end up with the streets of NYC at the turn of the century 20th - where there were countless power lines running electricity from every different provider under the sun. The reason Google Fiber failed is because running fiber is incredibly expensive and disrupts the streets in the city hosting it. So the solution is for the city to own the fiber just like it owns the streets on top of the fiber. The city doesn
Re: (Score:2)
"However, you canâ(TM)t easily do something like that with cellular service."
Your points are solid but I would like to expand on it and point out that... Well, you CAN easily do something if you force standards better. The real problem is that they are allowed to operate and control their infrastructure using only their own proprietary protocols which are not compatible with each other and exclusive access to "auctioned frequencies" creating more monopolies yet again as a solution to a problem that do
Re: (Score:3)
The correct "free-market" control on capitalist monopoly is for the "consumers" to refuse to buy these product and to start up competing businesses... o wait... sorry you effectively prevented that proper "control" by letting the regulators do that for you and subsequently allowed them to be bought off by the industry to put in regulations that make it very difficult for you to challenge incumbents with new services making it difficult for even super rich businesses to compete.
The preferred "free market" solution does not automatically happen for free in all markets.
Telecommunications companies started off big, because they had to have the economic muscle to negotiate with many private and gov't entities to achieve a network of sufficient scale to be economically viable. At this size, pure free market solutions are fantasy.
Of course, we, as consumers, do have options. We could choose to not be a part of a cell system at all, and use apps that connect through wifi to make and re
Re: (Score:2)
"Telecommunications companies started off big, because they had to have the economic muscle to negotiate with many private and gov't entities to achieve a network of sufficient scale to be economically viable."
This is purely specious. You are making a blind claim in this regard, does being big help? Sure does, but it is also often not a requirement like so many people think. Lots of businesses have started off small and then got big. Additionally, the government helped them to create this problem by let
Re: (Score:3)
This is purely specious. You are making a blind claim in this regard, does being big help? Sure does, but it is also often not a requirement like so many people think. Lots of businesses have started off small and then got big
Didn't think this through much, did you?
So you start your little telco, with your 10 customers.
Why does AT&T route any calls to you? Or any calls from your customers to AT&T customers? Keep in mind we're in your ideal world without telecom regulations, so "common carrier" doesn't exist.
Or such regulations do exist, and AT&T just decided to route a few petabytes of traffic through your network, utterly swamping your network and crippling your service. Causing 8 of your customers to cancel serv
Re: (Score:2)
This conversation goes better when you use your brain a little.
"Why does AT&T route any calls to you?"
There already are regulations that prevent that without calling up congress to for them to also stop them from invading your privacy. There really is such a thing as too much regulation but it sounds like for people like you anything less than total regulation is zero regulation at all.
"The poles don't belong to the telephone companies. They belong to the power companies. The telephone companies are le
Re: (Score:2)
I guess what I said flew right over your head. No private company providing utilities of any kind should own private property on public lands, this naturally includes more than just ISP's, but it seems you don't get that.
Without a bit more concrete details on how that framework could work for the various kinds of utilities and telecomms, I do not think you have an argument here at all.
In the real world, these services are provided with a messy combination of public property, publicly owned easements, private property, privately owned easements, and various leases for all of the above, the exact details of which vary by state and county and city. And while you may have fine ideas of what a better approach would be, it actua
Re: (Score:3)
But since you brought that up as well. Let me ask you this. Would you rather face down a free-market monopoly screwing you over or would you rather face down a government monopoly screwing you over? One side gets to put you in jail for not doing what they tell you to do.
Ultimately you are dependent on gov't honesty and competence to some degree, even if not exactly the same in both cases.
In the case of more direct gov't involvement, I can vote with my vote.
In the case of less direct gov't involvement, I vote in the hope the gov't will protect me when my little startup is visited by hired goons who rough me up and smash my equipment.
That was not a theoretical concern, in the real world. There are two reasons that Hollywood is in California, BTW. First the land and (sun)l
Re: (Score:1)
Where did I say or imply that?
They can spend billions of dollars to keep the little guy little. It's like fighting a fire-hose with a squirt-gun. It's a wonderful ideal, but often fails in practice. I can convey dozens of historical Microsoft/IBM/AT&T/etc. shannegins (and
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
>Warning to telecoms: if you don't like being regulated, don't invent reasons to get regulated.
or get your puppet lead FCC, seems cheraper
The No Shit Sherlock prize goes to (Score:2)
Burying the lede (Score:2)
Nice tool for burglars as well (Score:2)
Burglars might like to know who is traveling and on the other side of the country.
Or people doing corporate espionage might like to poke around in the target's home computer and have time to clean up their traces.
Duh! (Score:2)
People with outstanding warrants know that the police can track them, so they use throwaway phones, so that the cops don't know their number.
I don't see how bounty hunters would get to know that number unless they criminals are so stupid to call acquaintances with it.
Then they deserve it.
It's simple, if you don't want to get found, don't use a phone.
Use forwarding numbers? (Score:2)
Can't you protect yourself from this by never giving out your direct number? Just give people a number from a service like Google Voice that allows you to forward calls to your real number.
Thoughts and prayers? (Score:2)
Ron Wyden, a senator from Oregon, said in a statement, "This is a nightmare for national security and the personal safety of anyone with a phone."
So let's hurry up and do nothing about it!
Easy Manipulation (Score:4, Insightful)
If nothing else, this article shows how easy it is to manipulate people's views.
Had this article been about how anyone, such as a connected stalker, could for a few hundred dollars, track your location through your phone, there would have been almost universal outrage in the comments.
But because it is framed in terms of bounty hunters catching bad guys, there are an awful lot of comments in support of this capability. Even if it is illegal and can be used by anyone with the dollars to buy the services.
Does not give hope for the future.