US cell carriers are selling access to your real-time phone location data | ZDNet
Description: The company embroiled in a privacy row has "direct connections" to all major US wireless carriers, including AT&T, Verizon, T-Mobile, and Sprint -- and Canadian cell networks, too.
Date: 2018-05-15T02:15:11Z

archive.today webpage capture | Saved from |
history |
| 15 May 2018 02:15:11 UTC
All snapshots | from host www.zdnet.com
Webpage Screenshot
share download .zip report error or abuse | short link long link markdown html code <a href="http://archive.today/IOzNb"> <img style="width:300px;height:200px;background-color:white" src="https://archive.fo/IOzNb/7c6fb6d43d2aa20b102933d6537844405ffdfd78/scr.png"><br> US cell carriers are selling access to your real-time phone location …<br> archived 15 May 2018 02:15:11 UTC </a> wiki code {{cite web | title = US cell carriers are selling access to your real-time phone location … | url = https://www.zdnet.com/article/us-cell-carriers-selling-access-to-real-time-location-data/ | date = 2018-05-15 | archiveurl = http://archive.today/IOzNb | archivedate = 2018-05-15 }}

This web site uses cookies to improve your experience. By viewing our content, you are accepting the use of cookies. To find out more and change your cookie settings, please view our cookie policy.

- 0

(Screenshot: ZDNet. Source: State of Georgia)
Four of the largest cell giants in the US are selling your real-time location data to a company that you've probably never heard about before.
In case you missed it, a senator last week sent a letter demanding the Federal Communications Commission (FCC) investigate why Securus, a prison technology company, can track any phone "within seconds" by using data obtained from the country's largest cell giants, including AT&T, Verizon, T-Mobile, and Sprint, through an intermediary, LocationSmart.

### privacy

Senator wants to know how police can locate any phone in seconds without a warrant
Real-time location data was accessible by police under "the legal equivalent of a pinky promise," said a senator.
Read More
The story blew up because a former police sheriff snooped on phone location data without a warrant, according The New York Times. The sheriff has pleaded not guilty to charges of unlawful surveillance.
Yet little is known about how LocationSmart obtained the real-time location data on millions of Americans, how the required consent from cell user owners was obtained, and who else has access to the data.
Kevin Bankston, director of New America's Open Technology Institute, explained in a phone call that the Electronic Communications Privacy Act only restricts telecom companies from disclosing data to the government. It doesn't restrict disclosure to other companies, who then may disclose that same data to the government.
He called that loophole "one of the biggest gaps in US privacy law."
"The issue doesn't appear to have been directly litigated before, but because of the way that the law only restricts disclosures by these types of companies to government, my fear is that they would argue that they can do a pass-through arrangement like this," he said.
LocationSmart, a California-based technology company, is one of a handful of so-called data aggregators. It claimed to have "direct connections" to cell carrier networks to obtain real-time cell phone location data from nearby cell towers. It's less accurate than using GPS, but cell tower data won't drain a phone battery and doesn't require a user to install an app. Verizon, one of many cell carriers that sells access to its vast amounts of customer location data, counts LocationSmart as a close partner.
The company boasts coverage of 95 percent of the country, thanks to its access to all the major US carriers, including US Cellular, Virgin, Boost, and MetroPCS, as well as Canadian carriers, like Bell, Rogers, and Telus.
"We utilize the same technology used to enable emergency assistance and this includes cell tower and cell sector location, assisted GPS and cell tower trilateration," said a case study on the company's website.
"With these location sources, we are able to locate virtually any US based mobile devices," the company claimed.
A person's precise location can be returned in as little as 15 seconds, according to another case study, and data is usually not cached for longer than two minutes.
Other companies then buy access to LocationSmart's data -- or the data is obtained by a customer of LocationSmart, like 3Cinteractive, which is said to have supplied location data to Securus.
But LocationSmart hasn't said how it ensures its corporate customers protect the location data to prevent abuse and misuse. A spokesperson for LocationSmart did not return an email with several questions sent prior to publication.
Companies buy into LocationSmart's location data for many reasons. Sometimes it's to help locate a nearby store, or to send a marketing text message when a person visits a rival store. Location data can even be used by companies to track deliveries or shipments, or by banks to fight fraud, such as if a person is making card transactions miles apart within just a few minutes of each other.
In any case, the company requires explicit consent from the user before their location data can be used, by sending a one-time text message or allowing a user to hit a button in an app.
LocationSmart also said it allows some customers to obtain "implied" consent, used on a case-by-case basis, when "the nature of the service implies that location will be used." The company said one example could be when a stranded motorist calls roadside assistance, and the event implies the person is "calling to be found."
The company even has its own "try-before-you-buy" page that lets you test the accuracy of its data. With a colleague's consent, we tracked his phone to within a city block of his actual location.
(Screenshot: ZDNet)
The data aggregator said it has access to carrier network location data "because privacy is built into its cloud-based platform."
While that may be true, the requirement to obtain a person's consent collapses if a search warrant for that data is issued. That's exactly how companies like Securus can reveal location data without asking a person's permission.
According to a Nebraska state government document, an application "can also be configured -- with carrier approval and appropriate warrant documentation -- to retrieve location data without the user opting-in." Securus was able to return real-time location data on users without their consent because the system required a valid order be submitted first.
However, as the The New York Times reported, Securus never verified orders before spitting back results.
We reached out to the four major US carriers prior to publication. We asked how each carrier obtains consent from customers to sell their data and what safeguards they put in place to prevent abuse.
Sprint spokesperson Lisa Belot said the company shares personally identifiable location data "only with customer consent or in response to a lawful request such as a validated court order from law enforcement."
The company's privacy policy, which governs customer consent, said third-parties may collect customers' personal data, "including location information."
Sprint said the company's relationship with Securus "does not include data sharing," and is limited "to supporting efforts to curb unlawful use of contraband cell phones in correctional facilities."
When asked the same questions, Verizon spokesperson Rich Young provided a boilerplate response regarding Securus and would not comment further.
"We're still trying to verify their activities, but if this company is, in fact, doing this with our customers' data, we will take steps to stop it," he said.
AT&T spokesperson Jim Greer said in a statement: "We have a best practices approach to handling our customers' data. We are aware of the letter and will provide a response." Our questions were also not answered.
A spokesperson for T-Mobile did not respond by our deadline.
"It's important for us to close off that potential loophole and that can easily be done with one line of legislative language," said Bankston, "which would also have the benefit of making every other company careful about always getting consent before disclosing your data to anyone."
Ron Wyden, a Democratic senator from Oregon, called on each carrier to stop sharing data with third parties. Wyden argued the sharing "skirts wireless carriers' legal obligation to be the sole conduit by which the government may conduct surveillance of Americans' phone records."
In a blog post, Electronic Frontier Foundation (EFF) said law enforcement may be violating the law by not seeking data directly from the phone carriers. "Law enforcement shouldn't have unfettered access to this data, whether they get it from Securus or directly from the phone companies," said the EFF.
Wyden has also called on the FCC to investigate the carriers for allegedly not obtaining user consent.
The FCC has not said yet if it will investigate.
Contact me securely
Zack Whittaker can be reached securely on Signal and WhatsApp at 646-755–8849, and his PGP fingerprint for email is: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.
Read More

### ZDNET INVESTIGATIONS

- Researchers say a breathalyzer has flaws, casting doubt on countless convictions
- Lawsuits threaten infosec research — just when we need it most
- NSA's Ragtime program targets Americans, leaked files show
- Leaked TSA documents reveal New York airport's wave of security lapses
- US government pushed tech firms to hand over source code
- Millions of Verizon customer records exposed in security lapse
- Meet the shadowy tech brokers that deliver your data to the NSA
- Inside the global terror watchlist that secretly shadows millions
- 198 million Americans hit by 'largest ever' voter records leak
- Britain has passed the 'most extreme surveillance law ever passed in a democracy'
- Microsoft says 'no known ransomware' runs on Windows 10 S — so we tried to hack it
- Leaked document reveals UK plans for wider internet surveillance

### Related Topics:

Security TV Data Management CXO Data Centers

- 0

LOG IN TO COMMENT

- My Profile
- Log Out

| Community Guidelines

### Join Discussion

Add Your Comment
Add Your Comment

## Related Stories

- Security
  Cyber crime: Under-reporting of attacks gives hackers a green light, say police
- Security
  Rail Europe had a three-month long credit card breach
- Security
  This malware is harvesting saved credentials in Chrome, Firefox browsers
- Security
  My Health Record opt-out period from July 16 to October 15, 2018

×

#### Thank You

## Please review our terms of service to complete your newsletter subscription.

By registering you become a member of the CBS Interactive family of sites and you have read and agree to the Terms of Use, Privacy Policy and Video Services Policy. You agree to receive updates, alerts and promotions from CBS and that CBS may share information about you with our marketing partners so that they may contact you by email or otherwise about their products or services. You will also receive a complimentary subscription to the ZDNet's Tech Update Today and ZDNet Announcement newsletters. You may unsubscribe from these newsletters at any time.

## Newsletters

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
See All
See All

## Related Stories

- Security
  WannaCry ransomware: Have the lessons been learned?
- Google
  Android security: Adware reappears on Google Play
- Security
  Symantec stock falls after internal investigation disclosure
- Security
  Apple cracks down on iOS apps that share location data without consent

Your Email*

I agree to the Terms of Use, Privacy Policy and Video Services Policy,. I understand I will receive a complimentary subscription to ZDNet's Tech Today newsletter, and the ZDNet Announce newsletter (you can opt out at any time).
Subscribe to our Security newsletter
Your Name*
First
Last
Your Email*
Email Address
Thank you for subscribing to ZDNet's Tech Today newsletter.
See all ZDNet newsletters.
Your Name*
First
Last
Your Email*
Email Address
Your Name*
First
Last
Your Email*
Email Address
Your Name*
First
Last
Your Email*
Email Address
Your Name*
First
Last
Your Email*
Email Address
x

0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%