U.S. law enforcement agencies, from a southern California suburb to rural North Carolina, have used a little-known tool to track cellphones, sometimes without a warrant, that allows them to follow a person’s movements over the previous months, according to public records and internal emails accessed by The Associated Press.
Police have used “Fog Reveal” to search hundreds of billions of records from 250 million mobile devices, and used the data to create analyzes of movements known among law enforcement as “patterns of life,” according to thousands of pages. company records.
Fog Reveal, sold by Virginia firm Fog Data Science LLC, has been used since at least 2018 in criminal investigations ranging from the murder of a nurse in Arkansas to tracking the movements of possible participants in the Jan. 6 insurrection on Capitol Hill. . The tool is rarely mentioned in court records, something defense attorneys say makes it harder for them to defend their clients in cases where the technology was used.
The company was developed by two former high-level Department of Homeland Security officials under former President George W. Bush. It collects advertising identification numbers, which Fog officials say are taken from popular apps like Waze, Starbucks and hundreds of other services that tailor advertising based on a person’s movements and interests, according to emails from police. That information is then sold to companies like Fog.
“It’s like an affordable mass surveillance program,” said Bennett Cyphers, a special adviser to the Electronic Frontier Foundation, an activist group that advocates for digital privacy rights.
This report, with assistance from the Pulitzer Center for Crisis Journalism, is part of an Associated Press series investigating the power and consequences of algorithmic decisions in people’s daily lives.
EFF had access to the documents and emails through petitions protected by the Law of Transparency and Access to Public Information. The group shared the documents with the AP, which independently verified that Fog sold its software in about 40 contracts to nearly two dozen agencies, according to GovSpend, a company that tracks government spending.
The AP files and investigation provide the first public account of the extensive use of Fog Reveal by local law enforcement, according to analysts and legal experts who study the technologies.
“Local law enforcement is on the front lines of human trafficking and missing persons cases, but those departments are often lagging behind in technology adoption,” Matthew Broderick, managing partner at Fog, said in an email. “We fill a gap for departments that are understaffed and underfunded.”
Due to the secrecy surrounding Fog, however, there are few details about its use and most security agencies do not comment on it, fueling concerns among privacy activists that it violates the Constitution’s Fourth Amendment. which protects against unwarranted searches and seizures.
What sets Fog Reveal apart from other cell phone tracking technologies used by law enforcement is that it tracks devices via their advertising identifier, unique numbers assigned to each device. These numbers do not contain the name of the device’s user, but can be traced back to homes and workplaces to help police draw analysis of a person’s vital patterns.
“The ability he had to find anyone in an area, whether in public or at home, seemed to me to be a very clear violation of the Fourth Amendment,” said Davin Hall, a former crime data analysis supervisor for Greensboro police, North Carolina. “I feel angry and betrayed and cheated.”
Hall resigned in late 2020 after expressing concern for months to police lawyers and the city council about Fog’s employment with the police department.
Although Greensboro authorities admitted to using Fog and initially defended it, police said it had not renewed its subscription this year because it was not “independently benefiting investigations.”
But federal, state and local law enforcement agencies across the United States continue to use Fog with little public oversight. The local police are attracted by the affordable price of the service: it can be contracted from 7,500 dollars a year. And some departments that hire him have shared their access with other nearby agencies, according to the emails.
Law enforcement agencies also like how quickly they can access detailed geographic information with Fog. Geofence warrants, which track a device from GPS data and other information sources, work with data from firms like Google or Apple. This requires police to obtain a warrant and ask tech companies for the specific data they want, which can take days or weeks.
Using Fog’s data, which the company says is anonymous, police can track an entire area or search by identifiers for a specific device, depending on the terms of use accessed by AP. However, Fog claims that “we have no way of associating the signals to a specific device or owner,” according to a business representative who wrote to the California Highway Patrol in 2018 after a lieutenant asked if the tool could be used safely. legal.
Despite those promises of privacy, the documents show that authorities can use Fog’s data as a lead to find information that identifies a person. “There is no (personal information) associated with the (advertising identifier),” a Missouri official wrote about Fog in 2019. “But if we’re good at our jobs, we should be able to determine the owner.”
Federal oversight of companies like Fog is a changing legal environment. The Federal Trade Commission on Monday sued a data broker called Kochava that, like Fog, offers its customers advertising identifiers that authorities say can be easily used to determine where a mobile device user lives, violating regulations. of the Commission. And there are bills in Congress that, if approved, would regulate the sector.
Fog’s Broderick said in an email that the company doesn’t have access to people’s personal information and leverages “commercially available data with no restrictions on use” from data brokers “who legitimately acquire data from apps in accordance with with its legal terms. The company declined to share information about how many law enforcement agencies it works with.
“We trust that the Security Forces have the responsible leadership, limitations and political guidelines at the municipal, state and federal levels to ensure that any police tool or method is used in accordance with the laws in their respective jurisdictions,” Broderick said.