Earlier this year, a cross-team group of EFF technologists, researchers, activists, and lawyers broke the story of Fog Data Science, a secretive data broker that sells cops access to huge quantities of people's precise location data. The data they use is harvested from our phone apps, sent to data brokers, and sold to the highest bidder – including, we learned, to state and local law enforcement. This violates the Fourth Amendment. While federal agencies have been notorious in recent years for their purchase of such data, our reporting seems to be the first showing a company selling it to state and local police. In addition to our several deep-dives into Fog and its product, we collaborated with Associated Press on a major article which led to further reporting from dozens of other press outlets, criticism from members of Congress, and calls by others for the FTC to investigate.
Perhaps most entertainingly, an Arkansas state prosecutor and former Fog Data Science trainer told the Associated Press that objectors to this location surveillance are part of a “cult of privacy.” We responded with a Slate article titled: “If caring about your digital privacy makes me a cult member, sign me up.”
These revelations were the result of more than a year of work. EFF spent months meticulously picking apart thousands of documents from public records requests, slowly building up Fog's connections to dozens of police agencies and other data brokers. These documents were the product of public records requests to scores of local, state, and federal law enforcement agencies across the country. We also carefully researched and reverse engineered Fog's public-facing product in order to document how we believe it works, and uncovered several worrying and previously undocumented features in their code.
The result of this work has been promising. After we revealed the problem, Rep. Anna Eshoo urged the FTC to investigate Fog and “work to ensure that surveillance advertising becomes a prohibited business practice.” Last month, EFF filed comments with the FTC also urging such an investigation. We explained that Fog “is mass surveillance, often with no judicial oversight, and flies in the face of Fourth Amendment protections against unreasonable search and seizure.”
Although Fog’s sale of location data to state and local law enforcement is new, this shady business practice of commodifying our data is not. Fog is merely repackaging data gathered and sold by other data brokers, who themselves often buy and rebundle the data from other brokers. As we documented earlier this year, this toxic marketplace of people’s phone data has been a goldmine for U.S. federal agencies, such as the IRS, the DHS and its subsidiaries ICE and CBP, the DEA, and the FBI. The data is available for purchase by the general public too: recently, some dubious researchers reportedly bought "10 trillion" geolocation data points from over 500,000 people's phones for the bogus documentary 2000 Mules. Clearly, the problem of location data brokers runs deeper than just Fog Data Science.
There’s a highly effective way to prevent your phone’s data from ending up in the data broker pipeline: disable Ad ID tracking on your phone. You can also urge your legislators to ban police from purchasing phone app location data.
