How the U.S. Government Tracks Your Phone

0:05Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds both online and IRL. 404 Media is a journalist founded company and needs your support to subscribe. Go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I am your host, Joseph, and with me are 404 Media co-founders, Sam Cole. Hey. Emmanuel Mayberg. Hello. and Jason Kebler. Hello, hello. We will have a special guest in the second segment of the show as well.

0:49But first, we're going to talk about a story, but we haven't actually published it yet. It will be published basically the exact same time as this podcast goes up. And it's one I've written. It's a collaboration with some other journalists as well. And it's called Inside the US government-bought tool that can track phones at abortion clinics. Let me just paint sort of the scene. So imagine a computer screen and there's sort of a map interface and it shows the movements of smartphones all around the world. The person then using this tool zooms in to an abortion clinic in the south of the US, and it shows something like 700 tiny little red dots over that clinic.

1:41Each of these represent a phone, and I would argue by extension a person, right? There's obviously going to be an owner of that phone. This tool is called LocateX from a company called Babel Street. The user then narrows down to a particular phone in that data set, and what LocateX allows the person to do is follow that phone to and from the abortion clinic. So in this case, it started at a residence in Alabama in mid-June, it then went by a Lowe's home improvement store, it went along a highway, passed a gas station, stopped by a church, and then it crossed over into Florida, which is where the abortion clinic is.

2:29The phone, and presumably the person, stays there for a couple of hours, and then it heads back over into Alabama. So that's a long way of saying this tool has watched somebody leave Alabama, where abortion is illegal after the June 2022 overturning of Roe v. Wade, over to an abortion clinic in a neighboring state and they've gone back. We don't know, was that person seeking an abortion? Were they helping somebody get one? Were they, I don't know, a janitor who works there and happens to live in Alabama? I mean, obviously that seems less likely. But the reason we're talking about this is because some privacy advocates from a company called Atlas Privacy gained access to a free trial of this tool.

3:20They filmed themselves using it, doing the look up on the abortion clinic and other places as well. And then they provided those videos to me, slash 404 Media. Notus, which is a outlet where my friend and colleague Byron Tao, who's done a ton of stuff on location data practices, works as well. Krebs on security. Harats in Israel, and the New York Times has also seen the videos as well. Joseph, this is a pretty astounding story. I think it's something that you've reported on Babel Street and LocateX and cell phone location data a lot over the years. But I feel like this is not surprising necessarily because we know all of this stuff exists because of your previous reporting.

4:17But this is an example of what the tool actually looks like and how it works. So I guess what is the tool and who has bought it over the course of time? Like what entities have access to it? Yeah, and you're right. It's the first time we're seeing it. And that's why this one feels especially big. It was almost, not properly theoretical, but it was a little bit more abstract before. Now we have screenshots and we see what it is. So the tool, as I said, LocateX, and it tracks smartphone locations around the world or around the country. And it's been bought by a ton of different people. You can have the military side, and I reported the, I think it was Special Operations Command, bought access to LocateX back when I reported that in maybe 2018 when we were at Vice.

5:07You then have law enforcement agencies, Customs and Border Protection, Immigration and Customs Enforcement, a tech outlet called Protocol reported that way back when. I got a Secret Service contract that shows that as well. I've also reported that a drone sort of unit or base, a military unit that conducts drone strikes also bought access to the tool. And I think most importantly for this abortion story is that the Florida sort of prison system previously bought it as well. And that's important because, of course, that's a state agency, not a federal one. well i think those are the entities that we know have purchased it and then there is a sort of federal database that makes it a little bit easier to find out who has purchased something at a federal level whereas like at the state and local level you kind of have to just like guess um and file a bunch of public records requests and things like that so i mean this is speculative, of course.

6:18We don't know. But the fact that one state agency has bought it probably means they're not the only entity in the entire country that has access to it. So tell me more about how you did this reporting, who the privacy advocates were, and how they got access to it. You mentioned that it was a free trial. Do you know if there were any restrictions on that trial or sort of like what's the deal? I mean, I think that's one of the wild things about this story is that there didn't appear to be any restrictions on this free trial. So the people who got access, they're a company called Atlas Privacy. They're one of these many sort of data deletion companies.

7:06What I would say how Atlas is a little bit different is that they they're using a pretty interesting law, I think called Daniel's Law, in New Jersey. And that is supposed to protect the sort of address and the contact information of judges, police officers, prosecutors, those sorts of people. So Atlas is doing all of these lawsuits against data brokers to have that data removed if it hasn't been possible, all of that sort of thing. Sort of auxiliary to that, what Atlas does is they'll have internal or external investigators who will basically buy access to these data brokers, like anybody else, to verify whether the deletion request has actually been processed or not.

7:53And the way it was described to me was that they were buying or looking into a tool from Babel Street that would have just addresses of people in New Jersey as part of that work. And then a sales representative said, hey, we have this other tool called LocateX. Do you want to see that? We only offer it to people who are working with the government. And this investigator said, truthfully, I'll clarify as well, that, hey, I'm not working with the government right now, but I might in the future. and according to Atlas, the salesperson at Babel Street, that's fine. They don't really check anyway. Here's a free trial to locate X.

8:33And for something like a week, they were able to log in and just query essentially anything they wanted. So to do the abortion one, they drew a geofence, which is sort of just a polygon around a particular area. They drew that around the abortion clinic, saw those 700 red dots, and then selected one to follow. It was really that easy, you know, and maybe there are legal restrictions. It's hard to say. I haven't seen the full up-to-date sort of terms of service of Babel Street when it comes to a LocateX product and Babel Street hasn't responded to multiple requests for comment, but technically and practically speaking, we didn't see any restrictions.

9:15Yeah, I think just to sort of highlight why this is so important. I mean, one, you'll talk a little bit more about other locations they looked at, but you've done a lot of stories in the past just about how sensitive location data is, how it can be used to sort of like plot out someone's life and infer, you know, what they've been doing. And I think that this is so, I mean, it's so important, hopefully for obvious reasons, but also because specific states that have banned abortion since the end of Roe v. Wade have... There's politicians in those states that have proposed trying to criminalize traveling to other states for abortions.

10:01And they've tried to twist themselves into pretzels, figuring out how to legally do this. some of them have what are known as like abortion trafficking bills where it can be illegal or they they propose to make it illegal to drive a minor across state lines there have been like two cities in Texas tried to make it illegal to use city roads to travel to get an abortion somewhere else And it's just like this sort of information could theoretically be used to create a situation where you can't necessarily travel freely within the United States, which courts have ruled is like, I added this story, so did a lot of research while editing it to just sort of see what the current state of play is.

10:53there's like a constitutionally protected right to interstate travel, but there's also lots of legal theories for how you would try to restrict that theoretically. And there are various like lawmakers in multiple states that have tried to do this. And so it's really important, especially a few weeks before an election that where abortion is one of the most important issues um but they they also so they also did a bunch of other lookups uh and i think you sort of rightfully focused on abortion center um or like abortion clinic data for most of the story but this also applies to like literally any place not just in the u.s i believe like in the world right yeah i mean um and there's a way to demonstrate that as well apart from just zooming out on the map so atlas privacy they did mostly uh look at u.s locations one was um there was a mosque they looked up and then it showed all the phones that had been there they then zoomed out and they were able to see that oh well some went to other um other locations in the u.s some went to canada some then went to lebanon uh or iraq or jordan as well.

12:17So it shows that you could monitor one location and then see absolutely where else those people have appeared, sort of irrespective of where they are in the world. They also did basically the same thing to a synagogue as well. And then they also drilled down to specific people with their consent. So in the synagogue, in the mosque, in the abortion clinic, we don't know who those individual people are and i should have said this up top but let me clarify law enforcement absolutely could and it would be incredibly trivial for them to do it this tool does not require a warrant to use you literally log in and start clicking and you get the data um lawmakers lawmakers have tried to put more regulations and more friction here uh santa Ron Wyden had the Fourth Amendment is not for sale act that would have put protections against this sort of data and blocked its use without a warrant.

13:19That legislation, as far as I know, is dead. It got some early traction and then the current administration opposed it. But you can just log in and start doing whatever you want. So when it comes to, I don't know, any of the examples listed, or as you say, other locations, law enforcement could just follow where that phone goes and then they can see it at home or of course i mean they're the police they could then go to use any of their legal powers this is just basically a crazy powerful engine or tool for getting really really um powerful tips yeah um so what where like do we know how they're getting this data are we don't 100 know where babel street is getting it but it broadly comes from two sources at least that's how it's worked in location data industry uh that i and have that i and others have covered for a long time the first is ordinary apps installed on your smartphone uh so this could be a weather app a game uh i don't know a maps gps app or whatever it's those apps that sort of they request your location and you don't really know why they're asking for it.

14:39In many cases, location data is being harvested by those apps. It then goes into a very complicated business and ecosystem and eventually ends up in tools like this. You know, I've previously identified specific apps that relate to some of these tools and some of these programs and, you know, Google or Apple or whoever have taken action against those. The other one is a process called real-time bidding, which I won't go super in-depth into, but basically when an online ad is about to be placed in the background, there's like this near instantaneous bidding process going on where each company is trying to get their ad in front of you to target particular demographics.

15:28A side product of that is that you can just sit there and you can listen almost to this bidding process and exfiltrate data that way. And surveillance companies do that. And they siphon location information that way and then feed it into tools like this. That being said, again, we don't have full confirmation on how exactly Babel Street is getting its data. it previously got it from a company called Ventel, which did get it from apps, but we don't know 100 % if that's what's happening in 2024. Yeah, so in the article you write a little bit about MAIDs, which are the I believe it stands for Mobile Advertising Identification, which is I mean, it's not a MAC address for a phone, but it's basically like an identifier for your phone.

16:20And these are like nominally not uh it's like it's not you can't like look at it and say hey that's joseph but you could look at it and then compare it to other information and de-identify it is isn't that correct they have they have been de-anonymized like pretty regularly yeah yeah there's a few different things it's it's like it's the glue that the location data is stuck to in a way like rather than saying phone one went here it says phone one two three four a b c d went here and that's sort of the anonymous identifier that um the sort of tracks the location data and those maids are in locate x as well um and and crucially that is a direct product and consequence of the mobile advertising ecosystem.

17:17If I'm in the ads advertising business and I want to target ads at somebody, I may not be interested in who that specific person is, but I need to know that, that made 1234 is interested in sports and lives in New Mexico and goes to these various places and goes to these websites or whatever. That's in that context, advertisers or people in that industry aren't really bothered about who's behind the maid in a tool like this law enforcement customers might be and we've reported on this before back at motherboard but i actually posed as a customer to a company that advertised the ability to unmask maids you would give them a bunch of maids in return they would give you the name the phone number the address and the physical address of that um of the real person behind that made so i just think it completely shatters the idea that these are anonymous identifiers and this isn't actually in the article because i'm probably going to continue to cover it but when i spoke to google they said it was a pseudonymous identifier which is like huh i haven't heard google say that before because the general consensus is that it's anonymous and i just think that's i mean that's bullshit now yeah um It's possible to opt out of this ecosystem more or less on both Android and Apple somehow.

18:53I'm still not sure how. Yeah, and it was your suggestion, and I think we'll try to get to it. But maybe we do a short piece just telling people explicitly how to do it. But there are some links in the article as well. There are two things which people who care about this may wish to opt out of. The first is sharing their maid. On Apple, this is very easy. You go to the Ask Apps Not to Track feature and you turn it off. You can either do that globally or you can do it per app. And that's a very prominent pop-up on your iPhone or iOS device. For Google, you have to go into the settings. It's something like settings, privacy, ads, and then you have to delete or change the made it is buried compared to the Apple settings so that's how you deal with the made stuff and that will stop advertising companies and then potentially companies like Babel Street getting that unique identifier of course the other part is location data itself and I think people be familiar with this where an app requests location data and you tell it no and if you're not able to you just don't install the app and you can opt out of that sort of thing in your settings as well so So it's the made and it's the location data that you may, those settings you may want to change on your own device if this is something that concerns you.

20:14I want to go back to something that I just remembered as we were talking about this, which is, well, one, you wrote about sort of like heat map type data to Planned Parenthood being sold through data brokers, which you can talk about in a second. But Sam has also written about period tracking data that was available in the immediate aftermath of the end of Roe v. Wade. And I think this is just another part of a surveillance system that is designed to track people who are seeking abortions. Sam, can you tell us a little bit about that earlier reporting that you did? Yeah, I was just thinking about this because just talking about like things you can do to protect yourself from this kind of tracking.

21:04And it just seems like that the window of things that you can do to protect yourself from being tracked in this specific way is narrower and narrower. And it's like the powers that be, especially Republicans in power, are trying very hard to make it that way increasingly. amazingly um so yeah i mean the the story that i did in it was in 2022 um and that was right after the fall of row um it was just hitting up a bunch of different period trackers and saying hey do you give uh your user data to um how basically i asked how they how they plan to protect user data and how they want to handle law enforcement requests because it seemed like those were going to start happening more.

21:53Law enforcement was going to try to track people's period data to determine whether they were getting abortions, which is just so fucked. And every single one that I emailed and called, I don't know, it was like a half a dozen, maybe eight or nine, but only one of them out of all of them was like, we would rather burn our own company to the ground than give our user data to the cops, which I was like, hell yeah. um but yeah it's just i mean this is something that's like it's it keeps coming up it's i start to kind of feel like okay there is like nothing left to do at some point to try to protect yourself from this kind of tracking other than just like throw all of your devices away which in my like most um i don't know like depressed moments about technology that's kind of how i feel i know you guys probably share that um i was just reading just speaking of tracking i was reading um the other day uh this report about how a handful of republican attorneys general uh in a couple states are trying to restrict abortion drug access through the mail which is a revival of a constant comstock act um clause because mailing like quote-unquote obscene things was uh part of that act and that act is not fully repealed which is fun and that's kind of what we're facing i mean that's that's what we're that's what you know especially like jd vance has talked a lot about this about how he wants to restrict um access in this way to abortion and also to ivf and to fertility treatment so yeah i don't know it's like this is this story seems so timely and so it's not theoretical.

23:41It's so real and horrifying. I mean, I just, I don't know. It's like, it's scary for everyone to be tracked in this way, but because this is what's on the table, I think it's how things shake out and over, I think is going to be really interesting and possibly terrifying to see how these kind of trackers get used by the government who's very interested in buying them, obviously. Yeah. And I mean, I think that was at least my main purpose of the piece, which is, as we've said, I focused on abortion because that is a massive issue for people at the moment. It's concrete, it's tangible, people can understand it, people care about it.

24:25But as I said, there's also the mosque in there, there's a synagogue as well. And the point is that even if you, for whatever reason, don't personally care about it right now, this tool exists and the political context around it can shift on a, it can absolutely flip on a dime, you know? And I think that's what we're seeing and why we wanted to publish this specifically. I do recommend that people go, obviously read the full article. It's like 3 ,500 words. It's a long one. And I know we publish a lot of long articles, but this took me a while. So there's that, but there's also images in there of the actual tool itself.

25:04And I think people would be very, very interested in seeing, hey, this is what a tool the US government and other governments, I believe, have bought access to actually looks like. And I think that's pretty interesting. All right. We will leave that there. When we come back, we have a very special guest. We will be right back after this.

25:35This episode is sponsored by Shopify. We've taken a DIY approach to everything we do at 404 Media, which means I didn't want to do dropship merch and I wanted to handle everything ourselves. But I didn't really know how to set up an online shop. Then I found Shopify. Shopify makes the whole process super easy. Shopify has made it really simple for me to manage our listings and our inventory, sell online or in person, print shipping labels, process returns, and get paid. And newsflash, I just added something new to our shop. Socks. Go check them out. Shopify also lets you customize your front end for consumers, letting you show your products in all their glory and a simple backend that helps you manage your business no sweat.

26:22It's a one-stop solution that gives us everything we need to manage our online store. Upgrade your business and get the same checkout we use with Shopify. Sign up for your$1 a month trial period at shopify.com slash media, all lowercase. Go to shopify.com slash media to upgrade your selling today. Shopify.com slash media. I love a great deal as much as the next guy, but I'm not going to crawl through a bed of hot coals just to save a few bucks. It has to be easy. No hoops, no BS. So when Mint Mobile said it was easy to get wireless for$15 a month with the purchase of a three-month plan, I called him on it.

27:07Turns out it really is that easy to get wireless for just$15 a month. The longest part of the process is just the time you need to spend breaking up with your old provider. Mint Mobile's plans make it super easy to keep your phone number and your device, buy the plan, and activate your new unlimited phone plan. To get started, go to mintmobile.com slash 404media. There, you'll see that right now, all three-month plans are only $15 a month, including the unlimited plan. All plans come with high-speed data and unlimited talk and text delivered on the nation's largest 5G network. You can use your own phone with any Mint Mobile plan and bring your phone number along with all your existing contacts.

27:48Find out how easy it is to switch to Mint Mobile and get three months of premium wireless service for$15 a month. To get this new customer offer and your new three-month premium wireless plan for just$15 a month, go to mintmobile.com slash 404media. That's mintmobile.com slash 404media. Cut your wireless bill to$15 a month at mintmobile.com slash 404media. $45 upfront payment required, equivalent to$15 a month. New customers on first three-month plan only. Speed slower above 40 gigabytes on unlimited plan. Additional taxes, fees, and restrictions apply. See Mint Mobile for details. In today's world, data breaches happen all the time.

28:33And even the most secure companies can't always protect their employees' personal information from ending up in the wrong hands. That's where Delete Me comes in. Delete Me is a service that removes your employees' sensitive information from hundreds of data broker websites, sites where hackers can find phone numbers and emails within seconds. Rachel Toback, CEO of Social Proof Security, says attackers use this data to target employees with phishing messages and AI-powered phone scams. But Delete Me makes it harder for these bad actors by scrubbing your employees' details regularly. It's simple.

29:10Attackers are lazy. If it's too hard to find contact info, they'll move on to easier targets. Delete Me takes care of this for you, doing the heavy lifting so you don't have to. And over time, they keep removing the information so it stays down, protecting your team from constant exposure. If your business has a social presence or deals with clients, you need Delete Me. Visit deleteme.com slash 404media and start safeguarding your team's information today. That's deleteme.com slash 404media.

29:52All right, and we are back and we have a very special guest. Becky, hi. Do you want to introduce yourself briefly? Sure. Hey, I'm Becky Ferreira. I'm a science reporter and worked with all you lovely folks for years at Motherboard. And now I'm contributing to 404, which I'm very excited about. Yeah, you've been writing the abstract, which is a column that we email out every Saturday. You've done an amazing job with that. It is very pleasant to not be publishing horrible news all the time, which is basically what we do, unfortunately. um but emmanuel you've been editing becky i think more than anybody um how have you been finding it uh an absolute joy as it always has been a joy here and then also a joy for many years at vice where we all worked and i thought we could start out um for our audience but also from my own curiosity because despite working with becky for many years and admiring her work I don't actually know the Becky origin story.

31:04And I was wondering if you could tell us how you got on this, like, very in the weeds science beat. Yeah, absolutely. I've always really been interested in science and, you know, really loved like Carl Sagan's work and stuff like that from being a kid and a teenager and got into a lot of reading science fiction and stuff like that. And then I wanted to do science in college, but like differential calculus was I just I hated it. So I ended up just getting going a lot more into the journalism and writing direction and realizing that it would be really fun to actually just be this person who could parachute into different fields of science and kind of vicariously experience them without having to do massive amounts of data entry or calculus or anything like that.

32:00so um and then it was i really think though um uh i was kind of doing any kind of reporting for a while there uh you know 15 years back when i first started writing and it was really motherboard that was like the proving ground for starting uh reporting in science i think i started there only a couple years after the site was founded and um just it was such a great team obviously over the years we published so much stuff and that was really where I felt like I could get a voice where it was um I could I could express like the enthusiasm and have a little bit more of voice-driven character fun work uh that was like meant to draw people in a little bit more about these these interesting scientific topics so that's sort of where I came from yeah ultimately so many of us are in this field because we couldn't do the hard math so i definitely relate to you on that um and also i mean something that anyone who'll read the the column will notice that anyone who um read your work at motherboard will know it's like always a great sense of humor which i appreciate because the studies are very interesting um but are very dry um so that always I think humanizes and makes them relatable.

33:22But that kind of steps on what I want you to talk about next, which is what is generally your approach to the abstract? How would you describe it? What do you think we're trying to accomplish with this column? So I'm definitely still working it out. And I have to say, it is a dream gig. It's exactly the kind of stuff that I haven't really been able to do over the last year, getting into the weekly news, well, the weekly research studies, really. And so what I really, you know, when we talked about it right at the beginning, I think a lot of these studies get, you know, put into the PR press release kind of version of things.

34:01And the kind of magic of what's in the actual study gets lost a bit. And I really want to be every quote that's in the abstract is from the original study. And I really wanted to find the kind of most plain language parts of the studies. that are, you know, uh, often quite lyrical, often quite exciting. Sometimes even the ones that are like require a little bit of explanation, the still, the, the, the phrases that come out are really like special. And you, you don't often get that coming through from a press release because they're just so focused on kind of getting the general audience summary out.

34:40So I, I, I'm really trying to um show how scientists talk to each other and show and encourage i think people to actually look at the original studies even if they you know you're not going to read through all of you know when it gets into their percentages and whatever but just to just to see how these studies look um and the the components of them and the the depth of research that goes into each one um and i think also you know this has been a a great opportunity to do something i've wanted to do for years which is just like bring together all of these kind of niche studies and and make a giant feed which i'm still building for this project which is like the most fun thing i'm doing right now but just like trying to get a mix of the big mainline studies that you'll probably see in any science site each week but also have a couple that are not going to be covered anywhere that are from much smaller journals about much more niche topics.

35:44And I wish I could include all of them. It's very hard to winnow down the list each week. But so far, that's sort of what I'm focusing on. But it's been really, really exciting to be able to do it for sure. Becky, you just mentioned something really important, I think, which is that the press release dynamic. I think that's something useful for our listeners to know is that, you know, many press releases are good, but often press releases that are put out by the universities where the science is done, like often they get things wrong or they sensationalize things. And then it becomes the narrative in the media is something that the original paper, like never said.