{"id":19390,"date":"2026-11-09T11:01:17","date_gmt":"2026-11-09T18:01:17","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=19390"},"modified":"2026-11-09T11:01:17","modified_gmt":"2026-11-09T18:01:17","slug":"inside-the-leaky-plumbing-of-commercial-surveillance","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2026\/11\/09\/inside-the-leaky-plumbing-of-commercial-surveillance\/","title":{"rendered":"Inside the Leaky Plumbing of Commercial Surveillance"},"content":{"rendered":"\n

(Headline article below) There are a couple new tidbits, but most is already known. And blocking ads is a security feature these days as they can feed you malware as well as the bidding process reveal, and just look at how they abuse it. At home run your own Pi-Hole<\/a>\/Unbound<\/a> DNS servers with ad, telemetry and malware blocking<\/a> protecting every device on your home network, and\/or use a VPN with the same features that can be enabled in the application for their DNS servers like Mullvad VPN. <\/p>\n\n\n\n

\"\"<\/a>
Mullvad Linux Client<\/figcaption><\/figure>\n\n\n\n
\"\"
Pi-Hole\/Unbound main server status page<\/figcaption><\/figure>\n\n\n\n

https:\/\/reclaimthenet.org\/inside-the-leaky-plumbing-of-commercial-surveillance<\/a><\/p>\n\n\n

<\/div><\/div><\/div>\n\n\n
The data broker economy turns ordinary errands into evidence, then sells the map.<\/h5>\n\n\n\n
\"A<\/figure>\n\n\n\n

By Ken Macon<\/p>\n\n\n\n

Ordinary ad tech builds a minute-by-minute record of where your phone goes, and it’s for sale. Here’s how to get off the map, and what you can’t undo.<\/p>\n\n\n\n

In sales pitches to law enforcement around the world, Penlink has shown how its product, Webloc, can be used for \u201ctracking people as they walked down Fifth Avenue in New York City, visited the European Central Bank in Frankfurt, and moved close to the UK Parliament in central London.\u201d<\/p>\n\n\n\n

What these demonstrations showed is ordinary people on an ordinary street – but the dots on the map that represent them are anything but ordinary. They are precise and timestamped, and can be searched for.<\/p>\n\n\n\n

\"Cobwebs
Webloc example.<\/figcaption><\/figure>\n\n\n\n

The question is, could your phone be one of those dots? If you live in the US, no judge is involved.<\/p>\n\n\n\n

In the US, it \u201ccan be used without the need for any kind of search warrant or judicial authorization.\u201d Officers can \u201czero in on a map and look at all phones that were present at a specific place and time,\u201d analyzing \u201cbillions of location data points,\u201d according to company documents.<\/p>\n\n\n\n

The data is collected from apps on phones \u2013 \u201ccommonly used weather, gaming, email and religious apps,\u201d as Bloomberg recently wrote<\/a>.<\/p>\n\n\n\n

The data can be updated hourly, and show where a phone has been \u201cover the past 12 months.\u201d<\/p>\n\n\n\n

In one of the sales presentations, Penlink said that Webloc can track \u201chundreds of millions of mobile phones across the world.\u201d<\/p>\n\n\n\n

The ACLU\u2019s Nathan Freed Wessler calls it a \u201cridiculous expansion of these tools\u201d that raises \u201ctremendous concerns.\u201d He said, \u201cIt means that people are going to be investigated who the government has no business investigating.\u201d<\/p>\n\n\n\n

Even though the tool is powerful, it\u2019s becoming more and more available to more and more law enforcement agencies. Citizen Lab researcher Wolfie Christl said, \u201cThis is a powerful mass surveillance tool that\u2019s trickling down from military and intelligence agencies to federal law enforcement and then to state and local police.\u201d<\/p>\n\n\n\n

Cobwebs, a company founded in 2015 by three veterans of Israeli special forces, developed the Webloc tool for counterterrorism, and it is now in the hands of police and government agencies in several countries, including the US, UK, Saudi Arabia, and others, according.<\/p>\n\n\n\n

Cobwebs was merged in 2023 with Penlink, a US company that has been around since 1986 and has a long history of providing law enforcement with tools to analyze wiretapped communications.<\/p>\n\n\n\n

The report is based on Penlink\u2019s internal documents and people familiar with Webloc\u2019s development, and it details how the tool uses data harvested from apps on people\u2019s phones, often those that track location for advertising purposes, and sells it to law enforcement, who in the US can access it without a warrant.<\/p>\n\n\n\n

Webloc is an add-on to Penlink\u2019s Tangles, a tool to monitor social media, and licenses to use it start at $100,000 a year. Data is collected from apps that are on millions of phones, and the tool can show where a phone has been over the past year, updated hourly.<\/p>\n\n\n\n

Documents show that among the US customers are Immigration and Customs Enforcement (ICE), at least two branches of the US military, and over a dozen police departments, while abroad, the UK, Saudi Arabia, the UAE, Singapore, the Netherlands, Germany, Austria, and Hungary are named as countries whose law enforcement agencies are buying Webloc.<\/p>\n\n\n\n

ICE has spent $9 million on four contracts that included Webloc licenses between 2022 and 2026, and although the Tucson police department in Arizona used it to track down a thief, it let its license expire.<\/p>\n\n\n\n

Penlink is not confirming any of its customers or commenting on them. But Sean White, a partner at the company\u2019s owner, Spire Capital, said that the right of US law enforcement to buy access to commercially available data is \u201cstill an open question.\u201d<\/p>\n\n\n\n

The tool is demonstrated to police as a means to track and identify protesters and to follow members of motorcycle gangs.<\/p>\n\n\n\n

The first \u201cpipe\u201d that lets your phone\u2019s location be turned into a searchable record that law enforcement can buy without a warrant is the software development kit (SDK).<\/p>\n\n\n\n

It is embedded in many apps, and although those who develop and use them may not be aware of this, the SDKs can collect and share a vast amount of personal data.<\/p>\n\n\n\n

According to the University of Toronto\u2019s Citizen Lab<\/u><\/a>, these are third-party tracking software that are \u201cembedded in mobile apps\u201d and \u201ccan potentially access all data that the mobile app they are embedded into can access.\u201d<\/p>\n\n\n\n

To bypass phone OS restrictions, Citizen Lab continues, \u201cdata collection efforts focus on apps that require access to location data such as weather, navigation, fitness, and dating apps.\u201d<\/p>\n\n\n\n

It was the Bloomberg report that named some of the apps from which the Webloc system gathered the data: Accuweather, Muslim Pro, and Multi Maze 3D.<\/p>\n\n\n\n

The three app makers denied any relationship with Penlink, the company behind Webloc. Accuweather said it has \u201cabsolutely no relationship, commercial or otherwise, with Penlink,\u201d while Bitsmedia, which owns Muslim Pro, said it was \u201cunaware of any arrangement between Penlink and any third-party technology provider involving location data originating from Muslim Pro.\u201d<\/p>\n\n\n\n

Penlink responded by saying that its \u201cdata partners provide data from their own SDK relationships and represent that they obtain consent through their app partners; they do not provide Penlink with a comprehensive list of those app partners.\u201d<\/p>\n\n\n\n

So even if the app makers are telling the truth – and they probably are – the tracker embedded in their apps doesn\u2019t answer to them, and nobody is willing to name the next link in the chain.<\/p>\n\n\n\n

Some of Webloc\u2019s data was sourced from the Israeli company Start.io, which embeds its SDK in apps and pays the developers for doing so. Start.io is present in over 500,000 apps and markets \u201ca 360-degree view of consumers.\u201d<\/p>\n\n\n\n

\"\"
Start.io helps to power many widely-used apps.<\/figcaption><\/figure>\n\n\n\n

Exodus, a platform that audits Android apps, found Start.io\u2019s tracker in more than 4,400 apps. Penlink denied buying data from Start.io, but admitted that Cobwebs, the company it merged with in 2023, ran a \u201ctrial\u201d using Start.io data.<\/p>\n\n\n\n

Bloomberg noted that even app developers \u201cmay not know\u201d that the trackers they use for advertising purposes ultimately sell location data to companies like Penlink.<\/p>\n\n\n\n

Even if they did, it would be beside the point, because the SDKs \u201cpiggyback on whatever permissions the app already has, particularly location, and quietly siphon data back to the aggregator,\u201d as we reported in April<\/u><\/a>.<\/p>\n\n\n\n

Meanwhile, Thorsten Wetzling of the Berlin-based think tank Interface told Bloomberg, \u201cI\u2019ve yet to come across anyone who has explicitly consented to these private companies handing over data for surveillance purposes.\u201d<\/p>\n\n\n\n

The second pipe that feeds the vast surveillance state is ad auctions, and it is here that the industry\u2019s plumbing gets particularly leaky.<\/p>\n\n\n\n

The killer detail is that every bidder – not just the winner – gets to see the data, and all can store it regardless of whether or not they end up buying the ad space.<\/p>\n\n\n\n

Citizen Lab also said that the data is broadcast without any security and that surveillance vendors either buy it from brokers or participate in the auctions to get it.<\/p>\n\n\n\n

The Electronic Frontier Foundation (EFF) has also explained that real-time bidding (RTB), as this process is known, is inherently leaky: \u201ca key vulnerability of real-time bidding is that while only one advertiser wins the auction, all participants receive the data.\u201d<\/p>\n\n\n\n

While location data is particularly sensitive, the bid request that is sent out to bidders contains a lot of other personal data, including \u201cyour unique advertising ID, location, IP address, device details, interests, and demographic information.\u201d<\/p>\n\n\n\n

The EFF said that the US Federal Trade Commission (FTC) found one broker, Mobilewalla, to be in possession of data on over a billion people, and that about 60 percent of it came from RTB auctions where it did not even bother to place an ad.<\/p>\n\n\n\n

A US Customs and Border Protection (CBP) document we reported on in March<\/u><\/a> contained the following note: \u201cRTB-sourced location data is recorded when an advertisement is served.\u201d<\/p>\n\n\n\n

It\u2019s not only the number of people who are tracked this way that is mind-boggling – the Irish Council for Civil Liberties (ICCL) says the industry broadcasts information about us \u201chundreds of billions of times, every day.\u201d<\/p>\n\n\n\n

As for Webloc, Citizen Lab found that its data likely came from SDK sources in 2021, because its documents from that year show Wi-Fi data, which is not available to those who source it from RTB.<\/p>\n\n\n\n

So, here is your file. You, as in, the data that is being collected, stored, analyzed, and sold, and in the end, used to build a pretty accurate picture of your life, your habits, your interests, your relationships – and your identity.<\/p>\n\n\n\n

Citizen Lab was able to see some of the data held by Webloc thanks to three government documents: one from El Salvador, one from Vietnam, and one from the US Navy.<\/p>\n\n\n\n

The documents show that Webloc holds personal identifiers, location data, inferred data such as home and work location, as well as \u201cmost visited locations,\u201d device data, personal characteristics, and behavioral profiles.<\/p>\n\n\n\n

Other data that\u2019s collected includes GPS coordinates, Wi-Fi location, and the precision of that data. The system also collects \u201cdevice model, manufacturer, type, operating system,\u201d as well as \u201cage, gender, locale\/language, parent (y\/n), traveller (y\/n), gamer (y\/n).\u201d<\/p>\n\n\n\n

Then there\u2019s the \u201clist of mobile apps used, including the period of time each app was seen on the device.\u201d<\/p>\n\n\n\n

\"Irish
How data is captured on every visitor.<\/figcaption><\/figure>\n\n\n\n

The behavioral profile segment is where things get particularly sensitive, as it can contain inferences about a person\u2019s health, sexual orientation, or financial situation.<\/p>\n\n\n\n

Citizen Lab was able to see a profile of a man in Abu Dhabi, whose phone sent 81 GPS coordinates over the course of five days, while Wi-Fi signals also located him 110 times. The phone was also identified as having 141 apps installed.<\/p>\n\n\n\n

Another example is that of a man in Hungary, aged 18-24, who used a Samsung Galaxy S8, was a regular commuter, and was interested in basketball and luxury goods.<\/p>\n\n\n\n

Penlink claims that it only holds location data tied to device IDs, but Citizen Lab says it \u201ccannot verify this claim.\u201d The same report said that the categories used to segment people for advertising purposes can reveal \u201cemployment, political views, religion and sexual orientation to pregnancy, health issues or personal debt.\u201d<\/p>\n\n\n\n

The US Federal Trade Commission (FTC) is quoted as saying that advertising IDs \u201coffer no anonymity in the marketplace.\u201d<\/p>\n\n\n\n

\u201cMany parties can easily retrieve the name, email address and phone number associated with an advertising ID, and vice versa,\u201d said Citizen Lab.<\/p>\n\n\n\n

It\u2019s not like a person\u2019s name is needed to build an accurate, and very revealing, picture of their life. The device that is always at a given location during the day is likely to be its user\u2019s workplace.<\/p>\n\n\n\n

Citizen Lab says that if an individual\u2019s phone is identified as having visited a place of worship, it can reveal their religion, while frequent visits to a hospital can indicate a person\u2019s health issues.<\/p>\n\n\n\n

Penlink, the maker of Webloc, promises that its data providers \u201cobtain user consent for location data sharing and filter out sensitive locations,\u201d naming hospitals, schools and places of worship.<\/p>\n\n\n\n

The US Navy, meanwhile, said in one document that Webloc can be used to \u201cfind and establish relevant and meaningful relationships and connections to individual\u2019s virtual and physical patterns of life.\u201d<\/p>\n\n\n\n

The data is not always precise \u2013 but it doesn\u2019t have to be, Citizen Lab is saying. \u201cFor targeted surveillance, however, it does not matter whether 90% of the data is flawed, as long as the target\u2019s device identifier is in the set,\u201d the report reads.<\/p>\n\n\n\n

Citizen Lab found that the Tucson police used Webloc to find the apartment address and workplace of a suspect \u2013 and of his romantic partner.<\/p>\n\n\n\n

The first step in reclaiming your privacy from the dragnet-style data harvesting that feeds the location tracking industry is to know what is happening on your phone.<\/p>\n\n\n\n

Apple users can turn to the App Privacy Report<\/u><\/a> introduced with iOS 15.2, which, once turned on, shows the data each app has accessed, its network activity, and the web domains that all apps contact most frequently. The data is stored encrypted on the device.<\/p>\n\n\n\n

On Android, the Exodus website<\/u><\/a> analyzes apps for embedded trackers, and the report will show what trackers are embedded into the application.<\/p>\n\n\n\n

These tools are not the same as the permission screens you see when you install an app. Those will tell you what the app may touch on your phone \u2013 but not who it talks to. To find that out, look at the domain list and the tracker list.<\/p>\n\n\n\n

If you are concerned about location data, one simple step is to get rid of third-party weather apps, since your phone\u2019s built-in one will do the job. And while you\u2019re at it, delete any free torch or free game apps.<\/p>\n\n\n\n

To remove your location history from the clutches of data brokers, first you have to remove it from your device, and then from the brokers\u2019 servers.<\/p>\n\n\n\n

The identifier that ad tech uses to turn your every move into a record that can be searched and bought is the ad ID, which is stored on your phone and can be read by apps. So, to get off this particular tracking and data collection \u201cmap,\u201d the first step is to get rid of the identifier.<\/p>\n\n\n\n

On an Android phone, the process is a little more complicated because of the order in which you have to do things. First, you have to go to Settings, find Privacy, and then Ads, and copy your ad ID<\/u><\/a> because you will need it in the next step. If you delete it first, the phone will show a string of zeros and the deletion request that follows will not work. So, copy the ID, then delete it.<\/p>\n\n\n\n

On an iPhone, go to Settings, then Privacy & Security, then Tracking, and switch off \u201cAllow Apps to Request to Track.\u201d This will stop the apps from accessing the system advertising identifier (IDFA).<\/p>\n\n\n\n

Next, go to Location Services and set it to \u201cNever\u201d for each app that does not need it. Additionally, you can turn off \u201cPrecise Location\u201d<\/u><\/a> to share only your approximate location, which is often \u201csufficient for an app that doesn\u2019t need your exact location.\u201d<\/p>\n\n\n\n

Google has a similar setting for apps\u2019 precise location permission that can be managed on Android 12 and later versions.<\/p>\n\n\n\n

Even after you restrict location permissions, there are still a number of ways it can find out where you are, and then sell that information to third parties, who can then buy it, without the need to obtain a warrant.<\/p>\n\n\n\n

One of the ways this can happen is by accessing the name of your router, as well as the names of the routers you connect to when you\u2019re away from home. This information can reveal your last name, your workplace, and the places you visit. This is one of the many disturbing findings of a new report by Canada\u2019s Citizen Lab.<\/p>\n\n\n\n

You can minimize the damage by changing the name of your router to something that doesn\u2019t identify you, and adding \u201c_nomap\u201d to the end of it \u2013 but this will only keep it out of Apple\u2019s and Google\u2019s location databases<\/u><\/a>, not prevent an app from reading it.<\/p>\n\n\n\n

In fact, the two giants make it clear that adding \u201c_nomap\u201d at the end of the router name is a way to keep it out of their crowd-sourced location maps<\/u><\/a> \u2013 but they don\u2019t mention anything about it stopping an app from reading the name of your router. That\u2019s why it\u2019s essential that the name doesn\u2019t reveal your identity or location.<\/p>\n\n\n\n

Another way to stop your location being revealed is to turn off Wi-Fi scanning<\/u><\/a>, and on Android 12 and higher, this can be done by going to Settings, Location, Location Services, and then turning off Wi-Fi scanning or Bluetooth scanning. On Samsung phones, the path is Location, Improve accuracy<\/u><\/a>.<\/p>\n\n\n\n

Then there\u2019s your IP address, which can give away your city-level location, the Citizen Lab report said. This can be mitigated by using a VPN, which will hide your IP address from the ad network, and show them the IP of the VPN server instead.<\/p>\n\n\n\n

Separately, a filtering DNS service can be used that blocks known tracker domains.<\/p>\n\n\n\n

To get off the map, you need to get rid of the record of your location. And to do that, you have to ask the company holding it to delete it. The ad ID you have hopefully saved by now is the key to this, as a deletion request that quotes it is much harder to brush off.<\/p>\n\n\n\n

The idea is to use this unique identifier to prove to the data broker that you are the owner of the device whose location has been logged and sold to the highest bidder, including the police. Without it, the broker can easily claim that it cannot find your record.<\/p>\n\n\n\n

Several US states and the EU have laws that are supposed to make this possible, but the process is far from straightforward. In California, the Delete Act and DROP<\/u><\/a> are supposed to streamline this process, but the former only applies to data brokers that are registered with the state, while the latter is a single opt-out request that can be submitted to all active data brokers at once, and it\u2019s not clear what the success rate is.<\/p>\n\n\n\n

The CCPA, California\u2019s privacy law<\/u><\/a>, gives residents the right to ask that their personal information be deleted, including from service providers, but there are many exceptions.<\/p>\n\n\n\n

In the EU, GDPR Article 17<\/u><\/a> states that personal data must be erased \u201cwithout undue delay,\u201d though here as well, there are exceptions.<\/p>\n\n\n\n

The only way to ensure your record is deleted is to name it. This means you have to provide the ad ID when submitting your deletion request. The effect is limited to the future: any data that has already been sold remains out there.<\/p>\n\n\n\n

Even if you get rid of your phone\u2019s location data from the clutches of one data broker \u2013 or even several \u2013 the problem is not solved.<\/p>\n\n\n\n

The data that has already been sold stays sold. And generating a new ad ID will make you appear as a new person to the data harvesting and brokering industry, but it will not erase the trail of data that has already been collected from your device. It will not make you invisible to the industry, it will only make you look like a new, different person.<\/p>\n\n\n\n

That is because a new ad ID does not delete the old one and the data associated with it. Webloc keeps it \u2013 12 months, according to Bloomberg, while a 2023 contract document mentioned three years.<\/p>\n\n\n\n

This data is constantly changing hands, Citizen Lab has found. \u201cAlmost certainly, Webloc\u2019s data sources are different in 2026,\u201d the lab said in its report.<\/p>\n\n\n\n

With your ad ID, you have a chance to get your record deleted from one broker, but the data will still be out there, sold to somebody else, and there\u2019s no way to know who that is.<\/p>\n\n\n\n

The only way to ensure that this data cannot be bought by the police is for a law to be passed that requires a warrant for the purchase. Until that happens, the only record that nobody can sell is the one that was never sent.<\/p>\n","protected":false},"excerpt":{"rendered":"

(Headline article below) There are a couple new tidbits, but most is already known. And blocking ads is a security feature these days as they can feed you malware as well as the bidding process reveal, and just look at how they abuse it. At home run your own Pi-Hole\/Unbound DNS servers with ad, telemetry […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-19390","post","type-post","status-publish","format-standard","hentry","category-tech","category-world"],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/19390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=19390"}],"version-history":[{"count":1,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/19390\/revisions"}],"predecessor-version":[{"id":19393,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/19390\/revisions\/19393"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=19390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=19390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=19390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}