Investigation Finds Telecom Companies Sold Sensitive Customer GPS Data

Investigation Finds Telecom Companies Sold Sensitive Customer GPS Data

An investigation by Motherboard has found that an estimated 250 bounty hunters and related businesses had access to customer location data from AT&T, T-Mobile and Sprint.

An investigation by Motherboard has found that an estimated 250 bounty hunters and related businesses had access to customer location data from AT&T, T-Mobile and Sprint.

Documents obtained by Motherboard show that telecommunications companies sold data intended for use by 911 operators and first responders to data aggregators, who then sold it to bounty hunters. In some cases, the GPS data was so accurate that a user could be tracked to specific locations inside a building.

According to Motherboard, between at least 2012 until it closed in late 2017, a now-defunct data seller called CerCareOne allowed bounty hunters, bail bondsmen and bail agents to access the real-time location of AT&T, T-Mobile and Sprint cell phones. A source familiar with the company told investigators that the company would sometimes charge up to $1,100 per phone location.

CerCareOne customers were able to access data including a phone’s “assisted GPS” –or A-GPS—data, a technology used by first responders to find 911 callers in emergency situations.

Blake Reid, associate clinical professor at Colorado Law, told Motherboard that “with assisted GPS, your location can be triangulated within just a few meters. This allows constructing a detailed record of everywhere you travel.”

“The only reason we grant carriers any access to this information is to make sure that first responders are able to locate us in an emergency,” Reid said. “If the carriers are turning around and using that access to sell information to bounty hunters or whomever else, it is a shocking abuse of the trust that the public places in them to safeguard privacy while protecting public safety.”

A Sprint spokesperson did not directly answer whether the company has ever sold A-GPS data, and AT&T did not respond to a request to clarify whether it has ever sold A-GPS data. A T-Mobile spokesperson told Motherboard “We don’t have anything further to add at this stage.”

A list of one customer’s use of the phone location service, obtained by Motherboard, goes on for about 450 pages, listing more than 18,000 individual phone location requests in just over a year.

“This scandal keeps getting worse. Carriers assured customers location tracking abuses were isolated incidents. Now it appears that hundreds of people could track our phones, and they were doing it for years before anyone at the wireless companies took action,” Oregon Senator Ron Wyden said after being presented with Motherboard’s findings. “That’s more than an oversight—that’s flagrant, willful disregard for the safety and security of Americans.”

Motherboard’s full investigation can be read here.

About the Author

Jessica Davis is the Associate Content Editor for 1105 Media.

Featured

  • ISC West Is Two Months Away

    ISC West Is Two Months Away

    The annual “vacation” to Las Vegas is less than two months away. I anticipate it will be an amazing show, and furthermore, I expect the show hall to be teeming with interested security professionals. Read Now

    • Industry Events
  • Security Today Launches 2023 Government Security Awards

    Security Today Launches 2023 Government Security Awards

    Security Today is proud to announce the launch of the 2023 Government Security Awards. The Govies honor outstanding government security products in a variety of categories. For this year’s awards program, participants can choose from 38 different categories to enter their product(s) into. Read Now

  • Back to the Basics

    Back to the Basics

    Security is a continuous evolution of practices and procedures. The developments in technology and advancements in threats make security difficult at times. Although security from one location may look different from another location, there is a common goal applied to security measures. The common goal is protection. Read Now

  • The Top Three Security Trends in 2023

    The Top Three Security Trends in 2023

    As security technology has become more widely used, the interest in new capabilities and increased security measures has increased. As we head into 2023, these three trends will shape the security landscape. Read Now

Featured Cybersecurity

New Products

  • Pivot3 Surety

    Pivot3 Surety

    Pivot3 has announced Surety, a new intelligent software framework to simplify the management and monitoring of physical security environments. 3

  • ALTO Neoxx Electronic Padlock

    ALTO Neoxx Electronic Padlock

    Built to withstand all access control needs, the tough new SALTO Neoxx electronic padlock takes security beyond your expectations. 3

  • SAFR® from RealNetworks

    SAFR® from RealNetworks

    A unique feature in SAFR version 3.4 is its ability to automate alerts to security personnel when a spoofing attempt or a fraudulent attempt to gain access is detected. 3