Investigation Finds Telecom Companies Sold Sensitive Customer GPS Data

Investigation Finds Telecom Companies Sold Sensitive Customer GPS Data

An investigation by Motherboard has found that an estimated 250 bounty hunters and related businesses had access to customer location data from AT&T, T-Mobile and Sprint.

An investigation by Motherboard has found that an estimated 250 bounty hunters and related businesses had access to customer location data from AT&T, T-Mobile and Sprint.

Documents obtained by Motherboard show that telecommunications companies sold data intended for use by 911 operators and first responders to data aggregators, who then sold it to bounty hunters. In some cases, the GPS data was so accurate that a user could be tracked to specific locations inside a building.

According to Motherboard, between at least 2012 until it closed in late 2017, a now-defunct data seller called CerCareOne allowed bounty hunters, bail bondsmen and bail agents to access the real-time location of AT&T, T-Mobile and Sprint cell phones. A source familiar with the company told investigators that the company would sometimes charge up to $1,100 per phone location.

CerCareOne customers were able to access data including a phone’s “assisted GPS” –or A-GPS—data, a technology used by first responders to find 911 callers in emergency situations.

Blake Reid, associate clinical professor at Colorado Law, told Motherboard that “with assisted GPS, your location can be triangulated within just a few meters. This allows constructing a detailed record of everywhere you travel.”

“The only reason we grant carriers any access to this information is to make sure that first responders are able to locate us in an emergency,” Reid said. “If the carriers are turning around and using that access to sell information to bounty hunters or whomever else, it is a shocking abuse of the trust that the public places in them to safeguard privacy while protecting public safety.”

A Sprint spokesperson did not directly answer whether the company has ever sold A-GPS data, and AT&T did not respond to a request to clarify whether it has ever sold A-GPS data. A T-Mobile spokesperson told Motherboard “We don’t have anything further to add at this stage.”

A list of one customer’s use of the phone location service, obtained by Motherboard, goes on for about 450 pages, listing more than 18,000 individual phone location requests in just over a year.

“This scandal keeps getting worse. Carriers assured customers location tracking abuses were isolated incidents. Now it appears that hundreds of people could track our phones, and they were doing it for years before anyone at the wireless companies took action,” Oregon Senator Ron Wyden said after being presented with Motherboard’s findings. “That’s more than an oversight—that’s flagrant, willful disregard for the safety and security of Americans.”

Motherboard’s full investigation can be read here.

About the Author

Jessica Davis is the Associate Content Editor for 1105 Media.

Featured

Featured Cybersecurity

Webinars

New Products

  • HID Signo Readers

    HID Signo Readers

    HID Global has announced its HID® Signo™ Biometric Reader 25B that is designed to capture and read fingerprints in real-world applications and conditions. 3

  • Kangaroo Home Security System

    Kangaroo Home Security System

    Kangaroo is the affordable, easy-to-install home security system designed for anyone who wants an added layer of peace of mind and protection. It has several products, ranging from the fan-favorite Doorbell Camera + Chime, to the more comprehensive Front Door Security Kit with Professional Monitoring. Regardless of the level of desired security, Kangaroo’s designed to move with consumers - wherever that next chapter may be. Motion sensors, keypads and additional features can be part of the package to any Kangaroo system in place, anytime. Additionally, Kangaroo offers scalable protection plans with a variety of benefits ranging from 24/7 professional monitoring to expanded cloud storage, coverage for damage and theft. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3