20 ms·
Mobile customer location data is ending up in the hands of bounty hunters
- loa-in-backup 8y agoPay operators for the location Pay operators to auto-rotate your number every so often It's free real estate!
- max76 8y agoIs this a computer generated sentence?
- dragonwriter 8y agoIt's perfectly good sentence (or 3, rather) once you insert the missing punctuation; a full stop before each of the capitalized words (except the first.)
- danso 8y agoIt’s true that they are correctly formed sentences. But they seem to lack context. What does it mean to pay an operator to auto-rotate my number, and what relevance does it have with the subject of the posted article? What’s “free real estate” refer to?
- deleted 8y ago[deleted]
- techsupporter 8y ago"It's free real estate" is a meme based on a parody of late-night infomercials touting quick and easy money but are actually bait-and-switch scams. https://knowyourmeme.com/memes/its-free-real-estate https://knowyourmeme.com/memes/its-free-real-estate The other two bits are probably meaning that the phone company can make money selling your location and make money charging you to change phone numbers every so often to avoid tracking efforts by people who only have your old number.
- danso 8y agoThanks for the helpful explanation (TIL a new meme :)). I guess it seems the problem is the commenter using inconsistent subjects, i.e. it would make sense (even without punctuation, or knowing the meme) had it been phrased as: > Charge for your users' locations! Charge users to change/auto-rotate their numbers! It's free real estate!
- loa-in-backup 8y agoIndeed this is what I meant. I pondered my informal phrasing afterwards. Also I entered single carriage feeds between sentences, forgetting that they're going to get stripped on HN anyway.
- deleted 8y ago[deleted]
- brohee 8y agoI wonder if any of those companies had access to, and sold, roaming European users location data. The GDPR may possibly be weaponized if it was the case...
- astura 8y agoThe GDPR doesn't apply to "roaming European users."
- lol768 8y agoWhat's your reasoning for this assertion? If the user is a European citizen, I was under the impression that GDPR was applicable. The location at which the user is at does not matter one iota. US companies need to understand this, or risk losing trading abilities with citizens and organisations in EU member states.
- astura 8y agoNo, Youre wrong, citizenship doesn't matter, the application dependeds on physical location. If youre an American in Europe the GDPR applies to you, if youre a European in America the GDPR does not https://www.compliancejunction.com/does-gdpr-apply-to-eu-citizens-in-the-united-states/ https://www.compliancejunction.com/does-gdpr-apply-to-eu-cit... https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- lol768 8y ago>the application dependeds on physical location Thanks for the correction.
- guitarbill 8y ago> “The allegation here would violate our contract and Privacy Policy,” an AT&T spokesperson told Motherboard in an email. That pretty much sums up how much carriers care about this. But it is nice to see Senator Ron Wyden is still doing good work, almost restores my faith in politics.
- ducktypegoose 8y agoTelco companies will keep selling data as long as it's profitable. If the company continues to sell data to the offending clients despite knowingly violating its terms, then a case could be made for negligence against the telco. In my eyes this practice, like many shady data-dealings, lacks legal precedence and its profitability will change as litigation mounts against the telcos. Furthermore national laws need individual cases to gain traction. Bad practices are bound to change when a few high profile cases end up in the courts. Feels funny to say this, but it seems like the world needs more lawyers.
- axaxs 8y agoEven as an independent that leans a bit right, I love Ron Wyden. I feel the US would be a much better country with a congress full of his type (even if not his ideas).
- Spooky23 8y agoThis is why utilities need to be heavily regulated. Selling real time location data to wholesalers in the bail bonds industry? Who would think there would be abuse? Only license actions and criminal penalties will stop this kind of abuse.
- robrenaud 8y agoPerhaps this is a good reason to use Google Voice and not give anyone the underlying real phone number with cell service.
- twerkable 8y agoany reason to think google doesn't sell your data
- ohithereyou 8y agoNo, not particularly.
- gruez 8y agogoogle monetizes your data (targeting), but doesn't sell it to others.
- simion314 8y agoAs we seen with the Google Plus bug that exposed user data even if Google would be a nice company even they can have a bug and expose your data, this makes me think that the best solution as a user is minimize the data that is collected about you and as a company to discard any data that you don't need and anonymize the data you have to keep and can be anonymized.
- StreamBright 8y agoMaybe not intentionally but problem is that often such data can be partially or fully de-anonymized using various statistical analysis techniques.
- onetimemanytime 8y ago#1 Reason: no one can monetize that data better than Google #2 They'd be helping their rivals with such data #3 Sharing might kill the golden goose (bad press etc) ...
- 8y ago
- StreamBright 8y agoChange title please and add "in the USA"
- deleted 8y ago[deleted]
- danso 8y agoThe title doesn’t assert that this necessarily exists worldwide. edit: I mention this downstream, but it's worth correcting myself. The article prominently features a company named Zumigo, which provides mobile device location data in India as well as North America. So adding "in the U.S." to the (already altered) post title is not needed, especially since it could obfuscate the fact that these location companies do operate internationally. [0] https://zumigo.com/zumigo-introduces-breakthrough-mobile-location-technology-for-securing-and-enabling-payment-transactions-in-india/ https://zumigo.com/zumigo-introduces-breakthrough-mobile-loc...
- StreamBright 8y agoYet mobile customers exist worldwide and I opened the article to see how they circumvent GDPR because I though it applies to Europeans too.
- Beldin 8y agoAs a European, having "bounty hunters" in the title implied that already. I was unaware of bounty hunters being aserious profession in any particular EU country. Then again, i don't know any EU country where an accused can bail themselves out of jail till the court case.
- dragonwriter 8y ago> Then again, i don't know any EU country where an accused can bail themselves out of jail till the court case. While some other countries have cash deposits as part of bail, the US and the Phillipines appear to be the only countries with widespread commercial bail bonds system.
- andrewxhill 8y agoThe barrier to access for many people's location data is simply effort. If you want it you can probably find someplace to buy it. We need new ways to get control of our digital shadow.
- sneak 8y agoIt would appear that sometimes even paying for the service doesn’t mean you won’t end up as the product anyway. How can one avoid this kind of aggregated location tracking?
- h0mEDw 8y agoYou guys need (something like) GDPR in the US. I believe it's a necessity.
- StreamBright 8y agoThere are lots of things needed in the US.
- r00fus 8y agoMeaning, GDRP will be a result of other (political) changes? I'd concur.
- StreamBright 8y agoYes. Instead of focusing on corporate profits the US should focus on quality of service (in every aspect of life) for citizens.
- dragonwriter 8y agoProbably, though eliminating cash bail would address this particular problem and is a good idea anyway.
- rocqua 8y agoIt seems to me that eliminating bondsmen is better. This should coincide with actual affordable cash bail. Unless you meant eliminating all forms of bail involving money. I actually have no idea how that works here in the Netherlands.
- zorga 8y ago
- h0mEDw 8y agoFor EU folks: anyone tried a GDPR request to their phone provider to figure out what do they collect and what do they store? I'm thinking any of the following are within the realm of possibilities: - Call history, including metadata and potentially also contents; - Text messages, same as with calls: metadata and potentially the contents; - Location history; - Data connection activity, again: metadata and potentially the contents; - IMEIs of the devices I used. Basically I want http://myactivity.google.com/ http://myactivity.google.com/, but for my mobile subscription. I submitted a GDPR request to my GSM provider a few days ago, but I'm not fluent in legalese, so may not reach as far as someone fluent in it. Still awaiting initial response.
- lifeisstillgood 8y agoCan you post your request and who is sent it to - with yours as a starting point I reckon a few of us can iterate to a good solution
- h0mEDw 8y agoNothing fancy, and I sent it to the contact point they have in their privacy policy. You can find it on their websites (or at least I found it; in my case it was just an email but it will possibly escalate to snail mail). As far as contents goes - here it is, translated into English: I am a/an [OPERATOR] subscriber, identification data: (...) I would like to get a complete list of personal data that [OPERATOR] stores about me: - The history of telephone calls, metadata (when and where [to which number] I called or when and who [what number] called me) as well as the data itself (the content of the calls themselves); - The history of text messages, as in the case of calls - metadata and the data itself; - History of data transfer (Internet), as above - metadata and the data exchanged itself; - Connection history - when my phone was connected to the [OPERATOR]'s network, when in [OPERATOR'S COUNTRY] or when via roaming; - Location history - where my phone was located, e.g. which base stations it was connected to or from which country it was connecting or any other information allowing to determine my location more accurately than "Planet Earth"; - History of used devices - IMEI numbers as well as other data collected about my device / devices; - Any additional information collected about me. If any of the above mentioned types of data is not stored by [OPERATOR] please let me know.
- openloop 8y agoSS7 is highly insecure.
- deleted 8y ago[deleted]
- onetimemanytime 8y ago>“The allegation here would violate our contract and Privacy Policy,” an AT&T spokesperson told Motherboard in an email. Probably now AT&T execs are looking at increasing prices on such data. This is very valuable to be sold so cheap.
- guelo 8y agoThis is outrageous. In the last congress Republicans voted to strip what little privacy protections we had from network providers.
- draw_down 8y agoRegulation is bad, don’tcha know.
- 40acres 8y agoI think we need to reassess how we treat data generated by users via phones, devices and our digital activities. We had the concept of private and public property long before intellectual property became codified by law. I believe that we are entering a new phase which may require the development of a new type of jurisprudence around things like location data. I'm definitely not a lawyer, but I'm starting to believe there is an argument that despite the fact that mobile phones and devices facilitate the generation of location data, that does not necessarily mean that the device manufacture 'owns' that data and can transact with it as they please. This may all be moot because most of us agree to Privacy Policy contacts, but maybe a mind shift in treating data you generate as a type of property that is covered by property law is required to change behavior.
- jmickey 8y agoNo need to invent new jurisprudence - if the location data can be used to identify an individual, it is personal data under the GDPR and enjoys all the rights and protections enabled by the regulation.
- schaefer 8y agosome of us are in the USA, (including article's author). The privacy realities we face are drastically different than in the EU.
- crankylinuxuser 8y agoThat's fine for you Europeans under GDPR. (Sure, there's careouts for weird exceptions.) That doesn't do diddly for us US citizens living in the US. Our data policy is "we will sell your data, too bad so sad".
- jlarocco 8y agoIt is kind of our own fault, though. Judging by the sentiment on HN when GDPR was coming into effect, if something like it came up for a vote in the US, a lot of HN users and other tech people would vote against it. There was no shortage of angry geeks posting articles about their service turning away EU users rather than complying with GDPR.
- 21 8y agoAre we gonna talk about the Silicon Valley VC's investing in these shady companies? > Zumigo is a pioneer of mobile services providing _deeper insights_ into consumer behavior to help secure transactions, devices and identities. https://www.crunchbase.com/organization/zumigo https://www.crunchbase.com/organization/zumigo > Intel Capital > Aligned Partners
- Whitestrake 8y agoInvestors are gonna invest, right? They're there to make money. Presumably they believe the company's operations are legal and likely to provide returns.
- kevincrane 8y agoVCs have a choice in whether or not to invest in unethical things. If they pay money to an unethical cause, that's them supporting it.
- deleted 8y ago[deleted]
- closeparen 8y agoCriminal investigations have to stand up to court scrutiny. Fugitive recoveries do not. I expect there’s a lot more misconduct where this came from.
- jopsen 8y agoThe whole bounty hunter system sounds like something out of a bad movie.. I would be very surprised if it wasn't full of abuse stories.
- closeparen 8y agoProfessional law enforcement agencies are a recent development historically, and for a long time were resisted as something out of an authoritarian dystopia. Policing was the job of amateurs and freelancers for much longer than it’s been a civil service bureaucracy. Even death investigation was, until recently, a side gig for the town doctor.
- geggam 8y agoIts almost like we outsourced our civic duties to hired guns
- learc83 8y agoYep, and there are good reasons that policing was put into the hands of professional agencies. London's self-proclaimed "Thief-Taker General" is a good example. A gang leader who made money through both committing and "solving" crime. https://en.wikipedia.org/wiki/Jonathan_Wild https://en.wikipedia.org/wiki/Jonathan_Wild
- jopsen 8y agoHow is this relevant? Human rights is a recent development, that does make them a bad idea? Or justify violations :) The concept of a professional trained police force is well proven by now, I see no reason to question it :)
- 8y ago
- jonahhorowitz 8y agoIt should be illegal to sell people's data without a wet ink signature. That's really the end of the story.
- jonahhorowitz 8y agoAdding: You should still be able to use services, without consenting to them selling your data, like you can under the GDPR.
- chii 8y agoWould your tune change if by not agreeing to sell your own data, the service charges you money?
- icebraining 8y agoIf we're talking about the GDPR, the service can ask you to sell your data, and it can charge you, but it can't force you to choose between the two. Data ain't currency.
- matte_black 8y agoAnd what is the answer if we're not talking about GDPR?
- craftyguy 8y ago> the service charges you money They (mobile carriers) already do charge me money... What's your point?
- jonahhorowitz 8y agoExactly this. I’m already paying them. I’d be open to a “won’t sell your data” surcharge, but I doubt that would last long due to the political implications.
- deleted 8y ago
- mlindner 8y agoAmazing chain of data transfer there. Likely with each one obeying their individual terms but the terms being lessened at each step of the line. AT&T/Verizon/T-Mobile --> Zumigo --> Microbilt --> Bail bond company --> Bounty Hunter --> Motherboard
- Sephr 8y agoLocationSmart advertised themselves to bounty hunters[1]. This kind of unethical/illegal location sharing from other location brokers like Zumigo is unsurprising. 1. https://twitter.com/sephr/status/1082711937257893888 https://twitter.com/sephr/status/1082711937257893888
- roywiggins 8y agoThey're the same folks who accidentally left an API public that let literally anyone do it: https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/ https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...
- davidf18 8y agoNotably, Verizon was found not to give out locations unlike AT&T, Sprint and T-mobile. Disclosure: I"m a long-time Verizon customer. These firms have no business selling customer location data. There is absolutely no respect for customer privacy which is a cultural issue within these firms. "Microbilt’s product documentation suggests the phone location service works on all mobile networks, however the middleman was unable or unwilling to conduct a search for a Verizon device. Verizon did not respond to a request for comment."
- Johnny555 8y ago5G microcells will make this data much more accurate.
- Jolter 8y agoThe network operator already has more detailed info, but the article says they are fuzzing it before selling it. Presumably this is to prevent pinpointing users too precisely. If radio cells are smaller, they get higher resolution in the source data, but we can't know what resolution data they would resell.
- ezoe 8y agoThat's why I will never own a phone.
- intea 8y agoReporting on bad privacy practices while having an atrocious consent dialog...
- wybiral 8y agoWith this many companies of questionable security owning the data I think it's safe to say that this data is getting leaked.
- maloneyg 8y agoThat is really not a good news for all of us. The big brands have to stop selling customers’ location data to anyone. There should be some law or act for this.