12 ms·
How The Pentagon learned to use targeted ads to find its targets
- nova22033 3y ago[flagged]
- vaylian 3y agoNot putin himself, but his entourage who frequently traveled together with putin.
- jdawg777 3y agohttps://archive.is/wNxjS https://archive.is/wNxjS
- winstonprivacy 3y agoExcellent article and the methods described are accurate. I was speaking extensively about this from 2017-2020 and the usual reaction when I talked about this was disbelief. I was not surprised when In-Q-Tel came calling. I pitched them a military grade privacy protocol but my suspicion was that they were more interested in spying on our users (a non-starter).
- unethical_ban 3y agoAny additional info on the subject you recommend?
- lifestyleguru 3y agoOne can be in process of making the most unfortunate or catastrophic decision or action, and their phone with adtech will only worry how to display them ad for a rope.
- hnburnsy 3y ago>Working with Grindr data, Yeagley began drawing geofences—creating virtual boundaries in geographical data sets—around buildings belonging to government agencies that do national security work. Are you seriously telling me that government phones of national security employees allow for the installation of apps that track your location and/or these employees are allowed to bring personal cell phones into these buildings?
- Jtsummers 3y agoEmployees are generally allowed to bring phones into federal buildings. There are areas within the buildings they may not be able to take them to, and there are some buildings with a total ban. In that case, though, the phones would still be left somewhere nearby, like the parking lot.
- schaefer 3y agoThere are buildings that do not allow cell phones. For these buildings, it's common to leave your phone in your car. So... still close enough?
- AndrewKemendo 3y agoYes, close enough.
- voxic11 3y agoEven if not allowed in the building people will still want to carry a personal phone so it likely just stays in their car right outside the building in the parking lot.
- mandevil 3y agoWhen we had to go into SCIFs, generally phones went into lockers. At some locations, phones stayed in cars. But that doesn't make it any harder to figure out. But this isn't the first time people are encountering this problem. Strava has given away plenty of US military bases: https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases https://www.theguardian.com/world/2018/jan/28/fitness-tracki... Russia has the same problem, VKontakte has given away plenty of secret Russian military bases and troop positions over the past few decades. I've never read of this on Weibo or WeChat, but my guess is they have the same problem, just English language open source accounts are keeping it more discrete for now. The WashPost about a week ago had an article about how at a recent NTC rotation out at Fort Irwin the OPFOR was trying to figure out how an Apache had gotten past their air defenses, so they looked up commercial cell phone tracking data and were able to spot how a phone had gone across the desert at 120 mph and plug the hole in their air defenses.[1] Adtech on the cell phone we all carry in our pocket is better at surveillance than the best tools a military has. And it's one of those things where not being part of the surveillance can make you stand out too. Think about a spy operating under a real cover, how long is their Facebook (or Weibo or VK or TikTok or whatever is appropriate for the person they are trying to be) account history? If you found someone claiming to be a 45 year old woman living in an American suburb and she had a Facebook account that was three months old, wouldn't you investigate further? 1: https://www.washingtonpost.com/national-security/2024/02/22/ukraine-war-pentagon-lessons-learned/ https://www.washingtonpost.com/national-security/2024/02/22/...
- Tjiti5igigi 3y ago[flagged]
- cmpxchg8b 3y agoThere are more nefarious actors than the TLAs.
- onychomys 3y agoSome or most of that will require a warrant to access. This ad information can just be purchased, no judge sign-off required.
- nova22033 3y agoThis article makes it clear that this location data is easily available to 3 letter agencies like the SVR and the GRU.
- deleted 3y ago[deleted]
- ourmandave 3y agoApropos to nothing... Choose which apps use your Android phone's location https://support.google.com/android/answer/6179507?hl=en https://support.google.com/android/answer/6179507?hl=en Control app tracking permissions on iPhone https://support.apple.com/guide/iphone/control-app-tracking-permissions-iph4f4cbd242/ios https://support.apple.com/guide/iphone/control-app-tracking-...
- unethical_ban 3y agoI found that OnePlus android allows you to toggle mobile data and WiFi data per app, by the way. Pixel and Samsung only allow that for mobile. Semi related.
- deleted 3y ago[deleted]
- ametrau 3y agoPaywalled (after getting sufficient traffic from the share)
- Jtsummers 3y agohttps://web.archive.org/web/20240228004529/https://www.wired.com/story/how-pentagon-learned-targeted-ads-to-find-targets-and-vladimir-putin/ https://web.archive.org/web/20240228004529/https://www.wired... Easily solved.
- 082349872349872 3y agoAt least I'm old enough that I can still go places without a phone.
- panzagl 3y agoA friend of mine had a girl he was dating drop him because she couldn't understand why he didn't text her all the time- never mind that he worked at a Navy facility that didn't allow cell phones.
- mucle6 3y agoI don't understand how targeted ads on Grindr can be used to get peoples locations. Does the ad auction tell the users current location? Does grindr let you run your own auction bidder on your own machine?
- prepend 3y agoAd serves up an image hosted by the advertiser. Phone makes an http get for the image and gives out its IP. You can also target ads by geography and do a lat/long box over your target area and show a specific ad so you know how many unique users are in that area.
- 082349872349872 3y ago> so you know how many unique users are in that area would you like to know more? see also: https://www.jstor.org/stable/27862533 https://www.jstor.org/stable/27862533 Baryshnikov & Ghrist, Target Enumeration Via Euler Characteristic Integrals (2009) > We solve the problem of counting the total number of observable targets (e.g., persons, vehicles, landmarks) in a region using local counts performed by a network of sensors, each of which measures the number of targets nearby but neither their identities nor any positional information. We formulate and solve several such problems based on the types of sensors and mobility of the targets.
- eastbound 3y agoGiving up the IP is against the GDPR.
- victorbjorklund 3y agothis about US not EU
- iamacyborg 3y agoThat hasn’t stopped RTB (real time bidding) mechanisms from leaking personal data to hundred/thousands of third parties yet.
- brutus1213 3y agoI don't work in the ad industry but am quite curious to learn the high level software components. For instance, I have heard of Audience Intelligence Platforms from the likes of Google and Adobe. Curious if anyone has come across a book, blog or lecture that lays out the landscape.
- fma 3y agoSo, what's the best weather app to use that's not going to sell my location?
- lifestyleguru 3y agoWhy you need an app for the weather, what's wrong with websites?
- vineyardmike 3y agoMore convenient, more location-accurate, can integrate with the OS like widgets. What a terrible take. People like apps, we should make apps private I stead of telling people not to use apps. FWIW, websites can gain access to your location too, so plenty of people will still be tracked.
- acdha 3y agoMine gives me notifications before unpleasant weather events. A website can’t send me an alert saying that it’s about to start raining in 20 minutes.
- bhouston 3y agoiOS/Apple Watch has a built in weather app.
- vineyardmike 3y agoApple bought a weather company for this purpose. So probably Apple’s honestly. Everything else needs to make money somehow while freely giving you data.
- metabagel 3y agoApple bought Dark Sky, ostensibly in order to incorporate it into their Weather app. But, that app is the same or worse than it was before, so I can't recommend it. Dark Sky was excellent.
- hellojesus 3y ago
- smallerfish 3y agoAndroid lets you delete the advertising id that's mentioned in the article, as well as reset it. Does anybody who is in Adtech know what that does in terms of identifiability on brokers? Am I now "anon at location x,y", or am I "anon4321 at location x,y”?
- licheness 3y agoNever underestimate the power of metadata. An expired ID that patterns quite similar to a new ID is quite easy to identify.
- neves 3y agoit looks like you stay with "no id". There is just an option "get a new advertising id" Here how to delete it in Android and Apple: https://www.eff.org/pt-br/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now https://www.eff.org/pt-br/deeplinks/2022/05/how-disable-ad-i...
- neves 3y agohere how to delete it: https://www.eff.org/pt-br/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now https://www.eff.org/pt-br/deeplinks/2022/05/how-disable-ad-i...
- username135 3y agoOne thing I've always been curious about, and have never been able to find a solid answer too, is what data is available to the various companies whose software I have on my phone? What can AT&T/TMobile/etc... learn from my device as my carrier? What can the apps I have installed decern from my device if I allow no access to anything settings? How does this change if I use a vpn? I have an idea of whats possible based on my career in tech, but I'd love a more solid answer. Happy to read any content answering the aforementioned.
- jstarfish 3y agoI don't know of any carrier hypervisory capability, but there has been a lot of discussion about OnePlus phones and the data they exfiltrate. There's a bunch of vendor bloatware even on my factory-reset phones so it's not out of the question that a carrier-locked phone might have snuck something else in there. Intelligence can be inferred at the carrier level even with paranoid privacy settings and all apps using HTTPS. CDNs in particular frequently serve content over regular HTTP, and there aren't too many reasons why you'd be communicating with Grindr's CDN. All of this is visible over the wire. DNS requests betray a lot about you. VPNs are notoriously leaky when it comes to DNS as well. I'd expect that even with a VPN running you're not stopping anything, just changing the exfiltration route for some of your traffic.
- HenryBemis 3y agoChances are yes. On Android, you can control 'some' of the permissions - the basic ones (contacts, calendar, location, etc.) There are some though "view Wi-Fi connections", "have full network access", "view network connections", "query all packages", "advertising ID permission", and so on, that give the app (and it's creator) a good view of what's going on in your phone. I tend to (by trial & error) block everything with NoRoot Firewall. Those who want to be naughty though cannot be stopped, as they send both useful and telemetry through the same connection/target IP.
- mike_d 3y ago> but I'd love a more solid answer Unfortunately that isn't a question you'll get an answer to. Anyone who actually knows and has access to sensitive sources and methods is under an obligation not to disclose them. Further nobody in the know wants to burn these sources - because it makes their job harder. The general advice I can give is use an iPhone (turn on Lock Down mode if you believe you might be the target of well resourced attackers), use Google suite for your personal data (and turn on Advanced Protection), don't use commercially available VPNs (set up your own or just don't connect to wifi in untrusted places), and periodically delete third party apps you don't use (especially any that use location services).
- nova22033 3y agohttps://www.cnet.com/home/security/life360-app-is-selling-data-from-millions-of-families-report-says/ https://www.cnet.com/home/security/life360-app-is-selling-da... Life360, like other apps that track location data, makes a significant portion of its annual revenue from selling this data -- about 20 percent in 2020.
- deleted 3y ago[deleted]
- pluc 3y agoI haven't read it yet, but I have "Means of Control: How the Hidden Alliance of Tech and Government Is Creating a New American Surveillance State" by Byron Tau in my cart and that feels related so.. maybe look it up. https://www.penguinrandomhouse.com/books/706321/means-of-control-by-byron-tau/ https://www.penguinrandomhouse.com/books/706321/means-of-con...
- glitchcrab 3y agoThis article is taken from that book.
- npilk 3y agoReminds me of the guy who pranked his roommate with Facebook ads targeted to an audience of one: https://ghostinfluence.com/the-ultimate-retaliation-pranking-my-roommate-with-targeted-facebook-ads/ https://ghostinfluence.com/the-ultimate-retaliation-pranking...
- andirk 3y agoI did this once too and it worked. The targeting is much less specific than it was years ago though.
- smcin 3y agoUseful to gives dates. Swichkow's prank ad mentioned above was back in 2014. I think you're referring to Facebook/Meta removing many detailed PII-specific targeting options, 1/2022.
- dhosek 3y agoThat said, the prank still works if you can get your targeted ad in front of the victim even if it also goes to unconnected recipients as well.
- andirk 3y agoYear was mid 2008. Targeted via geo, gender, and then finally interests. It got down to like "less than 100" which I think was more like 1. She lived in a rural area which probably made it easier.
- sharpshadow 3y agoIndeed I remember back then one could target somebody by his email. I would guess the agencies still get extended targeting access.
- pests 3y agoYou still can via custom audiences. Also used for creating lookalikes. I believe it's not direct targeting and there are limits to stop targeting like we're discussing.
- hellojesus 3y agoAre any of these Real Time Bidding markets open to small companies or individuals? I'm curious to see what days exists for bidders.
- instagib 3y agoDupe of my earlier post: https://news.ycombinator.com/item?id=39534662 https://news.ycombinator.com/item?id=39534662
- aussieguy1234 3y agoThis is why you don't let the weather app access your location. In fact, weather apps are one of the main offenders here. ICE in the US has been known to use this same data to track down and harm undocumented migrants. Personally, I have a de-googled Pixel running GrapheneOS. It has a sandboxed version of Google Play, but without the elevated system privileges. I am not signed in to Google at any kind of global device level. I can still install and run most apps, but without the tracking.
- unmole 3y ago[flagged]
- aussieguy1234 3y agoThat would involve force and most likely some harm, state sanctioned or not. I'll bet most would have been completely unaware that viewing a weather app led to being arrested.
- andrei_says_ 3y agoI prefer the lest dehumanizing undocumented migrants. Using intentionally dehumanizing language exposes a desire for unchecked cruelty.
- deleted 3y ago[deleted]
- jevoten 3y agoDo you have this backwards? Any animal can be "undocumented", and there are in fact strict requirements for cattle documentation if they're to be used as food. But only humans can be criminals. More relevant is perhaps the issue of accuracy - if a US citizen loses their ID, they are "undocumented". Meanwhile an illegal immigrant, even if they have all their papers and the authorities know who they are, i.e. they are fully "documented", is still not permitted to stay in the country.
- gia4151 3y ago[dead]
- camilamacedo 3y ago[dead]