9 ms·
FBI is buying location data to track US citizens, director confirms
- givemeethekeys 7mo agoThat's the job of the FBI - to investigate domestic crimes. But, why do private organizations so willingly participate in the tracking ecosystem? I suppose they're in the, "you have nothing to worry about if you're not doing anything illegal" camp! Hopefully they understand that they have the most to lose.
- wmf 7mo agoIt's just business. Buy (your data) for a dollar, sell for two. It's all legal and the data brokers are mostly unknown or already-hated companies so I'd say they have nothing to lose.
- anonymars 7mo agoI wonder if we can still buy burner phones for cash at Mondo Mart
- SoftTalker 7mo agoYou can buy almost anything for cash.
- helterskelter 7mo agoHell, I can get you a toe by three o'clock this afternoon -- with nailpolish.
- skirmish 7mo agoYour German girlfriend will not be happy about it. Give her "halbe Pfannkuchen"!
- observationist 7mo agoDifferential identification means you can be singled out based on profiles. Even if you don't have any accounts, big tech companies still have shadow profiles, and those shadow profiles can be linked to your offline identity, such that everything you've done that's been recorded, and everything you've done in (temporal, physical, or digital) proximity to other people who do have accounts results in a record of activities. Sure, you can get a burner, but you have to make sure you never use it anywhere near anyone you know, that the sim is obtained anonymously, that you're never imaged by any of the ubiquitous cameras, etc. Merely having it powered on provides enough metadata to establish a shadow profile, and it's nearly impossible for a person to secure two separate identities. There's also the superman problem - the burner phone would only ever appear when anonymars is missing, and vice versa, creating a real and exploitable pattern if anyone like the FBI wanted to root around in your life. All they'd have to do is query which shadow profiles match the temporal gaps correlated with your disappearance from tracking. There's really no escaping it. The only fix is legislation - outright banning mass surveillance, with lethal corporate penalties and long prison terms for C-Suite responsible for violations. Short of that, we live in a world that is implicitly compromised and insecure unless you have nation state level resources.
- anigbrowl 7mo agoThere's also the superman problem - the burner phone would only ever appear when anonymars is missing, and vice versa, creating a real and exploitable pattern if anyone like the FBI wanted to root around in your life. All they'd have to do is query which shadow profiles match the temporal gaps correlated with your disappearance from tracking. This is nonsense. By your logic, people go 'missing' any time they are not using a computer, whether they're reading a book, in the shower, or asleep in bed.
- orsorna 7mo agoIt's not useful in a vacuum, but one of many degrees that can be combined to create a unique profile of you.
- doomslayer999 7mo ago
- triceratops 7mo agoI can't tell if these The Wire references are deliberate or a coincidence.
- wmf 7mo agoNo doubt.
- pnw 7mo agoYou can buy eSIMs that aren't linked to your identity at https://www.phreeli.com/ https://www.phreeli.com/
- renewiltord 7mo ago[flagged]
- rendx 7mo agoHow Legal Punishment Affects Crime: An Integrated Understanding of the Law's Punitive Behavioral Mechanisms (2025) "This article explains what these 13 potential effects of punishment are and how they have been theorized. It further reviews the body of available empirical evidence for each of these mechanisms." https://news.ycombinator.com/item?id=47266997 https://news.ycombinator.com/item?id=47266997
- staplers 7mo agoAm all for it if law enforcement were held to the same standards. Plenty of cases where LE murder is simply not enforced. Thus LE becomes a haven for those seeking impunity and ability to nefariously track anyone.
- whatshisface 7mo agoIf something is bad when it's done illegally, it's worse when it's done legally, and even worse than that when it's done dutifully.
- mhurron 7mo agoNo it is not the job of the FBI to to conduct mass surveillance of citizens.
- saltyoldman 7mo agoWhat if an investigation is based on finding the same specific people near another specific person that they're tracking, but they only know about the one person, not the others. And by doing this they stop a terror attack? One more thought - if they buy just data for specific people related to an investigation, the seller of the data is tipped off. If they just buy all the data, then there is no potential tip-off to the target.
- themafia 7mo agoYou get a "geofence warrant." They exist and are ubiquitous. You then go to Google or any other provider and you demand the data for a specific location in a specific time window. You then use the data to capture criminals. Any other data would not meet the standards of evidence and probably couldn't be used in court anyways. It's only function is for "parallel construction." Then again, what I _really_ want is for the FBI to prevent crime. If their only solution is to let crime happen and then use a giant dragnet to put people in jail then they are less than worthless... they are actively dangerous to democracy.
- saltyoldman 7mo agoI agree with this route too.
- anigbrowl 7mo agoThey can get a warrant. And by doing this they stop a terror attack? Fuck off. This is just trying to manipulate people with fear of undefined bad thing.
- AngryData 7mo agoYou can justify anything and everything, including torturing random innocent civilians for information, under the guise of preventing terror attacks. Which is why it is a bullshit excuse.
- SoftTalker 7mo agoIt's also not new. The FBI has kept dossiers on people of interest and people in positions of power since it was founded. Easier now of course, which is a concern.
- thephyber 7mo agoFor profit organizations are legally required to maximize shareholder value. Many of them will abuse the spirit of the law in order to squeeze profits where others won’t. The FBI is violating the spirit and original intent of the 4A by creating an entire industry out of the “3rd party doctrine” bypass to the 4A. That doctrine was whole cloth created by SCOTUS and Congress has been too happy to avoid credit or blame for it to not enshrine it in statute.
- Finnucane 7mo ago>For profit organizations are legally required to maximize shareholder value. No: https://www.nytimes.com/roomfordebate/2015/04/16/what-are-corporations-obligations-to-shareholders/corporations-dont-have-to-maximize-profits https://www.nytimes.com/roomfordebate/2015/04/16/what-are-co...
- delfinom 7mo agoLemme give you an example. Many retail sites have a "find a nearby" store function. They often outsource this to a third party...for something as silly as geolocation and geographical lookups. This third party is the one that offers its services for a discount but also siphons up your location data to sell.
- quickthrowman 7mo ago[dead]
- autoexec 7mo ago> But, why do private organizations so willingly participate in the tracking ecosystem? Because it makes them money and that's literally the only thing they care about. They'd do anything for money and the only reason they ever don't do something is because it either wouldn't make them money at all, or it would cost them more money than they'd make.
- AngryData 7mo agoIf this kind of surveillance is part of their job, why are they constitutionally forbidden from doing the surveillance themselves?
- givemeethekeys 7mo agoHaven't they been tapping phones since their conception?
- shevy-java 7mo agoThey hate us for our freedom. Also, isn't this breaking the constitution? It bypasses needing a warrant respectively having a objective suspicion.
- zer00eyz 7mo ago> Also, isn't this breaking the constitution? It bypasses needing a warrant respectively having a objective suspicion. Nope. Your personal information, when given to others, is now trash on the curb (in a literal sense, see: https://en.wikipedia.org/wiki/California_v._Greenwood https://en.wikipedia.org/wiki/California_v._Greenwood ) Buying it just clears up the chain of custody as opposed to the NSA stealing it and reverse engineering your warrant -- OR -- using the good ole stingray.
- downrightmike 7mo agoAnti Pinkerton act: gov can't buy services it isn't legally allowed to do themselves
- baggachipz 7mo ago> Also, isn't this breaking the constitution? I don't think that's been of much concern as of late.
- josefritzishere 7mo agoA generation ago our leaders derided China (and Russia) for this kind of pervasive spying on it's citizens. In the US we did the same thing just increasing costs by enriching the private sector on the way. That's not better. That's worse.
- hombre_fatal 7mo agoKinda reminds me of when I saw footage online of a group of teens raiding a 7/11 store -- maybe during the BLM riots --, and a top comment was "heh, come try that in Texas ;)". Fantasizing, of course, that Texas has a unique bulwark against that behavior, probably having to do with gun ownership. And then it turns out the video took place in Dallas. We like to think there are all these barriers to bad things happening where we live. "I'm sure someone (not me) would stop that." But it turns out there isn't as much bulwark as we think. Or we're the bulwark, so if it isn't us, then there is nobody else.
- RickJWagner 7mo agoIt’s that sort of behavior— groups of perpetrators committing crimes— that allow people to justify enhanced surveillance tactics. I think in years past people would have objected to sale of personal location data. But that was before people had videos of groups of lawbreakers overwhelming laws through organized efforts.
- triceratops 7mo ago> groups of lawbreakers overwhelming laws through organized efforts You're saying organized crime is new? Or videos of it?
- quentindanjou 7mo agoI still remember people asking, "why people in [China], don't protest more actively against it?" as if they would do much better, some others arguing that it was in their "culture" not to protest, as if it would be in the US, they would do anything different: we now have our answer.
- nomel 7mo agoThe supreme court had a 5-4 decision related to this [1]. Was there something specific, in that decision, that leaves a loophole open? [1] https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf
- 46493168 7mo ago[flagged]
- nomel 7mo agoThe three letter agencies have a long history of ignoring the constitution, long before the Trump administration, going back to their inception, including as recent as the Biden administration [1]. [1] https://ij.org/press-release/fbi-caught-trying-to-sweep-its-violation-of-constitutional-rights-under-the-rug/ https://ij.org/press-release/fbi-caught-trying-to-sweep-its-... edit: downvoters, is this not true? this is a historic problem with the agencies. This doesn't mean it's not also a problem with this administration. Two things can be true at once. I like pancakes and waffles.
- jfengel 7mo agoThis administration has also expressed an interest in using that information to persecute citizens. Every administration needs to deal with the conflict of protection versus privacy. They all do things that privacy advocates wish they didn't. But not since the early 70s has one been so explicit that it wants to use the justice system to punish their enemies, without even the pretense of a criminal charge. So I think you're being downvoted over the perception of both-sidesism.
- edm0nd 7mo ago[flagged]
- dare944 7mo agoOr... kinda like... not the same technique at all, since Congress can legally change the size of the Supreme Court but Trump can't legally ignore its rulings.
- rootusrootus 7mo agoPerhaps we could overturn the third party doctrine. With legislation, preferably. And while we are at it, solve the underlying issue of pervasive data collection and sharing in the first place.
- jmbuilds 7mo agoAnother angle I think worth attention is product developers should build tools / platforms that don't even touch user data and be open about that so consumers can choose those more. I believe people will choose privacy when given the choice more often if the product is just as good or better.
- fsflover 7mo agoThis is what F-Droid does. However Apple doesn't allow you to use it, and Google is slowly following their lead, too.
- FL4TLiN3 7mo agoWho's selling the data is the far more serious issue here. Behind this is a remarkably well-structured syndicate. The supply chain looks something like this: consumer apps embed ad SDKs → those SDKs feed location signals into RTB ad exchanges → surveillance-oriented firms sit in the RTB pipeline and harvest bid request data even without winning auctions → that data flows to aggregators who don't have any direct relationship with consumers → and from there it's sold to government agencies, among others. The genius of this structure is that accountability dissolves at every layer. Each intermediary can claim they're just passing along "commercially available data." Nobody verifies whether consumers actually consented to their location data being collected and resold. The consent verification is always someone else's job. The real problem is that this data is buyable at all, by anyone, through an opaque multi-layered supply chain specifically designed so that no single entity bears responsibility for the end result.
- SoftTalker 7mo agoThere probably was a consent, buried on page 12 in the terms of use of the app they installed at the front of your chain.
- ranger_danger 7mo agoI think that practice should be illegal... they know nobody reads those. Even the "reasonable person" standard for court would probably conclude that most people would never read it.
- wittyusername 7mo agoI find myself uninstalling every app unless I really need it and use it. It's amazing how many apps just sit around in your life over time. get them off your phone
- WarOnPrivacy 7mo agoI do this. I also block the ad ecosystems on the device (root, adaway).
- 7mo ago
- nullcathedral 7mo agoYikes. Why are private organizations so happy to participate in mass surveillance.
- skirmish 7mo agoShould be obvious: lots of money in that. Corporations are amoral psychopaths.
- array_key_first 7mo agoA lot of them don't know they're doing it. The tracking itself is embedded in dependencies of dependencies. SDKs you add for legitimate purposes. Along the way it's sent from platform to platform. Analytics, add targets, and eventually data brokers. Data brokers then sell it to other data brokers or the government. If you're lucky, it's pseudo-anonymous. Of course it's actually not - aggregated location data is inherently not anonymous.
- Ey7NFZ3P0nzAe 7mo agoYes. The french newspaper Le Monde recently did a piece on how easy it was to find every moves and the home adress of sensitive people (elite special forces, nucleat submarine engineers, president bodyguards, etc) by exploiting the free sample of a data broker. They were stunned to see lemonde's app appeared as sources inside that excel file because of SDKs in their app.
- AngryData 7mo agoBecause capitalism would happily burn the world to ash if the capitalists thought it would make them richer. It makes them think they are winning at life.
- thenthenthen 7mo agoThere was a great talk at the Chaos Computer Conference a few years ago how to diy this, sadly cant find it because web search seems dead nowaydays. If anyone knows, please chip in. It was a german researcher following german politicians who hilariously(scandalously?) related travel patterns
- ranger_danger 7mo agohttps://arstechnica.com/cars/2024/12/whistleblower-finds-unencrypted-location-data-for-800000-vw-evs/ https://arstechnica.com/cars/2024/12/whistleblower-finds-une... https://www.youtube.com/watch?v=iHsz6jzjbRc https://www.youtube.com/watch?v=iHsz6jzjbRc
- evan_a_a 7mo agodirect from the media server https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo...
- SilverElfin 7mo agoThe government shouldn’t be able to contract out anything it isn’t permitted to do directly itself. We should have this in the law, get rid of qualified immunity for everyone including lawmakers, and reign in the government.
- themafia 7mo agoI have to give my age to my OS. Yet they can't write a law to make this basic practice illegal. Why do I feel like I'm not being represented _at all_?
- sidewndr46 7mo ago[dead]
- jimt1234 7mo agoThis should be a surprise to absolutely no one. I think it sucks, but I also don't think it's anything new.
- clayhacks 7mo agoYeah, if you had any faith in these private companies to not bend over backwards for the feds, I have a bridge in San Francisco to sell you
- lukeschlather 7mo agoI'd really like to just have legislation to treat location data like audio or video under wiretapping provisions. If you collect my location info and convey it to a third party without my consent or a reasonable good-faith belief that I would consent, that ought to be treated similarly to recording without consent. And consent needs to be granted explicitly for each party that might get access to my location, you can't just get blanket consent to sell my location to anyone, especially not with real-time identifiable location data.
- ryandrake 7mo ago> or a reasonable good-faith belief that I would consent Don't deliberately write a loophole. No need for this part.
- lukeschlather 7mo agoGood-faith is pretty narrow, mainly talking about emergencies where I implicitly could be said to have given consent, like when calling 911, or services that are close to 911 but privately administered.
- octoberfranklin 7mo agoFair enough, but the wiretap laws are all phrased in terms of "conversation participant" -- a listener who every speaker is aware is listening. Some states require consent of all participants, others require consent of one participant. In one-party states the consenting party has to be the one who makes the recording. In all-party-consent states, the verbal declaration that a recording is happening has to be part of the recording. It has to be verbal, so there is no "fine print loophole" -- you have to waste 2-3 seconds of everybody's time saying it out loud. I like your idea, but the wiretap laws work so smoothly because they bootstrap off of things like "conversation participant" and "verbally granted in the recording itself" that don't carry over to location data.
- cat-turner 7mo agoApple should take care of this. I would pay. Sadly it has gotten to this point
- jshier 7mo agoWhat would you like them to do? They already force apps to ask for permission, give user control over when the app can even access the location (including just once), tell the user when the app has been accessing the location repeatedly over time, and allow the user the shut off location services for each app individually whenever they want. So aside from shutting off more and more possible sideband sources of location information, what else are they supposed to do? Unless you're saying Apple is selling the location information they may have directly?
- jshier 7mo agoAnswering my own question, they need a way for users to grant location permission only to the primary app and not any of its dependencies, as once you grant it, it's available to all code in the app. It would be great if there was some way to separate those. They could also better enable network traffic inspection on device, so we could tell where data is going. LittleSnitch on iOS would be great.
- betaby 7mo agoIP is often enough to correlate things. LittleSnich or whatever is no help - oftentimes data is collected by the app/site directly, and then funneled to various systems via kafka-like brokers. In this case you always have only cobbections to something like cool-application-domain.au
- jshier 7mo agoLittleSnitch also does filtering, so it's both parts of the solution: it allows inspection of outgoing connections, at least by domain, and filtering of those connections you don't want, allowing you to block ads and most data networks.
- rasz 7mo agoTo be fair they are only doing that in order to track if his honeypot brib^de isnt cheating on him. Might be cheaper than round the clock SWAT teams https://www.nytimes.com/2025/11/23/us/politics/kash-patel-girlfriend-fbi-protection.html https://www.nytimes.com/2025/11/23/us/politics/kash-patel-gi...
- pnw 7mo agoNobody has explained to me how iOS ad SDKs across different apps can track individual users given that there hasn't been an accessible GUID on iOS for many years now.
- Terr_ 7mo agoEnough location data becomes effectively unique: There is likely only one phone in the world that averages over X nighttime hours in my apartment-complex and averages over Y workday-hours in the the same office block where I work. That kind of pattern can be used to determine that two or more different app-identities are the same person, and anybody buying that data has a strong incentive to try it.
- rcoder 7mo agoFingerprinting devices once you’re installed on them isn’t much harder than doing so in a web browser. Have Instagram installed on your phone? Great, now every Meta-owned app _or advertiser running on their platform_ has a pretty good shot at identifying you based on IP, location, app usage, etc. There is a ton of signal about identity available just by virtue of running alongside other apps. Screen size, OS version, and IP are pretty good proxies for unique identity, especially if all you care about is _probable_ matches.
- pnw 7mo agoMy understanding was that it's very difficult to reliably fingerprint iOS devices. Apple limits access to identifiers and specifically disallows fingerprinting. For this application of tracking people, you'd need decent reliability or you'd just get noise. And no, I don't have any Meta published apps on my phone for exactly the reason you outline. I'm very aware of how IDFV and IDFA work.
- shermantanktop 7mo agoIn the US we live in a bizarre world of dual expectations. The government is supposed to follow the law, be accountable, transparent, and must operate within a constrained, circumscribed zone of activity which is debated and discussed. That's at least how it's supposed to work. Private companies are understood as amoral sharks who have no obligation to do anything other than operate in their narrowest self-interest, and the law is used as a club to beat them back from what they so clearly want to do, and will do if at all possible. They are unaccountable to anything other than the legal system and their share price. Suggesting that they might have any further obligation is tantamount to questioning whether capitalism should exist. It happens all the time on HN. So of course the FBI would like to keep their hands mostly clean by having one of those accepted-to-be-horrible companies gather this data and then buy the resulting trove.
- AngryData 7mo agoThe US is SUPPOSE to do that, but I have yet to see it do any of those things with anything close to regularity or consistency at any point in living memory.
- shermantanktop 7mo agoWe criticize the government bitterly, but when a company does the same thing we seem to say “oh well of course they did that, what can you do, it’s capitalism and the free market knows best, ho hum.” See: the US healthcare system.
- 3818923 7mo agoSome citizens are exempt. Wired magazine got cell phone movement data to and from Little Saint James and found a lot of visitor locations. The FBI is not interested: https://www.wired.com/story/jeffrey-epstein-island-visitors-data-broker-leak/ https://www.wired.com/story/jeffrey-epstein-island-visitors-...
- sayYayToLife 7mo ago[dead]
- paulryanrogers 7mo agoIsn't this is just a naked reach around the 4th amendment?!
- deathanatos 7mo agoYes. But AFAIK, not an unconstitutional one. Wyden agrees with you: > Wyden said buying information on Americans without obtaining a warrant was an “outrageous end-run around the Fourth Amendment,” America needs privacy laws for this reason (or an amendment, but good luck). Vote when November rolls around; the other piece is finding Democrats that will take an actual stance on privacy closer to Wyden's.
- autoexec 7mo agoI think that the problem is that it absolutely does violate the constitution, we just have judges willing to defend it and say otherwise even when it clearly allows for exactly what the fourth amendment was intended to prevent.
- deathanatos 7mo ago(IANAL) I meant that statement in the sense of "in the current jurisprudence". AIUI, because the companies are willingly giving up the data, it's not a search and thus no warrant is required; companies could tell the government to take a hike. But why would they, when a buck could be made? And we treat the data as being the company's, b/c its on their servers, etc. As for when customers gave it to companies, again, this is treated as voluntary: you could have, in theory, not used that company. Now, again, I don't necessarily agree with that position: many companies here are monopolies, or their market has so little competition that all their competitors do it as well. Also, with no downside to it, I don't see why a company isn't going to sell their customers' data, and if not them, then some company that might acquire them down the road. Futher, some companies even just outright lie to customers about this. But again, the current government is unwilling to enforce any sort of extant consumer protection law, and much of the above boils down to "… because America has no privacy laws." So, we're back to "if you want it, vote for it". The GOP is fundamentally opposed to regulation of business, but even the Democrats have been really tepid around privacy laws and consumer protection.
- tamimio 7mo agoI don’t thinks there’s any person who doesn’t know this information already, yet you keep seeing the same empty articles of “oh yes they collect your data using commercial apps”.. list all these apps to consumers, list the services too, list the companies that are selling them, so people will stop using them or at least limit its access. I know most social media are, but there are far more companies and apps that are willing to sell such data.
- autoexec 7mo agoThe companies handing your data over to the government are apple, google, microsoft, and every ISP, every social media platform, and every cell phone provider in the country. What now? You going to throw out every computer you own and never use the internet? When the problem exists in everything we use and depend on there is no avoiding it.
- alian_eth71 7mo ago[dead]
- realaliarain74 7mo ago[dead]
- net_rener88 7mo ago[dead]
- zombot 7mo agoThis is the reason why every company is collecting all the data they can. They can sell it to the government, which is likely still cheaper than having a bureaucratic behemoth collect that data.
- treebeard901 7mo agoLaw enforcement should require a subpoena if they want to have location data for anyone. It really isnt a third party loophole issue. Law enforcement should only be accessing location data if they have probable cause to believe a crime is happening. This invalidates the third party doctrine loophole and becomes an unreasonable search (and seizure of your privacy) under the 4th amendment. Location data specifically should be treated as the most private data about a person. It should have the highest scrutiny for any access. It is more important than your financial records and medical records.
- TylerLorenzen92 7mo ago[dead]
- jamesvzb 7mo ago[dead]
- xtiansimon 7mo agoGood. If before the OS masters permitted this ad tracking—-a dirty secret of smaller developer revenue. Now the FBI shows up to free lunch and blows up the spot. Now _everyone_ knows the ads in “free” apps are tracking you.
- pugchat2 7mo ago[dead]
- starsmartonl 7mo agoThe apathy of majority of common users who are both unawares and unperturbed speaks volumes in this regards. Unfortunately, there seems to be very narrow means to educate people even when the regulatory constantly beefs up efforts. The big tech grows stronger with every link clicks or digital engagement.
- Stancyhd8 7mo agoThanks so much to Henryclarkethicalhacker for helping me hack into my husband's phone so I could see what he is up to and I was able to catch him red handed, now I am out and a lot happier credit goes to earlier mention hacker for a good job. If you are also interested in any hack job you can contact him via his email – HENRYCLARKETHICALHACKER@GMAIL. COM Tell him I refer you