by Douglas Ankney

According to a September 2022 report from AP News, law enforcement agencies from suburban Southern California to rural North Carolina are using an obscure cellphone tracking tool known as “Fog Reveal” that enables the cops to follow people’s movements months back in time. As of September 2022, police have used Fog Reveal to search hundreds of billions of records — in most instances without a warrant — from 250 million mobile devices, gathering the data to create location analyses known among law enforcement agencies as “patterns of life.” These patterns of life include identifying where a person sleeps at night, goes to work each day, which bars are frequented, which protests a person attends, which reproductive clinic the person visited, and so on.

Fog Reveal is the product of Fog Data Science LLC, (“Fog”) and is headquartered in Leesburg, Virginia. The company was developed by Robert Liscouski (who led the Department of Homeland Security’s (“DHS”) National Cyber Security Division during the reign of former President George W. Bush) and Matthew Broderick (a former U.S. Marine brigadier general who ran DHS’s Operations Center during Hurricane Katrina). Fog Reveal relies on advertising identification numbers (“ad ID numbers”). Ad ID numbers are culled by private data brokers from popular cellphone apps like Waze, Starbucks, and hundreds of others and then marketed to other companies such as Fog. (Every cellphone has ad ID numbers that allow advertisers to target individuals for promotions.)

Fog’s clients access Fog Reveal through a web portal. Investigators enter a crime scene’s coordinates into a database, which brings back search results showing a device’s Fog ID, which is based on the device’s unique ad ID numbers. The investigators see which devices’ Fog IDs were near the location of the crime. Investigators or other law enforcement officers can also search the location for Fog IDs going forward from the time of the crime and back at least 180 days (so says the company’s user license agreement). But police emails and Broderick assert that Fog Reveal’s data permit law enforcement to track a mobile device as far back as June 2017. Broderick, who initially refused to answer the question, recently claimed Fog Reveal “only has a three year reach back.”

Broderick said in an email, “Local law enforcement is at the front lines of trafficking and missing persons cases, yet these departments are often behind in technology adoption. We fill a gap for underfunded and understaffed departments.”

But Fog isn’t forthcoming with information about how Fog Reveal is actually used, and most law enforcement agencies won’t discuss it. This has raised concern among privacy advocates that Fog Reveal violates the Fourth Amendment’s protections against unreasonable searches and seizures. While the ad ID numbers unique to each mobile device do not reveal the name of the user, these numbers can be used to trace the movements of the mobile devices to homes, workplaces, and other locations to establish pattern of life analyses. As one Missouri law enforcement official wrote about Fog Reveal in 2019: “There is no [personal information] linked to the [ad ID]. But if we are good at what we do, we should be able to figure out the owner.”

Davin Hall, former crime data analysis supervisor for the Greensboro, North Carolina, Police Department said, “The capability that [Fog Reveal] had for bringing up just anybody in an area whether they were in public or at home seemed to me to be a very clear violation of the Fourth Amendment. I just feel angry and betrayed and lied to.” Hall resigned in 2020 after months of expressing his concerns to police attorneys and to the city council about the department’s use of Fog Reveal.

Fog Reveal allows police to geofence an area and locate each mobile device based on the ad ID numbers. Police may also use Fog Reveal to search by a specific mobile device’s ad ID numbers, tracking the device’s movements on a Google Map of the area. Geofence warrants, on the other hand, have been held to violate the Fourth Amendment when used for non-particular searches of all people who happen to be present at a particular location. The Fourth Amendment’s “particularity clause” prohibits warrants authorizing general searches of people and places.

Broderick counters that “[s]earch warrants are not required for the use of the public data.” He said Fog does not have access to people’s personal information but draws from “commercially available data without restrictions to use” from data brokers “that legitimately purchase data from apps in accordance with their legal agreements.” He added, “[w]e are confident Law Enforcement has the responsible leadership, constraints, and political guidance at the municipal, state, and federal level to ensure that any law enforcement tool and method is appropriately used in accordance with the laws in their respective jurisdictions.”

Washington County, Arkansas, Prosecutor Kevin Metcalf said he has used Fog Reveal without a warrant, especially in “exigent circumstances” (situations allowing exemption to the warrant requirement such as when a crime-in-progress endangers civilians or police or threatens the destruction of evidence). Metcalf also heads the National Child Protection Task Force (“NCPTF”). Fog is listed as a sponsor on NCPTF’s website, and a Fog executive chairs NCPTF’s board. According to Metcalf, “Fog has been invaluable to cracking missing children cases and homicides.” He said, “[w]e push the limits, but we do them in a way that we target the bad guys. Time is of the essence in those situations. We can’t wait on the traditional search warrant route.”

Metcalf claims that Fog Reveal was used successfully in solving the murder of 25-year-old nurse Sydney Sutherland. Last seen while jogging near Newport, Arkansas, the only thing police had to go on was her cellphone found in a ditch. Metcalf shared his agency’s access to Fog Reveal with the U.S. Marshals Service to determine which other mobile devices were nearby when Sutherland was killed. Metcalf said Fog Reveal helped lead authorities to arrest a farmer for Sutherland’s rape and murder. But its use was not documented in any of the court records reviewed by the Associated Press.

Fog Reveal was also used in the investigation of the 2017 murder of exotic snake breeder Ben Renick. Emails reveal that during the investigation, Missouri State Highway Patrol used Fog Reveal’s portal to search for cellphones at Renick’s home, ultimately zeroing in on a mobile device. Using data from Fog Reveal, investigators were able to determine the phone owner’s identity (it belonged to Renick’s babysitter). Police used the data to track the babysitter’s whereabouts over time to create a pattern of life analysis. But it was all for naught since Renick’s wife, Lynlee, was later charged and convicted of the murder.

But disturbingly, prosecutors again did not cite Fog Reveal in the list of other tools used in the investigation, according to the Associated Press after examination of the trial exhibits. Defense attorneys, of course, are deeply concerned over the few legal restrictions on law enforcement’s use of Fog Reveal and other location data. “It’s a gap police agencies exploit, and often don’t disclose in court,” said Michael Price, Litigation Director of the National Association of Criminal Defense Lawyers’ Fourth Amendment Center. “[Fog Reveal] is exceedingly rare to see in the wild because the cops often don’t get warrants,” Price said, adding, “[e]ven if you do ask for [information] sometimes they say ‘We don’t know what you are talking about.’”

Fog refers to Venntel, Inc. (“Venntel”) as its “data partner.” Venntel, also headquartered in Virginia, has access to a mammoth amount of users’ mobile data. The company is perhaps the largest data broker that has supplied location data to agencies such as Immigration and Customs Enforcement and the FBI. Venntel is being investigated by the DHS after Democratic lawmakers uncovered U.S. Customs and Border Protection officials have used Venntel’s data to track and harass reporters and other individuals without a warrant.

However, Metcalf has argued against congressional efforts to require search warrants when law enforcement uses Fog and Venntel’s technology. He believes Americans give up any reasonable expectation of privacy when they use free apps and considers any objectors to technology like Fog Reveal to be “a cult of privacy” (wonder if average Americans would agree with this view if they were actually aware of Fog and Venntel’s use of their data). Metcalf said, “I think people are going to have to make a decision on whether we want all this free technology, we want all this free stuff, we want all the selfies. But we can’t have that and at the same time say, ‘I’m a private person, so you can’t look at any of that.’ That just seems crazy.”

Fog and Venntel claim they collect data from thousands of apps, but those companies are not aware of who is using their data. Companies like Fog and Venntel collect billions of data points filled with detailed information because many apps embed invisible tracking software that follows users’ behavior (such as types of products most frequently purchased, when and where the users most often purchase these products, and so on). The primary purpose of these apps is to enable companies to sell customized ads targeted to a person’s current location. But data brokers like Fog and Venntel suck up this personal data and sell it to agencies to be used for other purposes without the primary companies’ direct knowledge or consent.

For example, both Starbucks and Waze denied any relationship with Fog. Starbucks explicitly stated it had not given permission to its business partners to share customer information with Fog. Starbucks spokesperson Megan Adams said, “Starbucks has not approved Ad ID data generated by our app to be used in this way by Fog Data Science LLC. In our review to date, we have no relationship with this company.” And a Waze spokesperson said, “We have never had a relationship with Fog Data Science, have not worked with them in any capacity, and have not shared information with them.”

In Carpenter v. United States,138 S. Ct. 2206 (2018),the U.S. Supreme Court held that the Fourth Amendment requires law enforcement to obtain a warrant before seizing historical location data from phone companies (known as “cell site location data” or “CSLI” based on the signals from cellphone towers as a phone passes within the tower’s range). The Carpenter Court observed that “seismic shifts in digital technology made possible the tracking of not only Carpenter’s location but also everyone else’s, not for a short period but for years and years.” Yet law enforcement agencies currently do an end-run around the requirement set forth in Carpenter via purchasing data from private brokers like Fog that those agencies cannot legally obtain directly from telecommunication companies.

Bennett Cyphers, who led the Electronic Frontier Foundation’s (“EFF”) records works, pointed out “there hasn’t been any previous record of companies selling this kind of granular data directly to local law enforcement.” He added, “We’re seeing counties with less than 100,000 people where the sheriff is using this extremely high tech, extremely invasive, secretive surveillance tool to chase down local crime.”

Starting at just $7,500 annually and with agencies able to share access with other agencies (thus, sharing the costs), Fog Reveal is just right for small town and county budgets.

Considering all of the fluff and fuss raised over Hillary Clinton’s emails, Hunter Biden’s laptop, and Donald Trump’s phone calls, it is easy to imagine a local sheriff in a conservative locale using Fog Reveal to track the wife of the person opposing him in the next election to the Planned Parenthood clinic in the next county. Or a local business person hiring the sheriff to “get the dirt” on a competitor.

While police are quick to promote their use of Fog Reveal in solving crimes involving children and in murders, they are not forthcoming in revealing how it’s actually used day-to-day. And contrary to Broderick’s assurances about law enforcement’s responsible use of surveillance tools, the federal and state courts report a long history of police abusing and harassing citizens through the use of unlawful surveillance.

Even two years after leaving his position as crime data supervisor, Hall still frets about police surveillance of neighboring communities. “Anyone with that login information can do as many searches as they want,” he said. “I don’t believe the police have earned the trust to use that, and I don’t believe it should be legal.”

Ditto, Mr. Hall. Ditto. 

Sources: AP News, eff.org

Subscribe today

Already a subscriber? Login