by Anthony W. Accurso

Criminal Legal News has previously reported on data broker companies — companies that buy and sell data on consumers, most often location data harvested from mobile apps. Fog Data Science is one such company, though one that some believe is quite possibly more dangerous to democracy than its predecessors.

Fog is a relative newcomer in the data broker space, but its age is deceptive due to its association with more established data broker Venntel. Advertising materials for both Fog’s service “Reveal” and Venntel’s products claim to have “location signals from 250 million mobile devices in the U.S.” with “15+ billion daily location signals.” An investigation by the Electronic Frontier Foundation (“EFF”) into computer code from fogreveal.com made explicit references to “Venntel/GetLocationData,” and Fog claims it “has a unique and privileged relationship as an ‘associate’” of a large data broker from which many other brokers get their data.

The most conclusive link between the two companies, however, was demonstrated in an email exchange between a Fog representative and an officer with the Iowa Department of Public Safety. When the Iowa agent asked a question about Fog’s data, the representative forwarded the request and received a conclusive answer from a Venntel representative, whom the Fog spokesperson referred to as representing “our data partner.”

As Fog’s data partner, Venntel provides the company with much (or all) of their data points obtained from “over 700 apps,” though notably excluding Google and Facebook as direct sources. And like Venntel, Fog prefers not to specify the sources of its location data, only saying they are sourced from “lots of smaller apps.” Also, because it is still a separate company, it could forge partnerships to obtain data outside of this association with Venntel.

Open-records requests have revealed communications between Fog and its client agencies which, though the company is tight-lipped about which specific apps provide the location data, show that navigation apps such as Waze are crucial because it is during navigation that location services are active and these apps are able to obtain a device’s location. While users may turn off location services during routine tasks, they must enable location services for navigation apps to function. Once location services are enabled, other apps that collect location data for Venntel can contribute to the data set.

This is in accord with what was previously known about how Venntel gets its data. While large tech companies have the clout to negotiate pricing for, or restrict access to, data that is valuable to advertisers, smaller companies or individuals are willing to place Venntel’s tracking code in their app in exchange for a per-user fee. For instance, broker X-Mode is known to have “paid app developers around 3 cents per user per month for access to location data.”

Though Fog and Venntel’s services are sourced from the same data, they present different faces toward clients — like the Roman deity Janus, who had two faces on the same head. Venntel markets its location data analysis product to large law enforcement and intelligence agencies, charging in the neighborhood of $650,000 for a yearly subscription to its services.

Fog, on the other hand, pitches its product to regional, state, and local law enforcement agencies while charging an average of just under $10,000 per year. An EFF investigation has also shown that Venntel products have a “slightly different” visual style than Fog’s Reveal and “also [appear] to display more information than Fog’s [do], including an IP address associated with each signal.”

The EFF has uncovered current or past links between Fog and 18 agencies that have contracted to use its services, though Fog itself has claimed that it works with “50–60” agencies nationwide. Because most of the EFF’s data comes from open-records requests that yield invoices, its data is almost certainly undercounted because Fog allows for a free trial period of indeterminate length. Absent laws like those in California where law enforcement must publicly disclose training materials and policies relating to surveillance technologies used on citizens, most communities will be wholly unaware when their local police use Fog’s free trial to spy on them when they don’t generate a paper trail in the form of invoices.

Herein lies why critics argue Fog is uniquely dangerous to democracy: Because of their specific clientele and the data disclosed, they undermine important rights of citizens in a way that will likely directly impact their lives. While Venntel sells user location data to agencies at the federal level, most people will never have an interaction with federal authorities in their lifetime. But even if you are a generally law-abiding citizen, you will have some contact with local police. And when communities resist over-policing or react to police murdering citizens, local police are the ones who will interact with the community, not the feds.

Fog’s Reveal has essentially two modes: area searches and device searches. In the case of protests against police murder of citizens, the police can use Reveal to obtain advertising IDs for all the devices in a specific area during a given time frame, such as during a protest. They can then use the device search to follow the IDs from the first area search backwards in time to where those users live, work, and travel. Chillingly, by exercising one’s constitutional rights in attending a protest or other lawful event being surveilled, law enforcement can develop a full picture of a person’s movements and, by extension, associations.

Even when such abuses are not part of a coordinated response, individual “bad apples” can misuse such information. In June 2022, it was discovered “that a US Marshal [was] being charged for allegedly using a different geolocation service in 2018 that was sold by a prison payphone company — Securus — to track ‘people he had personal relationships with as well as their spouses.’” It’s bad enough having to worry about how unpredictable a jilted lover can be, but this is made far worse when they have the seemingly infinite resources of the government’s surveillance apparatus at their disposal.

Unfortunately, such nightmare scenarios are going to continue to be possible in the vacuum left by legislative inaction around the collection of private data. Only a few states such as California and Colorado have laws that regulate the collection of personally identifying information (“PII”), though data brokers claim that such laws do not apply to their data sets because they have been anonymized — that is, the data is organized around an advertising ID instead of another identifier commonly linked to a specific person, such as a name, email, or SSN.

However, one St. Louis County officer summarized that, “‘There is no PI linked to the [device ID]. (But, if we are good at what we do, we should be able to figure out the owner).’” And even when police are not so good at what they do, the EFF has reported that on multiple occasions, Fog has helped its customers use device searches to track devices with specific ad IDs, resulting in deanonymization.

Further, despite the U.S. Supreme Court’s decision in Carpenter v. United States, 138 S. Ct. 2206 (2018), in which the Court decided that historical cell site location information over a period of time obtained by police from a cellular carrier is protected by Fourth Amendment search requirements, Fog has told its client agencies that the Carpenter decision does not apply to their service. Though its legal analysis is far from unbiased or likely settled law, various agencies will continue to purchase location data from brokers absent any clear admonishment from legislatures or the courts.

As more and more of our life becomes digitized, location information is going to be even more valuable to law enforcement going forward. Citizens who want to safeguard their rights in the face of rampant data collection can follow guides available from the EFF about how to reduce your chances of being tracked by companies like Fog and how to organize for more comprehensive legal protections for personal data. 

Source: eff.org

Subscribe today

Already a subscriber? Login