Secret Service Bought Phone Location Data from Apps, Contract Confirms

The Secret Service paid for a product that gives the agency access to location data generated by ordinary apps installed on peoples' smartphones, an internal Secret Service document confirms.

The sale highlights the issue of law enforcement agencies buying information, and in particular location data, that they would ordinarily need a warrant or court order to obtain. This contract relates to the sale of Locate X, a product from a company called Babel Street.

In March, tech publication Protocol reported that multiple government agencies signed millions of dollars worth of deals with Babel Street after the company launched its Locate X product. Multiple sources told the site that Locate X tracks the location of devices anonymously, using data harvested by popular apps installed on peoples' phones.

Protocol found public records showed that U.S. Customs and Border Protection (CBP) purchased Locate X. One former Babel Street employee told the publication that the Secret Service used the technology. Now, the document obtained by Motherboard corroborates that finding.

"The purpose of this modification is to add 1 licenses [sic] to CLIN 0003 and incorporate the Master Subscription Agreement and Locate X Addendum as attached," the contract document reads. Motherboard obtained the document through a Freedom of Information Act (FOIA) request.

The contract that mentions Locate X stretches from September 28, 2017 to September 27, 2018, according to the document. With the modifications to an existing Secret Service and Babel Street contract, the total amount increased by $35,844 to $1,999,394, the document adds.

Babel Street did not respond to a request for comment. The Secret Service did not respond either.

“As part of my investigation into the sale of Americans’ private data, my office has pressed Babel Street for answers about where their data comes from, who they sell it to, and whether they respect mobile device opt-outs. Not only has Babel Street refused to answer questions over email, they won’t even put an employee on the phone,” Senator Ron Wyden told Motherboard in a statement.

A myriad of smartphone apps, from weather predictors, to games, to flashlights, collect location data. Sometimes this may provide some benefit to the app's operation itself, such as being able to route directions from a users' current location, but many of these apps often sell that information as well to data brokers or other companies who incorporate it into their own products.

Government agencies are increasingly at the end of that location data chain. In February The Wall Street Journal reported that Immigration and Customs Enforcement (ICE) and other agencies bought an app-based location data product from a different firm called Venntel. Senator Wyden's office then found the Internal Revenue Service (IRS) was also a Venntel customer.

Law enforcement agencies typically require a warrant or court order to compel a company to provide location data for an investigation. Many agencies have filed so-called reverse location warrants to ask Google to hand over information on what Android devices were in a particular area at a given time, for example. But an agency does not need to seek a warrant when it simply buys the data instead.

Senator Wyden is planning legislation that would block such purchases.

“It is clear that multiple federal agencies have turned to purchasing Americans’ data to buy their way around Americans’ Fourth Amendment Rights. I’m drafting legislation to close this loophole, and ensure the Fourth Amendment isn’t for sale,” Wyden’s statement added.

Motherboard has also reported how some law enforcement agencies are paying for access to data from hacked websites.

Other documents obtained as part of the same FOIA request detail the Secret Service's purchase of Babel Street's open source intelligence product. The Secret Service wanted a tool that would let it monitor a wide range of social networks, including Facebook, Instagram, SnapChat, Tumblr, Vine, YouTube, WhatsApp, and many others, according to one of the documents.

Subscribe to our cybersecurity podcast, CYBER.