(light music)
- [Narrator] You're probably aware
that different apps on your cellphone
can track your movements.
That location data is commercially available
along with other personal information
like your social media profile, email address,
and date of birth.
But what the Wall Street Journal has learned
is that the government has also bought a commercial data
and is using it for some forms of law enforcement.
- Two components of the Department of Homeland Security
are using this app-generated marketing data
for law enforcement purposes.
The fact that there're millions of cellphones
and cellphone locations in this database
makes it one of the larger domestic surveillance efforts
that we've become aware of in recent years.
It raises a lot of questions among the Americans
about their privacy
and what kind of information corporations
are collecting on them,
and what those corporations are doing with that information.
(light music)
- [Narrator] This is how it works.
You get this popup
and agree to let an app use your location.
A travel app may want it
to suggest nearby hotels or airports.
Rideshare apps want to know where to pick you up.
But often those apps are also sharing your location
with marketers who're using it for targeted ads, research,
analysis and even reselling it.
But what we found is that, in some cases,
that consumer data is being resold to companies
that buy and sell data for the government.
According to people familiar with the matter
and documents reviewed by the Wall Street Journal,
the Trump administration has purchased the database
that maps the movements of millions of cellphones
in the U.S.,
and it's using it for immigration and border enforcement.
(light music)
In 2018, data tracking contributed to the discovery
of a drug-smuggling tunnel
according to people with knowledge of the operation.
- Sources describe this one case down in Arizona,
a border town called, San Luis,
where a man had allegedly built a tunnel
between his property, which was an abandoned KFC restaurant,
and the Mexican border.
Police say that smugglers were using this tunnel,
but the interesting thing is,
when this person was arrested,
none of the court records indicate
that they found this tunnel based on cell records.
This data was showing cellphone's moving
from one side of the border to the other
and investigator surmised
there must be an illegal tunnel there
and began further investigation
that led the arrest of this person.
- [Narrator] In a statement to the Wall Street Journal,
a CBP spokesman said,
"While CBP is being provided access to location information,
"it is important to note that such information
"does not include cellular phone tower data,
"is not ingested in bulk,
"and does not include the individual user's identity."
The government would not discuss details
about how it is using the data.
But people familiar with some of the government efforts
say it is used to generate investigative leads
about possible illegal border crossings,
and for detection or tracking of migrant groups.
The government's location data efforts
are also described opaquely
in the U.S. Department of Homeland Security's
Privacy Assessment.
One reads, "The goal is to utilize this data
"to detect the presence of - but not identify -
"individuals in an area which CBP has identified
"as an area of interest,
"consistent with CBP statutory authorities,
"federal law, and DHS policy."
(upbeat music)
- [Woman's Voice] Your average consumer looks at their phone
over 150 times a day.
- [Narrator] The marketing technology ecosystem
has taken off in recent years.
(upbeat music)
- [Man's Voice] Marketers create audiences
based on rich device-level attributes
including location, platform, device type
and app (mumbles).
All this data has built on
what more than 250 million mobile consumers do in real life.
Every day,
- [Narrator] It's big business and there are many companies
collecting all sorts of different data,
anything from the speed to a traveling,
to what floor you're on, to your social media profiles.
Some companies known as data brokers
buy different sets of these data and combine them to create
even more sophisticated individual digital profiles
while the privacy policies of these companies say
they do not keep personal information and explain that,
to them, you were just a few letters or numbers
known as an Ad-ID.
Experts we spoke to say that, by using large data sets,
it's easy to figure out who a phone belongs to,
which is one of the reasons
why this data is so valuable to the government.
- The location data is some of the most sensitive data
that exists.
- [Narrator] Alan Butler is the general counsel
of the Electronic Privacy Information Center,
a nonprofit research and advocacy center based in D.C..
- There are a number of different ways
that a company that obtains these data sets
could identify a person.
One way might be by mapping the locations over time
because people live in operative patterns,
the companies are more concerned with discrete connections.
They wanna tie everything together in an automated way.
And the easiest way for them to do that
is by using identifiers, the Ad-ID,
which is gonna connect the dots,
all the dots of them will add data,
but also email addresses, Facebook profiles,
or Twitter profiles, or other sort of app profile data.
And so, the more data those companies can get about you,
the more they can connect it.
(light music)
- [Narrator] If the government wanted to get
that kind of data from your cellphone provider,
they have to get a warrant from a judge.
But because this data is for sale, for marketers,
they are able to buy it and access it without a warrant.
- Most recently, the Supreme Court
in the Carpenter versus United States case
restricted the government's ability
to use a court order to get commercial data
from the phone company,
which is the data about where your phone is connecting
on the cellphone network.
The Supreme Court has not directly addressed
the purchasing of commercial data,
the federal law doesn't impose restrictions
and the circumstance under which the federal government
can collect personal data under the Privacy Act,
but that also can be tricky
if the company never actually stores the data
in a government database.
- [Narrator] Recently, some companies have taken steps
to alert users about location data.
- This market advertising data on smartphones
is barely 10 years old
and already we're seeing
that consumers are taking more control over their privacy
in ways that could've hurt this industry.
Apple and its latest update made it
so that it reminded users how often apps are tracking them.
And some industry insiders have said
that the amount of location data has plummeted
since Apple made that change.
Users are becoming broadly much more aware of
how their phones are tracking them and taking steps
to limit what kind of apps have accessed to their location.
- [Narrator] Critics argue that if companies have this data,
then why shouldn't the government also have access to it
for crime prevention.
- I think the reaction that law enforcement should be able
to get access to data that the companies have access to,
it kinda falls into two common traps.
One is that it assumes that the company
should have access to that data, too,
but even given the fact
that some companies are accessed to data,
I think law enforcement use the data,
it's just a fundamental different thing
because the government exercises the power of the state
and so we've always had a special set of rules
for the government's collection of data
and surveillance of individuals.
- [Narrator] Right now,
there is no comprehensive U.S. privacy law.
The European Union, in 2016,
passed the General Data Protection Regulation,
which more tightly controls how European data can be used.
In the U.S., there are ongoing efforts
to introduce tougher national privacy laws in Congress.
- Programs like this are certainly going to fuel the call
for a comprehensive privacy law in the United States
that limits the way corporations can share data
that they collect on users.
California has taken some steps
towards passing some greater privacy protections,
but federally, there's no law that stops or limits
what corporations can do with the data they collect
on their users in this particular market.
That's how it ended up in the hands of the government.