US Law Enforcement Agencies Using 'Fog Reveal' Tool to Track Users With Data From Popular Apps: Report

US law enforcement agencies have reportedly been accessing the location of 250 million smartphones in order to access "hundreds of billions of records", using a tool provided by a private company that purchases information on users collected by data brokers sourced from popular apps. The company's device tracking tool relies on advertising IDs from user's phones that allow officials to trace their movements, without the need for a warrant, over time while focusing and analysing patterns, according to a report.

According to a detailed report by the Associated Press based on documents obtained by the Electronic Frontier Foundation (EFF), a tool called Fog Reveal, was sold in around 40 contracts to over 20 US law enforcement agencies. The tool is created by Virginia-based Fog Data Science and is reportedly used extensively by law enforcement agencies in the US. 

Unlike lawful location tracking of users that requires the lengthy process of obtaining a warrant, the use of Fog Reveal allows law enforcement agencies to track smartphones using data that is sourced from popular apps like Starbucks or Waze, according to the report. The data on user locations allow the agencies to trace people's movements over time, while creating "patterns of life", which are based on location information.  

The report states that the use of the tool was highly secretive — in some cases, it was not mentioned in US court records, which could prevent lawyers from defending their clients in cases where the technology was used. 

Fog Reveal relies on data sourced from popular apps, such as Waze and Starbucks — which assign users an advertising identifier. The location details of users, which are tied to their ID, is both used to target them with ads, while it makes its way to companies like Fog Data Science, according to the report, which states that the companies were unaware that the data was being used for the location tracking tool. 

While the advertising IDs do not contain the name, phone number, or personally identifying details of a user, the report says that location details can be used over time to de-anonymise the user and analyse their movements.

As the report points out, US courts are still weighing the use of location information, and the latest such ruling from the US Supreme Court held that law enforcement agencies would require a warrant in most cases, to view records of users' movements and location.