Inside ICE’s Tool to Monitor Phones in Entire Neighborhoods

Hey there, Joseph here. We've obtained material that explains how a mobile phone surveillance tool ICE bought works. It's called Webloc, and is designed to monitor entire neighborhoods at once. Webloc isn't the only location data tool on the market, but it's rare for journalists to get material that goes in-depth on what these products are capable of. We also got an internal ICE legal analysis showing the agency doesn't believe it needs a warrant to use such data. Read below, and also check out our piece from yesterday about DHS's lies about the shooting of Renee Good.

A social media and phone surveillance system ICE bought access to is designed to monitor a city neighborhood or block for mobile phones, track the movements of those devices and their owners over time, and follow them from their places of work to home or other locations, according to material that describes how the system works obtained by 404 Media. 

Commercial location data, in this case acquired from hundreds of millions of phones via a company called Penlink, can be queried without a warrant, according to an internal ICE legal analysis shared with 404 Media. The purchase comes squarely during ICE’s mass deportation effort and continued crackdown on protected speech, alarming civil liberties experts and raising questions on what exactly ICE will use the surveillance system for. 

“This is a very dangerous tool in the hands of an out-of-control agency. This granular location information paints a detailed picture of who we are, where we go, and who we spend time with,” Nathan Freed Wessler, deputy project director of the American Civil Liberties Union’s (ACLU) Speech, Privacy, and Technology Project, told 404 Media.

This week, the Department of Homeland Security (DHS) started deploying as many as 2,000 officers to Minneapolis, including from ICE’s deportation arm. On Wednesday, an ICE official repeatedly shot and killed a woman, Renee Nicole Good, 37, when she was turning around her car. 

In September, 404 Media reported on ICE’s planned purchase of the technology, consisting of two Penlink products called Tangles and Webloc. 404 Media has now obtained material that explains in greater detail how the system works.

The material shows Webloc users can search its databases of mobile phone data in various ways. Users can perform a single perimeter analysis to search a specific area for mobile phones across a certain time period. They can draw the target area with a rectangle, circle, or polygon. They then select the maximum number of results the system should display, and the maximum number of devices to return. 

Once a Webloc user has identified a device of interest, they can get more details about that particular phone, and, by extension, its owner, by seeing where else it has travelled both locally and across the country. Users can click a route feature which shows the path the device took. The material suggests that if users look at where the device was located at night, they might find the person’s possible home, and during the day, the person’s possible employer.

The software can also do a multi-permiter analysis, which monitors multiple locations at once to see which devices have been present at two or more specific places.

A results page then displays the list of discovered devices. This includes whether the phone is an Android or iOS device; the number of days the device visited a given location; the average amount of time a device stayed at the location; and the total number of pieces of location data for that phone.

A screenshot of Penlink marketing material. Available here.

The material does not say how Penlink obtains the smartphone location data in the first place. But surveillance companies and data brokers broadly gather it in two different ways. The first is from small bundles of code included in ordinary apps called software development kits, or SDKs. SDK owners then pay the app developers, who might make things like weather or prayer apps, for their users’ location data. The second is through real-time bidding, or RTB. This is where companies in the online advertising industry place near instantaneous bids to get their advert in front of a certain demographic. A side effect is that companies can obtain data about peoples’ individual devices, including their GPS coordinates. Spy firms have sourced this sort of RTB information from hugely popular smartphone apps. 

The Webloc material says users can filter devices by their unique Apple and Android advertising identifiers, which are often collected by surveillance companies. The material also says users can filter location data by GPS, WiFi, or IP address.

“​​It's dangerous for ICE or any government agency to be vacuuming up this type of sensitive data in bulk and absent checks. This type of surveillance dragnet will enable draconian policing and  abuse,” Jake Laperruque, deputy director of the Center for Democracy & Technology's Security and Surveillance Project, told 404 Media.

Senator Ron Wyden, whose office has repeatedly investigated the location data industry, told 404 Media, “Under Trump, ICE has terrorized American cities with zero regard for due process or the wishes of the people who live there. In the hands of Trump’s shock troops, location data could do tremendous harm to people who have done nothing wrong.”

ICE paid nearly $2 million for access to Tangles in September, Forbes reported. The agency then bought additional licenses in December for another $312,500, according to public procurement data. The purchase was on behalf of ICE’s Homeland Security Investigations (HSI), which traditionally has focused on criminal investigations, but has recently been roped into ICE’s mass deportation effort, according to data obtained by the CATO Institute.

A document ICE previously published signalling its intent to buy the products explicitly mentioned Webloc. Webloc isn’t a unique capability in the location data industry. A former employee of a similar company called Babel Street previously told me users can draw a shape on a map to see all devices Babel Street has for that location, then see where else that device has been. But the ICE document indicated the agency chose Penlink over its competitors because the company provides an “all-in-one” tool for searching both masses of location data and information from social media.

A government official told 404 Media commercial location data can be less useful than other types of location information, such as that from telecoms. 404 Media granted the official anonymity as they weren’t permitted to speak to the press. One glaring issue for government users is if a target’s device happens to be in the sold dataset or not. For example, the IRS previously tried to use location data from Venntel to find where targets lived, but were unsuccessful because the people the agency were looking for weren’t included in that particular dataset. 

Location data has been used to identify groups, or movements, of people. When the Wall Street Journal first revealed the sale of commercial location data to government agencies, it reported Customs and Border Protection (CBP) used the data to look for phone activity in unusual places along the Mexican border. The report also said ICE had used the data to help identify immigrants who were later arrested.

A screenshot of the internal ICE legal analysis. Available here.

The ACLU obtained an internal ICE legal analysis on the use of smartphone location data through a Freedom of Information Act (FOIA) lawsuit. At the time it was written it was discussing data from another location broker. But it provides insight into ICE’s legal justification to not seek a warrant when using such data. 404 Media has uploaded a copy of the document here.

“Under longstanding Supreme Court precedent, an individual has no reasonable expectation of privacy under the Fourth Amendment in information voluntarily disclosed to third parties,” the analysis says, referring to data collected by location data companies and sold to the government. The rationale is that the phone’s owner has provided this information willingly because they could, theoretically, remove apps gathering their location data or turn off location services altogether. (In multiple investigations into the location data industry, I’ve found apps did not always disclose how their location data might be used or sold, and in some cases apps still collected data even when people opted-out, meaning users could not have meaningfully consented.)

“The government’s justifications are tremendously self-serving. The government tries to satisfy privacy concerns by noting that this tracking data is attached to a phone’s AdID number instead of a phone number, but that’s a meaningless distinction,” Wessler from the ACLU continued. “This data allows precise tracking of millions of people’s phones, revealing granular detail about us that can be easily linked to our identities. Nobody expects that by carrying a phone, they are somehow consenting to let the government make a record of their every move. That’s a chilling power. The government’s scrabbling about for legal loopholes can’t cover for the massive privacy violation that this technology enables.”

In 2018 the Supreme Court ruled in the landmark Carpenter v. United States case that authorities need a warrant to access historical cellphone location data sourced from telecoms. The ICE legal analysis suggests that the agency does not think the same protection extends to commercially available smartphone location data.

“By claiming the power to buy access to this information with no judicial oversight, ICE can track any of us or all of us for as long as it wants at an agent’s mere whim. Anyone can become a suspect, and there’s no meaningful safeguard against abuse. And of course, in a time of rampant racial profiling by ICE agents, members of immigrant communities and communities of color are likely to suffer particularly acute harms,” Wessler added.

Senator Wyden added, “The Federal Trade Commission made clear in multiple settlements that selling location data from apps and online ads—including to the government—is a violation of federal law unless users receive clear notice and consent to selling their data to the government. But now that the FTC is effectively a wing of the White House, data brokers have continued to sell data to ICE and other agencies with impunity. The abuse of Americans’ personal data won't stop until Congress or states pass clear laws that give users an easy way to block the sale of their data, or to ban the sale of personal data altogether.”

The Department of Homeland Security (DHS) did not respond to a series of questions about ICE’s legal analysis or its use of Webloc.

ICE, CBP, and the Secret Service all broke the law when using commercial location data, a government report found in 2023. That included a CBP official using the technology to track the location of coworkers with no investigative purpose, and the agencies not having enough formal guardrails in place. At the time, the Inspector General recommended that ICE stop using commercial location data until it obtained the necessary approvals. ICE declined to do so. “CTD [Commercial Telemetry Data] is an important mission contributor to the ICE investigative process as, in combination with other information and investigative methods, it can fill knowledge gaps and produce investigative leads that might otherwise remain hidden. Accordingly, continued use of CTD enables ICE HSI to successfully accomplish its law enforcement mission,” the agency’s response read.

404 Media also obtained material related to Tangles, the social media monitoring product ICE bought access to. That shows users can detect faces in an image and then attempt to identify them; perform sentiment analysis on a target’s posts; and add specific social media accounts to a “watch list.” Independent journalist Jack Poulson previously reported on Tangles material showing how the tool could be used to monitor protesters, including the Black Lives Matter movement.

A Penlink spokesperson told 404 Media in an email, “The tools we provide to the government exclusively use publicly or commercially available data and are used to advance criminal investigations and save lives. They enable law enforcement to spot threats faster and use evidence more efficiently.”

It added, “Penlink operates under strict compliance, due diligence, and responsible-use standards. PenLink is committed to transparency, legality, and integrity in every aspect of our work.”