.jpg "Apps Illegally Sold Location Data of US Military and Intelligence Personnel")
.jpg)
Earlier this year, news reports revealed that a Florida-based data brokerage company had engaged in the sale of location data belonging to US military and intelligence personnel stationed overseas in the course of its operations.
While at the time, it remained unclear to us as to how this sensitive information came into existence.
However, recent investigations reveal that the data was collected in part through various mobile applications that operated under revenue-sharing agreements with an advertising technology company headquartered in Lithuania.
An American company later resold this data, which was then resold by that firm. Location data collection is one of the most common practices among mobile applications. It is an essential component of navigation and mapping, but it also enhances the functionality of a variety of other applications, such as a camera app that embeds geolocation metadata in the images captured.
There are concerns raised by the fact that many applications are collecting location data without a clear or justified reason. Apps that run on Apple's iOS operating system, on the other hand, are mandated to request permission to access location data before they can perform any operation.
Since almost all iPhone users have experienced such requests at some point, even if the use of location tracking does not seem necessary, it is common for them to suggest such requests. Regulations provide a level of transparency and control over the collection and use of sensitive information regarding location that is designed to ensure privacy.
The presence of location data is extremely important for a considerable number of mobile applications, but the necessity of collecting this data for each application varies. For example, mapping services and transit navigation applications are dependent on location data to function effectively.
As well as providing location tracking benefits, there are other cases in which it has a secondary benefit, such as when GPS metadata is stored by camera applications, allowing users to search for and organize photos based on where they were taken and to organize them by location.
In Apple's native Camera app, for example, this feature is incorporated to enhance the user experience. Unfortunately, many other applications are also collecting location data without clearly defining a purpose, raising privacy as well as security concerns.
As part of Apple's policy, applications that access location data on iOS devices are required to ask for user permission before taking advantage of this.
In consequence, users are commonly confronted with permission requests for location tracking even when they do not need to track their location, which highlights the importance of transparency when it comes to data collection practices and allowing users to control them.
After it was revealed that American military personnel were selling unauthorized location data, Senator Ron Wyden (D-WA) requested clarification from Datastream as to the source of the data that was being sold.
As soon as Wyden's office became aware of the involvement of Eskimi, an ad-tech company based in Lithuania, it attempted several times to contact the company to check on its involvement. However, it did not receive a response.
The senator then escalated the issue and reported the incident to Lithuania's Data Protection Authority (DPA) due to the possible national security implications associated with the sale of sensitive location data about U.S. military personnel.
The Lithuanian DPA initiated an official investigation into the incident as a response to the incident. However, the results remain pending. This case has underscored the complexity of the location data industry, which is characterized by the fact that information is often shared between multiple organizations without much regulation.
The incident has also highlighted the concern surrounding the collection, trade, and misuse of mobile location data, as well as the broader global concerns about it, which has led regulatory bodies around the world to pay greater attention.
Due to the incident, many have been asking what risks there may be associated with commercial data collection in association with national security challenges.
During his speech at the Silent Push senior threat analyst conference, cybersecurity expert Zach Edwards pointed out that "advertising companies often function as surveillance companies with better business models" and expressed this concern. According to him, the growing apprehension regarding the collection, sharing, and monetization of personal and sensitive information in the digital advertising industry is reflected in his observation.
The risks associated with location data are so significant that security experts suggest people adopt proactive measures to secure their location data. Users of smart devices are highly encouraged to disable location services when they do not need them to minimize the chances of their data being exposed.
Moreover, people who work in the government or handle sensitive information should also take advantage of VPNs (Virtual Private Networks) that can add an extra layer of protection to their systems.
Mobile devices are continuously storing and transmitting vast amounts of location data through various applications, and thus, such precautions are becoming increasingly important as a protective measure against potential security threats due to their growing prevalence.
A detailed investigation of the source mobile applications responsible for providing the location data has not yet been conducted, and the investigation into the specific apps responsible for the data is still ongoing.
The agreement signed by app developers does not explicitly imply that their data can be sold or resold, although that might be possible if the data is used only for in-app advertising, as it appears to be at present.
A fundamental concern that has arisen as a result of this ambiguity is the lack of transparency and regulatory oversight about data-sharing agreements in the digital advertising sector.
It is also worth noting that despite the absence of any specific allegations that the goal of the initial collection of this data was to collect information about U.S. military personnel, the process of filtering the user location data so that users closest to U.S. military bases could be identified is a straightforward one technically speaking.
A wide range of risks are associated with the general collection and distribution of location data in such a manner that it can fall into the hands of unauthorized entities, especially when such data is widespread and easy to access.
There is a growing consensus among cybersecurity experts that the trade in commercial location data has significant security implications.
Several advertising technology companies sell location data every day to a variety of customers, including corporations, government agencies, media companies and other businesses, according to Zach Edwards, a senior threat analyst at Silent Push.
He described these companies as operating fundamentally as surveillance entities under the guise of legitimate business models, emphasizing the increasing overlap between commercial data collection and surveillance operations. His assessment underscores the pressing need for enhanced regulatory measures and stricter safeguards to prevent the misuse of sensitive user information and ensure greater accountability in data handling practices.
