ATF cancels phone tracking contract after lawmakers raise concerns

WASHINGTON (AP) — The Bureau of Alcohol, Tobacco, Firearms and Explosives canceled its contract for a surveillance tool that enables warrantless tracking of mobile devices after lawmakers, a prosecutor and a judge raised concerns about the legality of the tool in criminal investigations.

ATF, the federal agency responsible for enforcing the nation’s gun laws, told The Associated Press that it discontinued what it called a “pilot” program using a tool called Webloc after Rep. Michael Cloud, a Republican from Texas, and Sen. Ron Wyden, a Democrat from Oregon, expressed reservations about the agency’s use of bulk commercial location data.

Webloc, which is made by a vendor called Penlink, sources data from consumer apps and advertising networks, which collect the location of mobile devices from consumers who download apps or browse the web. Such data is sometimes called “ad tech” and has been controversial in criminal law enforcement as it allows agencies to bypass warrant requirements to identify the mobile devices present in certain areas at specific times.

The U.S. Supreme Court ruled in 2018 that police needed a warrant to obtain historic movement data from cellphone companies on a criminal suspect. But it has never addressed the growing practice of commercially acquired data.

Other users of Webloc include the U.S. military and U.S. Immigration and Customs Enforcement but also local law enforcement agencies such as police in places like Elk Grove, Calif. and Durham, N.C. The technology has also expanded around the world, with the national police in El Salvador and Hungarian intelligence agencies as customers, according to a report from earlier this year from Citizen Lab, a group of researchers at the University of Toronto who investigate digital threats to civil society.

“A victory for Americans’ constitutional rights”

ATF said in a statement that it determined that the tool “does not meet our needs.” The agency said it is not using any other ad-tech-sourced services.

“ATF continually evaluates tools and techniques to enhance our investigations and ultimately reduce violent crime in American communities. We did conduct a pilot with Webloc to determine if it could improve our investigative capabilities,” an ATF spokesperson said in an email.

Wyden called ATF’s decision to abandon the software “a victory for Americans’ constitutional rights.”

“For years, I have warned that the government’s purchase of Americans’ location data from shady data brokers is an unacceptable end-run around the Fourth Amendment,” Wyden said in a statement. After Rep. Cloud and my staff informed the ATF about the legal and privacy quagmire surrounding adtech data, the agency did the right thing.”

Under questioning from Cloud, ATF Director Robert Cekada acknowledged in a congressional hearing in May that the agency had been buying geolocation data on American cell phones.

After the hearing, Wyden and Cloud’s office were briefed by ATF. In a joint press release, the two lawmakers said they learned ATF had conducted more than 300 warrantless searches using the tool — including more than 200 tied to active ATF cases.

In one instance involving suspected arson at a facility belonging to a U.S. defense contractor, both a prosecutor and a judge expressed concerns about the use of Webloc ad tech data, according to the two lawmakers. The agency “was ultimately forced to backtrack and obtain a traditional court order for bulk cellphone tower data” from cell carriers instead, Wyden and Cloud said in a release.

Webloc was originally made by an Israeli company called Cobwebs before it was bought and merged with a U.S. company called Penlink.

Penlink said in a statement that it is “proud to have a long-standing relationship with ATF that has enabled us to support its mission to protect America’s communities from violent crime involving the illegal use of firearms, explosives and arson.” The company added that it “looks forward to continuing our relationship in support of that mission.”

Practice continues in other government agencies

Other law enforcement agencies, including the FBI and the Department of Homeland Security continue to buy commercial geolocation data.

DHS issued a request for information to private industry in January asking about how commercially available advertising data might be used to assist in its deportation and law enforcement mission. And earlier this year, FBI director Kash Patel told the Senate: “We do purchase commercially available information that’s consistent with the constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us.”

A bipartisan group of lawmakers, including Wyden, Republican Sen. Mike Lee of Utah, Republican Rep. Warren Davidson of Ohio, and Democratic Rep. Zoe Lofgren of California, have introduced a bill that would ban the practice of buying data without a judicial order.