Big Telecom Sold Highly Sensitive Customer GPS Data Typically Used for 911 Calls

This is a breaking news piece. You can read our full investigation here.

Around 250 bounty hunters and related businesses had access to AT&T, T-Mobile, and Sprint customer location data, according to documents obtained by Motherboard. The documents also show that telecom companies sold data intended to be used by 911 operators and first responders to data aggregators, who sold it to bounty hunters. The data was in some cases so accurate that a user could be tracked to specific spots inside a building.

The news shows not only how widely Americans' sensitive location data has been sold through the overlooked and questionable data broker market, but also how the ease-of-access dramatically increased the risk of abuse. Motherboard found that an individual company made more than 18,000 data location requests through a data broker; other companies made thousands of requests. The full details of our investigation are available here.

"This scandal keeps getting worse. Carriers assured customers location tracking abuses were isolated incidents. Now it appears that hundreds of people could track our phones, and they were doing it for years before anyone at the wireless companies took action," Oregon Senator Ron Wyden said in an emailed statement after presented with Motherboard's findings. "That's more than an oversight-that's flagrant, wilful disregard for the safety and security of Americans."

A screenshot obtained by Motherboard of a phone being located via its GPS data. Motherboard has blurred and cropped parts of the image to protect individuals' privacy. Image: Motherboard

Between at least 2012 until it closed in late 2017, a now-defunct data seller called CerCareOne allowed bounty hunters, bail bondsmen, and bail agents to find the real-time location of AT&T, T-Mobile, and Sprint mobile phones. The company would sometimes charge up to $1,100 per phone location, according to a source familiar with the company. Motherboard granted a number of sources in this story anonymity to provide details about a controversial industry practice.

Some of the data available to CerCareOne customers included a phone's "assisted GPS" or A-GPS data, according to documents and screenshots of the service in action provided by two independent sources. A-GPS is a technology that is used by first responders to locate 911 callers in emergency situations. A letter to the Federal Communications Commission from a T-Mobile lawyer in 2013 noted that "A-GPS is reasonably the foundation of wireless [emergency] 911 location for both indoor and outdoor locations."

"Oftentimes A-GPS provides location information about where someone is inside a building," Laura Moy, executive director at the Center on Privacy & Technology at Georgetown University Law Center, told Motherboard in an email.

Blake Reid, associate clinical professor at Colorado Law, told Motherboard in an email that "with assisted GPS, your location can be triangulated within just a few meters. This allows constructing a detailed record of everywhere you travel."

"The only reason we grant carriers any access to this information is to make sure that first responders are able to locate us in an emergency," Reid added. "If the carriers are turning around and using that access to sell information to bounty hunters or whomever else, it is a shocking abuse of the trust that the public places in them to safeguard privacy while protecting public safety."

Both Reid and Moy said this was the first instance of a telco selling A-GPS data they had heard of.

Got a tip? You can contact this reporter securely on Signal on +44 20 8133 5190, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

A Sprint spokesperson did not directly answer whether the company has ever sold A-GPS data. When asked if T-Mobile has sold A-GPS data, a company spokesperson told Motherboard in an email "We don't have anything further to add at this stage." AT&T did not respond to a request to clarify whether it sells or has ever sold A-GPS data.

A list of a particular customer's use of the phone location service obtained by Motherboard stretches on for around 450 pages, with more than 18,000 individual phone location requests in just over a year of activity. The bail bonds firm that initiated the requests-known in the industry as phone pings-did not respond to questions asking whether they obtained consent for locating the phones, or what the pings were for.

"The scale of this abuse is outrageous," Eva Galperin, director of cybersecurity at campaign group the Electronic Frontier Foundation, told Motherboard in an email.

Subscribe to our new cybersecurity podcast, CYBER.