【衝撃】米税関・国境警備局、アドテクを悪用して市民の移動を追跡していたことが判明

米税関・国境警備局（CBP）が、オンライン広告のエコシステム（アドテク）に食い込み、人々の移動履歴を追跡していたことが明らかになりました。普段私たちが目にしている広告の裏側で収集される位置情報データなどが、法執行機関による監視ツールとして転用されている実態が浮き彫りになっています。

https://archive.md/N3BZV (https://archive.md/N3BZV)

Taxpayers' money used to track taxpayers and finance the advertising industry.

I can’t respond directly to octoclaw’s dead comment (edit: embarrassingly this was an LLM), but I will just say I agree, it is ridiculous both how cheap this data is and how many people aren’t aware of it. It’s not just governments who can get access, either.

This is another reason why you should not be carrying a phone everywhere except for times where you absolutely need one.

I work with Ad Data a lot in my job, and there's a lot of misconceptions about what this data that journalists love to propogate:

The location data in these networks is very inaccurate. Your OS and browser actually do a pretty good job of locking down your location data unless you give explicit permission. It's in the ad network's interests to lie about the quality of their data - so a lot of the "location" data is going to be a vaguely accurate guess based on your IP address.

But also, location data is really important to ads right now because, contrary to common perception, per user tracking is very, very hard. Each SDK might be tattling on you, but unless you give them a key to match you across apps, each signal from each app is unique. Which is why you are often served advertisements based on what other people on your network is searching - it's much easier to just blast everyone at that IP address than it is to find that specific user or device again in the data stream.

Bidstream data in particular is very fraught. You're only getting the active data at the point the add is served, but it's not easy to aggregate in any way. You'll be counting the same person separately dozens or hundreds of times with different identifiers for each. The data you get from something like Mobilewalla is not useful for tracking individuals so much as it's useful for finding patterns.

I think it's pretty telling from the few examples shared about how agencies actually use the data:

"CBP uses the information to “look for cellphone activity in unusual places,” including unpopulated portions of the US-Mexico border."

According to the Wall Street Journal, the IRS tried to use Venntel’s data to track individual suspects, but gave up when it couldn’t locate its targets in the company’s dataset.

In March 2021, SOCOM told Vice that the purpose of the contract was to “evaluate” the feasibility of using A6 services in an “overseas operating environment,” and that the government was no longer executing the contract

Something is going to have to be figured out about this data - realistically the only way is a sunset on customized advertisements. However, I would personally not be worried (yet) that the government is going to be able to identify an individual and track them down using these public sources as they currently are.

That's Scroogled (2007) by Cory Doctorow! Life imitates art, again.

https://web.archive.org/web/20070920193501/http://www.radaro... (https://web.archive.org/web/20070920193501/http://www.radaronline.com/from-the-magazine/2007/09/google_fiction_evil_dangerous_surveillance_control_1.php)

I have 26 apps on my phone. Of those, four are Safari extensions, one is a PWA and another I wrote myself. I use a restrictive nextDNS profile that also blocks Apple's native tracking (as best they can) and don't use social media. I feel like that's the best I can realistically do.

I am surprised the article does not mention obvious mitigation strategies, including network-wide DNS blacklists, browser ad blockers, and not using proprietary apps on phones.

Is this something European style privacy laws would protect against? Though given the US political situation we are far from being able to enact any kind of anti-authoritarian protections...

I have never regretted my decision to aggressively block ads on every device I use, and to shun devices where I can't.

I run as few apps as possible, use Firefox / Ublock on my phone. I do play the odd card game (ad-supported), but only 1 or 2 times a month. I may just buy the app outright at some point.

Does sharing location with family (Android) leak any data?