Skip to main content

Carriers selling your location to bounty hunters: it was worse than we thought

Carriers selling your location to bounty hunters: it was worse than we thought

/

Never pass up a chance to say ‘bounty hunters’ in a headline

Share this story

security camera

Remember last month when we learned that AT&T, T-Mobile, and Sprint had not immediately fulfilled their promises to stop selling the real-time location of your phone to shady third parties, and a black market had sprung up to meet the demands of even shadier individuals who might like to know where you are?

Well, Motherboard is doubling down on the investigation that revealed these things, and today it’s reporting that the scandal may be larger than we thought. You’ll probably want to take a look at their full story, but the gist is this: until late 2017, a secondhand data broker called LocationSmart sold data to a thirdhand data broker known as CerCareOne, which in turn let as many as 250 bounty hunters and bail bondsman find an AT&T, T-Mobile, or Sprint phone’s real-time location for a fee.

I’m going to go out on a limb and say real-time location data probably shouldn’t be outsourced

That’s presumably in addition to the data these carriers shared with Zumigo and MicroBilt, the secondhand and thirdhand data brokers we learned about last month.

Motherboard’s sources also provided documents that suggest that CerCareOne sold access to A-GPS tracking data, too — originally designed to help emergency 911 services find victims quickly and precisely by combining location data from cellular networks and satellites simultaneously to pinpoint your phone. Just the sort of thing you’d want out there in the wild, no?

A couple of caveats worth noting:

  • When Motherboard interviewed a couple of bail bondsmen, they claimed they always got explicit consent from their customers to be tracked this way, in case they skipped out on their bonds. But clearly not all bondsmen are that scrupulous, or else there wouldn’t be a black market.
  • All of this happened in the past. Motherboard says both LocationSmart and its anonymous sources confirm that CerCareOne is no longer sharing location data. AT&T tells The Verge that the service ended two years ago.

And — at least according to the carriers — this saga will soon end for good. Last month, all three carriers recommitted to ending the sale of location data, with T-Mobile and AT&T setting a deadline of March. Verizon told The Verge that it had already stopped the practice, except for sharing with some roadside assistance companies, which it was in the process of stopping as well.

T-Mobile didn’t immediately respond to our requests for comment on the latest Motherboard story, and Sprint declined to comment, but AT&T shared this message:

We are not aware of any misuse of this service which ended two years ago. We’ve already decided to eliminate all location aggregation services—including those with clear consumer benefits—after reports of misuse by other location services involving aggregators.

Hopefully, the days of outsourcing access to anyone’s real-time location are behind us — but if carriers thought that was okay until proven otherwise, it makes me wonder what other unwanted practices might be going on.