A comprehensive investigation by Citizen Lab has brought to light the extensive use of an advertising based global geolocation surveillance system known as Webloc by various international and domestic agencies. The report identifies several high profile users, including Hungarian domestic intelligence, the national police in El Salvador, and a multitude of law enforcement departments within the United States. Developed by the Israeli firm Cobwebs Technologies and subsequently managed by Penlink following a 2023 merger, Webloc allows authorities to tap into a massive stream of data points. Penlink has been a long standing provider of digital evidence collection and analysis software to police forces since 1986. Within the United States, the tool has found a significant market among agencies such as Immigration and Customs Enforcement, the military, and various local police departments in major cities like Los Angeles, Dallas, and Baltimore. Smaller jurisdictions, including Pinal County and the City of Elk Grove, have also been identified as customers of this powerful tracking technology.
The functionality of Webloc revolves around its ability to harvest information from the digital advertising ecosystem, converting mundane app data into a sophisticated monitoring tool. Sold as an integrated add on to the social media intelligence system Tangles, Webloc provides access to records from approximately 500 million mobile devices worldwide. These records include unique device identifiers, precise location coordinates, and profile data collected from mobile applications. The platform effectively utilizes the massive amounts of data generated by the Real Time Bidding process in digital advertising to reconstruct the movements and behaviors of individuals. Originally announced in 2020, the system was marketed as a cutting edge platform capable of fusing web data with geospatial points to bridge the gap between digital activities and physical presence. Users can look back at up to three years of historical movement data, allowing them to track the personal characteristics and travel patterns of entire populations.
The ethical and legal implications of such technology are profound, as Webloc possesses the capability to infer specific locations from IP addresses and reveal the identities of device owners by pinpointing their home and work addresses. This level of intrusion has raised concerns regarding the lack of judicial oversight, with reports from media outlets like 404 Media and Forbes indicating that the tool is often used to track phones without a warrant. The history of the developer, Cobwebs Technologies, further complicates the narrative, as the firm was previously deplatformed by Meta in 2021 for engaging in reconnaissance and social engineering against activists and opposition politicians. Despite these controversies, the infrastructure for these services remains robust, with over 200 active servers detected globally, the majority of which are hosted in the United States, Singapore, and the Netherlands. This infrastructure supports the continuous monitoring of mobile advertising IDs and geolocated data points on a global scale.
In response to the findings, Penlink has maintained that the report relies on inaccurate information or misunderstandings of their current operations, specifically regarding practices following the acquisition of Cobwebs Technologies. The company asserts that it remains in compliance with state privacy laws. However, researchers from Citizen Lab emphasize that the use of such intrusive ad based surveillance by military and intelligence units often occurs without adequate oversight or legal warrants. The analysis also suggests historical links between the founders of Cobwebs and other known spyware entities, adding another layer of complexity to the surveillance landscape. This situation highlights a growing trend where law enforcement agencies bypass traditional legal hurdles by purchasing commercially available data that was originally intended for marketing purposes. As the digital advertising market continues to expand, the dual use of this data for state surveillance remains a critical point of debate for privacy advocates and policy makers worldwide.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
