While almost everyone agrees that privacy is an essential facet of our lives, governments and the law enforcement agencies under them tend to have a different view on the matter. The American Civil Liberties Union (ACLU) recently obtained a trove of documents through a Freedom of Information Act (FOIA) request highlighting the widespread use of certain surveillance tools within the US government without any checks or balances. We are now learning of another tool that is seemingly used by law enforcement agencies across the US since at least 2018, known as Fog Reveal.
This tool is developed by Fog Data Science LLC, based in Virginia, and has been used in multiple criminal investigations including to trace an individual who participated in the deadly US Capitol attack on January 6, 2021. Despite its use across multiple police departments, Fog Reveal’s name doesn’t come up in court records too often, as per a detailed investigative report published by The Associated Press. Defense attorneys claim this glaring omission from court records makes them unable to defend cases where the technology is involved.
Police have used Fog Reveal to scour over 250 million phones obtaining billions of data points to generate map plots known as “patterns of life,” enabling officials to track people’s movements, even from the past. The Associated Press says that these surveillance projects were often undertaken without any official search warrants.
Police emails show that the Fog Reveal surveillance tool benefits from gathering advertising identification numbers originally generated by apps like Starbucks, Waze, and many others. These numbers are used to learn about an individual’s interests and where they have visited, so it’s no surprise that this data gets sold to Fog which then aids law enforcement agencies in carrying out surveillance as they see fit.
The documents were obtained by the non-profit digital rights group Electronic Frontier Foundation (EFF) through a FOIA request. Special adviser at EFF, Bennett Cyphers told AP that this can be likened to “a mass surveillance program on a budget.” A check through public spending database GovSpend shows that Fog sold its tool to at least 24 law enforcement agencies across a total of 40 contracts.
Fog refused to provide information on the number of police departments it currently supports. The firm claims that it obtains information from data brokers who “legitimately purchase” the requisite data from apps as per their legal agreements, reiterating that Fog does not have access to personal information.
Fog and its advocates say that police are technologically underequipped to tackle investigations into missing persons or kidnappings and that Reveal fills the gap. The relative mystery around the use of Fog is exacerbated by the fact that police and other law enforcement agencies will not openly talk about it.
Privacy rights groups like the EFF say this is an open violation of the Fourth Amendment of the Constitution which safeguards citizens from unjustified searches and seizures.
Davin Hall, who worked as a crime data analysis supervisor for the Greensboro Police Department in North Carolina, resigned in 2020 after repeatedly alerting the city council and police attorneys about the use of Fog’s tracking tool.
“The capability that it had for bringing up just anybody in an area whether they were in public or at home seemed to me to be a very clear violation of the Fourth Amendment,” Hall told the AP.
While the Greensboro Police Department confirmed the use of Fog in past investigations, officials said they haven’t renewed their subscription to the service, saying they couldn’t find evidence to suggest that the tool could “independently benefit investigations.”
Among the reasons why police departments across the US prefer Fog’s surveillance software is the subscription price, which starts from as low as $7,500 per year. Furthermore, internal police emails indicate that subscribing departments have often shared the technology with other local law enforcement agencies in nearby regions.
Fog also allows officials to obtain user location data significantly quicker as compared to a geofence warrant, which usually requires data from companies like Google and Apple and is often not available immediately — in many instances, these warrants can take weeks or months to be approved.
The Virginia-based company defends its software by claiming that all data is anonymized, claiming that it doesn’t have a mechanism where signals can be linked back to a particular device or individual. However, the police can leverage the company’s tool to search a device’s ad ID numbers or even geofence an entire region based on the individual’s location history.
There is little federal oversight on the commercial user data chain from generation to brokerage to downstream use. The lack of rules or enforcement has led to enormous controversies over how that data ends up being abused or stolen. Congress is holding onto bills that could finally bring a change to the way personal data is brokered and broken down, but it’s anybody’s guess as to when or even if these bills would be passed. In the meantime, while there isn’t much end users can do to limit data collection easily, we have tips on how you can try to do so.
