Last year, four of the largest U.S cell carriers were caught red-handed selling their customers’ location data. They promised to change, but today, hackers can still buy your location on the black market – for no more than a few dollars.
Only 12 months ago AT&T, Verizon, T-Mobile, and Sprint were found to be selling customers’ data to a company named LocationSmart, which then sold that data to other companies. These third parties used this information to track people’s locations in real time as they saw fit. Once this wrongdoing was discovered and made public, cell carriers were pressured by the government and the public to stop selling users’ data without their consent. They promised they would, and everyone forgot about it.
That’s why we were shocked to hear that a Motherboard reporter successfully gave $300 to a bounty hunter to find the location of his phone. This proved that cell carriers hadn’t kept their promises after all.
LocationSmart wasn’t the only player in the location selling business. In this instance, the company Zumigo bought the reporter’s data from T-mobile and then sold the data onto another company – Microbilt. The latter sold the data to bail bond companies, one of which then found the reporter’s phone location almost instantaneously for a few hundred .
It looked like this: T-Mobile> Zumigo> Microbilt> bail bond company > The Motherboard
Each company in this ‘supply chain’ is shifting the blame to one another. Microbilt said that the bounty hunter shouldn’t have used this data to track devices, while T-Mobile said that they don’t cooperate with Microbilt. However, that doesn’t change the fact that T-mobile admitted working with Zumigo, which contradicts their statement and promises made a year ago:
“I’ve personally evaluated this issue & have pledged that @Tmobile will not sell customer location data to shady middlemen. Your consumer advocacy is admirable & we remain committed to consumer privacy.”
– John Legere, Chief Executive at T-Mobile
Motherboard also contacted Microbilt to ask how much such location data would cost. In their article they claim to have been sent a price list showing that locating a phone can cost you as little as $4.95. The price goes even lower if you need the location of more than one phone.
After this unprecedented experiment, AT&T stated that they would cut off any ties to any location aggregators, even those that need this information to locate roadside accidents or to prevent fraud. T-Mobile also confirmed that they will stop cooperating with any location aggregators, although they only pledged to do so by March.
Even though Motherboard’s drastic research has achieved a positive outcome, there are still many cell carriers that might secretly be selling our location data to shady middlemen. Some of these third parties might use this data for good reasons, but others clearly have no safeguarding policies and will share your location with anyone willing to pay.
Unfortunately, location tracking by phone service providers can't be blocked without actually shutting off your phone. However, there are other things you can do. Express your concern to your service provider directly. Contact your Congress members to encourage them to pass regulations that would force such companies to protect Americans' privacy.
For more news and tips on cybersecurity, subscribe to our monthly blog newsletter below.