ATF Cancels Controversial Geolocation Contract
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has canceled a contract with Penlink, a company that provides geolocation data through ad-surveillance technologies. The contract was canceled just over a month after ATF Director Robert Cekada acknowledged the agency's purchase of the data in a congressional hearing.
Cekada stated that the agency had purchased access to the system, but had not used it for a criminal case due to the lack of established policies on its use. The system was described as novel, and the ATF was still determining how to craft official guidance for its use in investigative work.
Background on the Contract
An ATF spokesperson confirmed the cancellation of the contract, describing it as a limited pilot project for capabilities the agency was no longer seeking. The spokesperson stated that the ATF continually evaluates tools and techniques to enhance investigations and reduce violent crime, but determined that the Penlink tool did not meet their needs.
According to Sen. Ron Wyden, the ATF had already conducted over 340 searches using the system, including over 222 directly tied to active ATF case numbers. Wyden's office noted that the purchase of ad-tech geolocation data is illegal in some states, and that the Federal Trade Commission has established that selling sensitive location data to government agencies and contractors falls under deceptive and unfair practices under the FTC Act.
Privacy Concerns and Legislative Response
Wyden, who led a group of 70 congressional Democrats calling for an investigation into the purchase of commercial location data by Immigration and Customs Enforcement, stated that the ATF did "the right thing" by canceling the contract. However, he called for Congress to pass his legislation, the Government Surveillance Reform Act, to close the data broker loophole once and for all.
The use of ad-tech to surveil and geolocate targets online is a growing problem, with bad actors using these tools to unmask identities or locations of individuals, or combine them with other public data in ways that worry privacy advocates. A University of Tennessee student is suing a company based in the Virgin Islands for using ad-tech geolocation to serve nonconsensual ads to men online near her.
Wyden's office cited an instance where the tool was used to get location data for devices associated with a defense contractor at the same time as a suspected arson incident, but the ATF later backed off from using it in court after both the prosecutor and judge expressed "serious discomfort" with the use of warrantless adtech data.
Conclusion
The cancellation of the ATF's geolocation contract with Penlink marks a victory for Americans' constitutional rights, but highlights the need for further legislative action to address the issue of commercial location data and government surveillance. As Wyden stated, "Americans' privacy shouldn't depend on ad hoc congressional interventions."
The ATF's decision to seek a court order for bulk cell phone tower data instead of using the ad-tech geolocation data demonstrates the agency's recognition of the privacy concerns surrounding the use of such technologies. The incident serves as a reminder of the importance of balancing investigative needs with individual privacy rights.
Source: CyberScoop