Remember last month, when we learned that AT&T, T-Mobile and Sprint had not immediately fulfilled their promises to stop selling the real-time location of your phone to shady third-parties, and a black market had sprung up to meet the demands of even shadier individuals who might like to know where you are?
Well, Motherboard is doubling down on the investigation that revealed these things, and today it’s reporting that the scandal may be larger than we thought. You’ll probably want to take a look at their full story, but the gist is this: until late 2017, a second-hand data broker called LocationSmart sold data to a third-hand data broker known as CerCareOne, which in turn let as many as 250 bounty hunters and bail bondsman find an AT&T, T-Mobile or Sprint phone’s real-time location for a fee.
That’s presumably in addition to the data these carriers shared with Zumigo and Microbilt, the second-hand and third-hand data brokers we learned about last month.
Motherboard’s sources also provided documents that suggest that CerCareOne sold access to A-GPS tracking data, too — originally designed to help emergency 911 services help find victims more quickly and precisely by combining location data from cellular networks and satellites simultaneously to pinpoint your phone. Just the sort of thing you’d want out there in the wild, no?
A couple of caveats worth noting:
- When Motherboard interviewed a couple of bail bondsmen, they claimed they always got explicit consent from their customers to be tracked this way, in case they skipped out on their bonds. But clearly not all bondsmen are that scrupulous, or else there wouldn’t be a black market.
- All of this happened in the past. Motherboard says both LocationSmart, and its anonymous sources, confirm that CerCareOne is no longer sharing location data. AT&T tells The Verge that the service ended two years ago.
And — at least according to the carriers — this saga will soon end for good. Last month, all three carriers re-committed to ending the sale of location data, with T-Mobile and AT&T setting a deadline of March. Verizon told The Verge that it had already stopped the practice, except for sharing with some roadside assistance companies, which it was in the process of stopping as well.
T-Mobile and Sprint didn’t immediately respond to our requests for comment on the latest Motherboard story, but AT&T shared this message:
We are not aware of any misuse of this service which ended two years ago. We’ve already decided to eliminate all location aggregation services—including those with clear consumer benefits—after reports of misuse by other location services involving aggregators.
Hopefully, the days of outsourcing access to anyone’s real-time location are behind us — but if carriers thought that was OK until proven otherwise, it makes me wonder what other unwanted practices might be going on.