According to public records and internal emails obtained by The Associated Press, local law enforcement agencies from suburban Southern California to rural North Carolina have been using a mysterious cellphone tracking tool, sometimes without search warrants, that gives them the ability to follow people’s movements months in the past.
According to thousands of pages of corporate information, police have used “Fog Reveal” to examine hundreds of billions of records from 250 million mobile devices and have used the data to generate location analyses known to law enforcement as “patterns of life.”
Fog Reveal, a product of Virginia-based Fog Data Science LLC, has been utilized in criminal investigations spanning from the murder of an Arkansas nurse to the Capitol uprising on January 6 at least since 2018. Defense lawyers claim that since the instrument is seldom, if ever, referenced in court documents, it is difficult for them to effectively defend their clients in situations where the technology has been employed.
Two former senior Department of Homeland Security officials working for former President George W. Bush founded the business. It makes use of advertising identification codes, which according to Fog authorities are taken from widely used smartphone applications like Waze, Starbucks, and hundreds of others that target adverts based on a person’s actions and interests.
Then, firms like Fog are offered the advertising ID data.
Bennett Cyphers, a special advisor at the Electronic Frontier Foundation (EFF), a nonprofit that promotes digital privacy rights, described it as “kind of a mass surveillance program on a budget.”
The EFF requested the records and emails under the Freedom of Information Act. According to GovSpend, a business that monitors government spending, the organization shared the papers with the AP, which separately discovered that Fog sold its software in approximately 40 contracts to almost two dozen agencies. Analysts and legal experts who study such technology say the documents and the AP’s investigation provide the first public evidence of the broad usage of Fog Reveal by local police.
“Underfunded and understaffed”
“Local law enforcement is at the front lines of trafficking and missing persons cases, yet these departments are often behind in technology adoption,” Matthew Broderick, a Fog managing partner, said in an email. “We fill a gap for underfunded and understaffed departments.”
Because of the secrecy surrounding Fog, however, there are scant details about its use. Most law enforcement agencies won’t even discuss their use of the tool, raising concerns among privacy advocates that it violates the Fourth Amendment to the U.S. Constitution, which protects against unreasonable search and seizure.
What distinguishes Fog Reveal from other cellphone location technologies used by police is that it follows the devices through their advertising IDs — unique numbers assigned to each device. These numbers do not contain the name of the phone’s user, but can be traced to homes and workplaces to help police establish pattern-of-life analyses.
“The capability that it had for bringing up just anybody in an area whether they were in public or at home seemed to me to be a very clear violation of the Fourth Amendment,” said Davin Hall, a former crime data analysis supervisor for the Greensboro Police Department on North Carolina. “I just feel angry and betrayed and lied to.”
Hall resigned in late 2020 after months of voicing concerns about the department’s use of Fog to police attorneys and the city council.
While Greensboro officials acknowledged Fog’s use and initially defended it, the police department said it allowed its subscription to expire earlier this year because it didn’t “independently benefit investigations.”
Low price, little oversight
But federal, state and local police agencies around the U.S. continue to use Fog with very little public accountability. Local police agencies have been enticed by Fog’s affordable price: it can start as low as $7,500 a year. And some departments that license it have shared access with other nearby law enforcement agencies, the emails show.
Police departments also like how quickly they can access detailed location information from Fog. Geofence warrants, which tap into GPS and other sources to track a device, are accessed by obtaining such data from companies, like Google or Apple. This requires police to obtain a warrant and ask the tech companies for the specific data they want, which can take days or weeks.
Using Fog’s data, which the company claims is anonymized, police can geofence an area or search by a specific device’s ad ID number, according to a user agreement obtained by the AP.
But Fog maintains that “we have no way of linking signals back to a specific device or owner,” according to a sales representative who emailed the California Highway Patrol in 2018, after a lieutenant asked whether the tool could be legally used.
Despite such privacy assurances, the records show that law enforcement can use Fog’s data as a clue to find identifying information. “There is no (personal information) linked to the (ad ID),” wrote a Missouri official about Fog in 2019. “But if we are good at what we do, we should be able to figure out the owner.”
Privacy groups condemn police use of Fog.
“It’s wrong that advertisers secretly track us, and it’s criminal that they sell our data to police,” Albert Fox Cahn, director of the Surveillance Technology Oversight Project, said in a statement. “A country where officers can track nearly anyone, at any time, without a warrant doesn’t sound like a democracy. Because there is no oversight, we have no idea how often officers have abused this power already.”
Feds eyeing enforcement
Federal regulation of businesses like Fog is subject to changing legal standards. The Federal Trade Commission filed a lawsuit against Kochava on Monday for allegedly breaking the commission’s regulations by giving its clients advertising IDs that, like Fog, can be readily used to determine where a mobile device user resides, according to officials. Additionally, legislation that, if approved, would regulate the business is now before Congress.
Fog’s Broderick said in an email that the company does not have access to people’s personal infrmation, and that it draws from “commercially available data without restrictions to use,” from data brokers “that legitimately purchased data from apps in accordance with their legal agreements.” The company refused to share information about how many police agencies it works with.
“We are confident Law Enforcement has the responsible leadership, constraints, and political guidance at the municipal, state, and federal level to ensure that any law enforcement tool and method is appropriately used in accordance with the laws in their respective jurisdictions,” Broderick said.