This article is part of EFF’s investigation of location data brokers and Fog Data Science. Be sure to check out our issue page on Location Data Brokers.

An EFF investigation of public records acquired from dozens of state and local law enforcement agencies has uncovered a widely-used mass surveillance technology. Americans are accustomed to hearing about how the National Security Agency (NSA), the Central Intelligence Agency (CIA), and even the domestically-focused Federal Bureau of Investigation (FBI) have illegally swept up massive amounts of data on people living in the United States—but what about the state and local police? Fog Data Science LLC, a previously unknown company,  provides law enforcement with easy and often warrantless access to the precise and continuous geolocation of hundreds of millions of unsuspecting Americans, collected through their smartphone apps and then aggregated by shadowy data brokers.

What is Fog Data Science?

Fog Data Science is a company that purchases raw geolocation data originally collected by applications people use every day on their smartphones and tablets. Those applications gather location data about where your phone is at any given moment and sell it to data brokers, who in turn sell it most often to advertisers or marketers who try to serve you ads based on your location. That’s where Fog swoops in. According to documents created by the company, Fog purchases “billions of data points” from some “250 million devices” around the United States, originally sourced from “tens of thousands” of mobile apps. Then, for a subscription fee that many law enforcement agencies are happy to pay, Fog provides access to a massive, searchable database of where people are located.

This means that police can open up their Fog map and do a number of things. They can draw a box and see identifiers representing every device within that geographical area at a given time frame. They can also use a device’s ID to trace that device’s precise location history over months or even years. Fog does not require police officers to obtain a warrant or other court order before acquiring this location data (unlike communication service companies that hold their customers’ location data and generally do require a court order). Likewise, many police departments that use Fog do not require their officers to get a warrant.

This means that police, sometimes without a warrant, have the ability to track the precise movements of hundreds of millions of Americans as they go about their day. This is mass surveillance, often with no judicial oversight.

Is this allowed?

In a word, no. The Fourth Amendment protects us from unreasonable searches and seizures. In Carpenter v. United States (2018), the U.S. Supreme Court ruled that the Fourth Amendment requires police to get a warrant before seizing historical location data, called “cell site location information,” from phone companies. The Court reasoned that “seismic shifts in digital technology made possible the tracking of not only Carpenter's location but also everyone else's, not for a short period but for years and years.” This same reasoning should apply not just to police seizing our precise and continuous location data from phone companies, but also to police buying it from data brokers like Fog. Warrantless purchase of this data also violates the First Amendment, because police can use it to identify people who attend protests, which can discourage people from attending. Further, warrantless purchase of this data violates privacy statutes like California’s Electronic Communications Privacy Act.

Some police departments that use Fog do require officers to get a warrant. Records show that representatives for Fog have circulated a template warrant to police. However, even when used with a warrant, the Fourth Amendment forbids general, non-particular searches of the location data of all people who happen to be present at a particular place. For this reason, courts have held that “geofencewarrants to service providers, which seek location data about everyone present somewhere, violate the Fourth Amendment. Moreover, Fog significantly lowers the practical barriers that properly limit law enforcement use of dragnet surveillance. Once they receive approval, law enforcement clients can access Fog’s data instantly and repeatedly; the process can be slower and require more review when police send warrants to service providers for their customers’ data.

What are the dangers of this kind of program?

Police use of Fog is a major blow to civil liberties in the United States. With a click and drag of a mouse, police can see the devices of every person who attended a protest, follow them home to where they sleep, and open up people exercising their constitutionally-protected right to protest to more surveillance, harassment, and retribution. Police can also, for instance, track people whose devices have been inside an immigration attorney’s office, a women’s health clinic, or a mental health facility. Police could easily, with almost no oversight, use this tool to watch secret rendezvous between a journalist and their whistleblowing source. Not to mention that law enforcement officials have often abused such powers for malicious reasons.

This type of surveillance also makes people who live and work around heavily-policed areas more vulnerable to being regarded with suspicion by police. If you happened to be next door to a pizza shop that got robbed, or took a coffee break near graffiti, police could easily see your device located near the crime and recommend you for more surveillance.

Fog claims that their product is made of data willingly given by people. But people did not hand their geolocation data over to Fog or the police, willingly or even knowingly. Rather, they gave it over, for example, to a weather app so that they could see if it will rain in their town today. When they downloaded the app, they may have clicked a box purporting to grant various so-called “consents,” but no reasonable person expects this will result in the app tracking all their movements, the app developer selling this sensitive information to a data broker, and police ultimately buying it.

Fog also claims that their product is privacy conscious, because it does not contain personally identifying information like a person’s name or phone number. Not so. The police looking at a dot representing you on a map may not know your phone number or your name–but when they follow that dot to the place where you sleep at night, suddenly they have your address. A decade ago, researchers found that four spatio-temporal points were enough to identify 95% of the 1.5 million people whose movements were tracked in a 15-month set of phone mobility data. Claims that location data has supposedly been “anonymized” are highly dubious.

Does Fog have my data? How do I stop it?

It’s extremely difficult to tell whether Fog, and by extension police, has access to your data. If you have downloaded a third-party app on your smartphone and granted it access to location data in the past 5 years, you may want to assume the answer is yes.

If you live in California, you can submit a “right to know” request under the California Consumer Privacy Act to Fog’s data source, Venntel, at this link.

What can you do about it? The most effective thing is to lock down data sharing on your mobile device. First, you can disable ad tracking and the mobile ad identifier, which allows data brokers to tie tranches of data to your individual device. Here are instructions for Android and iOS. Second, you can try to limit how many applications on your phone have permission to collect geolocation data. For some applications, like those that give you driving directions, GPS data might be necessary, but for others—like daily cute dog pictures or a Chess app–consider revoking its access to that data.

But, the biggest thing we can all do is put pressure on Congress and the states to protect our privacy. It’s up to lawmakers to act fast to flip the switch and forbid government entities from buying geolocation data sold on the open market. We also need comprehensive consumer data privacy legislation, and a ban on online behavioral advertising, to reduce the supply of location data available for purchase.    

Read more about Fog Data Science: