ROB SCHMITZ, HOST:
What if I told you there was powerful software on your phone run by a third party that tracks your location and habits? It's not spyware that was covertly installed on your phone, but rather advertising data. And it can be used by law enforcement agencies to surveil anyone without a warrant or their consent. That's the reality for hundreds of millions of people around the world, according to a report out this month. The software is called Webloc. And researchers have found that a number of governments around the world use the data to track people, including here in the U.S. The report called "Uncovering Webloc" was put together by the Citizen Lab, a group that researches the impact of digital technology on human rights. Ron Deibert is a professor of political science and director of the Citizen Lab at the University of Toronto. Welcome, Ron.
RON DEIBERT: Thanks for having me, Rob.
SCHMITZ: So your report describes Webloc as ad-based surveillance. What is that, and how does that work?
DEIBERT: So basically, everyone who has a mobile phone and surfs the internet or visits social media, whenever they open up a website or open up an application, information about them is broadcast within a millisecond to thousands, potentially more, advertisers who bid on the opportunity to put an advertisement in front of you. And that information that's broadcast includes a lot of demographic information, information about your browser, about your device, your IP address, and so on - basically markers that identify you as who you are so that the advertisers can precisely push something in front of you in the hope that you will purchase it. Now, what we have discovered is that there are surveillance vendors that service government security agencies that realize that they can take advantage of this marketplace.
SCHMITZ: So before we get to the agencies that are using this, I'm just curious - how does something like this even get on someone's phone?
DEIBERT: Frankly, it's the way that the internet ecosystem has been designed around personal data surveillance. So most websites that you visit contain beacons or trackers or cookies that are...
SCHMITZ: Right.
DEIBERT: ...Implanted on your browser, and they can also collect a lot of information from you as you visit their website - information about your browser characteristics, your screen size, the device you're using, where you're located. This is essentially how the economy works around the digital ecosystem that we live in.
SCHMITZ: How does someone know if they have this on their phone, and how do you get it off your phone?
DEIBERT: Well, unfortunately, given that we live in a system that's designed to relentlessly harvest data from us as we go about our day-to-day lives, there's nothing you can really do to protect yourself comprehensively unless you don't use a phone or unless you don't use the internet. That said, there are a few things you can do to better protect yourself. For example, both Apple and Google offer the ability to go through selectively and identify which of your apps are sharing your location. If you turn off that location sharing information, you're inoculating yourselves to some degree.
SCHMITZ: But I'm curious - here in the U.S., what federal and local law enforcement agencies are using this?
DEIBERT: Well, a lot of them. So in our investigation, we were able to verify that ICE is a customer of...
SCHMITZ: OK.
DEIBERT: ...Cobwebs, the maker of this product called Weblocs, which is essentially the data advertising surveillance system that's sold by Cobwebs. The U.S. military is as well, Texas Department of Public Safety, DHS, district attorneys in New York, police departments in Los Angeles, Dallas, Baltimore, Tucson, Durham, many other smaller cities and counties. So it is quite extensive.
SCHMITZ: Now, there may be people who think that governments should be able to track potentially bad actors. You know, if this technology is on hundreds of millions of phones, I guess the idea is, like, who cares if a relatively small percentage are tracked? How do you respond to folks who believe that?
DEIBERT: Yeah. It's a good way of framing it. I would put it slightly differently. You know, we live in a dangerous world. We need law enforcement to make sure that we're safe and also to enforce human rights and ensure that laws are being followed. The problem is, if this type of highly invasive technology is used by law enforcement and intelligence agencies without proper oversight, without proper judicial authorization, they're essentially violating the constitutional protections that are in place to prevent abuse of power. That's the problem. It's not really the nature of the technology in question. It's the fact that it's being used in ways that clearly circumvent legal protections that protect citizens.
SCHMITZ: That's Ron Deibert, founder and director of the Citizen Lab at the University of Toronto. Ron, thanks for your time.
DEIBERT: Thank you very much.
SCHMITZ: NPR reached out to Penlink, the company that acquired Webloc, for comment. We have yet to hear back. Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
