Intelligence agencies use advertising data for surveillance

The practice, which experts consider a violation of constitutional rights, gained a new dimension with the advancement of artificial intelligence (AI), which allows billions of records to be automatically cross-checked and analyzed.

A survey carried out by German security researchers with 11 European intelligence agency regulators concluded that the use of advertising data for surveillance represents a profound change in the way secret services operate around the world, and that, in most countries, there is practically no regulation on this practice. The study was published in June by think tank European Interface, specialized in technology and surveillance.

How data reaches agencies

The process begins when a person opens an app or website with ads. Even before the ad appears on the screen, the online advertising system collects information about that user, such as approximate or precise location, type of device, IP address, application used, interests and other behavioral signals.

This data is gathered in a package sent to companies interested in purchasing that advertising space. This sending takes place in milliseconds, in a system known as a real-time auction. In theory, companies receive the data to decide whether they want to pay to show an ad to that person.

The problem is that not only the company that wins the auction has access to the information. According to the Electronic Frontier Foundation (EFF), an American organization defending digital rights, several auction participants can receive the data at the same time, even if they do not buy the ad.

This is where data brokers come in. These companies collect, organize and sell information about people. They take advantage of the data exposed in advertising auctions to create large databases with location records, browsing habits and behavioral profiles.

These databases then feed an industry specialized in transforming advertising information into surveillance tools. The sector is known as They didn’tan acronym in English for advertising intelligence. In practice, data that was originally collected to sell advertisements is now used to monitor movements, identify cell phones and reconstruct a person’s routine.

The industry that sells surveillance to governments

The sector of They didn’t Today it moves billions of dollars and involves at least 15 companies identified by the French newspaper The Worldwhich earlier this year accompanied confidential commercial demonstrations of these tools for security forces in different countries.

Most of these companies are based in Israel and were founded by former members of the Israeli intelligence services or armed forces. Others operate in the United States and Europe. According to the The Worldsales representatives promise to track any cell phone in the world, in almost real time, without the need for collaboration with telecommunications operators.

The American company Penlink, whose They didn’t is of Israeli origin, stated in one of these presentations that he has collected data from all countries in the world since 2019, updated with a frequency ranging from two minutes to 24 hours. The Italian company RCS sells a tool called Ubiqo capable of tracking cell phones with a history of up to ten years. Israeli Wave Guard Technologies promotes its AdVantage platform with the slogan: “any device, anytime, anywhere.”

Recently, the United States Immigration and Customs Enforcement (ICE) acquired a They didn’t for US$5 million, according to the magazine Forbes. The same body also signed a contract with Penlink to use the Webloc program, which allows tracking cell phone movements or identifying devices that visited certain locations.

What agencies can find out about you

In theory, the data used by these tools is presented as anonymous. They do not initially appear with a name, CPF or address, but are linked to an advertising identifier, a sequence of letters and numbers assigned to the cell phone by Apple or Google systems.

In practice, however, this anonymity can be reversed. Companies in the sector offer ways to cross-reference this identifier with other databases, such as leaked records on the internet, commercial registrations, addresses and names. With this, a code that seemed anonymous can be associated with a real person.

According to the The Worldrepresentatives of the Italian company RCS stated, in one of the demonstrations followed by the newspaper, that they had managed to link advertising identifiers to real identities on a national scale, removing the anonymity of 95% of Italian mobile devices. The company denied the statement when questioned by the newspaper. Other companies, such as Penlink, have made similar promises to security officials.

From then on, the data no longer just shows where a cell phone has been. By monitoring a device for days, weeks or months, it is possible to find out where the person lives, where they work, what routes they take, who they meet, what places they frequent and even whether they have been to clinics, churches, political demonstrations or private events.

This type of information can be used to assemble detailed profiles of behavior. If a cell phone always spends the night at the same address, spends the day in another location and visits a certain person frequently, the system is able to reconstruct part of the user’s routine. When these records are combined with artificial intelligence, analysis can be done automatically on millions or billions of records.

Europe also uses this type of surveillance

The use of advertising data for surveillance has also advanced in Europe. According to the Interface study, the They didn’t has become one of the main sources of data used by security services on the continent, despite regulation of the service still being scarce or non-existent in several European countries.

In practice, European intelligence agencies purchase access to continually updated databases from private suppliers. These bases may include unique cell phone identifiers, precise location over time and detailed information about application user profiles.

According to Thorsten Wetzling, one of the study’s authors, these packages can gather everything from basic data, such as age, gender and location, to sensitive inferences about political preferences, sexual orientation and religious beliefs.

The survey also found that larger agencies purchase commercial data in bulk directly from private companies. In some cases, according to researchers, the purchase is made through shell companies, used to hide the identity of the public body and the real interest behind the acquisition.

In France, the external intelligence service, the DGSE, even asked Parliament, in 2021, to create a law to regulate the purchase of commercial data by intelligence bodies. So far, however, there has been no agreement on a specific standard.

FBI does not deny purchasing advertising data for surveillance

At a US Senate hearing in March, FBI Director Kash Patel was asked by Democratic Senator Ron Wyden whether the agency purchased Americans’ location data. At the time, Patel did not deny the practice.

The director said the FBI buys “commercially available information” and said this material is used in accordance with the Constitution and American laws. According to him, this data has already yielded “valuable intelligence” to the agency.

Patel’s speech indicated a change from the FBI’s previous position. In 2023, the then director of police, Christopher Wray, said the force had moved away from using location data derived from online advertising.

In addition to the FBI, the Department of Homeland Security and ICE, as already mentioned, also maintain known contracts with tools based on location data obtained by data brokers.

AI expands the power of surveillance

Artificial intelligence has made this type of surveillance more powerful. Previously, the volume of data made manual analysis difficult. Now, automated systems can cross-reference millions of location records, identify behavior patterns, map relationships between people and point out likely movements.

As a result, data purchased on the private market can be used to create detailed profiles about a person’s life. The analysis can indicate where she lives, where she works, who she meets, what places she frequents and what habits she maintains over time.

Dario Amodei, founder of the American artificial intelligence company Anthropic, warned that records purchased by the government can be used by AI systems to assemble a broad portrait of any person’s life, automatically and on a large scale. Anthropic refused to allow its technology to be used for mass domestic surveillance, which sparked conflict with the Pentagon.

Purchasing data circumvents the requirement for a court order

By purchasing data from private companies, the government circumvents legal requirements, such as judicial authorization. As this information is not collected directly by public bodies, it often escapes the rules applied to wiretapping, requests to operators or other traditional forms of state surveillance.

In the United States, the Supreme Court ruled in 2018, in the case Carpenter v. United Statesthat authorities need a court order to obtain cell phone location history through telephone towers. But purchasing similar data on the private market still remains in a legal gray area.

Privacy experts say that, in practice, the government is able to access information through private companies that it might not otherwise obtain directly without judicial authorization. That is why the issue began to be treated as a way to circumvent constitutional guarantees.

“Our privacy and our constitutional rights should not be for sale, at any price,” he told Financial Times national security analyst Patrick Eddington, senior researcher at the Cato Institute.

US Congress still debates initiatives to stop data purchases

In the United States, Republican and Democratic lawmakers have presented proposals in Congress to restrict the purchase of personal data by government security agencies. The idea is to prevent public bodies from purchasing information from data brokers that would require a warrant if obtained through traditional means.

The latest discussion in this regard gained momentum during the parliamentary debate on the renewal of Section 702 of the Foreign Intelligence Surveillance Act, known by the acronym FISA. The idea united a group of Republican and Democratic parliamentarians, such as Warren Davidson, Mike Lee, Zoe Lofgren and Ron Wyden. They tried to tie the ban on data purchases directly to the FISA renewal language as a privacy requirement.

The proposal, however, faced resistance from the White House and the president of the House, Republican Mike Johnson, who defended the renewal of the surveillance law without changes. The attempt to merge the agendas failed and the American government managed to approve the continuation of Section 702 of FISA without the loophole regarding the purchase of corporate data being closed.