Penlink, a U.S. digital-intelligence vendor, sells Webloc, a product that uses location data collected through advertising software in widely used mobile apps so police can track phones, Bloomberg News reported on Sunday, citing company presentations, training materials and interviews with seven current and former employees of Penlink and Israeli startup Cobwebs¹.

Company materials shown to international law enforcement last year depicted tracking people on Fifth Avenue in New York, near the European Central Bank in Frankfurt and close to the U.K. Parliament, Bloomberg reported¹.

Webloc, originally developed by Cobwebs, can track hundreds of millions of phones worldwide, reconstruct about 12 months of a device's movements and refresh data hourly, according to documents Bloomberg reviewed¹. Officers can zoom on a map and view phones present at a place and time, analyzing billions of location data points, the documents said¹.

The U.S. Supreme Court ruled in 2018 that agencies need a warrant to obtain location records from telecommunications companies, Bloomberg noted¹. The Justice Department has since argued that rule does not cover location data bought from commercial sources, the report said¹.

Webloc users include U.S. Immigration and Customs Enforcement, at least two branches of the U.S. military and more than a dozen American police forces, Bloomberg reported, citing sales records and people familiar with operations¹. Authorities in the United Kingdom, Saudi Arabia, the United Arab Emirates, Singapore, the Netherlands, Germany, Austria and Hungary have also acquired it, according to the same reporting¹.

Nathan Freed Wessler of the American Civil Liberties Union's Speech, Privacy, and Technology Project said the tools had expanded with little legal oversight¹. "It means that people are going to be investigated who the government has no business investigating," he said¹.

A Penlink spokesperson declined to discuss specific customers and said Webloc is provided only in support of law enforcement and national safety efforts¹. The company said strong privacy protections and lawful access must coexist and that it complies with applicable laws as those laws change¹.

Penlink, founded in 1986 in Lincoln, Nebraska, has long sold wiretap-analysis tools to U.S. agencies including the FBI, DEA, U.S. Marshals, Secret Service and DHS, according to sales records Bloomberg reviewed¹. Spire Capital acquired Penlink in 2022 and Cobwebs in 2023 for about $200 million¹. Licenses start around $100,000 a year, documents showed¹ Sean White of Spire Capital said Webloc was materially changed after the Cobwebs deal, is sold only to law enforcement and public-safety agencies, and has been used to find missing children, identify bank-robbery suspects and target trafficking groups¹. He said U.S. law on buying commercial location data remains an open question¹.

ICE spent about $9 million from 2022 to 2026 on four Cobwebs and Penlink contracts that included Webloc licenses, U.S. procurement records showed¹. A DHS spokesperson said ICE does not purchase illegal information and uses only tools it has legal authority to use¹. More than 70 Democratic lawmakers wrote DHS's inspector general in March seeking details on ICE's use of Webloc; they had not received a response, Bloomberg reported¹.

Citizen Lab at the University of Toronto listed state and local buyers including Texas DPS and police in Los Angeles, Dallas, Baltimore, Tucson, Durham, Elk Grove, California, and Pinal County, Arizona¹. Tucson Police said a license obtained with border-security funding had expired and was not renewed¹.

Bloomberg said Webloc has drawn location data from apps including AccuWeather, Muslim Pro and Multi Maze 3D; those publishers said they have no relationship with Penlink¹. Penlink said data partners obtain consent through app partners and do not give it a full list of those apps¹. The company denied buying data from Start.io after the Cobwebs acquisition, saying Cobwebs had only run a trial¹.

Montana last year banned police from buying location and other personal data without a warrant or court subpoena; Oregon, Maryland, New Jersey and Virginia have banned sales of precise location data, and Penlink said it stopped acquiring data on people in those places¹. The ATF canceled a Webloc pilot in June after questions from Rep. Michael Cloud and Sen. Ron Wyden¹.

Sources

1. bloomberg.comAds in Popular Apps Give Police a Powerful Tool to Spy on Users12:32 PM

Read the original at bloomberg.com ↗