'Lockdown Mode' comes to Android. Would you turn it on?
jsr, 5/16/2025, 4 engagements
jsr
Chasing digital badness at the citizen lab. All words here are my own.
Filtering by: privacy · clear filter
BREAKING: You checked the weather this morning.
And you just told a surveillance company where you sleep.
Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones.
No warrant required.
Read on to understand our latest Citizen Lab investigation + how to protect yourself.
HEARD OF ADINT? Aka ADvertising INTelligence?
Your apps don't just show ads.
They stream info about your GPS location + a unique identifier to HUNDREDS OF BROKERS EVERY SECOND.
The industry swears the data is "anonymous" but it's actually a Spies-eye-view. Of everyone.
THE "ANONYMIZED DATA" LIE Companies peddle the BS that advertising data is 'anonymous'
They want to keep you in the dark.
Because, behind the scenes...your weather app is a blinking tracking beacon.
And then players like Pen Link turn that beacon into a data flow.
And sell it to governments.
EXPORT-GRADE SURVEILLANCE Where does #Webloc, a tool that can monitor entire populations come from?
Well, it originated from notorious Israeli surveillance firm Cobwebs.
But like so many surveillance products, it's gone through some corporate ownership shuffling.
Now, it's sold by Pen Link. https://blossom.primal.net/cebecd52265591ed4b736653b3103df62606f939076f664a82fb3e97c0f3c5ac.png
YOUR AMERICAN RIGHTS DON'T PROTECT YOU American? Think you're protected by the 4th Amendment from ADINT?
I know my rights, get a warrant... right?
Well, some sheriff is just going to pull out the credit card & buy it.
EUROPE? NOT MUCH BETTER You're 🇪🇺European? Protected by #GDPR, right?
It may be a paper wall.
We sent 96 FOI requests & got some dubious answers.
Meanwhile our collaborator Szabolcs Panyi found multiple intel agencies in 🇭🇺#Hungary using Cobweb products.
If that's not bad enough, the Hungarian government filed charges against Szabolcs while he was collaborating with us.
That's after he revealed Russian influence operations targeting Hungary's upcoming election.
(He's also a past target of #Pegasus spyware...)
ONLY THE WORST BAD GUYS...RIGHT? 'We only use mass surveillance against the worst bad guys'
Tucson Police bought #webloc for sex trafficking.
And wound up using it to hunt a guy stealing cigarette packs from a CircleK gas station. https://blossom.primal.net/e0fdfe40c5806d221fe0ac763aedfd25e2914b8d9e2a85ead67550809c3acf3a.png
And monitor political protests (against Kamala Harris)
Mass surveillance turns regular citizens into surveillance targets.
And long history shows that the federal government has an insatiable appetite for tracking law-abiding people with inconvenient politics.
Whatever their stripe.
IT GETS WORSE Think #webloc is bad? Meet another Cobwebs product: #trapdoor.
Hallmarks of a hidden hacking kit + social engineering tools.
Shady looking stuff & much more investigation needed.
OH HAI BIG TECH Here's the thing, tons of this technology is hosted by big platforms.
And a sign of how surveillance vendors seek to leverage commercial relationships & infrastructure of big cloud providers.
TELL ME HOW TO STOP THIS Real talk, it's hard, but you can help starve the ADINT dragnet. Do this now:
IPHONE: ⚙️Settings➡️Privacy & Security➡️ Tracking
Turn off "Allow Apps to Request to Track"
ANDROID: ⚙️Settings➡️Privacy ➡️ Ads ➡️Delete Advertising ID
It's only a beginning, but you don't owe any of these companies a drop of your data.
TAKEAWAY Ad-tech built a warrantless surveillance system in the guise of a marketing tool.
You are the target. So are your kids. And your friends.
And it's being abused by some of the worst autocrats & security forces around the world.
The ADINT machinery is targeting you.
Search for your country & start asking questions.
It's time to bring more sunlight to this industry.
READ OUR FULL REPORT: https://citizenlab.ca/research/analysis-of-penlinks-ad-based-geolocation-surveillance-tech/
By my brilliant Citizen Lab colleagues Wolfie Christl, Astrid Perry, Luis Fernando Garcia, Siena Anstis, and Ron Deibert
GO DEEPER Want to learn more about #penlink & #webloc? There's some great reporting out there.
Like this investigation by 404 Media / Joseph Cox
https://www.404media.co/inside-ices-tool-to-monitor-phones-in-entire-neighborhoods/
Another good piece by Forbes' Thomas Fox Brewster: https://www.forbes.com/sites/thomasbrewster/2025/09/18/ice-spends-millions-on-social-media-spy-tech-banned-by-meta-facebook/
It's simple, your #privacy #security and #freedom are at constant risk by private companies that help governments trample on your rights.
They deserve maximum exposure. Thanks for reading!
Friends don't let friends get their eyeballs scanned to buy a coffee.
This portable dystopia machine is Tools for Humanity's latest effort to live up to their Orwellian name.
Connoisseurs of the AI-will-end-humanity marketing hype train of a few years ago should find plenty to appreciate in an eyeball scanner framed as as a 'helpful' tool to distinguish between AI agents & humans.
Or is it for that? Or maybe point of sale? Or nebulous 'verification?'
The only clear thing? This device starts from a point of biometric #privacy invasion.
It sure looks to me like another effort by the company Sam Altman founded to make a global data-grab.
Just say no.
https://techcrunch.com/2025/04/30/sam-altmans-world-unveils-a-mobile-verification-device/
GET IT: Best of #privacy & #security follow pack.
Follow em all:
https://following.space/d/3boa4ixmmv7h
Built on
's magnificent community gift: Following
Most folks don't love security theater & everyone has had a bad time at a screening checkpoint.
So, let's think for a second about hypothetical private-#TSA companies.
I'd expect them to gravitate towards AI-assigned individual risk ratings to minimize the cost of hiring & training people to interact with travelers.
To create ratings, I'd expect them to demand & consolidate invasive pools of our biometrics, web browsing, commenting, purchasing, movements & private lives.
Just don't call it a "social credit score"
You can bet they'll pivot to trying to monetize their data.
2026: We're a terminal security company 2029: We're a person rating company
Would these ratings make their way into other parts of our lives & things we want to visit?
And who exactly would stand up for us when the ratings are wrong? Or our data is shipped to foreign buyers.
Who holds #PrivateTSA companies accountable? The US doesn't have strong #privacy protections...
I'm also not optimistic about private sector security companies' ability to stop breaches. History backs me up here.
But I do expect that private-TSA companies could use lobbying to limit oversight & accountability.
That's been the history of other privacy-invasive tech companies.
So, as an airline security privatization conversation kicks off, remember that it can't just be "current thing is bad" but needs to consider what kind of future we're inviting in. https://m.primal.net/Pxhw.png
3/29/2025, 71 engagements
NEW: UK secretly demanded Apple build a backdoor into ALL encrypted iCloud accounts. https://m.primal.net/OUsQ.png
You haven't heard about this before because these orders are secret & there are typically bans on talking about them.
SHORT TERM IMPACT: Apple will probably stop offering encrypted iCloud storage in the UK.
DETAILS: the UK Home Secretary sent #Apple a so-called "Technical Capability Notice" which is a demand for access.
These flow from the 2016 Investigatory Powers Act (aka "Snooper's Charter") and is a mechanism for the government to compel companies to provide access.
ENFORCED SILENCE: Among the more pernicious parts of this secret demand: Apple would be FORBIDDEN from telling users that the backdoor had been introduced into iCloud's Advanced Data Protection.
BIG PICTURE: The public really doesn't realize it, but cloud backups of phones are constantly used for surveillance. Huge #privacy & #encryption gap.
By introducing optional Advanced Data Protection, Apple extended similar protections of device encryption to users' clouds.
So, since ADP was introduced in 2022, governments have been scheming to undermine it.
LOOKING INTO THE FUTURE: It's only a matter of time before governments try to target Private Cloud Compute. And do so with the same secret legal tools.
REPORT:
https://www.washingtonpost.com/technology/2025/02/07/apple-encryption-backdoor-uk/
2/7/2025, 23 engagements
Who on #nostr is saying interesting things about #privacy?
Help me fill out my follows!
Heard about a big breach over at Volkswagen?
Here's whats going on. Every major car company collects your driving data. And everything I've learned about this subject makes me want to go into the dash and start pulling wires out.
100% of car companies collect unnecessary data 84% share/sell it 92% provide insufficient control over data.
(Data: Mozilla Foundation investigation)
Most pour it into the shady data-broker ecosystem.
Where it goes to god-knows who. And represents a really exciting stream of surveillance data for governments and everybody else.
Most also turn it over to governments.
And insurance companies.
We got here because, in search of new revenue streams, these car mfrs turned to mining owners for movement data.
Their disrespect for your #privacy is a through-line, and is reflected in just how sloppy they can be about protecting it.
Unsecured AWS? Ugh. But this is just the tip of the iceberg.
This massive data exposure happens to be Volkswagen, but the story tracks for every major car company.
When companies do offer some sort of opt-out... your car might break. Or so they warn you.
We are still in earliest days of people investigating and pointing this out, but things are bound to get worse with electronic vehicles.
Reading list:
Mozilla Foundation's key investigation: https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/
CSO Oline report on VW:
Nissan breach report: