FCC investigates site that let most US mobile phones’ location be exposed
https://ift.tt/2kak7ME
The Federal Communications Commission has taken preliminary steps to examine the actions of LocationSmart, a southern California company that has suddenly found itself under intense public and government scrutiny for allowing most American cell phones’ locations to be easily accessed.
As Ars reported Thursday, LocationSmart identifies the locations of phones connected to AT&T, Sprint, T-Mobile, or Verizon, often to an accuracy of a few hundred yards, reporter Brian Krebs said. While the firm claims it provides the location-lookup service only for legitimate and authorized purposes, Krebs reported that a demo tool on the LocationSmart website could be used by just about anyone to surreptitiously track the real-time whereabouts of just about anyone else.
“I can confirm the matter has been referred to the Enforcement Bureau,” wrote FCC spokesman Neil Grace in a Friday afternoon email to Ars.
LocationSmart has not responded to Ars’ direct questions, but it did send a statement saying that the company “strives to bring secure operational efficiencies to enterprise customers.”
The demo tool that was once available has been yanked from the company’s public website.
“LocationSmart is continuing its efforts to verify that not a single subscriber’s location was accessed without their consent and that no other vulnerabilities exist,” Brenda Schafer, a company spokeswoman wrote in an email. “LocationSmart is committed to continuous improvement of its information privacy and security measures and is incorporating what it has learned from this incident into that process.”
LocationSmart is reportedly the vendor that ultimately sold location data to Securus, a prison telecom firm.
Sen. Ron Wyden (D-Ore.), who shared his concerns over the company’s actions to The New York Times, said in a statement to Ars on Friday that the “location aggregation industry” has functioned with “essentially no oversight.”
He continued:
The only real surprise is that it took this long for the public to learn that the wireless carriers and their business partners were demonstrating such a total disregard for Americans’ privacy and safety… I’m pleased the FCC is opening an investigation into the reported data leak by LocationSmart. The negligent attitude toward Americans’ security and privacy by wireless carriers and intermediaries puts every American at risk. I urge the FCC to expand the scope of this investigation and to more broadly probe the practice of third parties buying real-time location data on Americans.
He also called on FCC Chairman Ajit Pai, who served as an attorney for Securus in 2012, to recuse himself from any related investigation.
“Chairman Pai’s past work for Securus makes it untenable for Mr. Pai to lead this investigation,” he said.
Meanwhile, pressure is mounting on mobile carriers to stop selling the real-time location data of their hundreds of millions of customers.
I never do this, but this is important so please RT if you agree: It’s not okay for my mobile provider to sell or give my mobile device location info to a 3rd party without at least a court order/subpoena. Background: https://t.co/1Qn2PBweoS and https://t.co/8paXnOKyvV pic.twitter.com/J0Plh3TTh7
— briankrebs (@briankrebs) May 19, 2018
So far, none of the carriers have expressly denied they worked with companies such as LocationSmart in the past or pledged to stop working with them in the future.
Tech
via Ars Technica https://arstechnica.com
May 19, 2018 at 10:20AM