Hungary’s domestic intelligence agency, El Salvador’s national police, and several law enforcement agencies and police departments in the United States are believed to have used an ad-based global geolocation surveillance system called Weblock.
According to a report published by Citizen Lab, the tool was developed by Israeli company Cobwebs Technologies and sold by its successor, Penlink, after the two companies merged in July 2023. Founded in 1986, Penlink provides “mission-critical communications and digital evidence collection and analysis software” to law enforcement agencies in the United States and around the world.
Webloc’s U.S. customers include Immigration and Customs Enforcement (ICE), the U.S. Military, the Texas Department of Public Safety, DHS West Virginia, the New York City District Attorney’s Office, various police departments in Los Angeles, Dallas, Baltimore, Tucson, and Durham, as well as smaller cities and counties such as the City of Elk Grove and Pinal County.
“Webloc is sold as an add-on product to the social media and web intelligence system Tangles,” said Citizen Lab researchers Wolfie Kristol, Astrid Perry, Luis Fernando Garcia, Sienna Anstis, and Ron Deibert. “Webloc provides access to a constantly updated stream of records from up to 500 million mobile devices around the world, including device IDs, location coordinates, and profile data collected from mobile apps and digital ads.”
Simply put, ad-based surveillance systems utilize data purchased from mobile apps and digital ads to analyze the actions and movements of hundreds of millions of people. It was officially announced by Cobwebs Technologies in October 2020 and is described as “a cutting-edge location intelligence platform that connects the digital world and physical data using interactive layered maps to collect and analyze web data fused with geospatial data points.”
Customers of this tool can use it to monitor the location, movement, and personal characteristics of the entire population for up to the past three years. According to information available on Penlink’s website, Webloc can be used to “investigate and interpret location-based data in support of a case.” Webloc also has the ability to infer location from IP address and identify the person behind the device by collecting home address and workplace.
Interestingly, Cobwebs Technologies was among seven cyber mercenaries deplatformed by Meta in December 2021 for operating around 200 accounts to conduct reconnaissance of targets, as well as engaging in social engineering to participate in closed communities and forums to trick people into revealing personal information.
The social media giant said at the time that it had identified Cobwebs Technologies customers in Bangladesh, Hong Kong, the United States, New Zealand, Mexico, Saudi Arabia, and Poland. “In addition to targets related to law enforcement operations, we also observed frequent targeting of activists, opposition politicians, and government officials in Hong Kong and Mexico,” Mehta noted.
Reports from 404 Media, Forbes, and Texas Observer reveal that Webloc can be used to track phones without a warrant, and one procurement notice highlights the tool’s “automated and continuous monitoring capabilities for unique mobile advertising IDs, geolocated IP addresses, and connected device analytics.”
An analysis of company records and other public information revealed that Cobwebs Technologies shares a relationship with Israeli spyware vendor Quaddream through Cobwebs Technologies founder and former president Omri Timianker, who now oversees Penlink’s international operations. The company is suspected of ceasing operations in 2023.
We have identified 219 active servers associated with Cobwebs product deployments, most of which are located in the United States (126), the Netherlands (32), Singapore (17), Germany (8), Hong Kong (8), and the United Kingdom (7). Potential product servers have also been detected in various countries in Africa, Asia, and Europe.
In response to the report, PenLink said the findings “appear to be based on inaccurate information or misunderstandings about how we operate, including practices that PenLink has not engaged in since its acquisition of Kumowebs Technologies in 2023.” It also said it complies with U.S. state privacy laws.
“Our research shows that invasive and legally questionable ad-based surveillance (without warrants or proper oversight) is used by militaries, intelligence agencies, and law enforcement agencies in several countries around the world, as well as by local police departments,” Citizen Lab said in a statement.
Source link
