Treasury Watchdog Warns of Government’s Use of Cellphone Data Without Warrants
Intelligence and law enforcement agencies may be on shaky legal ground in purchasing the data, report says
WASHINGTON—A new Treasury Department watchdog report warns that law enforcement agencies may not be on firm legal footing when they use cellphone GPS data drawn from mobile apps without obtaining a warrant first.
In a review of the Internal Revenue Service’s use of a commercial platform that allowed the agency to track cellphones, the Treasury Department inspector general for tax administration said that a landmark 2018 Supreme Court case might preclude the warrantless tracking of criminal suspects through location data generated by weather, game and other apps. The report encouraged stricter controls on use of the data.
Many government lawyers have concluded that the decision in Carpenter v. United States doesn’t apply because it addresses data held by cellphone carriers that contain a subscriber’s personally identifying information, rather than GPS location data drawn from apps, which doesn’t.
The watchdog’s report is only a recommendation, and its interpretation of the law hasn’t been blessed by any court. Yet it is the first known government analysis to raise serious doubt about the legality of law enforcement and intelligence agencies purchasing highly revealing information generated by U.S. cellphones and other digital services.
The audit, requested by Sens. Ron Wyden (D., Ore.) and Elizabeth Warren (D., Mass.), examined the IRS Criminal Investigation division’s use of a commercial software platform provided by Venntel, a company that sells to the government access to GPS data gathered from apps. Venntel’s parent company, Gravy Analytics, caters to corporate clients. The IRS experimented with Venntel’s platform as an investigative tool in 2017 and 2018 but stopped using the software.
Mr. Wyden’s office provided a copy of the inspector general report to The Wall Street Journal.
In approving the agency’s project, IRS lawyers had maintained “that data obtained from marketers of information like Venntel is not subject to a warrant because the data is collected by apps loaded on cellphones to which the phone users voluntarily granted access,” the inspector general found.
But in the Carpenter case, the court rejected a similar argument about location data collected by cellphone carriers.
Cellphone location records are an “exhaustive chronicle of location information casually collected by wireless carriers,” the Supreme Court said, and therefore law enforcement must get a warrant to access the data.
“The court’s rationale was that phone users do not truly voluntarily agree to share the information given the necessity of phones in our society,” the IRS inspector general concluded. “Courts may apply similar logic to GPS data sold by marketers.”
The IRS didn’t immediately respond to a request for comment. A spokesman for the IRS’s Criminal Investigation division previously said it “takes the privacy of citizens very seriously and follows all laws and regulations surrounding that privacy while administering the very important law-enforcement mission of protecting our nation’s tax system.” After a year of experimenting with Venntel, the spokesman added, “It was determined that this tool did not benefit CI investigations and its use was discontinued.”
The president of Venntel didn’t respond to a request for comment.
Harvesting cellphone-location data from apps accessed by customers—used to understand consumer behavior, make investment and real estate decisions, target advertising and more—is a multibillion-dollar industry. Unlike cell-tower data kept by carriers, these data sets identify individual users only by an alphanumeric code, which the marketing industry says cloaks the identities of phone users. However, in practice, users’ identities can be gleaned based on things like the address where the device is usually located in the evening. This data also pinpoints a phone’s location more precisely than the data held by carriers.
This pool of data is increasingly being tapped by military units, intelligence agencies and law enforcement to observe the patterns, habits and routines of small groups of people or even individuals, including terrorist networks, criminal enterprises and unlawful immigrants, and to apprehend suspects, according to interviews with numerous people familiar with the government’s actions.
Intelligence and military agencies are collecting commercial app data in near-real time at global scale, the people say. Besides the IRS, the Department of Homeland Security and the Federal Bureau of Investigation have experimented with it for domestic law enforcement, according to government spending contracts and previous Wall Street Journal reporting.
A DHS spokesman last year acknowledged collecting location information but said “information doesn’t include cellular phone tower data, is not ingested in bulk and doesn’t include the individual user’s identity.” An FBI spokeswoman previously declined to address specific surveillance efforts, but added that “all FBI operations are conducted in accordance with all legal requirements.”
Using such data on overseas targets who aren’t U.S. citizens doesn’t raise any legal barriers under U.S. law.
Using it domestically for intelligence and criminal justice, however, raises thorny questions about whether the U.S. government can buy its way around Americans’ constitutional protections in order to surveil them.
Intelligence analysts are generally forbidden to use app-based GPS data to look at targets inside the continental U.S. without approval from supervisors and attorneys, people say. However, the intelligence agencies are collecting and storing that data and can access it under certain circumstances.
For example, the Defense Intelligence Agency acknowledged last month that it accessed data on U.S. persons five times in the past 2½ years. People familiar with the matter say that data came via a National Geospatial-Intelligence Agency program that obtains it directly from commercially available consumer apps.
“As part of their authorized activities, Department of Defense components purchase publicly and commercially available data to inform analysis of foreign threats to national security,” a Pentagon spokesman said. The Defense Department “ensures compliance with applicable law and policy through robust oversight,” he added.
A person familiar with the matter said that those five instances involved matters of national security, and the actions were carried out in conjunction with domestic law-enforcement agencies.