The Bureau of Alcohol, Tobacco, Firearms and Explosives has terminated its contract for a mobile device surveillance tool that allowed federal agents to track people’s locations without a warrant, following pressure from members of Congress, a prosecutor, and a judge who questioned whether the practice was legal.
ATF, the federal agency charged with enforcing the country’s gun laws, told The Associated Press it shut down what it described as a “pilot” program using a product called Webloc. The move came after Rep. Michael Cloud, a Republican from Texas, and Sen. Ron Wyden, a Democrat from Oregon, raised alarms about the agency’s use of bulk commercial location data.
Webloc is manufactured by a company called Penlink and pulls location information from consumer apps and advertising networks. Those networks gather data from mobile devices when users download apps or browse the internet. This type of information is often referred to as “ad tech” data, and its use in law enforcement has sparked controversy because it allows agencies to pinpoint which mobile devices were in a specific area at a specific time — without obtaining a warrant.
The U.S. Supreme Court ruled back in 2018 that law enforcement must obtain a warrant to access historic movement data from cellphone carriers when investigating a suspect. However, the high court has not yet weighed in on the growing use of commercially purchased location data.
Webloc is also used by the U.S. military, U.S. Immigration and Customs Enforcement, and various local police departments, including agencies in Elk Grove, Calif. and Durham, N.C. The technology has also spread internationally — the national police in El Salvador and intelligence agencies in Hungary are among its customers, according to a report from Citizen Lab, a research group at the University of Toronto that studies digital threats to civil society.
In a statement, ATF said the tool “does not meet our needs” and confirmed it is not currently using any other services that rely on ad tech data.
“ATF continually evaluates tools and techniques to enhance our investigations and ultimately reduce violent crime in American communities. We did conduct a pilot with Webloc to determine if it could improve our investigative capabilities,” an ATF spokesperson said.
Sen. Wyden praised the agency’s decision, calling it “a victory for Americans’ constitutional rights.”
“For years, I have warned that the government’s purchase of Americans’ location data from shady data brokers is an unacceptable end-run around the Fourth Amendment,” Wyden said. “After Rep. Cloud and my staff informed the ATF about the legal and privacy quagmire surrounding adtech data, the agency did the right thing.”
The issue first came to light publicly during a congressional hearing in May, when ATF Director Robert Cekada acknowledged under questioning from Rep. Cloud that the agency had been purchasing geolocation data tied to American cell phones.
Following that hearing, both lawmakers were briefed by ATF officials. In a joint statement, Wyden and Cloud revealed that ATF had carried out more than 300 warrantless searches using the tool — over 200 of which were connected to active ATF investigations.
In one case involving suspected arson at a facility owned by a U.S. defense contractor, both a prosecutor and a judge raised objections to the use of Webloc data. The agency “was ultimately forced to backtrack and obtain a traditional court order for bulk cellphone tower data” from wireless carriers instead, according to the two lawmakers.
Webloc was originally developed by an Israeli company called Cobwebs before being acquired and merged with a U.S.-based firm, Penlink. The company issued a statement saying it is “proud to have a long-standing relationship with ATF” and expressed hope for a continued partnership.
Other federal agencies continue to use commercially purchased location data. The FBI and the Department of Homeland Security both buy such information. DHS put out a request to private industry in January exploring how advertising data could support its deportation and law enforcement efforts. Earlier this year, FBI Director Kash Patel told the Senate that the bureau purchases “commercially available information that’s consistent with the constitution and the laws under the Electronic Communications Privacy Act.”
A bipartisan group of lawmakers — including Wyden, Republican Sen. Mike Lee of Utah, Republican Rep. Warren Davidson of Ohio, and Democratic Rep. Zoe Lofgren of California — has introduced legislation that would prohibit government agencies from purchasing location data without first obtaining a court order.
