What Is 'Fog Reveal,' the Police App Tracking Your Phone?

Fog Reveal has been in use since at least 2018, developed by a Virginia-based company called Fog Data Science LLC. Public records show the company was formed two years before that, and the Associated Press reports it was founded by two former high-ranking Department of Homeland Security officials. Among them: Matthew Broderick, who held the title of director of operations from 2005 to 2006. Broderick’s public profiles list him as a vice president and managing partner at the company.

According to GovTribe, a website that tracks federal grants and expenditures, Fog Data Science received upwards of $120,000 from the U.S. Justice Department between 2018 and 2020.

The Fog Reveal app itself claims to have the ability to search from records pertaining to 250 million devices, which equates to tens of billions of individual data points.

Fog Reveal relies on commercially available data to track people’s movements rather than information obtained directly from cellphone service providers. This is a widely recognized loophole that’s raised concerns among privacy advocates and scholars and lawmakers on Capitol Hill. Without some kind of legal device — namely, a warrant — there’s a variety of business records police cannot access on demand. But privacy laws, particularly at the federal level, are antiquated. At the time they were passed, few envisioned the sociotechnical paradigm under which we live today.

Point of fact: Cellphones, as we recognize them today, did not exist the last time Congress took concrete steps to shield Americans from invasive monitoring. The idea that basically everyone would wittingly carry around tracking devices and consent to the collection of the data they produce by hundreds, if not thousands of companies, might have seemed insane at the time. So while laws exist to prevent police from demanding access to your location, there is no law really specifying that companies can’t simply sell the information to police instead.

Of course, many constitutional lawyers — including those working at the Electronic Frontier Foundation — would tell you that’s nonsense, and that the Fourth Amendment itself prohibits this kind of activity. In a recent post, the EFF said the same 2018 Supreme Court ruling that requires police to acquire a warrant before seizing location data should naturally apply here.

“Warrantless purchase of this data also violates the First Amendment, because police can use it to identify people who attend protests, which can discourage people from attending,” the organization argues.

Fog Reveal differs from other cellphone tracking technologies (such as Stingrays) in that it relies on IDs associated with online advertising profiles. These IDs are connected across various phone apps that gather details about users’ online habits, which are in turn sold to marketing firms. It’s kind of a side business that a lot of app developers are engaged in, unless the app they offer is free, in which case, you might assume it’s one of their core revenue streams. Essentially, characteristics about your online activities across numerous apps are assigned to these IDs, which are often device specific, and they in turn allow other companies to target you with specific types of ads; the aim being to predict your interests and, hopefully, convince you to spend some money.

These IDs do not contain your actual name, though it is certainly possible to de-anonymize them by comparing the ID to other datasets that do contain names. And for the purposes of policing, this may be irrelevant anyway. With a thorough list of locations where the device has been present, it’s unlikely it’s difficult for police to discern who they’re tracking. You can imagine: wherever the device rests overnight is probably the user’s home address, and, similarly, wherever it stops for most of the day is likely their place of work.

Technology and the ways it’s used and abused is all very interesting, but any good story concerned with technology is going to focus on how it affects actual people. The Associated Press knows this, and so it tracked down a character to help readers better understand Fog Reveal’s implications: Davin Hall, a former police data analyst with the Greensboro, North Carolina, police force.

Hall is depicted as a cop with a conscience who fought against his department’s use of Fog Reveal, going as far as to voice his concerns to members of the Greensboro city council. In one quote, he tells the reporters: “The capability that it had for bringing up just anybody in an area whether they were in public or at home seemed to me to be a very clear violation of the Fourth Amendment.” As we’ve already mentioned, many legal scholars agree that there is little daylight between police demanding access to data and purchasing it, in so far as actual citizens are concerned.

Hall eventually resigned from the force, saying he’d grown angry about being “betrayed and lied to.” Hall also points to the fact that one of the sheriff’s departments in the area — in rural Rockingham County — has acquired Fog Reveal, adding he’s no longer shocked to learn small police agencies are paying for powerful surveillance tools, even if they don’t really need them.

“Anyone with that login information can do as many searches as they want,” Hall told the AP. “I don’t believe the police have earned the trust to use that, and I don’t believe it should be legal.”

The matter of warrantless location tracking by law enforcement has recently drawn the ire of several powerful Democrats on Capitol Hill — namely, Reps. Jerrold Nadler and Bennie Thompson, the chairs of the House Judiciary and Homeland Security Committees, respectively. Last month, the two congressmen sent demand letters to several federal agencies, including the Justice Department, FBI, and Department of Homeland Security, asking for details about their purchasing of commercially available data.

“While law enforcement investigations necessitate some searches, improper government acquisition of this data can thwart statutory and constitutional protections designed to protect Americans’ due process rights,” the congressmen said.

Others lawmakers, such as Sen. Ron Wyden, have led the charge to ban the practice, introducing and supporting legislation including the Geolocation Privacy and Surveillance Act and the Fourth Amendment Is Not For Sale Act, both of which would effectively ban law enforcement from purchasing location data and require a warrant or court order instead.

What’s more, there’s an ongoing effort to stop agencies under the Department of Defense’s umbrella from doing the same. These include nine separate intelligence components, including the National Security Agency. Each branch of the military’s service has its own intelligence office, and there’s a bipartisan contingent of lawmakers interested in reining in those offices’ capabilities to track Americans’ cell phones — a practice they admit they can’t even confirm is occuring.

In a statement, the EFF said: “The biggest thing we can all do is put pressure on Congress and the states to protect our privacy. It’s up to lawmakers to act fast to flip the switch and forbid government entities from buying geolocation data sold on the open market.”