Penlink's Webloc Tracks Phones Worldwide, Raising Privacy Concerns

Penlink, a US digital intelligence company, has promoted Webloc, a phone-tracking tool originally developed by Israeli startup Cobwebs, to law enforcement agencies. Presentations described a system that can track hundreds of millions of mobile phones across the world, collects smartphone location data from common apps, and can follow movements across countries, while US agencies can use it without a search warrant in some cases. The tool has drawn concern from privacy advocates and lawmakers over its reach and the lack of legal oversight around its use.

How the system works

Webloc gathers location data from smartphones through weather, gaming, email and religious apps. It can build a detailed picture of where a phone has been over the past 12 months and update that picture hourly, showing movements on a near real-time basis. Officers can zoom in on a map and view phones present at a specific place and time, analyzing billions of location data points, according to company documents. The Supreme Court ruled in 2018 that law enforcement must obtain a warrant from a judge to get location data from telecommunications companies, but the Justice Department has argued that principle does not apply to location data purchased from commercial sources.

Customers and uses

Webloc users include US Immigration and Customs Enforcement, at least two branches of the US military and more than a dozen American police forces. Authorities in the United Kingdom, Saudi Arabia, the United Arab Emirates, Singapore, the Netherlands, Germany, Austria and Hungary have also acquired it. ICE spent around $9 million between 2022 and 2026 on four contracts with Cobwebs and Penlink that included Webloc licenses. More than 70 Democratic lawmakers asked the Department of Homeland Security inspector general in March for information about ICE's use of the tool, but representatives said they had not received a response. State and local users have included the Texas Department of Public Safety and police in Los Angeles, Dallas, Baltimore, Tucson, Durham, Elk Grove in California and Pinal County in Arizona. Tucson police used Webloc to identify a suspect in cigarette thefts and bar burglaries, and in other investigations, before its license expired and was not renewed.

Companies and privacy concerns

Penlink was founded in 1986 in Lincoln, Nebraska, and Spire Capital acquired Penlink in 2022 and Cobwebs in 2023 in a deal worth about $200 million. Cobwebs was founded in 2015 by three veterans of Israeli special forces and developed Webloc for counterterrorism. Meta banned about 200 accounts it accused Cobwebs of using in 2021, and Cobwebs later focused on Webloc and Tangles, a social media surveillance product. Nathan Freed Wessler of the American Civil Liberties Union said the evidence showed a ridiculous expansion of these tools and tremendous concerns due to lack of legal oversight. Penlink said Webloc is provided only to clients in support of law enforcement and national safety efforts and that it complies with applicable laws. App developers and users may not know that advertising or monetization trackers can ultimately route location data to companies such as Penlink, according to Bloomberg's reporting. Thorsten Wetzling of Interface said he had yet to come across anyone who explicitly consented to private companies handing over data for surveillance purposes.

Sources: bloomberg.com