T mobile hands customer location data to fake US Marshall

[spartaman64]

Quote

Ruth Johnson didn't know exactly who rang her phone and threatened her around 20 times in 2014. The person on the other end said he was John Edens from the U.S. Marshals with a warrant for her arrest for stealing a car. She was behind on her payments.

It later turned out John Edens didn't have a warrant, nor was he from law enforcement at all. Instead, he was a debt collector with a history of stalking and domestic violence who had managed to get ahold of Johnson's phone location data. He did this by pretending to be a U.S. Marshal with the "Georgia Fugitive Task Force" to T-Mobile, which then provided Edens with the location of Johnson's phone in a handy Google Maps interface—"pinging" the phone, in industry parlance.

Quote

Motherboard previously reported on Edens' case using court documents and sources in the bounty hunting industry; Edens was sentenced to one year in prison for impersonating a U.S. officer. Now, Johnson explained in an interview what it was like to have her phone tracked. Her story demonstrates the very real human impact that the black market use and sale of phone location data can have.

"I was very upset with the phone company, because I was under the impression that you had to get [a] court order in order to get information such as that out," she said. T-Mobile "put my life in danger," she added.

The harassment was relentless. Edens turned up at Johnson's place of work. Someone banged on her home's door at 3 a.m., then Edens turned up on her porch another day. Johnson said her husband had been recently killed and Johnson didn't know if this harasser was somehow connected to his murder, compounding her fear. Her teenage daughter moved 10 hours away to be with her grandmother, just to feel safe.

Quote

Law enforcement who need to access data in an "exigent circumstance," such as a kidnapping, can ask carriers for a phone's location information. As court records show, Edens' scam was somewhat simple. He used a custom domain—"gafugitivetaskforce1.net”—to convince T-Mobile he was a legitimate requester of such data.

"Carriers should check credentials before giving out customers' location data. Failure to do so is irresponsible and puts their customers in danger," Eva Galperin, director of cybersecurity at activist group the Electronic Frontier Foundation, and who has extensively researched stalking through technology, said. "There is no question that it is used to perpetuate abuse."

Quote

And up until recently, AT&T, T-Mobile, Sprint, and Verizon were selling their customers' location data to data brokers, who would in turn provide it to bounty hunters with little oversight. Documents leaked to Motherboard show that one company was providing real-time location data to around 250 bounty hunters, with evidence of tens of thousands of phone pings.

Quote

Johnson only discovered her location data had been given out when Valerie McGilvrey, another person who locates those who owe a debt and who Edens confided in about his techniques, told her. McGilvrey recorded one of her conversations with Edens in which he described how he tricked multiple telecoms into handing over location data.

“Those are badass pings, is what they are,” Edens says in the audio recording.

McGilvrey told Motherboard, "the number one reason I turned John Edens in was because he emailed me an Excel spreadsheet of a cell phone account activity that even included location of the device that the target (victim) phone was connected to."

source: https://www.vice.com/en_us/article/8xwngb/t-mobile-put-my-life-in-danger-says-victim-of-black-market-location-data?utm_source=reddit.com

 

This is some scary stuff and I'm surprised that nobody got killed because of it yet or maybe they did and we just don't know about it. Telecom companies should do more to verify that the person requesting the data is actually law enforcement. Also he only got one year in prison for all this? There's people who get locked up for longer for doing marijuana I hope he at least got some big fine that wasn't stated in the article. There also should be extra laws and regulations against the practice of selling customer location data. Making money should never come at the expense of public safety. 

[justpoet]

While there's not too much you can do about the phone company knowing where you are if you choose to have a cell phone, this is another example of precisely why privacy, security, and anonymity matter…even if you have "nothing to hide".

[Tristerin]

We just don't know IF someone has been killed with due to this data dump. 

 

Well, we all know/knew it was happening to a degree.  Personally Ive been with Virgin Mobile for 10 years on a Pay As You Go plan where the only tie to that phone is a Top Up card I purchase with cash.

 

We all have a choice once we are faced with reality!  Don't LET them track you.

[RejZoR]

This is why COURT ORDERS exist and should be a thing. If you don't have a court order, you can't get the data. Also, will this guy be trialed for impersonating a law enforcment official? I'm pretty sure that's illegal in any country.

[AHaskin14]

I don't in any way disagree that this is a major problem.

 

But it's interesting to think how far we've come over phone numbers. 10 years ago, if I needed my friends address, I could look up their parents by last name in the local phone book and get it. Easy as that.

[Origami Cactus]

Bounty hunters? Is this Star Wars or real life?

Is there legit bounties on people's heads in america?

[AHaskin14]

1 minute ago, Origami Cactus said:

Bounty hunters? Is this Star Wars or real life?

Is there legit bounties on people's heads in america?

Usually they'll just take a finger, to prove a point.

 

Really though, I'm not sure of the full scale or legal scope, but I know they are most often used for things like recollecting cars/goods owed to the bank for payment failure.

[spartaman64]

2 minutes ago, Origami Cactus said:

Bounty hunters? Is this Star Wars or real life?

Is there legit bounties on people's heads in america?

 

[dalekphalm]

30 minutes ago, Origami Cactus said:

Bounty hunters? Is this Star Wars or real life?

Is there legit bounties on people's heads in america?

Bounty Hunters are legal in the US - they track people like fugitives, people who run on bail, people who owe money to collection agencies, etc. There is somewhat of an overlap to people who are also debt collectors ("repo men" - those will, for example, take your car if you're late on car payments).

 

There are laws and regulations that bounty hunters have to follow. This guy is already known for violating those laws and regulations.

[BuckGup]

47 minutes ago, Origami Cactus said:

Bounty hunters? Is this Star Wars or real life?

Is there legit bounties on people's heads in america?

It's a massive industry. There are countless TV shows based off of it. Ever heard of dog the bounty hunter?

[Origami Cactus]

2 minutes ago, BuckGup said:

It's a massive industry. There are countless TV shows based off of it. Ever heard of dog the bounty hunter?

No, never imagined that this kind of stuff still existed.

[BuckGup]

2 minutes ago, Origami Cactus said:

No, never imagined that this kind of stuff still existed.

Well when the incarceration system is made to make money there's a lot of businesses that pop up. Every heard of bail bondsman? 

[Curious Pineapple]

9 minutes ago, Origami Cactus said:

No, never imagined that this kind of stuff still existed.

It does in America, meanwhile the civilized world uses the court system and doesn't allow people to just turn up and lift a car away for parking near a sign.

[Jito463]

11 hours ago, justpoet said:

While there's not too much you can do about the phone company knowing where you are if you choose to have a cell phone, this is another example of precisely why privacy, security, and anonymity matter…even if you have "nothing to hide".

If you turn off location services on your phone, the best they can get is the nearest tower you last pinged.  It will still narrow it down, but not as precisely.

10 hours ago, Curious Pineapple said:

It does in America, meanwhile the civilized world

The "civilized world"?  Could you be any more condescending?

[justpoet]

26 minutes ago, Jito463 said:

If you turn off location services on your phone, the best they can get is the nearest tower you last pinged.  It will still narrow it down, but not as precisely.

In most places, it is full signal triangulation as it shows signal strength against each tower.  They're actually quite accurate except out in the country with few towers.  Location services off just prevents, in theory, the device from letting apps know.

[williamcll]

There's also just the bunch of scammers that dial random numbers.