Go ahead, enjoy a free trial and locate (within 100 yards) your ex-boyfriend or girlfriend, husband, wife, or friends. This online demo had few security checks to keep unauthorized users out, despite claims consent was required. (Image courtesy of: Krebs on Security)

A company best known for providing phone service to prisoners and monitoring inmate locations has sold access to the whereabouts of almost every powered-on cellphone in the country without verifying a court order, thanks to a lucrative partnership with America’s top four cell phone companies.

The service, provided by Securus, has proved a handy tool for law enforcement agencies nationwide, allowing one former sheriff of Mississippi County, Mo., to track the whereabouts of a judge and members of the State Highway Patrol, all without their consent.

The New York Times reported in May that despite repeated assurances from cell phone companies that location data sold to third parties would not include personally identifiable information, it now appears in fact, it often does, and not just information about a particular company’s own customers.

Securus’ location service has been available since at least 2013, although some claim the service has been active for much longer than that, and after recent attention from Congress, Verizon, AT&T, and Sprint have announced they will suspend the sale of location data to most third parties as soon as contract termination notices can be sent.

The industry’s commitments to customer privacy appear to be tissue thin, based on the confidential contracts companies like Verizon and AT&T sign with third-party data aggregators, who in turn resell each provider’s location service to an even broader range of companies. Sen. Ron Wyden (D-Ore.) called the contracts “the legal equivalent of a pinky promise” in a letter sent to the Federal Communications Commission.

Verizon, T-Mobile, AT&T, and Sprint all have contracts with two of the country’s largest resellers of location data – LocationSmart and Zumigo. The contracts allow the two firms to pull cellphone users’ locations in real time and sell that information to other companies, including Securus. The contracts claim to need users’ consent before their location information can be revealed, which is either done in an app directly requesting location data or in a thicket of fine print terms and conditions most consumers never read. There is scant evidence cell phone companies independently audit consent records, which means a company or app author could claim blanket consent.

Securus never had a contact with many of the people it tracked — often those suspected of a crime or law enforcement officers. Securus operates its service under provisions permitting law enforcement to access location data without the consent of those being tracked, as long as the law enforcement agency attests to the legality of its request. Laws requiring court orders to track cellphone users vary considerably in different states. Some require a judge’s signature on a court order, others demand a notarized statement from a law enforcement official, while others require no independent review at all.

Cell phone companies may have a loophole to escape legal culpability for revealing private personal location information to unauthorized third parties. Privacy laws have never offered strong privacy protections to consumers for telecommunications services. In March 2017, the Republican majority in Congress stripped what privacy protections did exist during the Obama Administration in a mostly party-line vote condemned by Democrats. After the rules were repealed, mobile providers can track and share people’s browsing and app activity without permission. Several Democrats warned the move would lead to an eventual scandal when providers were caught collecting and selling sensitive personal information without customer consent.

As long as they are following their own voluntary privacy policies, carriers “are largely free to do what they want with the information they obtain, including location information, as long as it’s unrelated to a phone call,” Albert Gidari, the consulting director of privacy at the Stanford Center for Internet and Society and a former technology and telecommunications lawyer told the New York Times. If a cellphone is powered on, constantly updated location information accurate within a few hundred feet is available for sale.

Because cell phone companies work with third-party aggregators, they can claim any privacy violations could be the result of unauthorized or inappropriate use of their location tools. But finding which company ultimately violated a consumers’ privacy requires investigative work because services like LocationSmart also sell services to other aggregators, who in turn sell services to a myriad of companies. That is what appears to have happened with Securus, who accessed location services through a mobile marketing company called 3Cinteractive, which in turn has a contract with LocationSmart. That means a provider can claim at least three layers of possible third-party liability, because requests moved through several hands:

Example: Law enforcement agency request -> Securus -> 3Cinteractive -> LocationSmart -> Verizon

Although law enforcement agencies are supposed to upload legal documents proving informed consent laws do not apply to a particular request, it appears the validity of those documents was not independently verified.

“Securus is neither a judge nor a district attorney, and the responsibility of ensuring the legal adequacy of supporting documentation lies with our law enforcement customers and their counsel,” a Securus spokesman said in a statement. Securus offers services only to law enforcement and corrections facilities, and not all officials at a given location have access to the system, the spokesman added.

But those that did could abuse the system with few consequences. In fact, a security hole left open for a year by LocationSmart appears to have let almost anyone use the service to find friends, family, or anyone else, thanks to a helpful free demo for prospective clients revealed by Robert Xiao, a security researcher at Carnegie Mellon University:

LocationSmart’s demo is a free service (Editor’s Note: the demo has since been locked down) that allows anyone to see the approximate location of their own mobile phone, just by entering their name, email address and phone number into a form on the site. LocationSmart then texts the phone number supplied by the user and requests permission to ping that device’s nearest cellular network tower.

Once that consent is obtained, LocationSmart texts the subscriber their approximate longitude and latitude, plotting the coordinates on a Google Street View map. [It also potentially collects and stores a great deal of technical data about your mobile device. For example, according to their privacy policy that information “may include, but is not limited to, device latitude/longitude, accuracy, heading, speed, and altitude, cell tower, Wi-Fi access point, or IP address information”].

But according to Xiao, a PhD candidate at CMU’s Human-Computer Interaction Institute, this same service failed to perform basic checks to prevent anonymous and unauthorized queries. Translation: Anyone with a modicum of knowledge about how Web sites work could abuse the LocationSmart demo site to figure out how to conduct mobile number location lookups at will, all without ever having to supply a password or other credentials.

“I stumbled upon this almost by accident, and it wasn’t terribly hard to do,” Xiao said. “This is something anyone could discover with minimal effort. And the gist of it is I can track most peoples’ cell phone without their consent.”

Obtaining customer consent to share location details appears to not always be a priority of the location data resellers. For them, a lucrative business depends on easy access to location information that can be sold for targeted marketing campaigns (such as texting a coupon offer when entering a store or sending a special offer if you appear to be visiting a competitor’s store), tracking packages, service calls, or deliveries (such as tracking the cable repair technician, the location of your pizza, or where the parcel service driver is with a package you ordered), or allowing your bank to flag a suspicious credit card transaction when they discover your cellphone is nowhere near the store where the purchase just occurred.

Wyden

The personal risks of unauthorized access are too numerous to count, starting with former boyfriends or girlfriends cyberstalking one’s live location, criminals tracking a target, and law enforcement officials violating your rights.

The revelations in the New York Times, published on May 10, have attracted the sudden attention from America’s largest cell phone companies this week because of Sen. Wyden’s letter informing them they are under scrutiny. No cell phone company wants to endure the media spotlight Facebook has been under since revelations it exposed the personal data of as many as 87 million users without their consent. The carriers, except for T-Mobile, have announced a lock-down.

Verizon: Verizon Communications pledged to stop selling individual customer locations to data brokers, and will wind down contracts with LocationSmart and Zumigo, a competing data aggregator. “We will not enter into new location aggregation arrangements unless and until we are comfortable that we can adequately protect our customers’ location data,” Verizon privacy chief Karen Zacharia wrote in a June 15 letter to Wyden. Verizon did not explain why it took at least two years for the lock-down to begin.

AT&T: Said it “will be ending our work with aggregators for these services as soon as practical in a way that preserves important, potential lifesaving services like emergency roadside assistance.”

Sprint: “Suspended all services with LocationSmart” last month and “is beginning the process of terminating its current contracts with data aggregators to whom we provide location data.” A spokeswoman said that effort “will take some time in order to unwind services to consumers, such as roadside assistance and fraud prevention services.”

T-Mobile: Stopped short of terminating agreements, T-Mobile executives told Wyden it “started one of our periodic reviews several months ago and selected a third-party to assess this program.”

Securus: Securus spokesman Mark Southland said in a statement that the company adheres to its contract, adding that cutting off law enforcement access to location tools “will hurt public safety and put Americans at risk.”

Read the full letters from America’s top-four mobile companies:

• Verizon
• Sprint
• T-Mobile
• AT&T

Sprint debuted its new $15/month Unlimited Kickstart plan on June 7th, and will stop taking new orders for it tomorrow evening, making it one of Sprint’s shortest-lived plans ever.

The plan, intended to steal customers from competitors, offers those bringing a qualified device (or buying one) the opportunity of paying just $15 a month for unlimited talk, texting, and data, with some caveats:

• Video streams are throttled to support up to 480p, music streams are limited to 500 kbps, and gaming streams don’t exceed 2 Mbps.
• Customers on this plan are subject to speed throttles, known at Sprint as “data deprioritization” when towers are congested, regardless of usage.
• Customers must enroll and maintain autopay.
• Requires customers to sign up for a new line, port an existing number, and either bring your own device or buy one from Sprint.

Unlimited Kickstart gives Sprint a chance to report a big boost in new customer signups during its next quarterly report to Wall Street. But the company claims the plan also allows customers of other carriers the opportunity of sampling Sprint’s upgraded network, or return to Sprint as an ex-customer to see how the network has improved. There are no contracts, and the offer also extends to other family members — each line up to four will cost just $15/month.

Sprint will attempt to upsell customers to its Unlimited Freedom plan, which offers more features at a higher price.

“At Sprint, we’ve worked incredibly hard to improve our network,” the company claimed in a press release. “In fact, Sprint’s national average download speed increased 34.5 percent year-over-year, more than any other national carrier. Plus, we’ve increased our investment to make our coverage, reliability and speed even better as Sprint prepares to launch the first mobile 5G network in the U.S. in the first half of 2019.”

The company claims interest in the offer is extremely heavy, but the press release announcing it also mentioned an expiration date for enrollees of Friday night (June 15) at 11:59pm EDT, which means time is running out. Customers have to sign up for the offer online, which isn’t particularly intuitive. A Live Chat button is located on the web page which may offer some help to those trying to enroll. If you own a qualified phone already, or acquire a new one, you will need to acquire a Sprint SIM card to activate the plan no later than June 22, 2018.

Rosenworcel

Using “stitched-together” stories and caricature, lobbyists are finding an audience among Republican members of the Federal Communications Commission eager to sweep away local control of broadband infrastructure to allow wireless companies to locate equipment almost anywhere they want.

FCC Commissioner Jessica Rosenworcel warned attendees at the 86th annual meeting of the U.S. Conference of Mayors that the ability of local communities to control what equipment ends up on municipally owned light and utility poles is at risk:

In our first city—which happens to be a fictional one—public infrastructure is dated. The city needs better broadband and wireless services. But city officials view improvements skeptically. They lack the policies and processes needed to clear the way for the deployment of fiber facilities, wireless towers, and small cells—all of which are essential digital age infrastructure. They delay applications for facilities siting. They charge big fees for access to municipal poles. And get this, these bad actors have the audacity to have public safety and aesthetic concerns.

Like I said, this city is fictional. It’s a caricature based on some outliers and stitched-together stories. But this city is the one dominating discussion in Washington. It’s unfortunately shaping the debate where I work—at the Federal Communications Commission. It’s animating our discussions about broadband deployment and how we ensure the next generation of wireless broadband known as 5G reaches everyone, everywhere. This narrative is priming the pump for Washington preempting cities and towns and preventing them from having a role in what is happening in their own backyards.

The wireless industry is backing a number of state measures that severely restrict local control and decision-making powers over wireless infrastructure and its placement. The coordinated campaign has relied heavily on dubious stories of local communities arbitrarily rejecting wireless infrastructure upgrades or seeking huge amounts of money in return for permission to place equipment on community-owned utility poles or street lights:

The telecommunications industry has stacked the deck on many levels of the debate over how much control local municipalities should have over locations for cell towers, small cells, backup battery cabinets, and other infrastructure, claiming cities want to extort confiscatory pole attachment fees, drag their feet on permitting, and impose arbitrary rules that delay the deployment of wireless upgrades.

FCC Chairman Ajit Pai’s Broadband Deployment Advisory Committee (BDAC) is heavily packed with telecom industry insiders and lobbyists. Only a small handful of members are local public officials. As a result, the industry-stacked committee quickly identified local communities as one of the biggest impediments of next generation broadband services like 5G, and prioritized recommendations for new policies designed to deregulate the process in favor of providers.

The Republican FCC chairman and commissioners frequently characterize this issue as ‘old rules’ getting in the way of new technology, like 5G, necessitating regulatory reform.

State lawmakers, often relying on information packages assembled by telecommunications companies, have introduced industry-drafted model bills dramatically curtailing local control over equipment placement and pole attachment pricing. In states like Tennessee, the debate was framed as an either/or choice of Tennessee receiving advanced 5G investment and deployment or watching companies choose more industry-friendly states for 5G services.

Rosenworcel acknowledged San Jose Mayor Sam Liccardo, who resigned from BDAC after complaining it was heavily biased in favor of telecommunications companies. She praised Liccardo for independently streamlining provider access to poles for future 5G service with fair pricing and for developing new digital inclusion projects that will funnel some provider compensation into programs designed to achieve broader adoption of broadband services by the public.

For Rosenworcel, the fastest and most resilient way to broadband deployment is with a community on board.

“That’s because picking fights with cities and states promises to yield little more than a fast trip to the courts. It’s already happening with the FCC’s effort to redefine “federal actions” under the National Historic Preservation Act and National Environmental Policy Act,” Rosenworcel said.

Rosenworcel recommends the FCC develop a new framework that spends less time on the lobbyists’ talking points and scare stories and instead relies on common sense cooperative coordination between companies, the FCC, and local communities.

“We can begin by developing model codes for small cell and 5G deployment—but we need to make sure they are supported by a wide range of industry and state and local officials,” Rosenworcel said. “Then we need to review every infrastructure grant program at the Department of Commerce, Department of Agriculture, and Department of Transportation and build in incentives to use this model. In the process, we can build a more common set of practices nationwide. But to do so, we would use carrots instead of sticks.”

As gigabit internet becomes more common across the United States, some ISPs are seeking a speed advantage by offering even faster speeds to residential and business customers. On Tuesday, Nokia announced Frontier Communications and Rochester, N.Y.-based Greenlight Networks would be upgrading their fiber networks to the company’s XGS-PON solution, which can handle 10 Gbps upload and download speeds.

“Next Generation PON technologies such as XGS-PON are increasingly being deployed as demand for ultra-broadband applications and services continue to grow,” said Julie Kunstler, principal analyst at Ovum, in a statement. “Providing operators with the ability to use the same passive and active plants, XGS-PON solutions like Nokia’s can be quickly deployed and used to capture 10Gbps service opportunities that help operators to improve the return on their existing fiber network investments.”

Many existing fiber networks currently rely on GPON (gigabit passive optical network) technology — which allows one fiber in a bundle of fibers to service multiple homes and businesses. GPON networks are typically capable of download speeds of 2.488 Gbps and shared upstream speeds of 1.244 Gbps. Many ISPs using GPON technology typically offer fast download speeds, but often slower upload speeds.

Next generation XGS-PON allows up to 10 Gbps in both directions over existing fiber networks. In fact, the technology is future proof, allowing operators to immediately upgrade to faster speeds and later move towards Full TWDM-PON, an even more robust technology, without expensive network upgrades.

Most providers are leveraging XGS-PON technology to deliver symmetrical broadband — same upload and download speeds — to residential customers and to expand network capacity to avoid congestion. XPS-PON technology also supports faster-than-gigabit speeds than can be attractive to commercial customers.

Frontier intends to deploy Nokia’s technology in ex-Verizon markets in California, Texas, and Florida, beginning in Dallas-Fort Worth. It will allow Frontier to beef up its FiOS network and market stronger broadband products to Texas businesses. In Rochester, Greenlight will use the technology to upgrade its fiber service, which competes locally with Frontier DSL and Charter/Spectrum. Spectrum recently introduced gigabit download speed in Rochester. Greenlight can now expand beyond its 1 Gbps offering, but more importantly, increase its maximum upload speed beyond 100 Mbps.

“Greenlight is constantly looking at ways we can deliver new services that fit every customer need. We pride ourselves on offering the fastest internet speeds available in the markets we serve and Nokia’s XGS-PON technology will play a critical part in our ability to deliver these services to our customers,” said Greenlight CEO Mark Murphy. “With Nokia’s next-generation PON fiber solution we will be able to deliver the latest technologies, applications, products and services quickly and reliably to our customers and ensure they have access to the ultra-broadband speeds and capacity they require now and in the future.”

Nokia points out its XGS-PON technology may also be very attractive to wireless companies considering deploying 5G services. Extensive fiber assets available in area neighborhoods will be crucial for the success of millimeter wave 5G technology, which relies on small cells placed around neighborhoods and fed by fiber optics.

Among the major wireless companies with spectrum holdings worth billions, few would suspect that the fifth largest (behind Sprint, AT&T, Verizon, and T-Mobile) is the satellite television company Dish Networks.

After spending nearly $20 billion over the last ten years acquiring nearly 95 MHz of extremely valuable low and mid-band spectrum in markets across the United States, Dish is the largest wireless company that isn’t actually providing wireless service. Critics have questioned whether Dish co-founder Charlie Ergen was ever really interested in getting into the wireless business when he could make an even bigger killing warehousing spectrum until it grows in value and can be profitably sold to someone else. One Wall Street analyst thinks there is a strong case for exactly that. Cowen and Company estimates Dish’s holdings are now worth $30.2 billion — a $10 billion profit possible from keeping spectrum off the market until a buyer is willing to make an offer Dish cannot refuse.

Unfortunately for Ergen, spectrum is public property and ultimate ownership rights can never be sold or transferred. Instead, the FCC licenses companies to use the public airwaves, and has provisions to take them back if a company does not put that spectrum to good use. For Dish Networks, the first important deadline is March 2020, by which time the FCC expects Dish to achieve at least 70% market coverage of its 700 MHz “E-Block” and 2000-2020/2180-2200 MHz AWS-4 licenses.

Dish’s “E-Block” spectrum was formerly known as UHF channel 56. Dish has already begun testing the next-generation TV standard ATSC 3.0 on its E-Block spectrum in Dallas, as part of a joint venture with TV station owners Sinclair, Nexstar, and Univision. Dish proposed to use this spectrum, which covers 95% of the United States, as a potential tool for broadcasters. Among the services Dish could offer are broadcast data applications made possible with the ATSC 3.0 standard.

Because time and money is on the line, Dish needs to either build its network quickly or sell/lease its spectrum to other companies before facing possible spectrum forfeiture in less than two years. Analysts say one of the cheapest and easiest ways of placating the FCC is to deploy a modest, narrowband wireless network designed for machine-to-machine communications. These networks rely on short bursts of data to communicate information. Possible applications include exchanging irrigation and crop data collected from wireless sensors and various remote weather and climate measurement tools.

Coincidentally, that is exactly the kind of network Ergen initially envisions, largely operating on the sparsely used AWS bands. Officially called “NB-IoT” in wireless industry parlance, the ‘narrowband Internet of Things’ network would be the first chapter of Dish’s wireless story. It’s a network done on the cheap — constructed with a relatively low investment of $500 million to $1 billion through 2020, adequate enough to keep the FCC off Dish’s back.

Ergen reports the radios have been ordered and in a sign of serious intent, Dish has now signed master lease agreements with cell tower companies that will allow Dish to place its transmission equipment on tens of thousands of cell towers around the country. The company has also hired experts in tower permitting and network design and planning. Those contracts are an important indicator for some skeptics on Wall Street who believed Ergen would not show seriousness of intent until he signed paid, binding commitments to begin network buildout.

Ergen would disagree that Dish has been foot-dragging its wireless network deployment, despite a decade of accumulating wireless spectrum that has gone unused.

“It’s all about timing; too early you are roadkill, if you get it just right you have a chance,” Ergen said. “We missed the 4G shift because of the regulatory reasons. The next big paradigm shift is 5G.”

Ergen

Unfortunately for Ergen, he will be late to that paradigm shift, admitting his dream of a national 5G network isn’t possible right now.

“We’re […] going to spend at least $10 billion or more on a 5G network,” Ergen said, while also admitting, “we don’t have that kind of capital on our balance sheet today.”

Ergen promised that sometime in the future, Dish will begin a “second phase” that will “build a complete 5G network.” But Ergen’s vision of 5G is somewhat different from Verizon and AT&T, which are focused on the consumer and business voice and data markets. Ergen envisions a robust 5G network designed to support IoT applications like smart cities, artificial intelligence, and autonomous vehicles, and does not seem interested launching a fifth national cell provider.

Ergen quit in December 2017 as CEO of Dish’s aging satellite TV business to refocus on Dish’s mobile future, and to recast the venture as a glorified startup, much like his early days in the home satellite television business where he got into the business manufacturing 10-foot C-band satellite dishes for consumers and then sold the programming to watch on those dishes. From money earned in that business, Ergen launched Dish Networks, which relies on today’s familiar small satellite dishes and competes with DirecTV.

Ergen’s satellite TV venture only had to compete with one other satellite provider. His wireless network will have to compete with at least four established national wireless companies, plus emerging competition from the cable industry and regional cellular providers. Ergen tried to turn that obvious business challenge into an opportunity:

“We have two disadvantages; We don’t [have many] customers and we are not as knowledgeable as other people in the business, but we don’t have the legacy of 2G, 3G, 4G networks,” Ergen said. “We have a clean sheet of paper with 5G. It reminds me of 1990 when we decided to reinvent ourselves from the big dish business to small dish. It took five years to design and build that system with not one penny of revenue, and we obsoleted the business we were in. When we got into satellites, we didn’t know anything about it, but neither did anyone else. It is the same with 5G/IoT. We are not the world’s experts, but neither is anyone else.”

What Ergen lacks in experience he makes up for in enthusiasm, laying out plans for Dish’s wireless future. By the time he activates 5G service, Dish expects to use its combined 95 MHz of spectrum in the 600 MHz and 2 GHz range for that network. That will take until at least July 2020, because many of the 600 MHz frequencies he needs are still occupied by UHF television stations that are in the process of migrating to a more compact UHF band.

Dish has spectrum holdings that reach almost every corner in the U.S.

Ergen may also consider acquiring additional millimeter wave spectrum if he deploys small cell technology. He has even decided to keep small cell and larger traditional “macrocells” found on traditional cell towers on different frequencies, claiming sharing the frequencies would create interference issues.

Ergen also hopes to convince the FCC to repurpose little-known Multichannel Video Distribution and Data Service (MVDDS) spectrum located between 12.2-12.7 GHz for 5G wireless applications. That solid block of 500 MHz of spectrum could be an important asset to power small cell 5G networks, because it can support faster speeds than the typical smaller blocks of frequencies most companies control. MVDDS also lacks a significant constituency to protect it, having been woefully underutilized in the United States. Only tiny Cibola Wireless, an ISP in Albuquerque, N.M., licenses MVDDS technology for its wireless internet service, selling Albuquerque residents up to 50 Mbps speed for $79.99 a month. Users claim the service does not suffer the latency problems of traditional satellite internet access, but can still slow down if too many users are online at the same time.

Back in 2010, MVDDS technology was seen as a potential competitor to companies like Dish and DirecTV, as well as satellite internet providers which share similar spectrum. Like satellite internet, MVDDS can transmit and receive data over a small dish. But instead of pointing it to a satellite 44,000 miles away, MVDDS systems target a ground-based transmission tower much closer nearby. The technology never attracted much attention, and will now likely be displaced by 5G in the United States, although it has done modestly better abroad, serving a limited customer base in the United Arab Emirates, Ireland, France, Vietnam, Greenland and Serbia.