Go ahead, enjoy a free trial and locate (within 100 yards) your ex-boyfriend or girlfriend, husband, wife, or friends. This online demo had few security checks to keep unauthorized users out, despite claims consent was required. (Image courtesy of: Krebs on Security)

A company best known for providing phone service to prisoners and monitoring inmate locations has sold access to the whereabouts of almost every powered-on cellphone in the country without verifying a court order, thanks to a lucrative partnership with America’s top four cell phone companies.

The service, provided by Securus, has proved a handy tool for law enforcement agencies nationwide, allowing one former sheriff of Mississippi County, Mo., to track the whereabouts of a judge and members of the State Highway Patrol, all without their consent.

The New York Times reported in May that despite repeated assurances from cell phone companies that location data sold to third parties would not include personally identifiable information, it now appears in fact, it often does, and not just information about a particular company’s own customers.

Securus’ location service has been available since at least 2013, although some claim the service has been active for much longer than that, and after recent attention from Congress, Verizon, AT&T, and Sprint have announced they will suspend the sale of location data to most third parties as soon as contract termination notices can be sent.

The industry’s commitments to customer privacy appear to be tissue thin, based on the confidential contracts companies like Verizon and AT&T sign with third-party data aggregators, who in turn resell each provider’s location service to an even broader range of companies. Sen. Ron Wyden (D-Ore.) called the contracts “the legal equivalent of a pinky promise” in a letter sent to the Federal Communications Commission.

Verizon, T-Mobile, AT&T, and Sprint all have contracts with two of the country’s largest resellers of location data – LocationSmart and Zumigo. The contracts allow the two firms to pull cellphone users’ locations in real time and sell that information to other companies, including Securus. The contracts claim to need users’ consent before their location information can be revealed, which is either done in an app directly requesting location data or in a thicket of fine print terms and conditions most consumers never read. There is scant evidence cell phone companies independently audit consent records, which means a company or app author could claim blanket consent.

Securus never had a contact with many of the people it tracked — often those suspected of a crime or law enforcement officers. Securus operates its service under provisions permitting law enforcement to access location data without the consent of those being tracked, as long as the law enforcement agency attests to the legality of its request. Laws requiring court orders to track cellphone users vary considerably in different states. Some require a judge’s signature on a court order, others demand a notarized statement from a law enforcement official, while others require no independent review at all.

Cell phone companies may have a loophole to escape legal culpability for revealing private personal location information to unauthorized third parties. Privacy laws have never offered strong privacy protections to consumers for telecommunications services. In March 2017, the Republican majority in Congress stripped what privacy protections did exist during the Obama Administration in a mostly party-line vote condemned by Democrats. After the rules were repealed, mobile providers can track and share people’s browsing and app activity without permission. Several Democrats warned the move would lead to an eventual scandal when providers were caught collecting and selling sensitive personal information without customer consent.

As long as they are following their own voluntary privacy policies, carriers “are largely free to do what they want with the information they obtain, including location information, as long as it’s unrelated to a phone call,” Albert Gidari, the consulting director of privacy at the Stanford Center for Internet and Society and a former technology and telecommunications lawyer told the New York Times. If a cellphone is powered on, constantly updated location information accurate within a few hundred feet is available for sale.

Because cell phone companies work with third-party aggregators, they can claim any privacy violations could be the result of unauthorized or inappropriate use of their location tools. But finding which company ultimately violated a consumers’ privacy requires investigative work because services like LocationSmart also sell services to other aggregators, who in turn sell services to a myriad of companies. That is what appears to have happened with Securus, who accessed location services through a mobile marketing company called 3Cinteractive, which in turn has a contract with LocationSmart. That means a provider can claim at least three layers of possible third-party liability, because requests moved through several hands:

Example: Law enforcement agency request -> Securus -> 3Cinteractive -> LocationSmart -> Verizon

Although law enforcement agencies are supposed to upload legal documents proving informed consent laws do not apply to a particular request, it appears the validity of those documents was not independently verified.

“Securus is neither a judge nor a district attorney, and the responsibility of ensuring the legal adequacy of supporting documentation lies with our law enforcement customers and their counsel,” a Securus spokesman said in a statement. Securus offers services only to law enforcement and corrections facilities, and not all officials at a given location have access to the system, the spokesman added.

But those that did could abuse the system with few consequences. In fact, a security hole left open for a year by LocationSmart appears to have let almost anyone use the service to find friends, family, or anyone else, thanks to a helpful free demo for prospective clients revealed by Robert Xiao, a security researcher at Carnegie Mellon University:

LocationSmart’s demo is a free service (Editor’s Note: the demo has since been locked down) that allows anyone to see the approximate location of their own mobile phone, just by entering their name, email address and phone number into a form on the site. LocationSmart then texts the phone number supplied by the user and requests permission to ping that device’s nearest cellular network tower.

Once that consent is obtained, LocationSmart texts the subscriber their approximate longitude and latitude, plotting the coordinates on a Google Street View map. [It also potentially collects and stores a great deal of technical data about your mobile device. For example, according to their privacy policy that information “may include, but is not limited to, device latitude/longitude, accuracy, heading, speed, and altitude, cell tower, Wi-Fi access point, or IP address information”].

But according to Xiao, a PhD candidate at CMU’s Human-Computer Interaction Institute, this same service failed to perform basic checks to prevent anonymous and unauthorized queries. Translation: Anyone with a modicum of knowledge about how Web sites work could abuse the LocationSmart demo site to figure out how to conduct mobile number location lookups at will, all without ever having to supply a password or other credentials.

“I stumbled upon this almost by accident, and it wasn’t terribly hard to do,” Xiao said. “This is something anyone could discover with minimal effort. And the gist of it is I can track most peoples’ cell phone without their consent.”

Obtaining customer consent to share location details appears to not always be a priority of the location data resellers. For them, a lucrative business depends on easy access to location information that can be sold for targeted marketing campaigns (such as texting a coupon offer when entering a store or sending a special offer if you appear to be visiting a competitor’s store), tracking packages, service calls, or deliveries (such as tracking the cable repair technician, the location of your pizza, or where the parcel service driver is with a package you ordered), or allowing your bank to flag a suspicious credit card transaction when they discover your cellphone is nowhere near the store where the purchase just occurred.

Wyden

The personal risks of unauthorized access are too numerous to count, starting with former boyfriends or girlfriends cyberstalking one’s live location, criminals tracking a target, and law enforcement officials violating your rights.

The revelations in the New York Times, published on May 10, have attracted the sudden attention from America’s largest cell phone companies this week because of Sen. Wyden’s letter informing them they are under scrutiny. No cell phone company wants to endure the media spotlight Facebook has been under since revelations it exposed the personal data of as many as 87 million users without their consent. The carriers, except for T-Mobile, have announced a lock-down.

Verizon: Verizon Communications pledged to stop selling individual customer locations to data brokers, and will wind down contracts with LocationSmart and Zumigo, a competing data aggregator. “We will not enter into new location aggregation arrangements unless and until we are comfortable that we can adequately protect our customers’ location data,” Verizon privacy chief Karen Zacharia wrote in a June 15 letter to Wyden. Verizon did not explain why it took at least two years for the lock-down to begin.

AT&T: Said it “will be ending our work with aggregators for these services as soon as practical in a way that preserves important, potential lifesaving services like emergency roadside assistance.”

Sprint: “Suspended all services with LocationSmart” last month and “is beginning the process of terminating its current contracts with data aggregators to whom we provide location data.” A spokeswoman said that effort “will take some time in order to unwind services to consumers, such as roadside assistance and fraud prevention services.”

T-Mobile: Stopped short of terminating agreements, T-Mobile executives told Wyden it “started one of our periodic reviews several months ago and selected a third-party to assess this program.”

Securus: Securus spokesman Mark Southland said in a statement that the company adheres to its contract, adding that cutting off law enforcement access to location tools “will hurt public safety and put Americans at risk.”

Read the full letters from America’s top-four mobile companies:

• Verizon
• Sprint
• T-Mobile
• AT&T

If Comcast’s $65 billion all-cash offer for 21st Century Fox is accepted, America’s largest cable operator will also be among the world’s largest corporate debtors, owing $170 billion in all.

Comcast will borrow as much as $85 billion to cover the acquisition of Fox, plus an additional $27.5 billion to cover the buyout of the United Kingdom’s satellite operator Sky.

Excluding banks, Comcast will be the world’s second most-buried-in-debt corporation, outdone only by AT&T, according to Moody’s.

Comcast’s all-cash offer to snatch Fox away from its corporate arch-enemy Disney, also bidding for Fox, is remarkable for a company with only $6 billion of cash on hand. Comcast will have to borrow most of the money for the buyout, in addition to covering Fox’s existing $20 billion in debt. The result will be a 1980s style leveraged buyout that is likely to result in a significant downgrade of Comcast’s credit rating. Moody’s has already warned the company of exactly that.

Some Wall Street analysts see the transaction as particularly unusual for Comcast, a company that has avoided massive debt. Some suspect the generous cash offer for Fox is being driven by personal animosity between Comcast CEO Brian Roberts and Disney CEO Robert Iger, originating more than a decade earlier when Comcast attempted a hostile takeover of Disney, and failed.

Many investors are clearly worried about the growing debt levels of several large telecommunications companies, which remind some of two spectacular corporate failures at the end of the dot.com boom, when MCI-Worldcom and Global Crossing were both brought down by accounting scandals and bankruptcy in an effort to hide their debts.

There are fears that a decade of unprecedented low-interest rates, business-friendly regulatory policies, and a stabilized economy have allowed companies to grow complacent about the risks of debts from blockbuster mergers that are now bigger and more expensive than ever. Companies may be overconfident that their huge, debt-financed deals can be managed with low interest loans and frequent refinancing and bond sales to until debts can be paid down. But some analysts warn that if there is a downturn in the economy, easy credit will be hard to get, and interest rates will be significantly higher. Because highly leveraged companies are bigger credit risks, bondholders will likely demand a better deal for themselves.

The Wall Street Journal reports global corporate debt (excluding financial institutions) now stands at $11 trillion, and those companies are now 30% more leveraged than they were just before the start of the financial crisis of 2007. Wall Street expects several additional merger deals in the telecommunications and media sectors this year, which will likely raise debt levels even higher.

The unprecedented level of debt has not escaped the notice of the Federal Reserve. Asked whether the United States is in a “credit bubble,” Fed chief Jerome Powell said last week that officials are “watching” elevated levels of corporate leverage.

AT&T and Comcast officials told the Journal any fears are unwarranted; they are different from most companies because their respective debts are expected to be repaid quickly with higher levels of cash generated by their businesses. AT&T claims it could apply the $8-10 billion of its anticipated free cash flow from the merger with Time Warner to reduce debts, although that could threaten shareholder perks like dividend payouts and share buybacks, as well as customer-focused network upgrades.

Investors that used to treat AT&T and Comcast stock as a safe haven are not anymore.

“We are getting a lot of calls,” Allyn Arden, a telecom and cable analyst at S&P Global Ratings, told the Journal after both S&P and Moody’s cut their respective ratings on AT&T bonds last week to a level just two notches above the junk-debt category.

AT&T CEO Randall Stephenson downplayed the concerns of Wall Street over the additional debt.

“This thing delivers quickly,” he told CNBC. “Within four years, we’ll be back to our normal levels of debt.”

Where will AT&T and Comcast get the money to pay down their debts? Captive customers could be one source. Both AT&T and Comcast are planning to continue raising rates, particularly on internet customers, providing a lucrative shot of extra revenue. By gaining control of deep content libraries, both Comcast and AT&T will be able to hike licensing fees on that content as well.

Spending priorities: mergers & acquisitions, not upgrades.

Since 2012, two of the country’s largest phone companies spent enough money — $281.4 billion — to wire at least three-quarters of the  nation with fiber-to-the-home service and deliver vastly improved rural internet access to the rest of the country. Instead of doing that, AT&T and Verizon used the money to buy their competitors and content creators including AOL and Yahoo.

A 2017 Deloitte Consulting analysis estimates the United States will need between $130 and $150 billion in investment over the next 5–7 years to upgrade at least 75% of homes and businesses to fiber to the home service, with the remaining 25% serviced by technologies including 5G that are capable of delivering broadband speeds greater than the federal minimum standard of 25/3 Mbps.

AT&T could almost deliver the country a major broadband upgrade all by itself, having spent $138 billion on mergers and acquisitions in the past six years. Verizon could have easily handled the entire cost, but instead spent its $143.4 billion on business deals, including $130 billion to buy out former Verizon Wireless partner Vodafone. Among independent phone companies, things look equally bad. Frontier Communications is saddled with so much debt after acquiring former AT&T customers in Connecticut and Verizon customers in more than a dozen states, it has been forced to suspend its shareholder dividend and has been only able to make token investments in network upgrades for its mostly copper wire infrastructure in its original “legacy” service areas and a mixture of copper and fiber in acquired service areas. Both CenturyLink and Windstream have refocused many of their business activities on the commercial services marketplace, including the sale of hosting, business IT services, and cloud server networks.

More recently, both AT&T and Verizon have raced into content company acquisitions, buying up AOL, Yahoo, and Time Warner to offer their respective customers additional content. The phone companies are diversifying their business interests away from simply offering phone lines and internet access. At the same time, many of these acquisitions are depleting resources that could be spent on critical network upgrades.

The article in Light Reading claims the telecom industry’s traditional financial model of borrowing money to build networks and upgrade others is broken, because telecom companies now prefer to spend money acquiring other companies instead. Although AT&T has, in recent years, been more aggressive than Verizon in deploying fiber to home service, both companies have resisted committing large amounts of capital to a territory-wide fiber buildout, preferring to spend smaller sums to incrementally upgrade their networks in selected areas over the next decade. But the merger and acquisition teams at both companies are far less cautious, given the go ahead to pay handsomely for companies that often have little to do with providing telephone or internet service.

Light Reading reports AT&T’s debt climbed from $59 billion in 2010 to $126 billion at the end of 2017. Verizon’s debt increased from $45 billion to $114 billion. But those acquisitions have done little to attract new customers. Both companies’ operating cash flows have barely budged — $39 billion annually at AT&T (up from $35 billion) and Verizon’s actually declined from $33 billion in 2010 to $25 billion in 2017.

Mergers and Acquisitions (2011-2018)

AT&T

• 2012: AT&T buys $1.93 billion worth of spectrum from Qualcomm.
• 2013: AT&T buys Leap Wireless (Cricket) for $1.2 billion.
• 2014: AT&T pays $49 billion for the DirectTV, issuing $17.5 billion in debt in April.
• 2015: AT&T buys out assets from bankrupt Mexican wireless business of NII Holdings for around $1.875 billion.
• 2018: AT&T pays $207 million to acquire FiberTower.
• 2018: AT&T is cleared to merge with Time Warner in a deal valued at more than $84 billion.

Verizon

• 2011: Verizon acquires Terremark for $1.4 billion.
• 2014: Verizon buys out Vodafone’s 45 percent stake in Verizon Wireless, valued at $130 billion, with a mixture of stock and debt.
• 2015: Verizon buys AOL for a deal valued around $4.4 billion.
• 2017: Verizon acquires Yahoo Internet assets for $4.5 billion.
• 2017: Verizon buys spectrum holder Straight Path Communications for $3.1 billion roughly double rival AT&T’s offer, to build up 5G spectrum and footprint.

The more debt (and debt payments) that pile up at the two companies, the less money will be available to spend on fiber upgrades. In fact, there is evidence these companies are hoping to further cut costs in their core landline network operations. Some regulators have noticed. Verizon was forced to make a deal with New York regulators requiring the company to spend millions replacing failing copper-based facilities and upgrade them to fiber and remove or replace tens of thousands of deteriorated utility poles. Verizon faced similar action in Pennsylvania.

AT&T has spent millions lobbying the federal government to permanently decommission rural America’s landline network and replace it with a wireless alternative, while also working to replace the current regulated telephone network with deregulated alternatives like internet and Voice over IP phone service.

Wall Street analysts have occasionally questioned or at least expressed surprise over some of the phone companies’ odd acquisitions:

• Verizon acquired Terremark to beef up its cloud-based and server-hosting businesses. But shortly after acquiring the company, Verizon began replacing top management, sometimes repeatedly, and ultimately divested itself of its data center portfolio, including Terremark, just five years later. Find uk reseller hosting services at netnerd.com.
• AT&T bought DirecTV to help it reduce wholesale TV programming expenses for its U-verse TV subscribers. But DirecTV has lost more than one million satellite TV customers since AT&T acquired it in 2014, despite new marketing efforts to convince would-be U-verse TV customers to choose DirecTV instead.
• Verizon saw value in web brands that were major players more than 18 years ago but are mostly afterthoughts today. The company spent almost $9 billion to acquire Yahoo and AOL, and their low quality content portfolios, which rely heavily on clickbait headlines, advertiser-sponsored content, and articles designed to maximize mouse clicks to boost the number of ads you see.

“The telcos are trying to diversify into content when they should instead be focused on their core business — building networks and charging for value-added technology,” said Scott Raynovich, founder and principal analyst at Futuriom. “It’s clear they see content as part of the value-add but customers so far don’t seem to be reacting that way. It’s clear they are allergic to paying higher prices for bundled content.”

AT&T and Verizon’s customers are not clamoring for more content deals. When surveyed, most want better internet service at more affordable prices.

Your bundle is bigger than ever.

A-la-carte TV is still dead. Long live the super-sized bundle!

If AT&T and Time Warner wanted to deliver a message to the cable industry as a result of their now-approved blockbuster merger deal, it is one that promises hundreds, if not thousands of more TV channels, movies and shows headed your way in the coming days, bundled into super-sized pricier packages of television, telephone, and internet service.

Despite the fact consumers claim they want to pick and pay only for the entertainment options they specifically want, in reality people are paying for more bundled packages and services — usually from multiple online streaming services — than ever before, with no possibility they will ever watch everything these services have to offer.

AT&T and Time Warner are well aware customers are now subscribing to cable television -and- streaming video services like Hulu and Netflix. But many customers are also buying streaming live cable TV alternatives, despite the fact they already subscribe to a cable television package. Given the option of selling you an inexpensive package of a dozen cable channels you claim to want or selling you much larger and more expensive bundles of services many are actually buying, AT&T will follow the money every time.

What will be different as a result of this merger is where you buy that programming. Before, you may have purchased AT&T Fiber internet access, AT&T wireless mobile phone service, a HBO GO subscription through DirecTV Now, a cable TV alternative, and Netflix. Now, with the exception of Netflix, all of that money will go directly to AT&T. The company will also be able to enhance their bottom line by monetizing content viewed over mobile devices. After taking control of Time Warner’s vast entertainment offerings, which range from HBO to Turner Broadcasting networks like CNN and TNT, AT&T will generously bestow liberal (or possibly free) access to this content for its broadband and wireless customers, while those served by other providers will have to pay up to watch. AT&T will ultimately set the terms of its licensing agreements. AT&T Wireless customers with unlimited data plans already have a sample of this with a free year of DirecTV Now, which customers of other wireless companies have to pay to watch.

AT&T plans to offer the best deals to customers who bundle everything through AT&T. The “quad play” bundle of TV, internet, home phone, and wireless phone will offer customers discounts on each element of the package, but some may experience sticker shock even with the discounts.

The Wall Street Journal noted a premium AT&T customer could pay more than $500 a month for AT&T’s best package — that’s more than $6,000 a year. Most bundled AT&T customers will pay about half that — around $246 a month for a package of 100 Mbps internet, a home phone line, wireless phone and a limited TV package bundling Time Warner content, including HBO. The entry level ‘poverty’ package will still cost around $115 a month.

By controlling each element of the package, AT&T can discourage a-la-carte package pickers by substantially raising the price of standalone services, to encourage bundling. That explains why many customers take a promotional TV offer priced just $10-20 more than the $70 broadband-only package some customers start with. If broadband-only service costs $40 a month and the TV package also costs $40 a month, those leaning towards cord-cutting would find it much easier to pass on cable television.

With Comcast on the verge of picking up much of 21st Century Fox’s content library and studio, Comcast will be able to defend its own turf creating similar giant bundles of content to keep its customers happy. Wall Street is already putting pressure on Verizon to respond with an acquisition of its own to protect its base of FiOS and Verizon Wireless customers.

Companies likely left out in the cold of the next wave of media and entertainment consolidation include online content companies like Google, Facebook, Amazon, and Apple, which will be stuck licensing someone else’s content or bankrolling many more original productions. Charter Communications, which has a small deal with AMC for content, is also stranded, as are smaller cable companies like Cox, Altice, and Mediacom. Independent phone companies like CenturyLink, Windstream, Consolidated, and Frontier are also in a bad position if Wall Street determines telecom companies without content divisions are in serious trouble.

Netflix stands alone as the behemoth content company, and is not likely to be impacted by the current wave of consolidation. Hulu will most likely end up in the hands of a telephone or cable company, most likely Comcast, if it successfully acquires Fox’s ownership share of Hulu.

For customers, your future choice of provider is about to get more complicated. In addition to pondering speed tiers and wireless coverage maps, you will also have to decide what content packages are the most valuable. Your choices will range from basic company-owned networks to third-party services like Netflix and Hulu, as well as full cable TV lineups ranging from DirecTV Now to XFINITY TV. Then get ready for the bill, which will likely include charges for most, if not all, of these services.

The Wall Street Journal explains the current wave of media consolidation. (2:44)

AT&T has won its $85 billion bid to acquire Time Warner, Inc., overturning Justice Department opposition in a court case and completely rejecting allegations the merger was anti-consumer and would raise prices by suppressing competition. The favorable decision is expected to signal the business community the time is right for several more multi-billion dollar media mergers.

U.S. District Court Judge Richard Leon ruled the deal can proceed without any consumer-protecting deal conditions, and warned Department of Justice lawyers not to appeal if the purpose was to stymie the deal from closing before the companies’ agreed on deal expiration date runs out, saying it would be “manifestly unjust” and damaging to the faith of America’s shareholders and business community.

Leon read his decision to a packed courtroom, telling the government’s lawyers they had failed to prove their case the merger would harm consumers. Observers called it one of the worst antitrust court losses the Justice Department has faced in its history.

“Today is a bad day for all internet users and media consumers,” said Free Press policy director Matt Wood. “The Justice Department’s failure to bring a winnable case will now set off a wave of communications and media consolidation that was unthinkable even a few years ago. All of us, regardless of our broadband carrier and no matter what we watch, are about to see higher bills, fewer choices, worse quality for competing options and a further erosion of our privacy rights.”

During a six-week trial held this spring, the government argued AT&T’s combination of DirecTV’s 20 million subscribers with its own U-verse TV customers, and its ownership of Time Warner’s pay television networks including HBO and Cinemax and Turner Broadcasting’s news, entertainment, and sports networks, would give the phone company too much power, allowing AT&T to unfairly raise prices for competing cable, satellite, and online streaming companies. AT&T acquired DirecTV in 2015, but regulators were already concerned about AT&T’s size, only approving the transaction with deal conditions.

AT&T argued it was willing to offer arbitration to make sure its competitors received fair deals, and volunteered to not cut off TV networks from customers during arbitration proceedings to resolve contract renewal disputes.

The decision has dramatic implications far beyond the merger at hand. Waiting in the wings are other media companies, Wall Street bankers, and advisers waiting to begin a frenzy of other blockbuster merger deals. Had the court blocked the merger, it would send a strong signal that the Justice Department’s case against vertical integration mergers — when companies buy other companies they do business with — has standing. The total defeat of the Justice Department in today’s decision may make government lawyers hesitant to challenge future vertical integration deals.

Comcast’s all-cash offer for a large part of 21st Century Fox is likely to proceed now that the AT&T-Time Warner merger was approved. More telecom industry deals are expected to emerge later this year.

The Trump Administration’s choice to oversee antitrust cases — Makan Delrahim, sent signals to Wall Street that he is still inclined to be pro-business on merger transactions, telling reporters most proposed transactions were either good for consumers or neutral — a view consumer advocates generally oppose.

“I understand that some journalists and observers have recently expressed concern that the antitrust division no longer believes that vertical mergers can be efficient and beneficial to competition and consumers,” Delrahim said. “Rest assured these concerns are misplaced.”

If the merger is completed, AT&T will now be the country’s largest pay-TV distributor, controlling more than a dozen “must-have” TV networks that competitors cannot afford to be without. The deal will even affect the wireless industry’s competitive landscape. AT&T’s unlimited wireless customers are expected to be given exclusive free access to a bundle of channels filled with Time Warner-owned content.