Go ahead, enjoy a free trial and locate (within 100 yards) your ex-boyfriend or girlfriend, husband, wife, or friends. This online demo had few security checks to keep unauthorized users out, despite claims consent was required. (Image courtesy of: Krebs on Security)

A company best known for providing phone service to prisoners and monitoring inmate locations has sold access to the whereabouts of almost every powered-on cellphone in the country without verifying a court order, thanks to a lucrative partnership with America’s top four cell phone companies.

The service, provided by Securus, has proved a handy tool for law enforcement agencies nationwide, allowing one former sheriff of Mississippi County, Mo., to track the whereabouts of a judge and members of the State Highway Patrol, all without their consent.

The New York Times reported in May that despite repeated assurances from cell phone companies that location data sold to third parties would not include personally identifiable information, it now appears in fact, it often does, and not just information about a particular company’s own customers.

Securus’ location service has been available since at least 2013, although some claim the service has been active for much longer than that, and after recent attention from Congress, Verizon, AT&T, and Sprint have announced they will suspend the sale of location data to most third parties as soon as contract termination notices can be sent.

The industry’s commitments to customer privacy appear to be tissue thin, based on the confidential contracts companies like Verizon and AT&T sign with third-party data aggregators, who in turn resell each provider’s location service to an even broader range of companies. Sen. Ron Wyden (D-Ore.) called the contracts “the legal equivalent of a pinky promise” in a letter sent to the Federal Communications Commission.

Verizon, T-Mobile, AT&T, and Sprint all have contracts with two of the country’s largest resellers of location data – LocationSmart and Zumigo. The contracts allow the two firms to pull cellphone users’ locations in real time and sell that information to other companies, including Securus. The contracts claim to need users’ consent before their location information can be revealed, which is either done in an app directly requesting location data or in a thicket of fine print terms and conditions most consumers never read. There is scant evidence cell phone companies independently audit consent records, which means a company or app author could claim blanket consent.

Securus never had a contact with many of the people it tracked — often those suspected of a crime or law enforcement officers. Securus operates its service under provisions permitting law enforcement to access location data without the consent of those being tracked, as long as the law enforcement agency attests to the legality of its request. Laws requiring court orders to track cellphone users vary considerably in different states. Some require a judge’s signature on a court order, others demand a notarized statement from a law enforcement official, while others require no independent review at all.

Cell phone companies may have a loophole to escape legal culpability for revealing private personal location information to unauthorized third parties. Privacy laws have never offered strong privacy protections to consumers for telecommunications services. In March 2017, the Republican majority in Congress stripped what privacy protections did exist during the Obama Administration in a mostly party-line vote condemned by Democrats. After the rules were repealed, mobile providers can track and share people’s browsing and app activity without permission. Several Democrats warned the move would lead to an eventual scandal when providers were caught collecting and selling sensitive personal information without customer consent.

As long as they are following their own voluntary privacy policies, carriers “are largely free to do what they want with the information they obtain, including location information, as long as it’s unrelated to a phone call,” Albert Gidari, the consulting director of privacy at the Stanford Center for Internet and Society and a former technology and telecommunications lawyer told the New York Times. If a cellphone is powered on, constantly updated location information accurate within a few hundred feet is available for sale.

Because cell phone companies work with third-party aggregators, they can claim any privacy violations could be the result of unauthorized or inappropriate use of their location tools. But finding which company ultimately violated a consumers’ privacy requires investigative work because services like LocationSmart also sell services to other aggregators, who in turn sell services to a myriad of companies. That is what appears to have happened with Securus, who accessed location services through a mobile marketing company called 3Cinteractive, which in turn has a contract with LocationSmart. That means a provider can claim at least three layers of possible third-party liability, because requests moved through several hands:

Example: Law enforcement agency request -> Securus -> 3Cinteractive -> LocationSmart -> Verizon

Although law enforcement agencies are supposed to upload legal documents proving informed consent laws do not apply to a particular request, it appears the validity of those documents was not independently verified.

“Securus is neither a judge nor a district attorney, and the responsibility of ensuring the legal adequacy of supporting documentation lies with our law enforcement customers and their counsel,” a Securus spokesman said in a statement. Securus offers services only to law enforcement and corrections facilities, and not all officials at a given location have access to the system, the spokesman added.

But those that did could abuse the system with few consequences. In fact, a security hole left open for a year by LocationSmart appears to have let almost anyone use the service to find friends, family, or anyone else, thanks to a helpful free demo for prospective clients revealed by Robert Xiao, a security researcher at Carnegie Mellon University:

LocationSmart’s demo is a free service (Editor’s Note: the demo has since been locked down) that allows anyone to see the approximate location of their own mobile phone, just by entering their name, email address and phone number into a form on the site. LocationSmart then texts the phone number supplied by the user and requests permission to ping that device’s nearest cellular network tower.

Once that consent is obtained, LocationSmart texts the subscriber their approximate longitude and latitude, plotting the coordinates on a Google Street View map. [It also potentially collects and stores a great deal of technical data about your mobile device. For example, according to their privacy policy that information “may include, but is not limited to, device latitude/longitude, accuracy, heading, speed, and altitude, cell tower, Wi-Fi access point, or IP address information”].

But according to Xiao, a PhD candidate at CMU’s Human-Computer Interaction Institute, this same service failed to perform basic checks to prevent anonymous and unauthorized queries. Translation: Anyone with a modicum of knowledge about how Web sites work could abuse the LocationSmart demo site to figure out how to conduct mobile number location lookups at will, all without ever having to supply a password or other credentials.

“I stumbled upon this almost by accident, and it wasn’t terribly hard to do,” Xiao said. “This is something anyone could discover with minimal effort. And the gist of it is I can track most peoples’ cell phone without their consent.”

Obtaining customer consent to share location details appears to not always be a priority of the location data resellers. For them, a lucrative business depends on easy access to location information that can be sold for targeted marketing campaigns (such as texting a coupon offer when entering a store or sending a special offer if you appear to be visiting a competitor’s store), tracking packages, service calls, or deliveries (such as tracking the cable repair technician, the location of your pizza, or where the parcel service driver is with a package you ordered), or allowing your bank to flag a suspicious credit card transaction when they discover your cellphone is nowhere near the store where the purchase just occurred.

Wyden

The personal risks of unauthorized access are too numerous to count, starting with former boyfriends or girlfriends cyberstalking one’s live location, criminals tracking a target, and law enforcement officials violating your rights.

The revelations in the New York Times, published on May 10, have attracted the sudden attention from America’s largest cell phone companies this week because of Sen. Wyden’s letter informing them they are under scrutiny. No cell phone company wants to endure the media spotlight Facebook has been under since revelations it exposed the personal data of as many as 87 million users without their consent. The carriers, except for T-Mobile, have announced a lock-down.

Verizon: Verizon Communications pledged to stop selling individual customer locations to data brokers, and will wind down contracts with LocationSmart and Zumigo, a competing data aggregator. “We will not enter into new location aggregation arrangements unless and until we are comfortable that we can adequately protect our customers’ location data,” Verizon privacy chief Karen Zacharia wrote in a June 15 letter to Wyden. Verizon did not explain why it took at least two years for the lock-down to begin.

AT&T: Said it “will be ending our work with aggregators for these services as soon as practical in a way that preserves important, potential lifesaving services like emergency roadside assistance.”

Sprint: “Suspended all services with LocationSmart” last month and “is beginning the process of terminating its current contracts with data aggregators to whom we provide location data.” A spokeswoman said that effort “will take some time in order to unwind services to consumers, such as roadside assistance and fraud prevention services.”

T-Mobile: Stopped short of terminating agreements, T-Mobile executives told Wyden it “started one of our periodic reviews several months ago and selected a third-party to assess this program.”

Securus: Securus spokesman Mark Southland said in a statement that the company adheres to its contract, adding that cutting off law enforcement access to location tools “will hurt public safety and put Americans at risk.”

Read the full letters from America’s top-four mobile companies:

• Verizon
• Sprint
• T-Mobile
• AT&T

Spending priorities: mergers & acquisitions, not upgrades.

Since 2012, two of the country’s largest phone companies spent enough money — $281.4 billion — to wire at least three-quarters of the  nation with fiber-to-the-home service and deliver vastly improved rural internet access to the rest of the country. Instead of doing that, AT&T and Verizon used the money to buy their competitors and content creators including AOL and Yahoo.

A 2017 Deloitte Consulting analysis estimates the United States will need between $130 and $150 billion in investment over the next 5–7 years to upgrade at least 75% of homes and businesses to fiber to the home service, with the remaining 25% serviced by technologies including 5G that are capable of delivering broadband speeds greater than the federal minimum standard of 25/3 Mbps.

AT&T could almost deliver the country a major broadband upgrade all by itself, having spent $138 billion on mergers and acquisitions in the past six years. Verizon could have easily handled the entire cost, but instead spent its $143.4 billion on business deals, including $130 billion to buy out former Verizon Wireless partner Vodafone. Among independent phone companies, things look equally bad. Frontier Communications is saddled with so much debt after acquiring former AT&T customers in Connecticut and Verizon customers in more than a dozen states, it has been forced to suspend its shareholder dividend and has been only able to make token investments in network upgrades for its mostly copper wire infrastructure in its original “legacy” service areas and a mixture of copper and fiber in acquired service areas. Both CenturyLink and Windstream have refocused many of their business activities on the commercial services marketplace, including the sale of hosting, business IT services, and cloud server networks.

More recently, both AT&T and Verizon have raced into content company acquisitions, buying up AOL, Yahoo, and Time Warner to offer their respective customers additional content. The phone companies are diversifying their business interests away from simply offering phone lines and internet access. At the same time, many of these acquisitions are depleting resources that could be spent on critical network upgrades.

The article in Light Reading claims the telecom industry’s traditional financial model of borrowing money to build networks and upgrade others is broken, because telecom companies now prefer to spend money acquiring other companies instead. Although AT&T has, in recent years, been more aggressive than Verizon in deploying fiber to home service, both companies have resisted committing large amounts of capital to a territory-wide fiber buildout, preferring to spend smaller sums to incrementally upgrade their networks in selected areas over the next decade. But the merger and acquisition teams at both companies are far less cautious, given the go ahead to pay handsomely for companies that often have little to do with providing telephone or internet service.

Light Reading reports AT&T’s debt climbed from $59 billion in 2010 to $126 billion at the end of 2017. Verizon’s debt increased from $45 billion to $114 billion. But those acquisitions have done little to attract new customers. Both companies’ operating cash flows have barely budged — $39 billion annually at AT&T (up from $35 billion) and Verizon’s actually declined from $33 billion in 2010 to $25 billion in 2017.

Mergers and Acquisitions (2011-2018)

AT&T

• 2012: AT&T buys $1.93 billion worth of spectrum from Qualcomm.
• 2013: AT&T buys Leap Wireless (Cricket) for $1.2 billion.
• 2014: AT&T pays $49 billion for the DirectTV, issuing $17.5 billion in debt in April.
• 2015: AT&T buys out assets from bankrupt Mexican wireless business of NII Holdings for around $1.875 billion.
• 2018: AT&T pays $207 million to acquire FiberTower.
• 2018: AT&T is cleared to merge with Time Warner in a deal valued at more than $84 billion.

Verizon

• 2011: Verizon acquires Terremark for $1.4 billion.
• 2014: Verizon buys out Vodafone’s 45 percent stake in Verizon Wireless, valued at $130 billion, with a mixture of stock and debt.
• 2015: Verizon buys AOL for a deal valued around $4.4 billion.
• 2017: Verizon acquires Yahoo Internet assets for $4.5 billion.
• 2017: Verizon buys spectrum holder Straight Path Communications for $3.1 billion roughly double rival AT&T’s offer, to build up 5G spectrum and footprint.

The more debt (and debt payments) that pile up at the two companies, the less money will be available to spend on fiber upgrades. In fact, there is evidence these companies are hoping to further cut costs in their core landline network operations. Some regulators have noticed. Verizon was forced to make a deal with New York regulators requiring the company to spend millions replacing failing copper-based facilities and upgrade them to fiber and remove or replace tens of thousands of deteriorated utility poles. Verizon faced similar action in Pennsylvania.

AT&T has spent millions lobbying the federal government to permanently decommission rural America’s landline network and replace it with a wireless alternative, while also working to replace the current regulated telephone network with deregulated alternatives like internet and Voice over IP phone service.

Wall Street analysts have occasionally questioned or at least expressed surprise over some of the phone companies’ odd acquisitions:

• Verizon acquired Terremark to beef up its cloud-based and server-hosting businesses. But shortly after acquiring the company, Verizon began replacing top management, sometimes repeatedly, and ultimately divested itself of its data center portfolio, including Terremark, just five years later.
• AT&T bought DirecTV to help it reduce wholesale TV programming expenses for its U-verse TV subscribers. But DirecTV has lost more than one million satellite TV customers since AT&T acquired it in 2014, despite new marketing efforts to convince would-be U-verse TV customers to choose DirecTV instead.
• Verizon saw value in web brands that were major players more than 18 years ago but are mostly afterthoughts today. The company spent almost $9 billion to acquire Yahoo and AOL, and their low quality content portfolios, which rely heavily on clickbait headlines, advertiser-sponsored content, and articles designed to maximize mouse clicks to boost the number of ads you see.

“The telcos are trying to diversify into content when they should instead be focused on their core business — building networks and charging for value-added technology,” said Scott Raynovich, founder and principal analyst at Futuriom. “It’s clear they see content as part of the value-add but customers so far don’t seem to be reacting that way. It’s clear they are allergic to paying higher prices for bundled content.”

AT&T and Verizon’s customers are not clamoring for more content deals. When surveyed, most want better internet service at more affordable prices.

AT&T does not see fixed wireless millimeter wave broadband in your future if you live in or around a major city.

John Stephens, AT&T’s chief financial officer, today reiterated to shareholders that building a small cell network for urban and suburban fixed wireless service does not make much sense from a business perspective.

“It’s the cost efficiency,” Stephens told an audience at Cowen and Company’s 46th Annual Technology, Media & Telecom Broker Conference. “Once you [get] the fixed wireless connection from the alley to your house, that’s great you can do that, but you have to get it from the alley into the core network.”

Stephens

Stephens noted that once AT&T realized it would require a collection of small cells to hand wireless traffic off, “building that out can be very expensive when you’re likely doing it in an urban market in a residential area that already has a lot of fiber [or] a lot of competition [from] incumbent telephone and cable companies.”

AT&T sees a likely different future for fixed wireless based on in its ongoing trials underway in Austin, Tex. — selling the service to commercial and manufacturing customers with robotic equipment and other machinery that need instant and fast wireless communications to communicate with each other and back to a central point.

Stephens believes a better idea for its 30 million U-verse fiber-near-the-home customers is to extend fiber directly to those customers’ homes. Stephens said AT&T would be financially better off scrapping the remaining copper wire running the last 500 feet from a customer’s home or business to the nearest fiber-equipped pedestal and give customers dedicated fiber to the home service instead.

“It may be very inexpensive for us compared to the [5G] alternative and gives the customer a tremendous level of service,” Stephens added.

Where millimeter wave could make sense is in exurban and rural areas where clusters of homes could potentially be reached by fixed wireless, assuming there was fiber infrastructure close enough to connect those small cells to AT&T’s network. But AT&T seems to be more interested in applying the technology in commercial and Internet of Things (IoT) applications where wireless access can be essential, and would be much easier to deploy.

Verizon, in contrast, is expanding millimeter wave fixed wireless broadband trials, with the hope of selling a wireless home internet replacement.

Existing Verizon DSL customers in some states are discovering the company is defining “usage” allowances on its two DSL packages. (Image courtesy: Smith6612)

Is Verizon slapping the caps on its DSL customers in the northeast?

A handful of New York and New Jersey Verizon customers were surprised to find Verizon suddenly defining usage limits on their DSL service on its website dashboard for existing customers:

• High Speed Internet: Up to .5 – 1 Mbps — 150 GB Usage
• High Speed Internet Enhanced: Up to 3.1 – 7 Mbps — 250 GB Usage

The sudden appearance of data allowances confused some customers, because the only references to them appear on pages for existing customers seeking to change or upgrade their current DSL package, and only in certain sections of upstate New York and New Jersey.

Careful scrutiny of Verizon’s terms and conditions make no reference to the new data caps, although the company declares customers are responsible for all usage charges. There is also no mention of the caps on Verizon’s sales pages for prospective customers, and phone reps didn’t know anything about them either.

Verizon has not indicated what might happen if a customer exceeds that cap or where the caps are being enforced, if anywhere.

We reached out to different Verizon press contacts twice this week to get confirmation and have heard nothing back.

If you are a Verizon DSL customer, do us a favor and let us know in the comment section what you see when you review options to change your DSL service.

Update 7:18pm EDT: Verizon did get back in touch with us after we went to press in response to several questions.

Here is our Q & A with Verizon’s Ray McConville, corporate media relations representative for New York, New Jersey, Connecticut, and FiOS:

Q. Is Verizon setting data allowances on their DSL service plans?

No. We have been conducting a usage billing trial to a very small set of customers in Virginia where we would measure their data use and display it in their billing. While these customers were given the 250 GB and 150 GB allowances you showed in those screen shots, we’ve never billed customers who exceed those allowances and have no plans to do so. The purpose of the trial was more the idea of accurately collecting and displaying usage in billing.

Q. If a customer exceeds that allowance, what happens?

Nothing. Again, we don’t do data caps. We have the small Virginia trial of displaying usage in billing, but it’s still not a cap, and customers aren’t billed for exceeding the 150 or 250 GB numbers.

Q. Is this a new policy?

No. It’s not a policy – we don’t have data caps or overage charges.

Q. In what states or service areas, if any, is this data allowance policy in effect?

Just the small Virginia trial, and customers are not charged for going over the “allowance.”

Q. If that is the case, why are customers in New York and New Jersey seeing the usage allowances?

It’s a likely system error; they should not have seen that. Only customers in the very limited part of Virginia where we have the trial should see such a thing.

Q. What is the status of the trial in Virginia?

Trial is ongoing – not aware of any end point.

Schneiderman

New York’s Attorney General Eric Schneiderman resigned late Monday after four women accused him of physical abuse, causing a political earthquake in Albany and potentially stalling several important telecommunications-related cases that were championed by the Democrat.

The New Yorker magazine published an article late Monday with the accounts of the four women who said Schneiderman subjected them to non-consensual physical violence during romantic encounters.

Schneiderman issued several statements denying he assaulted anyone or took part in non-consensual sex. His resignation announcement said the allegations will effectively prevent him from carrying out his office’s work.

He had been a vocal proponent of the #MeToo movement against sexual assault and harassment, including filing a lawsuit against Harvey Weinstein, one of the many high-profile men in politics, entertainment and business accused of assaulting women.

Schneiderman was also one of the country’s strongest advocates of holding telecom companies to their agreements. He was actively involved in pursuing the state’s dominant cable company, Charter Communications, for allegedly selling internet speeds his office claimed the company knew it could not deliver, and was more recently investigating Charter for its failure to adequately expand its rural service area to comply with the 2016 merger agreement between Charter, Time Warner Cable and the state’s Public Service Commission.

Schneiderman was elected in 2010 on a platform of pursuing equal justice for all New Yorkers. His website noted, “As the highest ranking law enforcement officer for the State, Schneiderman believes there has to be one set of rules for everyone, no matter how rich or powerful.”

On Tuesday, the governor announced New York Solicitor Barbara Underwood, also a Democrat, has stepped in to serve as acting attorney general.

Underwood, 73, has been the state Solicitor General since 2007 when she was appointed by then Attorney General Andrew Cuomo. Schneiderman left her in place after he won election to the attorney general position in 2010. Underwood has no record of being a political advocate and has no intention to run for the position in the fall elections, making her largely a caretaker of the office. Her role has traditionally been to represent the state in appeals cases.

Underwood

Her lack of political intention was cited by Gov. Cuomo in his remarks introducing her as Schneiderman’s replacement.

Traditionally, caretaker heads of the Attorney General’s office continue existing cases and rely heavily on staff attorneys and their supervisors to continue litigation. But few observers expect Underwood will break ground on new cases or attempt to shift priorities in the office. Because the next scheduled election for New York’s attorney general is this year, most anticipate Underwood will keep a low profile until the election or the legislature replaces her. Had the governor appointed an acting attorney general with political ambitions, most would have expected an active summer and fall of high profile cases to build a list of accomplishments to promote in the fall campaign.

The last Republican to hold the position, Dennis Vacco (1995-1998), told the press the sudden opening of the office could spark considerable interest among Democrats and Republicans. The Attorney General slot has recently proved to be an important position for anyone considering a run for governor in New York. Both Eliot Spitzer and Andrew Cuomo served in this position before being elected to the governor’s office.

Vacco told the Rochester Democrat & Chronicle he expects few changes in the office if Underwood remains a caretaker until the next election.

James

“If she is not a candidate for election, I think that she will be much more status quo-oriented,” he said.

But if the state legislature moves to appoint an interim replacement, the individual chosen will very likely have a political interest in winning the office at the next election opportunity. Vacco said that individual may want to put her or his own imprimatur on the office operations, which means the cases pursued in the future will not likely be the same as those chased by Schneiderman. The idea is “put[ting] distance between yourself and Schneiderman.”

There are multiple Democrats actively considering or who have been mentioned as possible candidates for the position this week:

NY City Public Advocate Letitia James: Favored by Gov. Cuomo, according to a report in the Wall Street Journal, James is no pushover for cable companies. James has led the charge against Charter Communications’ performance in Manhattan and has held Verizon’s feet to the fire over their slow deployment of FiOS in New York’s largest city.

Former Manhattan U.S. attorney Preet Bharara: Has the support of several prominent admirers in New York and Washington, D.C. His indefatigable prosecution of public corruption cases has him feared in some circles and admired in others. He is also a fierce critic of the president. Consumer groups are uncertain what types of cases would get his attention if he were to win the position.

Rep. Kathleen Rice, the former Nassau County district attorney is actively mentioned as a candidate, as is Queens state Sen. Michael Gianaris, and former gubernatorial candidate Zephyr Teachout. Teachout has been actively involved in promoting broadband issues including net neutrality. Another person who has been approached by Democratic officials to weigh a possible run is Ben Lawsky, the former superintendent of the state Department of Financial Services and a former federal prosecutor in the Manhattan U.S. attorney’s office.

Among members of the state legislature, who could quickly appoint a replacement until the fall election, James appears to be the current leading candidate. James would be New York’s first African-American attorney general, and would represent another instance of a female replacing a disgraced male official. She declined comment about her interest in the position.

On the Republican side, lawyer Manny Alicandro is running for the nomination for attorney general. His candidacy is likely to be challenging, given the Democratic enrollment advantage in New York and a mid-term election likely to drive more Democrats to the polls.