Skip to content

Citizen Lab: Webloc Tracked 500M Devices for Global Law Enforcement

alt text

Ad-Tech Surveillance Location Tracking Privacy Risk

Overview

A Citizen Lab investigation reported that a system called Webloc, developed by Cobwebs Technologies (now associated with Penlink), enabled law enforcement users to track mobile devices globally using commercial advertising data rather than malware or device exploitation. Webloc appears to rely on mobile ad-tech telemetry, including mobile advertising identifiers (MAIDs), location signals, and brokered metadata, to reconstruct movement patterns and behavioral profiles. The model highlights how large-scale location surveillance can be achieved through commercial data pipelines without traditional hacking techniques.

Technical Specifications

Attribute Details
System Name Webloc
Developer Cobwebs Technologies (associated with Penlink)
Operational Model Commercial Data Analytics for Device Geolocation
Primary Data Identifier Mobile Advertising IDs (MAIDs)
Data Sources RTB Ad Auctions, App SDK Tracking Data, Data Brokers, Ad Exchanges
Data Types GPS Coordinates, Timestamped Movement Logs, Device Metadata
Capabilities Geofencing Queries, Historical Movement Reconstruction, Cross-App Correlation
Method Passive Data Aggregation (No Malware / No Device Hacking)
Scale Cited Up to 500 Million Devices

Data Sources and Coverage

  • Mobile Apps with Ad/Tracking SDKs: Utility, game, and ad-supported apps that collect device and location data
  • Real-Time Bidding (RTB) Ecosystem: Bidstream and ad auction telemetry containing identifiers, location attributes, and contextual metadata
  • Data Brokers and Ad Exchanges: Aggregated datasets sold or licensed for analytics and targeting use cases
  • Mobile Device Identifiers: MAIDs and related metadata used to correlate user behavior across multiple apps and environments
  • Location Histories: Timestamped coordinate logs enabling retrospective movement analysis over extended periods

Technical Details

  • Webloc reportedly consumes commercial ad-tech datasets rather than breaching endpoints or compromising operating systems
  • Core identity linkage appears to depend on MAIDs, which can be associated with repeated location observations across apps and sessions
  • RTB auction flows and SDK telemetry provide granular spatiotemporal data points that can be aggregated into historical movement timelines
  • System capabilities reportedly include geofence-based queries to identify devices present in specific places at specific times
  • Historical replay functions can reconstruct routes and routines (home/work patterns, travel corridors, recurring visits)
  • Cross-app correlation allows a single device profile to be enriched from multiple independent data feeds, increasing confidence in behavioral inference
  • The surveillance model is passive: no exploit chain, no malware payload, and no direct device intrusion are required to produce high-resolution tracking outputs
  • The approach shifts risk from endpoint security weaknesses to consent, data brokerage, and ecosystem-level governance gaps in ad-tech markets

Attack Scenario

  1. App Installation: A user installs common ad-supported apps (for example, games, tools, or utility apps) on a mobile device
  2. SDK Data Collection: Embedded advertising/tracking SDKs collect location and device metadata, including MAIDs and timestamped signals
  3. RTB Transmission: Data is sent into ad-tech infrastructure during RTB bidding and ad exchange operations
  4. Broker Aggregation: Data brokers aggregate, normalize, and enrich these records across apps and sources
  5. Commercial Access Layer: Analytical access to aggregated datasets is provided through surveillance-oriented tooling
  6. Webloc Querying: An operator runs queries to identify devices present near target locations or events (geofence search)
  7. Historical Reconstruction: The system maps device movement over time to infer behavior, routines, and likely identity patterns
  8. Outcome: Large-scale passive surveillance is achieved without malware deployment or direct endpoint compromise

Impact Assessment

  • Mass-Scale Location Exposure: Large numbers of mobile users can be tracked through ad-tech telemetry without direct awareness
  • Sensitive Pattern Discovery: Home/work locations, travel routes, and recurring visits can reveal personal habits and affiliations
  • Identity Inference Risk: Even pseudonymous identifiers can become attributable when combined with movement and contextual data
  • Consent Transparency Gap: Users may not understand how ad-tech consent paths can enable downstream surveillance use
  • Warrant-Avoidance Concern: Commercially sourced data may be used for tracking where legal safeguards would otherwise require stronger oversight
  • Potential Overreach: Broad query capabilities increase risk of disproportionate or non-targeted surveillance practices
  • Third-Party Misuse Risk: Data brokerage and access chains create opportunities for misuse beyond intended law enforcement contexts
  • Chilling Effects: Awareness of persistent passive tracking can deter lawful civic, journalistic, or political activity
  • Ad-Tech Trust Erosion: Users and regulators may lose trust in mobile app ecosystems that monetize high-granularity location data
  • Regulatory Exposure: Platforms, developers, and brokers face increasing scrutiny under privacy and data protection regimes
  • Supply-Chain Data Risk: Each participant in the SDK-RTB-broker chain can expand exposure surface and governance complexity
  • Operational Security Blind Spot: Traditional cybersecurity controls do not detect or block lawful-but-invasive data brokerage flows by default

Mitigation Strategies

For Users

  • Disable Advertising ID Tracking: Limit ad personalization and reset/disable MAID usage where platform settings allow
  • Restrict Location Permissions: Use "While Using the App" only and revoke access for apps that do not need location data
  • Reduce Unnecessary App Footprint: Avoid installing nonessential free apps with heavy ad/analytics SDK integrations
  • Use Privacy Controls: Enable iOS "Ask App Not to Track" and Android privacy/ad controls, including periodic ad identifier reset
  • Audit App Permissions Regularly: Review and remove excessive location/background access from installed apps

For Organizations and Regulators

  • Restrict Surveillance Resale of Ad Data: Prohibit or tightly control secondary-market use of ad-tech data for geolocation surveillance
  • Strengthen Consent Transparency: Enforce clear disclosures and meaningful consent choices aligned with GDPR-style principles
  • Limit SDK-Level Location Collection: Require data minimization by default and prohibit unnecessary high-frequency location capture
  • Audit Brokers and RTB Pipelines: Establish independent audits and compliance controls for data brokers, exchanges, and SDK vendors
  • Increase Procurement Oversight: Require strict legal and policy review for law enforcement acquisition of commercial location intelligence tools
  • Define Retention and Access Controls: Mandate bounded retention windows, strict access logging, and accountability mechanisms for query usage

Resources

Open-Source Reporting

Last Updated: April 14, 2026