Carriers cut off access to location data

Verizon, AT& T, Sprint and T- Mobile have pledged to stop providing information on US phone owners’ locations to data brokers, stepping back from a business practice that has drawn criticism for endangering privacy.

The data has apparently allowed outside companies to pinpoint the location of wireless devices without their owners’ knowledge or consent. Verizon said that about 75 companies have been obtaining its customer data from two little- known California- based brokers that Verizon supplies directly — LocationSmart and Zumigo.

Verizon was the first major carrier to declare it would end sales of such data to brokers that then provide it to others. It did so in a June 15 letter to Sen. Ron Wyden, an Oregon Democrat who has been probing the phone location- tracking market. AT& T, T- Mobile and Sprint followed suit Tuesday after The Associated Press reported the Verizon move.

None of the carriers said they are getting out of the business of selling location data. The carriers together have more than 300 million US subscribers. Verizon Chief Privacy Officer Karen Zacharia said the company would be careful not to disrupt “beneficial services” such as fraud prevention and emergency roadside assistance. In an email to the AP, AT& T spokesman Jim Greer cited similar reasons for cutting off the intermediaries “as soon as practical.”

Last month, Wyden revealed abuses in the lucrative but loosely regulated field involving Securus Technologies, whose contract Verizon says was approved only for the location tracking of outside mobile phones called by prison inmates.

Therefore, Verizon notified LocationSmart and Zumigo, both privately held, that it intends to “terminate their ability to access and use our customers’ location data as soon as possible,” Zacharia wrote.

Location data from Verizon and other carriers make it possible to identify the whereabouts of nearly any phone in the US within seconds. Popular commercial uses for the information include keeping tabs on packages, vehicles and employees; bank fraud prevention; and targeted marketing offers.

The cut off won’t affect users’ ability to share locations directly with apps and other services. Rather, it deals with the practice of providing data to third parties with whom users have no direct contact. Wyden wrote all four major US wireless carriers on May 8 after learning about a web portal that let law officers track Americans’ locations without proper oversight. A former sheriff in Missouri has been accused of using Securus data for unauthorised surveillance of a judge, a sheriff and highway patrol officers.

Days later, a Carnegie Mellon University security researcher discovered a security flaw in LocationSmart’s website that could have allowed any reasonably sophisticated hacker to secretly track almost any phone in the US or Canada. Wyden asked the carriers to identify which third parties have been acquiring carrier location data.

AT& T and T- Mobile, No. two and three in customers, said to Wyden they only allow authorised third parties to access customer location data if the affected customers have given consent or if it is required by law — for instance, a court order. Verizon said the same.

Gigi Sohn, a former top advisor at the FCC in the Obama administration, said Verizon has lately proven itself a “shining example” on privacy. “I think they understand that bad privacy practices are bad for business,” she said.

Moy said Verizon may have been motivated by a $ 1.4 million FCC fine for an earlier episode in which the company quietly tracked its wireless customers’ online travels with a “supercookie” for at least 22 months beginning in December 2012.

The company subsequently signed a consent order with the FCC promising to restrict that tracking to customers who affirmatively agreed to it. The case also spurred FCC rules that would have required carriers to obtain consent for selling their customers’ wireless location data. But the GOP- led Congress quashed those rules last year. Analysts say it’s difficult to gauge the size of the location-tracking aggregation market. On its website, LocationSmart claims it is the No. 1 “location- as- a- service” provider with data from every top- tier US wireless carrier and more than 200 enterprise customers. Zumigo appears oriented to the financial sector and lists Intel, Wells Fargo and Capital One among investors. In a statement, LocationSmart said it respects user privacy, doesn’t provide access to location information without user consent and doesn’t warehouse data or track user location histories.

Analyst Rich Mogull of Arizona- based Securosis said telecom providers track and sell location data as a matter of course. A wide range of other businesses such as Google also assiduously compile location datasets on consumers.