In a surprising turn of events, Verizon has agreed to stop sharing cell phone location data with third party location aggregation services. Last month, I wrote a blog post titled "You are Being Tracked - Real-time Cell Phone Location Data Leaked" which provided a summary of events and a timeline about how a company called Securus Technologies marketed a service to allow law enforcement officials unfettered access to the cell phone location data for all cell phones in the US and Canada without authorization or a warrant. I also provided details about Oregon Senator Ron Wyden's demand that the FCC look into the matter. In addition, Senator Wyden also sent letters to all of the major US cellular carriers demanding that they take proactive measures to prevent this type of access from being abused in the future. From Wyman's letter to Sprint:
I am writing to insist that Sprint take proactive measures to prevent the unrestricted disclosure and potential abuse of private customer data, including real-time location information, by at least one other company to the government.
Here is a link to the Sprint letter.
Here is a link to the Verizon letter.
Here is a link to the AT&T letter.
Here is a link to the T-mobile letter.
On June 15th, Senator Wyden published the letters that he received in response to the letters he had previously sent to Sprint, Verizon, AT&T and T-mobile. In his article published yesterday, Brian Krebs from krebsonsecurity stated the following:
While three out of four providers said they had cancelled data sharing agreements with some of the offending companies, only one — Verizon — pledged to terminate all of them and initiate a wholesale review of their location data-sharing practices.
Verizon's response clearly indicates a commitment to end their relationships with the two location aggregation services with which they currently have contracts. It also gives a great summary of who Verizon contracts with, what consumer protections were in place, how Securus abused access to customer location data, and what steps will be taken in the future to prevent this from happening again.
Here are the responses from Sprint, T-mobile, and AT&T. While T-mobile and AT&T have made it clear that they have terminated their relationship with Securus, they did not go as far as Verizon in dropping contracts with all location aggregators. Sprint was the only one of the four companies that declined to name which location aggregators that they contract with.
Verizon's commitment to end its relationships with location aggregators is encouraging, but there is no guarantee that Verizon will not contract with location aggregators in the future. There are not any federal regulations that provide any enforcement for how these companies share your data. Currently, we just have to take the carriers at their word. As we have seen with this story and many others in the past, that is not good enough.