CBP used online advertising data to track phone locations

US Israel launched a war on Iran last week that has already killed more than 1,200 Iranians and spread throughout the Middle East. There are many unknowns about US President Donald Trump’s goals as the conflict enters its second week, and the situation appears set to spark an energy crisis with repercussions around the world.

Iran is suffering from a nationwide internet shutdown with only the country’s regime-created intranet available, plunging Iranians into digital darkness and making it difficult for humanitarian relief workers, journalists and others to spread information inside and outside the country. As strikes began on Tehran last weekend, an apparently hacked prayer app sent messages saying “surrender” and “help is on the way” to Iranians across the country.

Meanwhile, GPS-like jamming attacks – not to mention physical threats – are on the rise in the Strait of Hormuz, threatening cargo ships. Hacking security cameras has emerged as part of the rules of the game in war. Missile interception systems across the Middle East are under intense pressure – and in some cases destroyed in air strikes.

Trump fired Homeland Security Secretary Kristi Noem this week. Her tenure was marked by aggressive anti-immigration tactics, and the killing by ICE and CBP of two American protesters. A highly sophisticated iPhone hacking toolkit that was likely originally designed for the US government is in the hands of several other countries as well as crooks who have likely used the tools to infect tens of thousands of phones or more. Some US lawmakers are calling for an investigation into the threat posed by decades-old side-channel hacking technology. WIRED covered how music streaming CEO Elie Habib built the open source global threat map World Monitor in his spare time.

And there’s more. Every week we round up security and privacy news that we haven’t covered in depth ourselves. Click on the titles to read the full stories. And stay safe out there.

US Customs and Border Protection has admitted, for the first time, that it purchased phone location data from the sprawling, surveillance-laden online advertising industry. The agency’s acknowledgment was included in a document called the Privacy Threshold Analysis, which 404 Media obtained through a Freedom of Information Act request. The document relates to an experiment conducted by Customs and Border Protection between 2019 and 2021.

The post notes that CBP purchased data associated with real-time bidding processes. When you see ads online or in apps, they are often shown to you after automated, real-time auctions where advertisers bid to show that specific ad to you. The more obscure parts of the advertising industry can collect data from your device, including your phone’s identifying details and location data; It is then repackaged and sold to companies and entities. He has called the data a “gold mine” for tracking people’s daily activities.

CBP did not respond to 404 Media’s request for comment on whether it is still purchasing the data; However, ICE reportedly planned to purchase access to another system, called Webloc, which allows entire neighborhoods to be monitored for cellphone movements.

The FBI was able to identify an Atlanta protester after eventually obtaining information from Swiss encrypted email service Proton Mail, court documents revealed this week. A court document reviewed by 404 Media shows that payment information linked to Proton’s email address was provided to US law enforcement by Swiss authorities after a request was made under the Mutual Legal Assistance Treaty (MLAT), which allows agencies to share data internationally.

Swiss officials filed a data access request under Swiss laws to Proton to obtain payment information associated with the defencetheatlantaforest@protonmail.com email address, which was linked to protests in Atlanta. This information was then provided to US law enforcement officials under international agreements, and they were able to identify the person associated with the account.