- [Narrator] You're probably aware

that different apps on your cellphone

can track your movements.

That location data is commercially available

along with other personal information

like your social media profile, email address,

and date of birth.

But what the Wall Street Journal has learned

is that the government has also bought a commercial data

and is using it for some forms of law enforcement.

- Two components of the Department of Homeland Security

are using this app-generated marketing data

for law enforcement purposes.

The fact that there're millions of cellphones

and cellphone locations in this database

makes it one of the larger domestic surveillance efforts

that we've become aware of in recent years.

It raises a lot of questions among the Americans

about their privacy

and what kind of information corporations

are collecting on them,

and what those corporations are doing with that information.

(light music)

- [Narrator] This is how it works.

You get this popup

and agree to let an app use your location.

A travel app may want it

to suggest nearby hotels or airports.

Rideshare apps want to know where to pick you up.

But often those apps are also sharing your location

with marketers who're using it for targeted ads, research,

analysis and even reselling it.

But what we found is that, in some cases,

that consumer data is being resold to companies

that buy and sell data for the government.

According to people familiar with the matter

and documents reviewed by the Wall Street Journal,

the Trump administration has purchased the database

that maps the movements of millions of cellphones

in the U.S.,

and it's using it for immigration and border enforcement.

(light music)

In 2018, data tracking contributed to the discovery

of a drug-smuggling tunnel

according to people with knowledge of the operation.

- Sources describe this one case down in Arizona,

a border town called, San Luis,

where a man had allegedly built a tunnel

between his property, which was an abandoned KFC restaurant,

and the Mexican border.

Police say that smugglers were using this tunnel,

but the interesting thing is,

when this person was arrested,

none of the court records indicate

that they found this tunnel based on cell records.

This data was showing cellphone's moving

from one side of the border to the other

and investigator surmised

there must be an illegal tunnel there

and began further investigation

that led the arrest of this person.

- [Narrator] In a statement to the Wall Street Journal,

a CBP spokesman said,

"While CBP is being provided access to location information,

"it is important to note that such information

"does not include cellular phone tower data,

"is not ingested in bulk,

"and does not include the individual user's identity."

The government would not discuss details

about how it is using the data.

But people familiar with some of the government efforts

say it is used to generate investigative leads

about possible illegal border crossings,

and for detection or tracking of migrant groups.

The government's location data efforts

are also described opaquely

in the U.S. Department of Homeland Security's

Privacy Assessment.

One reads, "The goal is to utilize this data

"to detect the presence of - but not identify -

"individuals in an area which CBP has identified

"as an area of interest,

"consistent with CBP statutory authorities,

"federal law, and DHS policy."

(upbeat music)

- [Woman's Voice] Your average consumer looks at their phone

over 150 times a day.

- [Narrator] The marketing technology ecosystem

has taken off in recent years.

(upbeat music)

- [Man's Voice] Marketers create audiences

based on rich device-level attributes

including location, platform, device type

and app (mumbles).

All this data has built on

what more than 250 million mobile consumers do in real life.

Every day,

- [Narrator] It's big business and there are many companies

collecting all sorts of different data,

anything from the speed to a traveling,

to what floor you're on, to your social media profiles.

Some companies known as data brokers

buy different sets of these data and combine them to create

even more sophisticated individual digital profiles

while the privacy policies of these companies say

they do not keep personal information and explain that,

to them, you were just a few letters or numbers

known as an Ad-ID.

Experts we spoke to say that, by using large data sets,

it's easy to figure out who a phone belongs to,

which is one of the reasons

why this data is so valuable to the government.

- The location data is some of the most sensitive data

that exists.

- [Narrator] Alan Butler is the general counsel

of the Electronic Privacy Information Center,

a nonprofit research and advocacy center based in D.C..

- There are a number of different ways

that a company that obtains these data sets

could identify a person.

One way might be by mapping the locations over time

because people live in operative patterns,

the companies are more concerned with discrete connections.

They wanna tie everything together in an automated way.

And the easiest way for them to do that

is by using identifiers, the Ad-ID,

which is gonna connect the dots,

all the dots of them will add data,

but also email addresses, Facebook profiles,

or Twitter profiles, or other sort of app profile data.

And so, the more data those companies can get about you,

the more they can connect it.

(light music)

- [Narrator] If the government wanted to get

that kind of data from your cellphone provider,

they have to get a warrant from a judge.

But because this data is for sale, for marketers,

they are able to buy it and access it without a warrant.

- Most recently, the Supreme Court

in the Carpenter versus United States case

restricted the government's ability

to use a court order to get commercial data

from the phone company,

which is the data about where your phone is connecting

on the cellphone network.

The Supreme Court has not directly addressed

the purchasing of commercial data,

the federal law doesn't impose restrictions

and the circumstance under which the federal government

can collect personal data under the Privacy Act,

but that also can be tricky

if the company never actually stores the data

in a government database.

- [Narrator] Recently, some companies have taken steps

to alert users about location data.

- This market advertising data on smartphones

is barely 10 years old

and already we're seeing

that consumers are taking more control over their privacy

in ways that could've hurt this industry.

Apple and its latest update made it

so that it reminded users how often apps are tracking them.

And some industry insiders have said

that the amount of location data has plummeted

since Apple made that change.

Users are becoming broadly much more aware of

how their phones are tracking them and taking steps

to limit what kind of apps have accessed to their location.

- [Narrator] Critics argue that if companies have this data,

then why shouldn't the government also have access to it

for crime prevention.

- I think the reaction that law enforcement should be able

to get access to data that the companies have access to,

it kinda falls into two common traps.

One is that it assumes that the company

should have access to that data, too,

but even given the fact

that some companies are accessed to data,

I think law enforcement use the data,

it's just a fundamental different thing

because the government exercises the power of the state

and so we've always had a special set of rules

for the government's collection of data

and surveillance of individuals.

- [Narrator] Right now,

there is no comprehensive U.S. privacy law.

The European Union, in 2016,

passed the General Data Protection Regulation,

which more tightly controls how European data can be used.

In the U.S., there are ongoing efforts

to introduce tougher national privacy laws in Congress.

- Programs like this are certainly going to fuel the call

for a comprehensive privacy law in the United States

that limits the way corporations can share data

that they collect on users.

California has taken some steps

towards passing some greater privacy protections,

but federally, there's no law that stops or limits

what corporations can do with the data they collect

on their users in this particular market.

That's how it ended up in the hands of the government.