The Global Ad-Tech Panopticon: How Law Enforcement Tracks 500 Million Devices via Webloc

TL;DR

A new report from Citizen Lab reveals that law enforcement agencies globally are using a surveillance tool called Webloc to track 500 million mobile devices using advertising data. The tool, developed by Cobwebs Technologies (now part of Penlink), allows authorities—including dozens of U.S. agencies—to monitor locations and movements without a warrant by harvesting data from the digital advertising ecosystem.

---

A significant investigation by Citizen Lab has pulled back the curtain on a global geolocation surveillance system known as Webloc. According to the report, this ad-based intelligence tool provides law enforcement, military, and intelligence agencies with access to the movement data of approximately 500 million mobile devices worldwide.

By leveraging the "digital exhaust" of the mobile advertising industry, Webloc allows its users to bypass traditional legal hurdles, such as warrants, to track individuals and entire populations in near real-time.

What is Webloc?

Webloc is an advertising-based geolocation surveillance system. Originally developed by the Israeli firm Cobwebs Technologies, it is now sold by Penlink, a U.S.-based digital evidence firm that merged with Cobwebs in July 2023.

The tool operates as an add-on to a larger social media and web intelligence platform called Tangles. According to Citizen Lab researchers, Webloc provides a "constantly updated stream" of records harvested from mobile apps and digital advertising. This data includes:

• Unique device identifiers (MAIDs)
• Precise GPS coordinates
• Profile data and personal characteristics
• Geolocated IP addresses

One of the most powerful features of the tool is its historical depth; users can monitor the movements and behaviors of populations up to three years in the past.

Who is Using This Surveillance?

The Citizen Lab report attributes the use of Webloc to a wide array of domestic and international agencies. While the technology is global, the saturation of its use within the United States is particularly notable.

International Users:

• Hungarian domestic intelligence
• National police in El Salvador
• Previous reconnaissance activity (via Meta’s 2021 report) identified customers in Bangladesh, Hong Kong, New Zealand, Mexico, Saudi Arabia, and Poland.

U.S. Federal and Military Users:

• Immigration and Customs Enforcement (ICE)
• The U.S. Military
• Texas Department of Public Safety
• Department of Homeland Security (DHS) West Virginia

Local U.S. Law Enforcement: The tool is utilized by numerous local police departments and district attorneys, including those in Los Angeles, Dallas, Baltimore, Tucson, Durham, and NYC. Smaller jurisdictions, such as the City of Elk Grove and Pinal County, are also listed as users.

Privacy Concerns and the "Warrantless" Loophole

The core controversy surrounding Webloc is its ability to facilitate warrantless surveillance. Because the data is technically "purchased" from the commercial advertising ecosystem rather than seized from a service provider, many agencies use it to circumvent the Fourth Amendment requirements typically needed to track a phone's location.

Beyond mere location tracking, Webloc can:

1. Infer Identity: It can identify the person behind a device by gathering home and workplace addresses based on dwell time at specific coordinates.
2. Continuous Monitoring: Procurement notices suggest the tool automates the monitoring of unique mobile IDs and connected devices.
3. Cross-Platform Intelligence: It fuses digital web data with physical geospatial data points.

A History of Controversy

Cobwebs Technologies, the creator of Webloc, has a troubled history with privacy advocates. In December 2021, Meta (formerly Facebook) deplatformed Cobwebs, removing 200 accounts. Meta alleged the firm conducted reconnaissance on targets—including activists, opposition politicians, and government officials—and used social engineering to infiltrate closed communities.

Furthermore, corporate records reveal links between Cobwebs' founder, Omri Timianker, and the now-shuttered Israeli spyware vendor Quadream. While Penlink maintains that it complies with U.S. state privacy laws, Citizen Lab identified 219 active servers associated with Cobwebs products, the majority of which are hosted in the U.S., followed by the Netherlands and Singapore.

Conclusion

The findings from Citizen Lab underscore a growing trend where the private data brokerage industry is being weaponized for state surveillance. By rebranding "advertising data" as "location intelligence," companies like Penlink provide law enforcement with a persistent, global tracking system that operates largely in the shadows of current privacy legislation.

As Citizen Lab researchers noted, these "intrusive and legally questionable" systems are no longer reserved for high-level intelligence agencies; they are now part of the standard toolkit for local police units across the globe.

---

Source: Citizen Lab: Law Enforcement Used Webloc to Track 500 Million Devices via Ad Data