The domestic intelligence service of Hungary, the national police of El Salvador, and several law enforcement and police departments of the US are said to be responsible for the use of a global advertising-based surveillance program called. Webloc.
The tool was developed by Israeli company Cobwebs Technologies and is now sold by its successor Penlink after the two companies merged in July 2023, according to a report published by Citizen Lab. Penlink, founded in 1986, is a provider of “critical communications and digital evidence collection and analysis software” to law enforcement agencies in the US and around the world.
Webloc’s US customers include Immigration and Customs Enforcement (ICE), the US military, the Texas Department of Public Safety, DHS West Virginia, NYC district attorneys, and various police departments in Los Angeles, Dallas, Baltimore, Tucson, Durham, and smaller cities and counties such as Elk Grove City and Pinal County.
“Webloc is marketed as an add-on product to the social media and web intelligence system Tangles,” said Citizen Lab researchers Wolfie Christl, Astrid Perry, Luis Fernando Garcia, Siena Anstis, and Ron Deibert. “Webloc provides access to regularly updated records from up to 500 million mobile devices worldwide that contain device identifiers, geographic coordinates, and profile data collected from mobile apps and digital advertising.”
An ad-based surveillance system, in short, uses data purchased from mobile apps and digital advertising to analyze the behavior and movements of hundreds of millions of people. It was officially announced by Cobwebs Technologies in October 2020, describing it as “a state-of-the-art spatial intelligence platform that collects and analyzes web data combined with geospatial data points, using interactive layered maps to connect the digital world with physical data.”
Customers of the tool can use it to monitor the location, movement, and personal characteristics of all people for up to three years. According to information available on Penlink’s website, Webloc can be used to “investigate and interpret location-based data to support your cases.” Webloc also has the ability to find location from IP addresses and identify people supporting devices by collecting their home addresses and work locations.
Interestingly, Cobwebs Technologies was among the seven cyber-soldiers that Meta took down in December 2021 for using about 200 accounts to test targets and engage in social engineering to join closed communities and forums and trick people into revealing personal information.
The social media giant revealed at the time that it had identified Cobwebs Technologies customers in Bangladesh, Hong Kong, United States, New Zealand, Mexico, Saudi Arabia and Poland. “In addition to targeting related to law enforcement activities, we have also seen targeting of activists, opposition politicians, and government officials in Hong Kong and Mexico,” noted Meta.
Reports from 404 Media, Forbes, and the Texas Observer revealed that Webloc can be used to track phones without a warrant, with one purchase notice highlighting the tool’s “ability to automatically and continuously monitor unique mobile advertising IDs, localized IP addresses, and analysis of connected devices.”
An analysis of corporate records and other public information revealed that Cobwebs Technologies shared links with Israeli spyware vendor Quaddream through Omri Timianker, the founder and former president of Cobwebs Technologies, who now oversees Penlink’s international operations. The company is expected to close its operations in 2023.
About 219 active servers associated with Cobwebs product deployment have been identified, most of which are located in the US (126), the Netherlands (32), Singapore (17), Germany (8), Hong Kong (8), and the UK (7). Potential product servers have also been found in various countries across Africa, Asia, and Europe.
In response to the report, Penlink said the findings “appear to be based on misinformation or misunderstandings about our operations, including practices Penlink did not engage in following our acquisition of Cobwebs Technologies in 2023.” It also said it complies with US privacy laws.
“Our research shows that inadequate and questionable ad-based surveillance (ie, without consent or adequate oversight) is being used by military, intelligence and law enforcement agencies down to local police agencies in several countries around the world,” Citizen Lab said.
