Texas State Police Purchased Israeli Phone-Tracking Software for “Border Emergency”

The Texas Department of Public Safety purchased access to powerful software capable of locating and following people through their phones as part of Republican Gov. Greg Abbott’s “border security disaster” efforts, according to documents reviewed by The Intercept.

In 2021, Abbott proclaimed that the “surge of individuals unlawfully crossing the Texas-Mexico border posed an ongoing and imminent threat of disaster” to the state and its residents. Among other effects, the disaster declaration opened a spigot of government money to a variety of private firms ostensibly paid to help patrol and blockade the state’s border with Mexico.

One of the private companies that got in on the cash disbursements was Cobwebs Technologies, a little-known Israeli surveillance contractor. Cobwebs’s marquee product, the surveillance platform Tangles, offers its users a bounty of different tools for tracking people as they navigate both the internet and the real world, synthesizing social media posts, app activity, facial recognition, and phone tracking.

“As long as this broken consumer data industry exists as it exists today, shady actors will always exploit it.”

News of the purchase comes as Abbott’s border crackdown escalated to new heights, following a Department of Public Safety whistleblower’s report of severe mistreatment of migrants by state law enforcement and a Justice Department lawsuit over the governor’s deployment of razor wire on the Rio Grande. The Cobwebs documents show that Abbott’s efforts to usurp the federal government’s constitutional authority to conduct immigration enforcement have extended into the electronic realm as well. The implications could reach far beyond the geographic bounds of the border and into the private lives of citizens and noncitizens alike.

“Government agencies systematically buying data that has been originally collected to provide consumer services or digital advertising represents the worst possible kind of decontextualized misuse of personal information,” Wolfie Christl, a privacy researcher who tracks data brokerages, told The Intercept. “But as long as this broken consumer data industry exists as it exists today, shady actors will always exploit it.”

Like its competitors in the world of software tracking tools, Cobwebs — which sells its services to the Department of Homeland Security, the IRS, and a variety of undisclosed corporate customers — lets its clients track the movements of private individuals without a court order. Instead of needing a judge’s sign-off, these tracking services rely on bulk-purchasing location pings pulled from smartphones, often through unscrupulous mobile apps or in-app advertisers, an unregulated and increasingly pervasive form of location tracking.

In August 2021, the Texas Department of Public Safety’s Intelligence and Counterterrorism division purchased a year of Tangles access for $198,000, according to contract documents, obtained through a public records request by Tech Inquiry, a watchdog and research organization, and shared with The Intercept. The state has renewed its Tangles subscription twice since then, though the discovery that Cobwebs failed to pay taxes owed in Texas briefly derailed the renewal last April, according to an email included in the records request. (Cobwebs declined to comment for this story.)

A second 2021 contract document shared with The Intercept shows DPS purchased “unlimited” access to Clearview AI, a controversial face recognition platform that matches individuals to tens of billions of photos scraped from the internet. The purchase, according to the document, was made “in accordance/governed by the Texas Governor’s Disaster Declaration for the Texas-Mexico border for ongoing and imminent threats.” (Clearview did not respond to a request for comment.)

Each of the three yearlong subscriptions notes Tangles was purchased “in accordance to the provisions outlined in the Texas Governor-Proclaimed Border Disaster Declaration signed May 22, 2022, per Section 418.011 of the Texas Government Code.”

The disaster declaration, which spans more than 50 counties, is part of an ongoing campaign by Abbott that has pushed the bounds of civil liberties in Texas, chiefly through the governor’s use of the Department of Public Safety.

Under Operation Lone Star, Abbott has spent $4.5 billion surging 10,000 Department of Public Safety troopers and National Guard personnel to the border as part of a stated effort to beat back a migrant “invasion,” which he claims is aided and abetted by President Joe Biden. The resulting project has been riddled with scandal, including migrants languishing for months in state jails without charges and several suicides among personnel deployed on the mission. Just this week, the Houston Chronicle obtained an internal Department of Public Safety email revealing that troopers had been “ordered to push small children and nursing babies back into the Rio Grande” and “told not to give water to asylum seekers even in extreme heat.”

On Monday, the U.S. Justice Department sued Texas over Abbott’s deployment of floating barricades on the Rio Grande. Abbott, having spent more than two years angling for a states’ rights border showdown with the Biden administration, responded last week to news of the impending lawsuit by tweeting: “I’ll see you in court, Mr. President.”

Despite Abbott’s repeated claims that Operation Lone Star is a targeted effort focused specifically on crimes at the border, a joint investigation by the Texas Tribune, ProPublica, and the Marshall Project last year found that the state was counting arrests and drug charges far from the U.S-Mexico divide and unrelated to the Operation Lone Star mandate. Records obtained by the news organizations last summer showed that the Justice Department opened a civil rights investigation into Abbott’s operation. The status of the investigation has not been made public.

Where the Department of Public Safety’s access to Tangles’s powerful cellphone tracking software will fit into Abbott’s controversial border enforcement regime remains uncertain. (The Texas Department of Public Safety did not respond to a request for comment.)

Although Tangles provides an array of options for keeping tabs on a given target, the most powerful feature obtained by the Department of Public Safety is Tangles’s “WebLoc” feature: “a cutting-edge location solution which automatically monitors and analyzes location-based data in any specified geographic location,” according to company marketing materials. While Cobwebs claims it sources device location data from multiple sources, the Texas Department of Public Safety contract specifically mentions “ad ID,” a reference to the unique strings of text used to identify and track a mobile phone in the online advertising ecosystem.

“Every second, hundreds of consumer data brokers most people never heard of collect and sell huge amounts of personal information on everyone,” explained Christl, the privacy researcher. “Most of these shady and opaque data practices are systematically enabled by today’s digital marketing and advertising industry, which has gotten completely out of control.”

While advertisers defend this practice on the grounds that the device ID itself doesn’t contain a person’s name, Christl added that “several data companies sell information that helps to link mobile device identifiers to email addresses, phone numbers, names and postal addresses.” Even without extra context, tying a real name to an “anonymized” advertising identifier’s location ping is often trivial, as a person’s daily movement patterns typically quickly reveal both where they live and work.

Cobwebs advertises that WebLoc draws on “huge sums of location-based data,” and it means huge: According to a WebLoc promotional brochure, it affords customers “worldwide coverage” of smartphone pings based on “billions of data points to ensure maximum location based data coverage.” WebLoc not only provides the exact locations of smartphones, but also personal information associated with their owners, including age, gender, languages spoken, and interests — “e.g., music, luxury goods, basketball” — according to a contract document from the Office of Naval Intelligence, another Cobwebs customer.

The ability to track a person wherever they go based on an indispensable object they keep on or near them every hour of every day is of obvious appeal to law enforcement officials, particularly given that no judicial oversight is required to use a tool like Tangles. Critics of the technology have argued that a legislative vacuum allows phone-tracking tools, fed by the unregulated global data broker market, to give law enforcement agencies a way around Fourth Amendment protections.

The power to track people through Tangles, however, is valuable even in countries without an ostensible legal prohibition against unreasonable searches. In 2021, Facebook announced it had removed 200 accounts used by Cobwebs to track its users in Bangladesh, Saudi Arabia, Poland, and several other countries.

“In addition to targeting related to law enforcement activities,” the company explained, “we also observed frequent targeting of activists, opposition politicians and government officials in Hong Kong and Mexico.”

Beryl Lipton, an investigative researcher with the Electronic Frontier Foundation, told The Intercept that bolstering surveillance powers under the aegis of an emergency declaration adds further risk to an already fraught technology. “We need to be very skeptical of any expansion of surveillance that occurs under disaster declarations, particularly open-ended claims of emergency,” Lipton said. “They can undermine legislative checks on the executive branch and obviate bounds on state behavior that exist for good reason.”