CHESTERFIELD COUNTY, Va. (WRIC) — Virginia State Police (VSP) is one of several law enforcement agencies across the country making use of a Loudon County-based tracking tool that allows authorities to examine location data collected through applications on citizens’ phones.

Fog Data Science is the company behind Fog Reveal, which purchases and aggregates location data from software applications on smartphones. That information can then be sold to marketing firms and law enforcement agencies alike.

“When you opt into an app, you allow that app, whether it be any app or any of the 100 apps on your phone, to track your whereabouts,” Fog Data Science spokesperson Jessica Tocco told WFXR’s sister station 8News. “You give those apps the right to track your whereabouts, but also to share that data, typically, when you’re clicking ‘yes’ on that app. That data gets shared with a number of data aggregators that use it for a lot of different things.”

In VSP’s case, a spokesperson told 8News that the department purchased a year-long subscription in July 2022 with Fog Reveal, and would be re-evaluating its cost/value approach as the contract expiration date approaches this coming July.

“This particular resource has been a tool of last resort, and has been access for only about 18 criminal investigations, and has yet to generate any successful investigative leads or evidence,” VSP Public Relations Director Corinne Geller said in an email. “One example was trying to see if it would help generate a lead on the individual who struck and killed a person riding a scooter. The fatal hit-and-run occurred in an area without any witnesses or surveillance cameras.”

Tocco also noted that the information provided by Fog Reveal may just be a piece of the overall puzzle when it comes to crime solving.

“This is one of the many tools that we understand law enforcement are looking for. This is not the end,” she said. “You cannot convict someone because the marketing app number was in the location of a crime. But it’s a tool that helps police officers know who is in an area at a specific time, potentially even a witness.”

Documents obtained by nonprofit digital rights organization Electronic Frontier Foundation revealed discussions of the usage of Fog Reveal by law enforcement agencies in Florida, Indiana, Iowa, Maryland, Missouri, North Carolina, Tennessee and Texas. The technology was also mentioned in a Homeland Security Investigations presentation on analyst strategies when it comes to human trafficking investigations.

Beryl Lipton, an investigative researcher with Electronic Frontier Foundation, told 8News that documentation showed VSP purchased the one-year subscription to Fog Reveal for $15,000.

“The app does not provide real-time location data nor does it provide any personal identifying information. Fog Reveal aggregates and correlates commercially available data that could have the potential to be helpful in an investigation,” Geller said. “The phone must be turned on and its owner must have already consented to have their information collected and sold for the software to recognize it.” If the code provides any evidential indicators relevant to the ongoing criminal investigation, then a state police special agent must obtain a warrant in order to acquire any additional information.”

The concern from privacy advocates, however, is that the technology allows authorities to examine location data without a warrant.

In an email statement to 8News, ACLU of Virginia Senior Staff Attorney Matthew Callahan shared the following:

Fog Reveal is an invasive surveillance technology that raises serious privacy concerns, including Fourth Amendment concerns. The Supreme Court has made clear that long-term electronic surveillance of people without a warrant can violate the Fourth Amendment. If law enforcement officers are using these tools in any circumstances without a warrant, that use could very well be a violation of a Fourth Amendment.

Fog licenses data from apps that claim to track users for advertising purposes and sells it to law enforcement. It is likely that very few of the end users who install these apps understand in a practical sense that their data may end up in the hands of police. While Fog Reveal may not itself store what it considers to be “personally identifiable information” about the people whose data it aggregates, the data it is selling is often enough to identify people (such as location data showing which house someone is in during sleeping hours coupled with what building they are in during work hours).

Mass surveillance technologies make all Virginians less free. Surveillance technologies also have a long history of being used to intimidate and oppress certain communities and groups more than others, including those that are defined by a common race, ethnicity, religion, national origin, income level, sexual orientation, or political perspective.  At a minimum, before any new technology is adopted by law enforcement, the decision to use it should be subjected to an open and robust debate with the public. That conversation has not happened with the use of Fog Reveal in Virginia.

Geller noted that, in the event any “evidential indicators relevant to the ongoing criminal investigation” are provided from Fog Reveal’s use, a state police agent would then need to obtain a warrant in order to acquire additional information.

“It has a marketing ID number that’s tied to a device,” Tocco said. “They’ll use that data to look for patterns — who is coming and going at a specific time.”

She also noted that the data cannot be used for surveillance purposes because of a 24-48 hour lag.

“If a murder or something happened at a certain scene, if there was no lead, a police officer would have to go back to that location multiple times during the time the murder was committed to see who’s around,” Tocco said. “Maybe someone was passing by. This is similar to that. It just helps them know what could have been in that area.”

Lipston sent the following statement to 8News:

It is misleading to claim that real-time or historical location information accessed through Fog does not contain personally identifiable data (PII). This claim is made because the owner of the device is not explicitly named in connection to a particular set of location points. Location information is highly sensitive and can often be re-identified with just one other data point, like the location to which a particular device goes in the morning or stays stagnant at night. Policing agencies, in general, know this, and they are able to effectively geofence areas and access the historical locations of those who visited those places. The purchase of “commercially available” data is one way that law enforcement can circumvent restrictions, like warrants, that are designed to protect against unlawful seizure and to bolster due process. Lacking oversight and policies, agencies that have this kind of information could be providing access to this incredibly sensitive information to anyone in their department without reason or oversight. 

These issues implicate many of the problems that exist with the collection and retention of location data, in general, and the inadequacy of existing laws and regulations to deal with technological evolution. 

Smartphone users may opt-out of data sharing, however. For iPhones, Apple requires apps to ask permission before accessing this information. When a new app is installed, a pop-up will read, “Allow ‘App’ to track your activity across other companies’ apps and websites?” and the user can select “Ask App Not to Track” or “Allow.” This can also be done through the Privacy & Security settings. For Androids, Google allows user to delete the identification number associated with this information, known as an advertising ID. This can be done through Settings, Privacy, and then Ads.