BREAKING: You checked the weather this morning.

And you just told a surveillance company where you sleep.

Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones.


No warrant required.

Read on to understand our latest Citizen Lab investigation + how to protect yourself.

HEARD OF ADINT?
Aka ADvertising INTelligence?


Your apps don't just show ads.

They stream info about your GPS location + a unique identifier to HUNDREDS OF BROKERS EVERY SECOND.

The industry swears the data is "anonymous" but it's actually a Spies-eye-view. Of everyone.

THE "ANONYMIZED DATA" LIE
Companies peddle the BS that advertising data is 'anonymous'

They want to keep you in the dark.

Because, behind the scenes...your weather app is a blinking tracking beacon.

And then players like Pen Link turn that beacon into a data flow.

And sell it to governments.

EXPORT-GRADE SURVEILLANCE
Where does #Webloc, a tool that can monitor entire populations come from?

Well, it originated from notorious Israeli surveillance firm Cobwebs.

But like so many surveillance products, it's gone through some corporate ownership shuffling.

Now, it's sold by Pen Link.

YOUR AMERICAN RIGHTS DON'T PROTECT YOU
American? Think you're protected by the 4th Amendment from ADINT?

I know my rights, get a warrant... right?

Well, some sheriff is just going to pull out the credit card & buy it.


EUROPE? NOT MUCH BETTER
You're 🇪🇺European? Protected by #GDPR, right?

It may be a paper wall.

We sent 96 FOI requests & got some dubious answers.

Meanwhile our collaborator Szabolcs Panyi found multiple intel agencies in 🇭🇺#Hungary using Cobweb products.

If that's not bad enough, the Hungarian government filed charges against Szabolcs while he was collaborating with us.


That's after he revealed Russian influence operations targeting Hungary's upcoming election.

(He's also a past target of #Pegasus spyware...)

ONLY THE WORST BAD GUYS...RIGHT?
'We only use mass surveillance against the worst bad guys'

Tucson Police bought #webloc for sex trafficking.

And wound up using it to hunt a guy stealing cigarette packs from a CircleK gas station.

And monitor political protests (against Kamala Harris)

Mass surveillance turns regular citizens into surveillance targets.

And long history shows that the federal government has an insatiable appetite for tracking law-abiding people with inconvenient politics.

Whatever their stripe.

IT GETS WORSE
Think #webloc is bad? Meet another Cobwebs product: #trapdoor.


Hallmarks of a hidden hacking kit + social engineering tools.


Shady looking stuff & much more investigation needed.

OH HAI BIG TECH
Here's the thing, tons of this technology is hosted by big platforms.


And a sign of how surveillance vendors seek to leverage commercial relationships & infrastructure of big cloud providers.

TELL ME HOW TO STOP THIS
Real talk, it's hard, but you can help starve the ADINT dragnet. Do this now:

IPHONE: ⚙️Settings➡️Privacy & Security➡️ Tracking

Turn off "Allow Apps to Request to Track"


ANDROID: ⚙️Settings➡️Privacy ➡️ Ads ➡️Delete Advertising ID


It's only a beginning, but you don't owe any of these companies a drop of your data.

TAKEAWAY
Ad-tech built a warrantless surveillance system in the guise of a marketing tool.

You are the target. So are your kids. And your friends.

And it's being abused by some of the worst autocrats & security forces around the world.


The ADINT machinery is targeting you.

Search for your country & start asking questions.

It's time to bring more sunlight to this industry.

READ OUR FULL REPORT: https://citizenlab.ca/research/analysis-of-penlinks-ad-based-geolocation-surveillance-tech/

By my brilliant Citizen Lab colleagues Wolfie Christl, Astrid Perry, Luis Fernando Garcia, Siena Anstis, and Ron Deibert

GO DEEPER
Want to learn more about #penlink & #webloc? There's some great reporting out there.

Like this investigation by 404 Media / Joseph Cox


https://www.404media.co/inside-ices-tool-to-monitor-phones-in-entire-neighborhoods/



Another good piece by Forbes' Thomas Fox Brewster: https://www.forbes.com/sites/thomasbrewster/2025/09/18/ice-spends-millions-on-social-media-spy-tech-banned-by-meta-facebook/

It's simple, your #privacy #security and #freedom are at constant risk by private companies that help governments trample on your rights.

They deserve maximum exposure. Thanks for reading!

First, Outlook fails.

Now: Bluetooth won't pair.

Artemis II is NASA's most relatable mission yet.

If you're pissing off the powerful interests, watch this video.

Follow along. Get safer.

They showed us cute missing dogs & we consented to opt into a mass human tracking system.

I think Ring's wants to be Flock. On steroids.

Because instead of just sketchy cameras in parking lots, Search Party will cover your own backyards & homes.



And if you & your neighbors want to challenge the loss of privacy? Well, how exactly would you do that effectively?

Because, instead of going to the city council, looking at the contracts, and calling out your mayor for speeding your city to dystopia, it's massive and distributed.

Will you even know which of your neighbors is now helping to feed the system?

If we had half competent privacy regulators & laws in the US this kind of thing would be a big, hard fight for Ring.

Instead? It's a Super Bowl commercial.

Oh, and yeah Ring has already partnered with Flock Safety to incorporate tools letting the government directly request footage

A VPN company server was seized.

Reminder: your 'privacy' VPN is still a physical server in somebodies jurisdiction.



Claim of RAM disk servers as protection is...interesting.

I know nothing more about this case, but hotplugs that let authorities grab a server without cutting power are common.



Commodity VPNs are not tools for people that need strong privacy.

VPN servers can be seized, and data that goes in & out of them is subject to whatever interception regime is in place in the jurisdiction.

Then there's the question of whether the company can be compelled to turn over user data.

There are some clever approaches to interception & law enforcement demands, like layering data through multiple VPN companies.

Obscura VPN is an example of these tactics.

But it still comes down to you needing to place a lot of trust in a provider...



But your average podcast-sponsoring VPN company?

They are not a safe place if you are concerned about legal action taken in any of the jurisdictions that your data is passing through.

And that's if your data is actually going where you think it is.

Ultimately there is a massive information asymmetry between VPN providers and their customers.

Many of the claims 'defends against hackers' or 'prevents websites from tracking you' etc. are stinkers.

A VPN isn't protecting you from hacking that matters in 2026.

And despite the marketing BS, if all you do is change your IP address with a VPN, trust me your providers still know that you & your browser...are you.

On, and plenty of VPN providers are owned by some exceptionally shady companies..



VPNs are in the 2020s what Antivirus was in the 2000s.

Something that, thanks to marketing, everyone was conditioned to believe was the first step in being secure online.

When if you talked to experts, the consensus view was: nope, not even close.

https://research.google/pubs/no-one-can-hack-my-mind-comparing-expert-and-non-expert-security-practices/

I TRUST YOU BUT YOUR AI AGENT IS A SNITCH: Why We Need a New Social Contract

We’re chatting on Signal, enjoying encryption, right? But your DIY productivity agent is piping the whole thing back to Anthropic.

Friend, you’ve just created a permanent subpoena-able record of my private thoughts held by a corporation that owes me zero privacy protections.


Even when folks use open-source agents like #openclaw in decentralized setups, the default /easy configuration is to plug in an API resulting in data getting backhauled to Anthropic, OpenAI, etc.

And so those providers get all the good stuff: intimate confessions, legal strategies, work gripes. Worse? Even if you’ve made peace with this, your friends absolutely haven’t consented to their secrets piped to a datacenter. Do they even know?

Governments are spending a lot of time trying to kill end-to-end encryption, but if we’re not careful, we’ll do the job for them.

The problem is big & growing:

Threat 1: proprietary AI agents. Helpers inside apps or system-wide stuff. Think: desktop productivity tools by a big company. Hello, Copilot. These companies already have tons of incentive to soak up your private stuff & are very unlikely to respect developer intent & privacy without big fights (Those fights need to keep happening)

Threat 2: DIY agents that are privacy leaky as hell, not through evil intent or misaligned ethics, but just because folks are excited and moving quickly. Or carelessly. And are using someone’s API.

I sincerely hope is that the DIY/ OpenSource ecosystem that is spinning up around AI agents has some privacy heroes in it. Because it should be possible to do some building & standards that use permission and privacy as the first principle.

Maybe we can show what’s possible for respecting privacy so that we can demand it from big companies?

Respecting your friends means respecting when they use encrypted messaging. It means keeping privacy-leaking agents out of private spaces without all-party consent.

Ideas to mull (there are probably better ones, but I want to be constructive):

Human only mode/ X-No-Agents flags
How about converging on some standards & app signals that AI agents must respect, absolutely. Like signals that an app/chat can emit & be opted out of exposure to an AI agent.

Agent Exclusion Zones
For example, starting with the premise that the correct way to respect developer (& user intent) with end to end encrypted apps is that they not be included, perhaps with the exception [risky tho!] of whitelisting specific chats etc. This is important right now since so many folks are getting excited about connecting their agents to encrypted messengers as a control channel, which is going to mean lots more integrations soon.

#NoSecretAgents Dev Pledge
Something like a developer pledge that agents will declare themselves in chat and not share data to a backend without all-party consent.

None of these ideas are remotely perfect, but unless we start experimenting with them now, we're not building our best future.

Next challenge? Local Only / Private Processing: local-First as a default.
Unless we move very quickly towards a world where the processing that agents do is truly private (e.g. not accessible to a third party) and/or local by default, even if agents are not shipping signal chats, they are creating an unbelievably detailed view into your personal world, held by others. And fundamentally breaking your own mental model of what on your device is & isn't under your control / private.

NEW: Microsoft turned over Bitlocker keys to FBI.



When you key escrow your disk encryption with someone, they can be targeted with a warrant.

This case is a really good illustration that if you nudge users with a default to save their keys with you... they will do so & may not fully understand the implications.


Of course, once the requests start working... they are likely to accelerate.

Story: https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/

Hotel toilet privacy is disappearing.

Glass doors.

Or no door.

Or a big window into the room.

Who is asking for this?

Suddenly hearing about zcash everywhere.

Feels inorganic.

What's up?

YIKES: NSO floats Pegasus spyware use in a "time of domestic crisis" in 🇺🇸America.

I believe they won't stop lobbying until they get Pegasus into USA.

To hack Americans.