The 404 Media Podcast (Premium Feed)

And so I just started looking into the data that they had access to, which just was odd to me. Of all of the dating apps that they could have purchased, they chose to purchase Grindr.

Hello, and welcome to the four zero four Media Podcast where we bring you unparalleled access to hidden rules both online and IRL. Four zero four Media is a journalist on the company and needs your support. To subscribe, go to 404media.co, As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments, and they get early access to our interview series too. Gain access to that content at 404media.co. Also, do remember to subscribe to our YouTube channel where you can watch all of our episodes, including this one.

Subscribe at youtube.com/404mediaco. At This week, I'm speaking to Mike Yigley. He is someone that you may have come across if you follow the worlds of privacy and location data, especially the stuff I cover, the stuff that Byron Tau covers as well, who was sort of the leading journalist on location data, then I followed in his wake and did a bunch of stories. I spoke to Byron many, many episodes ago, you can go find that as well. But Mike comes up because he's one of these people that introduced location data to the government in the first place way back in around 2015.

I won't spoil everything we talk about, but what I will say is that I really like speaking to Mike because frankly, he's kind of a complicated character. He's kind of hard to pin down. He doesn't fall into a neat pigeonhole. On one side, he was one of these people describing the immense intelligence benefit of commercially sourced location data to the government and to special forces and that sort of thing. And on the flip side, he's also trying to warn parts of the government about the threats that this data poses.

So he's on both sides simultaneously. I imagine a lot of you may not agree with everything the mic says and that you may sympathize with others or some of you may take all of it on board as well. I think regardless of where you stand on this issue, this is a really, really interesting conversation about how we got to this point where you can just buy location data. Right? Or rather the government is buying it.

It is often using it without a warrant where it has done that historically. We'll see how the recent supreme court ruling changes that. But with that, I'll let you enjoy the rest of the conversation. Mike, you have a long history with the government and location data. Location data industry and the advertising industry is a very, very interesting space, but I feel like only relatively recently did the government sort of clock on sort of the power here and you played like a very, very important part in that transformation.

How does this story start for you when it comes to location data and the government and that sort of thing?

So this goes to recently, ten years ago, if we want to consider that recent. But that's where the story starts for me. And this was a project that's well documented, not classified, but originated in the special operations community. They were looking for alternative methods of being able to understand human geography in very remote places. And it just was a perfect combination of resources and requirements to be able to provide this new foundational understanding of how humans move even when we're talking about environments or marketplaces like Yemen, Syria, where it's not a huge vibrant advertising market but everybody there carries a smartphone and that location data was indeed collected by the ad tech ecosystem, not monetized, not used, usually wound up on the cutting room floor, but again available.

And I came in and started buying it in mass.

So when you say you started buying this data, I mean, what exactly does that look like in practice? I know like a lot of people like to say that, anybody with a credit card or a checkbook can buy location data. I don't think that's strictly true. It really depends upon the really, although it can be quite easy. What did it look like practically for you at that time?

So typically, these data providers are approached by advertisers, audience attribution companies. They've got a very specific use case. They want to target advertising to a certain demographic or a certain cohort. You can buy it with a credit card depending upon what you're buying. But I was buying about $400,000 worth of data per month, which is not something that you're going to slap on a credit card.

Well, yeah, not on your personal credit card.

Not on my personal. And so the suppliers, once they understood that this was not a usual buyer of their data, that I wasn't really trying to place an ad on any particular set of devices, that this was a straight data purchase, that created this new business model for them where we were moving bulk data from their Cloud environment to my Cloud environment, then I would move it onward to other environments. But the companies were it just was not something that they were used to. Somebody looking to buy bulk location data, ad IDs, and anything else that would be strung along with those observation events, metadata, user agent strings, and things like that. We weren't trying to advertise to people, but we needed to understand who these audiences were in these frontier markets for the humanitarian applications that we were building.

So yeah, it evolved and once we got the economics down and the data flows down and understood, we had that system up and running very quickly.

So give me some examples of what you were able to track in around that 2015 period. I think these examples have been reported publicly before, but there was some Syria stuff and then Putin's entourage as well. Is that the sort of stuff we're talking about at this particular point in time?

Yep. So think about it this way. When we needed to prove the efficacy or the value of the data, it would be one thing to say we've got all this location data and we're selling to a group of people who think of location data as something acquired through intercepts or stingrays, these types of technical means. And so demonstrating a use case that was relevant that they would understand brought us to this LaFarge cement factory in Syria, which clustered or emerged in my analysis because devices that had originated at Fort Bragg, North Carolina and at residences in Southern Pines, North Carolina were at this abandoned cement factory in Syria. And so when I walked them through that analysis and showed, and this is a home in Southern Pines, North Carolina, and this is the location at Fort Bragg.

And obviously they knew what the LaFarge Cement Factory represented, but that I was tracking right down to the operator's residence, that became a a watershed moment for location data. That's where I had to explain after being accused of hacking and witchcraft and remote viewing and all this other stuff. They called me the guy called me a Charlotte and were his his words.

Well, because he thought that you had gathered this data through an intercept or something else. Like, he couldn't believe that this was commercially available.

Correct. Correct. And understood. But this is somebody who should know better, in my opinion. And so when I had to explain, look guys, I didn't hack, intercept, engineer, or steal this data.

I bought it, and I bought it for a a cost factor far below anything that you would have had to spend to collect the same amount of volume, you know, using using your technical methods and at zero risk because I did it sitting in the room you see me in right now. Right? So I don't have to put people downrange and at risk to go and do this. I don't have to fly drones or airborne platforms for hours while we're hoovering up mobile data. Now there are different use cases.

If you are actually trying to locate a specific device, I. E. Locating the Bin Laden courier. If you've seen the movie Zero Dark 30 where they're driving around, they have a device in that vehicle that is looking to identify that specific device. That's a different use case.

This is I can collect in a large area and start micro targeting based upon areas of interest. Who goes into these buildings? What do these buildings represent? What are the centers of gravity of the people that are spending time there? And how create does new targeting or intelligence opportunities for us that otherwise would have required a lot of investment?

Yeah, and I think that's a really good point to highlight because it kind of clarifies something of a misconception about commercial location data, which is that even if you go look at the IRS, for example, they bought location data or access to it from one of the brokers, Ventel or one of those companies, Babble Street, whatever. And they were trying to use it, I reported, to identify specific individuals they were investigating, I think for cryptocurrency tax reasons. And they were unsuccessful in that because it actually is quite hard from this data to be like, well, I want to find this specific person. I have all this data. Now I'm going go look for it.

It's more fruitful the other way around where it's like, I have a location, like a cement factory, for instance, since Syria has a very sensitive operation going on there, or an abortion clinic, or the border, which has also been done, and you reverse engineer from the location then to the devices and ultimately the people. It's rarely the other way around, it seems.

Yeah. And in that use case, particularly in the law enforcement use case where they are using they are trying to apply it to almost like a surveillance application where we're gonna watch this, location and anybody that comes in and out, you really need to think about it from the perspective of, I am opening up, I need more devices, more volume in order to develop investigative pathways. The Vegas shooting in 2017, that was an example where we had an individual we knew nothing about. He had two residences in Metro Vegas and trying to determine if there was any transnational terrorism links based upon, his wife was Filipino and was there any intersection between Steven Paddock and and foreign actors. You know, that was we started with the homes, his two residences.

We found the guy that cuts his grass, eliminated him, a couple UPS drivers, FedEx drivers. But this is not the kind of thing where you're going to zero in and monitor some ATM machines and try to piece together forensically a crime. It's not that it's not the use case for this kind of, for this kind of application or for this kind of data.

I mean, it's not exactly this, but it is much closer to a reverse location, warrant from Google, for example, which was just ruled, if I'm remembering correctly, unconstitutional, and of course, that's gonna be, appealed as well. But like, that's when the authorities go to Google and they're like, we want all of the phones in this location at this time. Now, of course, the difference there is as a legal sort of court mandated mechanism and here, you're obviously just buying the data and that's of course the key difference. So those initial use cases where you were trying to prove the value of this data, was to a part of the US government that was focused much more obviously on military and special operations and like that sort of thing. Eventually a few years later, you were trying to warn, I think of other parts of the US government about what you call the grinder problem?

First of all, what other parts of government, so people have an idea if you're talking to law enforcement or more military or whatever, and then what is the Grindr problem?

So the users or the agencies that we were talking to, primarily large scale, large population level intelligence applications where we're trying to understand better population movements as opposed to a direct targeting application. Think about an intelligence analyst who's trying to understand a building that we have interest in but we don't know anything else about. This is kind of a way to sort of step away and observe that building without having to physically be there. The original design of this was for outside of The United States focusing on the global war on terror at the time, ISIS at the time, and supporting those high value targeting missions based upon the asymmetry of ISIS where we didn't they would just sort of blend into the crowd and trying to figure out who's who was the challenge.

Well, And they were everywhere, especially across Europe, obviously, as well, and then, obviously, The Middle East and Syria as well. But Europe, especially, it was a very scary time when in London and Paris, and we were having a lot of attacks at that time. Yeah.

So there was we we were we were successful in in working with partners to say, look, you you have this cultural service center and people who go there then go to another location in Europe and the next time we see them, they're on the front lines. It's not probative of terrorism, but it's a clue. You should look into this.

Yeah. If a guy goes from Europe to the Turkish border then crosses the Turkish border five foot into Syria or something, that is interesting probably.

Yep. Yep. Absolutely. Once we got into this, there's this perception that the government just goes wild on this stuff and everybody's just it's a free for all. Even before privacy and data rights was sort of a household term, there was a lot of oversight in what we could do, what we couldn't do, what constituted US person, which went well beyond their resident status or citizenship.

If they dwelled in The United States for a week, it was considered a US device. So a lot of oversight, a very, very top level, especially as we talk about all this AI and targeting events now, there was the most senior person at JSOC who saw my demo, saw my brief, saw the opportunity, and then made it very clear to everybody that we're not targeting anybody with this data. These are clues. This is for investigative purposes, analysis purpose. This is not a targeting.

We are not going to launch kinetic action based upon these datasets. So there was a lot of oversight and controls well before it became the topic that it is today. And so as this sort of moved on and the community began to understand and apply these things, I got a question from one of my users about Grindr. We've seen a lot of data in one of our datasets that was originating from the application, the dating app, Grindr. And it was just more of a curiosity question, and there was logic to why we see a lot of Grindr because they are selling inventory really to anybody.

It was like if they had inventory, they would sell it. So we were seeing a lot of these events in The United States originating through Grindr. And so I just I wasn't familiar with the app. I just started looking into it a little bit and and discovered that it's a dating app that is also had just been acquired by a private equity firm, with ties to the CCP. Mhmm.

And it's a dating app that doesn't really have the type of audience, in China that it doesn't in in in The United States. And so it just was odd to me that they would wanna be involved with Grindr. And so I just started looking into the data that they had access to. It's it's very similar to the TikTok problems because TikTok, you know, they have access to all of the telemetry on a device. This went well beyond location data and a user and an ad ID.

They owned that server to server dataset from their users, and it just struck me as being odd. And sure enough, you would have Grindr users who clearly would work at a national security building Monday through Friday. So I had high confidence that these were people that worked in national security and then you'd see them go into outbuildings that were also attributable to the US government. My confidence level increases that these are government people, users, and then I could see, I could visualize the date, which would last for about twenty two minutes and would be on the side of the road at a road stop. I mean, was just at McDonald's, all sorts of places.

Right. And by date, obviously you don't mean the literal time and date, although that is there as well, obviously. But you mean obviously this data implies that this person who works in a national security context is meeting probably for a sexual encounter at a rest stop, whatever. And the concern here is that, well, it's almost worse than the Chinese one in a way because the Chinese first party argument is that, well, they could access data from TikTok if they have ownership structure over that, they could access data from Grindr if they have ownership structure over that. That's the concern.

This is almost worse because you're clearly not the Chinese government. You have also got access basically to this data Yes. As well. And that is a Grindr problem.

Yeah. I would say, look, if if I can do it, we have to believe that a sophisticated adversary is doing it as well. And it's very uncomfortable conversations on the 7th Floor of various government buildings with trying to explain, you know, to, 50 plus year old white guys what Grindr is, and and it's not just a dating app.

Once you told them what the app was, did they click that, oh, this is potentially a national security risk, not because obviously homosexual people oppose a risk or anything like that, but they realize that maybe this could be leveraged by an adversary in a bad way. Like did they realize that?

Yeah, that was my example was, guys, this is not Okay Cupid. This is not seeking romance and love and life partners. This is something different.

At least in this context. Yeah.

In this context. Yeah. Trying to again, I'm telling you how I explained it to these guys that this is a different kind of dating app. And because it is a different kind of dating app and because it is now owned by a company with ties to the CCP, we to understand that this is a different risk. There is a reason why they of all of the dating apps that they could have purchased, they chose to purchase Grindr.

So I raised the flag of the issue. Took me some time to get some audiences to understand and to focus on the issue. And once we sort of crossed that chasm of, okay, this is different, this was referred to CFIUS. And CFIUS took action, the Committee on Foreign Investment for the US, and they are the ones that review and arbitrate acquisitions of companies that are sensitive to The United States national security. This was probably their first examination of a dating app and their first action to force the repatriation of Grindr back to US ownership.

We see happening a lot now with real estate and other factories, etcetera. And so the Grindr problem, in my opinion, is the current problem that we have today. 2,000,000 apps, most people have 70 plus apps on their phone, and when you install an app, you are giving that app privileged access to inspect and extract a variety of telemetry from your device that is far more probative about who you are and what your intent and context are than an ad ID and a GPS signal ever provided. And then you add in this new AI capability where you can drop in to a GPT a year's worth of telemetry. And when I say telemetry, I'm talking like the accelerometer, battery level, screen orientation, things that are not personally identifiable.

And because they're not PII, the app does not require your consent. So you don't even know this is happening and there's nothing on your phone that can throttle that extraction. And so when we think about a threat surface of 2,000,000 apps that some are owned by adversaries, people that work there, moving data from an app to an adversarial environment is not a hard thing to do. Privacy privacy toggles and VPNs at this level, an app is inspecting your device, there's nothing in the OS that prevents it from pulling that data and sending it to their server.

Yeah, the one question I get obviously a ton when I report on location data is how do I, as a reader or a listener, how do I specifically stop this tracking? And I'm a iOS user, so I can only really talk from that perspective. But my understanding is that when you do I mean, don't have location services on the vast, vast majority of the time at a OS level, and that would be the main thing. Of course, you then grant it on a per app basis. What you're saying is that there is other data that can be collected by these apps that isn't that doesn't fall under that sort of location permission.

I mean, briefly, how do you, if you take steps to do so, how do you sort of protect your own device sort of privacy when it comes to sort of this data being collected by third party apps installed on the phone? Yep.

So this is about the trade off. So there are some apps where I make that trade off and I take that risk. When I open up Uber, I don't want to have to drop a pin because I probably have 2% left in my battery. I want it to work. I want it to know where I am so it can come pick me up in the rain.

I do the opposite. It's a pain in the ass. I type it in every single time. Okay.

All right. So so there you go.

But it's it but it's a real pain. So I understand why you would. Yeah.

Yeah. But the sort of the new developments in mobile security or privacy shifting away from these perimeter tools, VPNs and toggles into this notion of of being able to inspect what an app is trying to extract from your phone and deprecating what is not essential to that app's functionality. So if it's trying to pull a bunch of telemetry fields that have nothing to do with app functionality, being able to this is I get this question a lot too from the operational community. How do I get out of commercial data? How do I do this?

And the surface that we have to focus on first are the apps and minimizing the amount of telemetry that that they're able to to extract from your device. And and that is that's getting that's gonna require a a rethink about the the operating system and the hardware. And I will tell your listeners, because they'll figure this out, that I'm on the board of advisors of a company called Unplugged. And the approach to this problem is being able to give the user control over what data leaves their device based upon what that app is. And when you start looking, are able to see what an app is pulling and when it's pulling and how it's resolving location when it doesn't have access to GPS.

Again, it makes me think that when Apple launched privacy and we had the apocalypse in 2022 and Meta stock tanked, the recovery based upon the telemetry and going deeper into the device and not just hanging their hat on stable identifiers like the ad ID and GPS, Their ability to attribute behavior to resolve intent is far more detailed than it ever was. So it's almost like privacy gave the apps a gift. They figure had out how do we replace the ad ID. Look at Meta. Meta stock's trading at $600 now.

Their business recovered without reliance on the ad ID. And if you look at what Meta's doing and any other app where they are resolving your location. Let's just focus on location. They're using everything from time zone to the ambient signals around you, time zone changes to understand exactly where you are. And when you drop your telemetry for a week into JATGPT or Claude and say, Tell me about this telemetry, it builds a profile and a pattern of life that, at scale, should concern every American, whether you're a case officer, special agent, special operator, I don't care.

This is the next level of privacy. We've been sort of hand waving privacy for years. And a VPN that mediates transport, and privacy toggles are mostly just user preference. It's not an operating system gate. It's a user preference.

Don't access my GPS. Most apps comply, but that's all it is. It's just indicating your preference. We need more engineered solutions that really attack this problem and give users control over their data once and for all.

Yeah, that makes sense. So you started warning the government about this and showing them this problem and then in parallel, but obviously also related, you did have more and more agencies buying technology like this. Obviously you mentioned your cases and I covered a bunch of customs and border protection, immigration and customs enforcement, secret service as well. There was a lot of debate and arguments around that because of course they were doing this without a warrant under the Fourth Amendment that may now be in flux with this recent Supreme Court ruling. We haven't really seen the fallout from that that yet.

Frankly, it's going to take years probably to to see that, but there was a lot of movement there. And then recently, there was some other news, which is that the Pentagon came out and it said that, yes, US military personnel are being targeted using location data. This isn't quite related, but the Financial Times, I think reported that commercial location data and SS seven stuff, which is the rooting backbone, right, was also used to monitor location of senior US officials during the Iran war. So there's all that sort of stuff. But back on the commercial data being used to target US military personnel, reaction to seeing that news?

That, oh, the Pentagon found out or the Pentagon said it?

Yeah, Senator Rodden Wyden from Oregon has been in the lead on this for a long time. They brought this up. And so Senator Wyden, who's not even on armed services, wrote a letter to the CIO at the Department of Defense demanding an accountant. And in that letter, you can almost sense the tone, the exasperated tone. In 2016, a contractor blew the whistle on this and what have we done in the last ten years?

That's my reaction. I've kinda gotten a little desensitized by how many times do I have to say, Yeah, I told you, we've been talking about this, we've known about this. How many different ways do I have to explain it until we get national level policies to deal with this and deal with it in a way that's not hand waving and creating more training and white papers and PowerPoint presentations describing ways that you can try to outthink and trick the ubiquitous technical surveillance of the platforms, but we engineered solutions. And so we have some congressmen and women that sort of heard us out on this and have developed amendments to the NDAA. We came in late, the National Defense Authorization Act of 2027, in which instructs the Pentagon to explore and assess technologies that attack this commercial data problem from its origins at the app layer to examine methods and approaches to minimize this data, leaving a device and networking into this opaque cartel of data brokers and attribution companies that end up in the hands of adversaries, which again is not hard to do at all.

More of this legislation is just sort of trying to put data back in the phone after it's left the phone, and we need to begin looking at how do we keep the data from leaving the phone in the first place because that's the problem and that's been the problem and that's we need to start thinking about, okay, how do we solve this because we're not gonna out tradecraft an $8,000,000,000,000 duopoly of Apple and Google and 2,000,000 apps, all of which have fraud detection algorithms that the minute you are doing something funky and weird, it de platforms you or it it outs you, it flags you as as unique and anomalous. So we need to think about how do people that are in sensitive positions carry a phone into a war zone because a lot of our personnel have children and if they're deployed for six months, they need to be able to reach back and do homework and do all of those kinds of things. So sending them out onto a deployment without a phone is not a salute, not practical. They'll quit. I would quit.

So how do we do this so that we are not giving an adversary an advantage for free.

Yeah. And I mean, you touched on it there with Apple and Google. And the question is, which entity or player is the one with the most power here to make the biggest change to this problem. Now I'm sure the company that you're on the board on would love to say it was them and then other providers would probably love that as well. You mentioned Apple and Google, obviously they are running the primary operating systems on this.

You obviously then have the app developers as well, but they're probably going to do whatever the fuck they want, right? Which entity here is the one with the most power that can do the most change? Is it like ultimately Apple and Google who should do this?

My answer to that question is the consumer. The consumer needs to decide is not proportionate. The amount of data that is being collected about me is not proportionate to a typical advertiser consumer relationship. This is beyond that assumed relationship that has fences and gates. They are going far deeper into my existence.

So consumer needs to understand what they're up against. You know, Google and and and Apple, they kinda depend upon their app ecosystem for significant amount of revenue. So regulating them is is difficult and replacing them with Google or Apple apps triggers antitrust. So they're they're in a in kind of a bind. And Google is indeed an advertising business, especially because many people use Google Apps.

And so the answer to your question really is, it's the apps. If I were to be counseling somebody today who wasn't going to into the market to buy a phone that was engineered for privacy, I would say have an understanding of the apps that you're installing on your phone. Just go to the App Store and try to figure out, look and see where that app is manufactured. But again, they can have employees there that are siphoning out data, but it really gets down to what apps do you need and controlling your appetite for convenience because convenience and lack of friction is how we got here in the first place and how surveillance builds and layers upon itself. And if you are really concerned about surveillance where you have no reason to be surveilled, you've got to take a look at your own tech profile and minimize that footprint as best you can.

But this is to really solve the problem, Joe. This is engineering. This is not having your name moved from data broker list. That's good, that's fine, do it if it makes you feel better. But at the end of the day, we need to take back the flow of data and resolve it back to something that is more proportionate to what we get from these apps and these experiences.

Yeah. Well, I think that's a really, really good way to pull it and a great place to leave it. Mike, thank you so much for joining us. I really, really enjoyed this conversation. Thank you so much.

Thanks for having me. I appreciate

job. And a a a doing each week. This podcast is produced by Alyssa Midcalf. Another way to support us is by leaving a five star rating and review for the podcast. That stuff really, really does help us out.

This has been for media. We'll see you again next time.