The U.S. Treasury Is Buying Private App Data to Target and Investigate People

The department will use controversial firm Babel Street to hunt for tax and sanctions dodgers, raising constitutional concerns.

The U.S. Treasury Department building in Washington, D.C., Friday, July 2, 2021.
The U.S. Treasury Department building in Washington, D.C., on July 2, 2021. Photo: Joshua Roberts/Bloomberg via Getty Images

The Treasury Department has in recent months expanded its digital surveillance powers, contracts provided to The Intercept reveal, turning to the controversial firm Babel Street, whose critics say it helps federal investigators buy their way around the Fourth Amendment.

Two contracts obtained via a Freedom of Information Act request and shared with The Intercept by Tech Inquiry, a research and advocacy group, show that over the past four months, the Treasury acquired two powerful new data feeds from Babel Street: one for its sanctions enforcement branch, and one for the Internal Revenue Service. Both feeds enable government use of sensitive data collected by private corporations not subject to due process restrictions. Critics were particularly alarmed that the Treasury acquired access to location and other data harvested from smartphone apps; users are often unaware of how widely apps share such information.

The first contract, dated July 15 at a cost of $154,982, is with Treasury’s Office of Foreign Assets Control, a quasi-intelligence wing responsible for enforcing economic sanctions against foreign regimes like Iran, Cuba, and Russia. A June report from New York University Law School’s Brennan Center for Justice found that OFAC’s vast enforcement powers require greater oversight from Congress. The report criticized the lack of legal limits on who OFAC can sanction, pointing out that this group includes American citizens within U.S. borders and foreigners without any government ties, and flagged the fact that OFAC is free to add people to sanctions lists even after sanctions are authorized—people now potentially subject to surveillance by Locate X.

According to contract documents, OFAC investigators can now use a Babel Street tool called Locate X to track the movements of individuals without a search warrant. Locate X provides clients with geolocational data gleaned from mobile apps, which often relay your coordinates to untold third parties via advertisements or pre-packaged code embedded to give the app social networking features or study statistics about users. This commercial location data exists largely in a regulatory vacuum, acquired by countless apps and bought, sold, and swapped between an incredibly vast and ever-growing ecosystem of ad tech firms and data brokers around the world, eventually landing in the possession of Babel Street, who then sells search access to government clients like OFAC.

Critics of the software say it essentially allows the state to buy its way past the Fourth Amendment, which protects Americans from unreasonable searches. The contract notes that OFAC’s Office of Global Targeting will use Locate X for “analysis of cellphone ad-tech data … to research malign activity and identify malign actors, conduct network exploitation, examine corporate structures, and determine beneficial ownership,” a rare public admission by the government of its use of personal location data acquired with cash rather than a warrant. The contract does not indicate any restrictions or intentions around whether Locate X will be used against U.S. persons or foreigners.

The contract provided to Tech Inquiry is heavily redacted in important sections that appear to discuss how Locate X will actually be used. Prior reporting on how other federal entities use Locate X, including a 2020 report by Protocol, indicates it allows agents to instantly determine what people were at a particular location at a particular time — and even where they arrived from and where they’d traveled in the preceding months.

“My office has pressed Babel Street for answers. They won’t even put an employee on the phone.”

Babel Street has claimed its location data is “anonymized,” meaning the harvested coordinates are tied not to an individual’s name but to a random string of characters. But researchers have found time and time again that deanonymizing precise historical location data is trivial. Indeed, in 2020 a company source told Motherboard “we could absolutely deanonymize a person” and that employees would “play with it, to be honest.” Oddly, despite the fact that the contract states Locate X will aid OFAC in “implementing its sanctions programs” — which is to say, enforcing the law — Babel Street’s terms of service, included in the FOIA response, state: “Due to the varied nature of Third-Party Data and Babel Street’s inability to attest to the accuracy of Third-Party Data (including any results Customer may obtain), Third-Party Data may be unsuitable for use in legal or administrative proceedings.”

In an emailed statement, Democratic Oregon Sen. Ron Wyden, a vocal critic of ad-based geolocation, told The Intercept, “As part of my investigation into the sale of Americans’ private data, my office has pressed Babel Street for answers about where their data comes from, who they sell it to, and whether they respect mobile device opt-outs. Not only has Babel Street refused to answer questions over email, they won’t even put an employee on the phone.”

Neither the Department of Treasury nor Babel Street responded to a request for comment on either contract.

Corporate Surveillance vs. Constitutional Rights

The government has long been able to pinpoint your location by tracking your phone through your mobile carrier, but the Supreme Court’s 2018 decision in Carpenter v. United States made clear that it needs a warrant to do so.The sprawling and unscrupulous digital advertising industry, constantly vacuuming up details of your movements in order to better target you with ads, provides a convenient loophole. Locate X has drawn intense scrutiny and criticism by allowing government agents to sidestep constitutional hurdles like those provided by the Carpenter ruling.

“It is clear that multiple federal agencies have turned to purchasing Americans’ data to buy their way around Americans’ Fourth Amendment rights,” Wyden added. Wyden is the co-sponsor of the Fourth Amendment Is Not For Sale Act, proposed legislation that would force law enforcement and intelligence agencies to obtain a court order for this sort of app data, rather than simply buying it from any willing broker.

“OFAC’s use of ad-tech location tracking for economic sanctions is a troubling extension of the previously known usage by CBP, the FBI and Secret Service, IRS, and the DoD,” Jack Poulson, Tech Inquiry’s founder, told The Intercept (for which he once wrote an opinion piece). He added, “Rather than backing off their invasive surveillance of smartphone location data after a prominent vendor was caught spying on a popular Muslim prayer app, US intelligence and law enforcement agencies appear to be finding more use cases,” referring to the Motherboard investigation that found the government buying location data from a Locate X competitor harvested via a popular Quran app.

Through a second contract, finalized on September 30 and totaling $150,000, Virginia-based Babel Street will provide another Treasury agency, the IRS, with software that “captures information from public facing digital media records” in order to detect individual and small business-owning tax dodgers through their online posts, a capability the office has sought previously. Though the contract language doesn’t mention specific social media platforms by name, the automated “monitoring” of sites like Twitter and Facebook is Babel Street’s bread and butter, a capability similar to that of rival Dataminr; a 2017 Motherboard report on Babel Street noted that it offers clients “access to over 25 social media sites, including Facebook, Instagram, and to Twitter’s firehose. … Babel Street’s filtering options are extremely precise, and allow for the user to screen for dates, times, data type, language, and—interestingly enough—sentiment.”

That the IRS would want to track down those trying to avoid paying their share is of course unsurprising, but the contract provides scant information about how greatly expanding the surveillance of what Americans say online — Babel Street’s tool will be able to handle “at least 25,000 concurrent users” — will achieve this end. In its initial request for contract solicitations, presumably now provided by Babel Street, the IRS cited capabilities far beyond simply searching tweets and Instagram posts, requiring that the winner of the contract provide “available bio-metric data, such as photos, current address, or changes to marital status” for individuals targeted by the agency, “provide publicly available information of taxpayers’ past or present locations,” as well as “reports showing that a taxpayer participated in an online chat room, blog, or forum, and reports showing the chat room or blog conversation threads.”

“Babel Street’s support for the IRS increasing its surveillance of small businesses and the self employed — after the IRS has already largely given up on auditing the ultrawealthy — is an example of the U.S. surveillance industry being used to help shift the tax burden to the working class,” Poulson said.

Join The Conversation