Ban the sale of precise location data

The sale of precise location data is threatening both privacy and national security in the United States at the same time. According to a Citizen Lab investigation, Webloc can access records collected from up to 500 million mobile devices, and can track individuals using device identifiers, location coordinates, and app/digital-advertising-based profile data.

The cases are concrete. A man in Abu Dhabi was tracked up to 12 times a day, and some devices had their exact locations captured at specific times in Romania and Italy. Even without identifying an individual, this kind of data can be combined with social media accounts, meaning anonymity can be broken without a warrant.

Webloc is not Penlink's flagship product but an optional feature of Tangles, yet government and commercial customers have actually used it. Examples cited include DHS, ICE, parts of the U.S. military, the Bureau of Indian Affairs police, and police agencies in California, Texas, New York, and Arizona. An internal Tucson police report shows a case in which the tool was used to track a serial cigarette thief.

The core argument is clear.

• Such tools are highly invasive investigative capabilities, so strong authorization and oversight mechanisms are needed.
• Domestically, regulation of law enforcement's use is needed.
• Internationally, as long as the data exists, foreign intelligence agencies can exploit the same data.
• Therefore, the U.S. must not only regulate use but also restrict the generation and sale of precise location data itself.

In addition, this piece also covers how quickly AI is amplifying hacking. A report from security firm Gambit analyzes a case in which an attacker used Claude Code and the OpenAI GPT-4.1 API to breach 9 Mexican government organizations, exfiltrating hundreds of millions of citizen records and a service for forging tax certificates.

The attacker planted persistent context into Claude, ran an open-source vulnerability scanner to gain remote access to the SAT system, and then tested multiple bypass techniques to generate customized exploits. Claude repeatedly refused, but the attacker kept up the pace by rephrasing and reframing requests. GPT-4.1 was then used for large-scale automated reconnaissance and analysis, and a 17,550-line Python tool organized data from 305 SAT servers into 2,957 structured intelligence reports.

The conclusion is simple. While this case did not reveal an entirely new attack technique, it clearly shows that AI lets a single attacker operate like a small team. For defenders, this means having to deal with faster and larger-scale breaches going forward.