ICE Buys Tool that Tracks Locations of Hundreds of Millions of Phones Every Day

Xtreix

MineralWater I explicitly responded to a comment that mentioned cell tower location data, not Wi-Fi. I don't think I implied that it should be done or that I want prevent all location tracking. I use Wi-Fi on GrapheneOS and the cellular network when I need to, I'm fine.

A reminder that Wi-Fi on GrapheneOS is very privacy-friendly and is essentially anonymous as long as apps do not leak uniquely identifying information to the network, MAC randomization is also performed on each new connection and works correctly, Wi-Fi scanning is disabled by default, and GrapheneOS prevents many VPN leaks.

https://grapheneos.org/usage#wifi-privacy

MineralWater

Xtreix

The WiFi "privacy" is only given as long as you don't connect to a wifi or better said, gives you privacy in regards of the wifi owner once you connect to a wifi.

Nothing of the things mentioned give you privacy when using a wifi. Changing MAC is like changing a T-shirt color and robbing the same bank every day in hope of being unrecognizable.

This and all the other things mentioned give you privacy under the scenario that you have WiFi turned on and all wifis around have an eye on you.

The moment you use a browser, email or app whilst online (no matter what network) and connect to a service or web page, you lost that little privacy.

It's like masquerading as the Average Joe, but your device just looks like that. Average Joe won't connect to addresses who are under surveillance, that's were surveillance begins.

It doesn't start at your smartphone, it ends there.

This is what I wanted to express. If people don't want to be found by government or third parties, there is no solution on the technical side-this is not how surveillance is done and all this implementations make it harder for ad companies to track you, but those don't look for an isolated individual person.

Surveillance is looking for an individual person and has already places of interest to observe. Or easier said, if you want privacy with a smartphone, you have to throw it away and don't use it ever again, each time after you used one.

I sometimes think people underestimate law enforcement largely and overestimate what an OS like Graphene can actually do in a global network that is build to harvest data and used by people who throw around data like mad.

Makes absolutely no difference if Wi-Fi or cellular, both ways connect to the same network and addresses, and even layers of VPN don't change that.

Blastoidea

LeslieFH
Stripped of all the bullshit, there it is.

GrapheneOS

treenutz68 JollyRancher LeslieFH Airplane mode works correctly for disabling the cellular radio including in early boot before the OS is fully loaded. If you have airplane mode enabled, the cellular network cannot detect your location. If you're willing to make a sacrifice to avoid location tracking, you can keep cellular off most of the time by relying on Wi-Fi networks including the ones at coffee shops, etc. In terms of apps, don't give out persistent Location permission access to anything other than highly trusted apps. You can use the one-time grant system for most apps requesting it and only give persistent (Allow while in use) or especially background access to your main maps/navigation apps.

MineralWater MineralWater No, your statements about Wi-Fi are not correct. Baseline Wi-FI privacy on the devices we support is solid. GrapheneOS improves it to be per-connection privacy instead of per-network privacy with per-connection Wi-Fi MAC randomization which also disables keeping DHCP state between connections. You can use a VPN to hide what you're connecting to and can set the connectivity checks to Standard to avoid showing that you're using GrapheneOS when using a VPN since not nearly as many people use GrapheneOS as regular Android.

Hill_Sphere

treenutz68

While our cell phone/device location is , out of necessity, known by our cell service provider, this location data being purchased by ICE is almost surely data collected from apps where users grant location permission. So this is likely solely the result of user choice to grant location permission to an app(s), and can occur on any phone OS - i.e. it's a question of personal digital hygiene.

The mechanism noted in the article:

"Companies that obtain mobile phone location data generally do it in two different ways. The first is through software development kits (SDKs) embedded in ordinary smartphone apps"

"The second is through real-time bidding (RTB). When an advert is about to be served to a mobile phone user, there is a near instantaneous, and invisible, bidding process in which different companies vie to have their advert placed in front of certain demographics."

Detail: This article is written by Joseph Cox, with 404 Media. 404 Media was founded by a group of former Vice Motherboard journalists, including Cox. Cox is well informed on these issues, and wrote the below 2019 article for Vice specifically about Cell providers selling location data:

https://www.vice.com/en/article/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile/

In 2018 the US Supreme Court ruled in Carpenter v. US, "the government must get a warrant before accessing a person’s sensitive cellphone location data."

https://www.aclu.org/news/privacy-technology/supreme-courts-most-consequential-ruling-privacy-digital

so it's a big deal that US cell providers in 2019 were still selling location data despite the Supreme Court's ruling.

In the aftermath of the 2019 reporting showing Cell providers were illegally selling location data, Cell providers pinky promised to stop selling location data.

So for ICE etc., it's easier, and less legally fraught for US government agencies to sidestep the 4th amendment questions and clear Supreme Court ruling, by just purchasing location data from private companies.

The remedy to all this is US Federal privacy protections - just this week Sen. Ron Wyden proposed a bill to "extended data privacy protections for federal lawmakers and public officials to everyone in the United States." that was stymied...

https://techcrunch.com/2025/09/30/ted-cruz-blocks-bill-that-would-extend-privacy-protections-to-all-americans/

If the topic of ICE (and US gov in general) data- driven surveillance and it's real world consequence interesting to any who pass by, Georgetown Law's "American Dragnet" project is excellent weekend reading

https://www.law.georgetown.edu/privacy-technology-center/publications/american-dragnet-data-driven-deportation-in-the-21st-century/

JollyRancher

GrapheneOS
At which point it ceases to be a smartphone as one generally thinks of the term.

Can you keep your device in Airplane mode 24/7? Yes. Can you even still use it for many things when doing so? Yes.
Is it a phone (I.e. Able to send & receive phone calls, text messages, use cellular data, etc.)? No.

user539

GrapheneOS set the connectivity checks to Standard

What about disabling checks completely, what are the downsides?

23Sha-ger

JollyRancher s it a phone (I.e. Able to send & receive phone calls, text messages, use cellular data, etc.)? No.

Yes, when you use VoWiFi. I send/recieve SMS and calls on Airplane mode for many years.
Yes, carrier calls and SMS, not Whatsapp/Signal if it wasn't clear.

JollyRancher

23Sha-ger
VoWiFi is actually highly traceable most of the time.

It avoids the VPN tunnel entirely and the IP address of the WiFi network is provided to the carrier.

Unless the WiFi network is itself routing the traffic through a VPN then the carrier has the real IP address and geolocating that is trivial.

So no, using VoWiFi in public with Airplane mode on isn't going to defeat carrier side location tracking most of the time and thus doesn't make the phone safely usable as a cellphone.

23Sha-ger

JollyRancher

Carry a hotspot with anonymous sim/esim plan optionally with VPN on.
You said you cannot use it as a phone for many things like calls/texts without tracking. I proved you can.
The "traceable" part is not even part of the discussion, we are talking about a secure ability to use a phone
without revealing your immediate identity or location to the carrier. If you are going to use it to make bomb threats, yes, that's something else.

alfred

user539 It can cause issues when at an airport or hotel if a captive portal is used. You are not prompted to log in.

There is a bit of info on the FAQ about the connectivity checks. https://grapheneos.org/faq#default-connections

GrapheneOS also adds the ability to fully turn Off the connectivity checks. This results in the OS no longer handling captive portals itself, not falling back to other networks when some don't have internet access and not being able to delay scheduled jobs depending on internet access until it becomes available.