Suggestions
Tom Lee
Experienced policy head and product manager with a history in software development
Tom Lee is a seasoned professional currently working at Mapbox in two key roles:
Head of Policy
Tom has been serving as the Head of Policy at Mapbox since January 2018.2 In this role, he:
- Oversees Mapbox's policy work, helping policymakers, customers, and journalists understand the company's data usage
- Ensures proper technical and ethical safeguards for Mapbox's location telemetry systems
- Handles legislative monitoring, government relations, and liaison with external open data communities
- Adjudicates controversial territorial depictions and works on privacy-related matters
Product Manager (Mobile Maps)
Since November 2020, Tom has also taken on the role of Product Manager for Mobile Maps at Mapbox.2 His responsibilities include:
- Planning and executing the rollout of Maps SDK v10
- Performing competitive analysis and monitoring business trends
- Representing the product team in high-profile customer meetings
- Investigating and analyzing the impact of industry developments on Mapbox's products
Background
Prior to his current roles, Tom held other positions at Mapbox:
- Geocoding Lead from June 2014 to December 20172
Before joining Mapbox, Tom served as:
- CTO at the Sunlight Foundation from December 2008 to September 20142
Tom's expertise spans policy, product management, and technical leadership in the geospatial and open data domains. He is known for his work in improving location search engines, data management, and bridging the gap between technology and policy in the mapping industry.13
Highlights
The Observer reports that Texas' Department of Public Safety has bought surveillance software called "Tangles" that can track individual user movements in geofenced areas, using both location data and ad IDs (IDFA/AAID). No warrant is required. The data is commercially available.
How does Tangles get this data? This isn't fully specified, but the likeliest answer is via advertising SDKs. Developers put ad SDKs into their apps to make money. The ad SDKs resell the data they collect to data brokers. The data brokers do who-knows-what with it. Eventually it winds up in the hands of Texas law enforcement.
This is a violation of both Google's and Apple's app store rules. It's definitely a violation of their rules concerning advertising IDs. It's very likely a violation of their rules concerning location data, depending on the disclosures that the apps make. App developers using these SDKs could--and in my opinion should--be kicked out of the App Store and Google Play Store. It's the only way to break this sleazy SDK business model.
The fact that this hasn't happened isn't entirely Google or Apple's fault. The data brokers probably don't provide enough detail to easily trace which app/SDK the data originally came from. And Tangles is made by an Israeli firm, complicating any US or EU regulator's aspiration to follow its breadcrumb trail.
Still, there is room here for a privacy-focused AG or state legislator to make some noise. Legislators and regulators rightly worry about privacy, but today, law enforcement fuels the market by which the most egregious extrajudicial violations of Americans' privacy occurs. Finding a way to resolve that dissonance would be vastly more worthwhile than mandating yet another consent screen or advertising disclosure notice.
After a weekend of stewing about it, I'm still mad about this, and I'm surprised not to see more people mad about it, too. This kind of "analysis" should not be possible. Its existence suggests big problems.
https://lnkd.in/ekhrXAQ2
Let me explain what I'm talking about. The Oversight Project, which is hosted at the Heritage Foundation, published a bunch of geolocation data associated with Thomas Crooks, the man who attempted to assassinate Donald Trump on July 13.
Heritage published geodata they think is connected to Crooks. Why do they believe it's connected to him? Well, the data is from an ad database. It doesn't name the specific people who generated the data. But the location records come with an ADID.
You generate lots of signals when you use your phone and computer, but taken individually, these are usually not very meaningful. To build a profile of you as a photography enthusiast, or car shopper, or would-be assassin, these signals must be linked together. The people attempting this tracking need some kind of value, shared across signals, that lets them say "this set of signals all came from one person".
Sometimes this is a random number stored in a cookie. Sometimes it's an IP address (though decreasingly so thanks to privacy law). Sometimes it's a bunch of not-identifying elements of your device that, taken together, form a unique fingerprint.
But best of all is to use an identifier linked to someone's phone. Crucially, this is a PAN-DEVICE identifier. Not "your Netflix account name" or "your Redditor ID". The point is to link activity across all the different signals you're emitting.
Originally, you (author of a surveilling website/app) could just ask a phone for its ID, often called the UDID (this is technically an iOS-specific term, but Android has an equivalent).
Apple and Google soon realized this was a bad idea. UDID was replaced by IDFA (and its Android counterpart, AAID). This was still a pan-device unique ID. But users got more control: they could reset it (which they almost never do). And surveillors had to promise they would only use IDFA for good (advertising) and not for evil (tracking dissident journalists, empowering abusers, enabling vigilantism). If they broke that rule, they could be banished from the app store.
In practice, this hasn't worked well either, and Apple has now put IDFA access behind a mandatory "Do you want to be tracked?" dialog that nobody consents to/wants to show in their app. This is a key part of the ATT initiative that has the entire adtech world mad at them.
But I digress.
We know Thomas Crooks was an Android user. What Heritage seems to have done is acquire a bunch of data with user locations, timestamps, and AAIDs. Then they looked at the area around his work and home for AAIDs that showed up there. Then they looked at where else those AAIDs showed up.
(cont'd in comments)
