Sign In

Tom Lee

Experienced policy head and product manager with a history in software development

Tom Lee is a seasoned professional currently working at Mapbox in two key roles:

Head of Policy

Tom has been serving as the Head of Policy at Mapbox since January 2018.2 In this role, he:

  • Oversees Mapbox's policy work, helping policymakers, customers, and journalists understand the company's data usage
  • Ensures proper technical and ethical safeguards for Mapbox's location telemetry systems
  • Handles legislative monitoring, government relations, and liaison with external open data communities
  • Adjudicates controversial territorial depictions and works on privacy-related matters

Product Manager (Mobile Maps)

Since November 2020, Tom has also taken on the role of Product Manager for Mobile Maps at Mapbox.2 His responsibilities include:

  • Planning and executing the rollout of Maps SDK v10
  • Performing competitive analysis and monitoring business trends
  • Representing the product team in high-profile customer meetings
  • Investigating and analyzing the impact of industry developments on Mapbox's products

Background

Prior to his current roles, Tom held other positions at Mapbox:

  • Geocoding Lead from June 2014 to December 20172

Before joining Mapbox, Tom served as:

  • CTO at the Sunlight Foundation from December 2008 to September 20142

Tom's expertise spans policy, product management, and technical leadership in the geospatial and open data domains. He is known for his work in improving location search engines, data management, and bridging the gap between technology and policy in the mapping industry.13

Highlights

Aug 27 · linkedin

The Observer reports that Texas' Department of Public Safety has bought surveillance software called "Tangles" that can track individual user movements in geofenced areas, using both location data and ad IDs (IDFA/AAID). No warrant is required. The data is commercially available.

How does Tangles get this data? This isn't fully specified, but the likeliest answer is via advertising SDKs. Developers put ad SDKs into their apps to make money. The ad SDKs resell the data they collect to data brokers. The data brokers do who-knows-what with it. Eventually it winds up in the hands of Texas law enforcement.

This is a violation of both Google's and Apple's app store rules. It's definitely a violation of their rules concerning advertising IDs. It's very likely a violation of their rules concerning location data, depending on the disclosures that the apps make. App developers using these SDKs could--and in my opinion should--be kicked out of the App Store and Google Play Store. It's the only way to break this sleazy SDK business model.

The fact that this hasn't happened isn't entirely Google or Apple's fault. The data brokers probably don't provide enough detail to easily trace which app/SDK the data originally came from. And Tangles is made by an Israeli firm, complicating any US or EU regulator's aspiration to follow its breadcrumb trail.

Still, there is room here for a privacy-focused AG or state legislator to make some noise. Legislators and regulators rightly worry about privacy, but today, law enforcement fuels the market by which the most egregious extrajudicial violations of Americans' privacy occurs. Finding a way to resolve that dissonance would be vastly more worthwhile than mandating yet another consent screen or advertising disclosure notice.

Jul 29 · linkedin

After a weekend of stewing about it, I'm still mad about this, and I'm surprised not to see more people mad about it, too. This kind of "analysis" should not be possible. Its existence suggests big problems.

https://lnkd.in/ekhrXAQ2

Let me explain what I'm talking about. The Oversight Project, which is hosted at the Heritage Foundation, published a bunch of geolocation data associated with Thomas Crooks, the man who attempted to assassinate Donald Trump on July 13.

Heritage published geodata they think is connected to Crooks. Why do they believe it's connected to him? Well, the data is from an ad database. It doesn't name the specific people who generated the data. But the location records come with an ADID.

You generate lots of signals when you use your phone and computer, but taken individually, these are usually not very meaningful. To build a profile of you as a photography enthusiast, or car shopper, or would-be assassin, these signals must be linked together. The people attempting this tracking need some kind of value, shared across signals, that lets them say "this set of signals all came from one person".

Sometimes this is a random number stored in a cookie. Sometimes it's an IP address (though decreasingly so thanks to privacy law). Sometimes it's a bunch of not-identifying elements of your device that, taken together, form a unique fingerprint.

But best of all is to use an identifier linked to someone's phone. Crucially, this is a PAN-DEVICE identifier. Not "your Netflix account name" or "your Redditor ID". The point is to link activity across all the different signals you're emitting.

Originally, you (author of a surveilling website/app) could just ask a phone for its ID, often called the UDID (this is technically an iOS-specific term, but Android has an equivalent).

Apple and Google soon realized this was a bad idea. UDID was replaced by IDFA (and its Android counterpart, AAID). This was still a pan-device unique ID. But users got more control: they could reset it (which they almost never do). And surveillors had to promise they would only use IDFA for good (advertising) and not for evil (tracking dissident journalists, empowering abusers, enabling vigilantism). If they broke that rule, they could be banished from the app store.

In practice, this hasn't worked well either, and Apple has now put IDFA access behind a mandatory "Do you want to be tracked?" dialog that nobody consents to/wants to show in their app. This is a key part of the ATT initiative that has the entire adtech world mad at them.

But I digress.

We know Thomas Crooks was an Android user. What Heritage seems to have done is acquire a bunch of data with user locations, timestamps, and AAIDs. Then they looked at the area around his work and home for AAIDs that showed up there. Then they looked at where else those AAIDs showed up.

(cont'd in comments)

Related Questions

What projects has Tom Lee led at the Sunlight Foundation?
How does Tom Lee's role at Mapbox differ from his role at the Sunlight Foundation?
What are Tom Lee's main responsibilities as Product Manager (Mobile Maps) at Mapbox?
How has Tom Lee contributed to the growth of Mapbox's data team?
What are some of the key technologies Tom Lee has worked with at Mapbox?
Tom Lee
Tom Lee, photo 1
Tom Lee, photo 2
Add to my network

Experience

Head of Policy at Mapbox Product Manager (Mobile Maps) at Mapbox
Geocoding Lead at Mapbox (June 2014 - December 2017) CTO at Sunlight Foundation (December 2008 - September 2014) Senior Software Architect at Echo&Co (December 2005 - December 2008) Software Developer at Competitive Innovations, LLC (August 2002 - December 2005)

Education

Cognitive Science, University of Virginia (1998 - 2002)

Location

Washington, District of Columbia, United States