A global geolocation surveillance system called Webloc, which uses advertising data, has reportedly been used by Hungarian intelligence, El Salvador’s national police, and numerous U.S. law enforcement agencies.

This tool was created by the Israeli firm Cobwebs Technologies. After Cobwebs merged with Penlink in July 2023, as a Citizen Lab report indicates, Penlink now sells it. Penlink, established in 1986, provides “essential communications and digital evidence collection and analysis software” to police forces around the world and in the U.S.

American users of Webloc include Immigration and Customs Enforcement (ICE), the U.S. military, the Texas Department of Public Safety, DHS West Virginia, NYC district attorneys, and several police departments in cities like Los Angeles, Dallas, Baltimore, Tucson, Durham, and smaller areas in Elk Grove and Pinal County.

According to Wolfie Christl, Astrid Perry, Luis Fernando Garcia, Siena Anstis, and Ron Deibert of Citizen Lab, Webloc is marketed as an add-on for the social media and web intelligence program Tangles. Webloc offers access to constantly refreshed data from around 500 million mobile devices worldwide, including device IDs, location data, and profile information gathered from mobile applications and digital advertising.

Essentially, this advertising-driven surveillance system uses data acquired from mobile apps and online ads to track the behavior and movements of hundreds of millions of people. Cobwebs Technologies officially announced the system in October 2020, describing it as a “leading-edge location intelligence platform” that combines web data with geographic information using interactive maps to link the digital and real worlds.

Users of the tool can track the locations, movements, and personal details of entire populations for up to three years in the past. Penlink’s website states that Webloc helps “investigate and interpret location-based data” and can estimate location from IP addresses and find individuals’ home and work addresses.

Interestingly, Cobwebs Technologies was one of seven cyber mercenaries removed from Meta in December 2021 for using around 200 fake profiles to gather information on targets, and even engaging in social engineering to infiltrate private groups and deceive targets into sharing personal details.

Meta reported finding Cobwebs Technologies customers in Bangladesh, Hong Kong, the United States, New Zealand, Mexico, Saudi Arabia, and Poland. “Besides law enforcement-related targeting, we also saw frequent targeting of activists, opposition politicians, and government officials in Hong Kong and Mexico,” according to Meta.

Reports from 404 Media, Forbes, and Texas Observer indicate that Webloc can be used to track phones without a warrant. A procurement notice highlighted the tool’s “ability to automate and continuously monitor unique mobile advertising IDs, geolocated IP addresses, and connected devices analysis.”

Public records analysis suggests that Cobwebs Technologies is connected to Israeli spyware vendor Quadream through Omri Timianker, the founder and former president of Cobwebs Technologies, who now oversees Penlink’s international operations. Quadream is thought to have ceased operations in 2023.

Approximately 219 active servers related to Cobwebs product implementations have been identified, primarily located in the U.S. (126), Netherlands (32), Singapore (17), Germany (8), Hong Kong (8), and the U.K. (7). Potential product servers have also been discovered in various African, Asian, and European countries.

In response to the report, Penlink stated that the findings “appear to rely on either inaccurate information or a misunderstanding about how we operate, including practices that Penlink does not engage in following our acquisition of Cobwebs Technologies in 2023.” The company also affirmed its compliance with U.S. state privacy regulations.

Citizen Lab concluded that their “research shows that intrusive and legally questionable ad-based surveillance (i.e., without a warrant or adequate oversight) is being used by military, intelligence, and law enforcement agencies down to local police units in several countries across the globe.”