Three out of four of the major American wireless carriers are selling 911 location data to third parties even though it’s illegal, reports Ars Technica. Pressing the Federal Communications Commission (FCC) to crack down on carriers for this illegal data mining, consumer advocacy group Public Knowledge explained in a blog post that US law requires telecommunications companies to protect Customer Proprietary Network Information (CPNI) such as information intended solely for emergency services.
“Around 250 bounty hunters and related businesses had access to AT&T, T-Mobile, and Sprint customer location data. according to data collected by Motherboard. “The documents also show that telecom companies sold data intended to be used by 911 operators and first responders to data aggregators, who sold it to bounty hunters. The data was in some cases so accurate that a user could be tracked to specific spots inside a building.”
These actions are in direct violation of a 2015 FCC order that states access to the National Emergency Address Database (NEAD) will only be permitted to mobile carriers who “certify that they will not use the NEAD or associated data for any purpose other than for the purpose of responding to 911 calls, except as required by law.” A 2013 order deemed the “location of a customer’s use of a telecommunications service” clearly as CPNI.
Major carriers, however, have not been acting in accordance. “Between at least 2012 until it closed in late 2017, a now-defunct data seller called CerCareOne allowed bounty hunters, bail bondsmen, and bail agents to find the real-time location of AT&T, T-Mobile, and Sprint mobile phones,” Motherboard wrote.
Despite the fact that mobile carriers pledged to not sell data to third parties anymore as of last summer, the Motherboard investigation found that T-Mobile, Sprint, and AT&T are still doing so. Such practices are illegal and the FCC has the power to fine carriers as much as “$160,000 for each violation or each day of a continuing violation” or “a total of $1,575,000 for any single act or failure to act.” Ajit Pai has made no comment that demonstrates an intent to do so.