You will hear this as a civil-liberties story and file it under someone else’s inbox. Wrong reflex. Penlink’s Webloc, sold to police, maps a phone for twelve months using weather, gaming, email, and religious apps, then refreshes hourly. Company documents reviewed by Bloomberg talk about billions of location points and a map query for every device at a place and time. Treat that as a cybersecurity problem, because your approved apps already sold the route.

The carrier warrant is no longer the bottleneck

Most of you still picture location access as a messy legal process. A detective calls a carrier. A judge signs something. Legal stalls for a week. That mental model is comforting because it implies friction you can brief to the board.

Bruce Schneier flagged Webloc this week, drawing on Bloomberg’s review of Penlink materials. The pitch is blunt. Common apps already collect location. Brokers already package it. A buyer gets a map of where a phone has been for the past year, plus near-real-time updates on an hourly cadence. Zoom to a building. Ask which devices were there at 18:40. Read the crowd.

The reverse lookup is the part that should rearrange your threat model. Tracking one named suspect is an old story. Querying every handset that stood outside a plant gate, a counsel’s office, or a hotel used for a deal is a search problem over a haystack you are already in. You spent years arguing about badge-log retention and camera archives. A weather SDK on a personally enrolled phone can produce a cleaner timeline than your physical access system, and it does it as a side effect of telling someone it might rain.

Religious apps in that list should make you sit up. People treat those as private in a way they do not treat a game. Email clients sit in a different trust bucket; they are work-adjacent, so they sail through allowlists. Gaming looks frivolous, which is how it avoids the review a remote-access tool would trigger. The collection layer hides inside categories your acceptable-use policy already blessed.

Hourly refresh changes the operational picture again. Your badge system may batch overnight. Webloc-class feeds can move with the person. That matters on layoff days, all-hands, protest weeks, and any afternoon an executive’s calendar is the whole secret. You cannot DLP a lat/long that left through a consumer API your split tunnel was designed to ignore.

You do not need a novel exploit for this. You need an SDK with a location permission and a vendor who sells the exhaust. That is a market. Police are one named customer. Markets that exist for one buyer tend to grow more buyers. Assume adjacent copies of the same feed are for sale next to the badge you are comfortable with.

Your cybersecurity stack still watches the NIC

Walk a typical enterprise cyber security program and you will find plenty of energy at the edge. Firewall change tickets. VPN brute-force lockouts. Mail threat-protection. EDR on the laptop. That work is real. It is also pointed at a boundary the location broker never crosses in a way your analysts will recognize.

The phone talks HTTPS to an app vendor. Your split-tunnel VPN may not even see it. If it does, the destination looks like a CDN for a consumer brand. Threat detection tuned for C2 beacons and credential stuffing will not fire, because nothing is stuffing credentials. The session is the product working as designed. Your users did the “right” thing. They installed the app from the store. MDM wrapped the device. Security hardening closed USB debugging and forced a PIN. The map still shipped.

Defense in depth that stops at the NIC leaves the SDK in the clear. That is the architectural tell. You built concentric rings around laptops and called phones a mobility project. Mobility projects optimize for enrollment counts, not for which third parties receive a twelve-month breadcrumb trail of the CFO. Procurement signed off on MDM as “mobile security” and closed the ticket. The broker never needed a device-admin API. It needed a forecast widget and a permission prompt a tired traveler would tap at the airport.

Same week, the Justice Department and FBI announced they had seized $1.2 billion tied to a North Korea-linked Binance theft and disrupted FaceStealer tooling. Different buyer, same device class. Criminals harvest what sits on the handset. Brokers harvest what the handset already broadcasts. Your incident response runbook probably has a line for a stolen laptop. Check whether it has a line for which always-on location apps were on the exec phone during the quarter you were negotiating.

SOC identity gaps make this worse. Teams already struggle to answer who is behind an API call. They will not magically grow a capability to answer which SDK on a BYOD handset reported a geofence around HQ. If you cannot name the processor, you do not have a control. You have a hope, plus a store icon your policy already trust-scored because it was popular.

You reviewed the icon and missed the SDK

If you want a practical program, stop arguing about whether this “counts” as an attack. Count the output. A year of lat/long for staff who walk into restricted spaces is a loss event. Handle it like one.

What to change before the next travel week

1. Inventory location permissions, not app names. Pull MDM and OS reports for which apps on work and enrolled BYOD devices hold Precise or Always location. Group by permission, not by the brand on the icon. Weather, mail, games, and faith apps belong in the same queue as maps.
2. Demand SDK and data-sale disclosures from the apps you require. If you mandate a mail client or a “wellness” app, you are the customer. Ask whether location leaves the device, whether it is sold, and whether law-enforcement products are a named channel. “We use industry-standard analytics” is a non-answer. Get processors in writing or remove the app.
3. Split the fleet. Work-managed devices used near plants, executive travel, and incident war rooms should run a short allowlist. Consumer weather can live on a personal phone that does not enter those spaces. If that sounds harsh, you have already decided the map is worth more than the convenience.
4. Cut Always location to While Using, then prove it. Policy text is not enforcement. Spot-check a sample of devices monthly. If an app dies without background location, that is evidence it was doing more than showing a forecast, and you should replace it.
5. Wire travel OPSEC into incident response. When you stand up IR for a targeted exec or a physical threat, pull the device’s location-permission list and the prior 90 days of travel. Brief legal on commercial geofence products, not only carrier legal process. Decide in advance who tells the executive their prayer app may have drawn the commute.
6. Keep the boring edge controls; stop overloading them. VPN lockouts and ipban-style blocks still matter when someone runs brute-force against mail and remote access. If IPBan Pro, or whatever you already use, is eating repeat offenders at the perimeter, leave it there. That threat-protection layer will not see a weather SDK. Do not ask it to.

Ongoing work is dull on purpose. Re-run the permission inventory after every OS and MDM upgrade; vendors re-enable defaults. Add location-data processors to your vendor-risk queue beside SSO and file sharing. Include fourth-party SDKs inside the apps you actually contracted, because the broker may not be the brand on the home screen. Red-team a tabletop where the only artifact is a commercial map of who stood outside the data center last Tuesday. If your team reaches for firewall logs first, the exercise worked. You found the habit you need to break.

None of this requires a new product category. It requires you to treat SDK exhaust as data leaving the company, the same way you finally learned to treat OAuth grants and browser extensions. The store icon was never the control. The permission and the processor are.

Frequently Asked Questions

Does this only matter if we are in a regulated industry?

Anyone with executives, a physical site, or staff who travel through sensitive meetings already has a movement log they do not control. Regulation may add notification duties later. The reconstructable year of routes is the harm in front of you now.

If the phone is personally owned, is this still our problem?

If that phone enters your buildings, joins your mail, or rides along on deal travel, the map includes your organization. BYOD keeps the trail pointed at your sites and your people. You declined to inventory the device that draws it.

Will blocking unknown apps on the firewall stop Webloc-style collection?

The traffic targets well-known consumer destinations over HTTPS, so it will pass. Put the control on permission, SDK inventory, and device role. A last-ditch IP denylist is theater against a weather CDN.

Sources

• Another Way Police Are Locating People from Their Smartphones
• Feds announce seizure of $1.2 billion from Binance theft; also takedown of FaceStealer tools