Secret recordings of a surveillance firm's presentation show how much iCloud data Apple surrenders to law enforcement with a warrant -- though it's Google and Facebook that can track a suspect to within three feet.
PenLink is a little-known firm from Nebraska which earns $20 million annually from helping the US government track criminal suspects. PenLink also sells its services to local law enforcement - and it's from such a sales presentation that details of iCloud warrants has emerged.
According to Forbes, Jack Poulson of the Tech Inquiry watchdog attended the National Sheriff's Association winter conference. While there, he secretly recorded the event.
During the presentation, PenLink's Scott Tuma described how the company works with law enforcement to track users through multiple services, including the "phenomenal" Apple with iCloud.
Apple is open about what it does in the event of a suboena from law enforcement. It's specific about how it will not unlock iPhones, for instance, but it will surrender information from iCloud backups that are stored on its servers.
"If you did something bad," said Tuma, "I bet you I could find it on that backup."
Tracking people to real-world locations
Tuma also says that in his experience, it's been possible to find people's locations through different services, although not through iCloud.
"[Google] can get me within three feet of a precise location," he said. "I cannot tell you how many cold cases I've helped work on where this is five, six, seven years old and people need to put [the suspect] at a hit-and-run or it was a sexual assault that took place."
It's also possible for law enforcement and firms like PenLink which help them, to get location data from Facebook and Snapchat. Reportedly, Facebook will report a suspect's location to within between 60 feet and 90 feet.
Snapchat has begun to provide location details accurate to within 15 feet. However, Snapchat also limits requests, releasing information to any one law enforcement agency around four times per day.
Tuma reports that the various services give access to data in different ways. Facebook, for instance, provides a portal where officials can log in and download the files. However, if the official investigator does not re-login every hour, they are locked out.
"This is how big a pain in the ass Facebook is," said Tuma.
This is one case where the use of PenLink to gather this information has a clear benefit. PenLink can automate the process of logging in to Facebook's portal.
The report says that the amount of data going from Facebook, Google, and others to the police is substantial. For example, one search warrant seen by the publication resulted in 27,000 pages of information from one man's account on Facebook.
Tuma does not believe that access to information is going to decrease. Firms that withheld information from the police would be unable to present that data to advertisers.
"I always call BS on it for this reason right here," Tuma said. "Google's ad revenue in 2020 was $182 billion."