Sprint Downplays Report it Shared GPS Data with Feds

Sprint Nextel is downplaying a blog report that it provided law enforcement authorities with customer GPS location data more than eight million times between September 2008 and October 2009.

By Jaikumar Vijayan

December 02, 2009 — Computerworld —

Sprint Nextel is downplaying a controversial blog report that it provided customer GPS location data to law enforcement authorities more than eight million times between September 2008 and October 2009.

In a statement Tuesday, the company called the figure a gross misrepresentation and said it doesn't represent the actual number of customers whose location information was provided -- nor does it represent the number of times law enforcement contacted Sprint directly seeking data. Instead, the number represents automated individual requests, or "pings," by authorities for specific location information needed for investigations over the 13-month period.

Typically, a single investigation could generate thousands of individual requests to the network by law enforcement officials trying to track or locate a person over several days or weeks. That means the eight million automated requests were probably generated by thousands of customer searches -- not millions, Sprint said.

Sprint's comments followed a blog report published earlier this week by Christopher Soghoian, a security researcher who attended a recent closed-door conference on electronic surveillance technologies and practices.

During a panel discussion at the conference, Paul Taylor, Sprint's manager of electronic surveillance, talked about the sizable number of requests for customer GPS data after Sprint rolled-out a new Web portal for automating such requests.

In an audio clip of Taylor's comments posted on Soghoian's blog and now mirrored elsewhere, the Sprint executive is heard expressing concern about the volume of requests that came in after the Web interface went live. "There is no way on earth my team could have handled eight million requests from law enforcement, just for GPS alone" without the portal, Taylor said. "So the tool has just really caught on fire with law enforcement."

Taylor also worried about the company's ability to handle the "millions and millions of requests" expected in future. He said Sprint now has 110 employees and contractors working full time to comply with requests for customer records from law enforcement officials.

Soghoian's report prompted an immediate outcry from privacy advocates, many of whom were surprise at the volume of location-based surveillance it appeared to reveal. In a blog post , Kevin Bankston, a senior staff attorney for the Electronic Frontier Foundation (EFF), said that what Soghoian reported was "more shocking and frightening" than anyone imagined.

"Eight million would have been a shocking number, even if it had included every single legal request to every single carrier for every single type of customer information; That Sprint alone received eight million requests just from law enforcement only for GPS data is absolutely mind-boggling," Bankston wrote.

• Print