Data Brokers Track Abortion Clinic Visits for Anyone to Buy

If the war in Ukraine and Russia’s still-unfolding atrocities there didn’t offer enough fodder for doomscrolling, this week supplied a new dose of domestic crisis: A leaked Supreme Court draft decision that would overturn Roe v. Wade, demolishing a ruling that has served as a cornerstone of reproductive rights for nearly five decades. And this crisis, too, will play out in the digital realm as much as the physical and legal ones.

WIRED’s Lily Hay Newman responded to the news with a guide to protecting your privacy if you’re seeking an abortion in a near-future world in which Roe has in fact been overturned. As right-wing pundits demand the Supreme Court leaker’s prosecution, meanwhile, we analyzed the laws concerning leaks of unclassified government information like a draft court ruling and found that there’s no clear statute criminalizing that sort of information sharing. And law professor Amy Gajda walked us through the history of Supreme Court information leaks, which stretches back hundreds of years.

As Russia’s war in Ukraine grinds on, we looked at how small, consumer-grade drones are offering a defensive tool to Ukrainians that they’re exploiting as in no other war in history. And further abroad in India, a battle is taking shape between VPN firms and the Indian government, which is demanding they hand over users’ data. Meanwhile, the country’s new “super app,” Tata Neu, has sparked user privacy concerns.

And there’s more. As we do every week, we’ve rounded up all the news that we didn’t break or cover in-depth. Click on the headlines to read the full stories. And stay safe out there.

If Roe‘s precedent ceases to protect people seeking abortions across the United States, the question of who can digitally surveil those seeking abortions and abortion providers—and how to evade that surveillance—will become a civil liberties battle of the highest urgency. This week, Motherboard’s Joseph Cox fired the opening salvos of that battle with a series of stories about data brokers who offer to sell location data that include individuals’ visits to abortion clinics and Planned Parenthood offices, an egregious form of surveillance capitalism with immediate human consequences. Anti-abortion protest groups have already used abortion clinic data to target ads at women inside the clinics, and the same data could soon be used to identify women who seek out-of-state abortions in violation of local laws.

Cox pointed to two companies, SafeGraph and Placer.ai, both of which sold location data of those apparently visiting abortion clinics. Placer.ai has gone so far as to offer “heat maps” of where abortion clinic visitors live to anyone who creates a free account on its site. Cox’s reporting had quick results: SafeGraph, which was banned from the Google Play store in June, responded to Motherboard’s story by committing to stop selling the abortion-related location data. One of its investors, Are Traasdahl, says he’s selling his stake in the company and donating the money to Planned Parenthood.

Your move, Placer.ai.

While we’re shaming firms that leak or sell their users’ location data, Grindr has long represented a uniquely dangerous combination: a company that courts at-risk users, and then egregiously fails to protect their privacy. This week, The Wall Street Journal revealed that Grindr users’ location data was sold for years—beginning in 2017 until at least two years ago—via ad networks, potentially exposing the movements, work locations, and home addresses of millions of gay men. The revelation follows years of Grindr data abuses and inattention to privacy and security, such as allowing anyone to pinpoint users with a triangulation technique, and even turning a blind eye as one man’s life was ruined by spoofed Grindr accounts.

In 2022 a Russian military occupation doesn’t merely mean physical devastation from shelling, unspeakable war crimes, and mass deportations of Ukrainian civilians to Russian hinterlands. In the Russian-occupied region of Kherson in southern Ukraine, it now means that Ukrainians have been disconnected from the global internet and rerouted through Russia’s tightly controlled, surveilled, and censored “Runet.” The move, confirmed Monday by the internet monitoring firm Netblocks, represents a grim advancement of the “splinternet” notion of repressive regimes increasingly walling off their own regional slice of the internet to exert greater control over their populations. Russia now appears to be experimenting with extending its internet repression to the victims of its unprovoked military conquests in a bid to better control and influence digital information there too.

Last month, The New Yorker published an in-depth investigation of how the Israeli hacking firm NSO Group’s highly sophisticated smartphone spyware known as Pegasus was used to target members of Spain’s Catalan independence movement. Now, Spain’s government may be getting a taste of its own medicine: Both the prime minister, Pedro Sánchez, and the country’s defense minister, Margarita Robles, have said that their phones, too, were hacked with Pegasus in May and June of 2021. Spain’s criminal court is investigating the hacking, which was revealed by security researchers at Citizen Lab. While the Spanish government has claimed that the hacking must have been carried out by a foreign culprit, the Catalan targets of Pegasus have long pointed the finger—for their own targeting at least—at Spain’s National Intelligence Center.

The US Treasury announced Friday that it’s issuing sanctions against Blender.io, a “mixing” service that’s used to obscure the origins and destinations of cryptocurrency. Mixers, including Bitcoin Fog and Helix, have been criminally prosecuted by the US Department of Justice for helping to obscure the criminal origins of cryptocurrency. But the sanctions against Blender.io represent the first time that the Treasury has taken measures to financially ostracize a mixer, making it a crime for any American to transact with the service. In this case, Blender is accused of helping to launder $20.5 million of the $620 million worth of cryptocurrency that North Korea’s Lazarus hackers allegedly stole from the cryptocurrency firm Ronin Networks in March. That hack alone suggests that North Korean thieves have already topped the estimated $400 million in crypto—largely in the Ethereum currency—that they stole last year.