British and Canadian spy agencies accumulated sensitive data on smartphone users, including location, app preferences, and unique device identifiers, by piggybacking on ubiquitous software from advertising and analytics companies, according to a document obtained by NSA whistleblower Edward Snowden.<\/p>\n
The document<\/a>, included in a trove of Snowden material released\u00a0by Der Spiegel<\/em>\u00a0on January 17, outlines a secret program run by the intelligence\u00a0agencies called BADASS. The German newsweekly did not write about the BADASS document, attaching it to a broader article<\/a>\u00a0on cyberwarfare. According to The Intercept<\/em>\u2018s analysis of the document, intelligence agents applied\u00a0BADASS software filters to\u00a0streams\u00a0of\u00a0intercepted\u00a0internet traffic, plucking from that traffic\u00a0unencrypted uploads from smartphones to servers run by advertising and analytics companies.<\/p>\n Programmers\u00a0frequently embed code from a handful of such\u00a0companies into their smartphone apps because it helps them answer a variety of questions: How often does a particular user open the app, and at what time of day? Where does the user\u00a0live? Where does\u00a0the user\u00a0work? Where is\u00a0the user\u00a0right now? What\u2019s the phone\u2019s unique identifier? What version of Android or iOS is the device running? What\u2019s the user\u2019s IP address? Answers to those questions guide app upgrades and help target advertisements, benefits that\u00a0help explain why tracking users is not only routine in the tech industry but also considered a best practice.<\/p>\n For users, however, the smartphone data routinely provided to ad and analytics companies represents a major privacy threat. When combined together, the information fragments can be used to identify specific users, and when concentrated in the hands of a small number of companies, they have proven to be irresistibly convenient targets for those engaged in mass surveillance. Although the BADASS presentation appears to be roughly four years old, at least one player in the mobile advertising and analytics space, Google, acknowledges that its servers still routinely receive unencrypted uploads from Google code embedded in\u00a0apps.<\/p>\n