Everything is bigger in Texas – including the state police’s contracts for surveillance technology.

In June, the Texas Department of Public Safety (DPS) signed a procurement plan for a 5-year contract worth nearly $5.3 million for a controversial surveillance tool called Tangles from technology company PenLink, according to documents obtained by the Texas Observer through a public information request. The deal is nearly twice the size of the company’s $2.7 million, two-year contract with U.S. Immigration and Customs Enforcement (ICE).

Tangles is an artificial intelligence-based web platform that collects information from the open web, deep web, and dark web. Tangles’ main add-on feature, WebLoc, is controversial among digital privacy advocates. Any customer who purchases access to WebLoc can track the movements of various mobile devices within a user-selected, designated virtual area using a feature called “geofencing.” Users of software like Tangles can do this without a warrant or subpoena. (In a highly publicized ruling, the Fifth Circuit recently ruled that police cannot compel companies like Google to turn over data obtained through geofencing.) Device tracking services rely on location pings and other personal data obtained from smartphones, usually via in-app advertising. Surveillance technology companies then buy this information from data brokers and sell access to it as part of their products.

According to a U.S. Naval Intelligence procurement notice, WebLoc can even access a device’s mobile ad ID, a string of numbers and letters that serves as a unique identifier for mobile devices in the ad marketing ecosystem.

Wolfie Christl, a Vienna-based public affairs researcher and digital rights activist, argues that data collected for one purpose, such as navigation or dating apps, should not be used by different parties for other purposes. “This is a disaster,” Christl told the observer“It is the greatest decontextualization of data imaginable. … This is not what our future digital society can look like.”

Although a device’s mobile advertising ID is technically anonymous information, it can easily be matched to other data points to determine the owner, said Beryl Lipton, an investigative researcher at the Electronic Frontier Foundation. “If there is another data point — like the address of the person who lives where your phone seems to be all the time — it can be very easy to use that supposedly anonymous information to quickly build a profile of people and identify them,” Lipton said.

In 2018, the US Supreme Court ruled in Carpenter v. United States that police need a search warrant to obtain cellphone location data from service providers like AT&T and Verizon. But Nate Wessler, the attorney who argued that Carpenter Fall and deputy director of the Speech, Privacy and Technology Project of the American Civil Liberties Union, said the observer that companies have justified the sale of phone location information through data brokers by arguing that mobile advertising IDs are anonymous.

“These companies are so keen to put that forward as one of their defenses, and that’s complete nonsense. … It’s obviously a ridiculous defense because the only thing they’re selling is the ability to track phones and find out where certain phones are going,” Wessler said.

The privacy implications of police using services such as Tangles that provide location data are “identical” to the problems identified in the Carpenter case, Wessler said. That’s because location data collected by apps, as opposed to that obtained from service providers, can be even more invasive, he said. “You can learn just as much about a person’s GPS history from their apps as you can from their cell phone location data from their phone provider. And in some cases, you can learn even more,” Wessler said.

Tangles is a product of cybersecurity firm Cobwebs Technologies, founded in Israel in 2014 by three former members of Israeli military special forces. The company said its products, marketed as open-source intelligence (OSINT) tools, have been used to combat terrorism, drug smuggling, and money laundering, but Meta accused the company of operating as a surveillance company for pay. In 2023, Cobwebs Technologies was acquired by Nebraska-based technology firm PenLink Ltd.

Christl, the Austria-based digital rights researcher, said companies that sell software that includes data from mobile phone apps have greatly expanded the definition of OSINT tools. If a company has to buy personal data from third parties to incorporate into software it sells to police, then that is not a truly open source tool, he said.

Lipton, the investigative researcher at the Electronic Frontier Foundation, said that’s troubling for the public. “People don’t realize that some of these things come at a high cost,” she said. “Both in terms of price and privacy.”

In a written statement, a spokesperson for PenLink told observer Their “open source intelligence (OSINT) solutions are used to protect our communities from crime, threats and cyber attacks by providing seamless access to publicly available data. From a technological perspective, we would like to point out that we work exclusively in accordance with the law and adhere to strict standards and regulations.” The spokesperson did not answer any further specific questions.

Cobwebs Technologies, now part of PenLink, has contracted with various federal agencies, including ICE, Internal Revenue Service, Bureau of Indian Affairs and Bureau of Indian Education, and U.S. Fish and Wildlife Service through its Delaware-based subsidiary Cobwebs America Inc. According to usa.spending.gov, ICE holds Cobwebs America’s most expensive federal contract to date.

The DPS Intelligence and Counterterrorism Division has been using Tangles since 2021, as first reported The Intercept. The agency initially bought the software as part of Gov. Greg Abbott’s multibillion-dollar Operation Lone Star, awarding an initial $200,000 contract as an “emergency contract” without public bidding. Since then, DPS has expanded the contract every year: In 2022, it paid $300,000 and in 2023, more than $400,000, according to contract documents on DPS’s website. The agency’s new plan for a 5-year Tangles license from 2024 to 2029 will cost about $1 million per year.

In its procurement plan, DPS says Division of Intelligence and Counterterrorism personnel need the tool to “identify and disrupt potential domestic terrorism and other mass casualty threats.” The plan references two mass shootings in Texas. In August 2019, a racist white man from Allen killed 23 people at a Walmart in El Paso. A few weeks later, another perpetrator fatally shot in Midland and Odessa. The plan does not mention the Uvalde school shooting in 2022, when 91 DPS officers were part of a massive, botched law enforcement response.

“Following the attacks in El Paso and Midland-Odessa, Governor Abbott issued several executive orders designed to prevent similar events,” says the takeover plan, which the observer it says. “In response to these orders, DPS (Division of Intelligence and Counterterrorism) has assigned personnel to identify potential mass attackers and terrorist threats.”

It’s unclear how DPS used Tangles or whether the software helped prevent potential mass shootings. DPS did not respond to written questions or an interview request for this story.

After DPS acquired the first license for Cobwebs’ software in 2021, local Texas law enforcement agencies followed suit. Expenditure records from the Goliad County Sheriff’s Office’s Operation Lone Star, obtained by the observershow that in the fall of 2023, the Goliad Sheriff, along with the sheriffs of Refugio and Brooks Counties, received “cooperative use of (Cobwebs) software” to “identify, link, and track the movements of cartel members throughout the region.”

Other Texas customers that have purchased Cobwebs’ software include Dallas and Houston police and the Jackson County Sheriff’s Office, which shares access with the Matagorda County Sheriff’s Office, according to local government meeting minutes and DPS emails.

Before being acquired by PenLink, Cobwebs Technologies received criticism for the way customers used its products. In 2021, Meta suspended seven companies – including Cobwebs – that were identified as participants in an online surveillance ecosystem for payment. As part of its sanctions, Meta deleted 200 accounts operated by Cobwebs and its customers. In a company report, Meta investigators wrote that they had identified Cobwebs customers in Bangladesh, Hong Kong, the United States, New Zealand, Mexico, Saudi Arabia, Poland and other countries.

Cobwebs’ clients were not only focused on public safety activities, Meta’s report said. “We also observed frequent attacks on activists, opposition politicians and government officials in Hong Kong and Mexico,” the report said.

Agencies around the world have used Tangles. From at least 2021 to 2022, the Salvadoran police used it, according to the investigative body The lighthouse. The police in Mexico have also bought the software, according to Wood woola newspaper from Mexico City.

In 2022, a sales representative for Cobwebs Technologies asked a DPS employee if the government agency could serve as a customer referral for a police department in Israel, according to an email obtained by the observer. In the email, the sales rep stated that DPS had at least 20 Tangles users at the time. DPS’s new acquisition plan calls for 230 named users.

Wessler, the ACLU attorney, said the sale of mobile device data to third-party data brokers and surveillance technology firms remains a legal gray area. “There are some legal frameworks that push the envelope, but there are a whole host of core issues that the law just hasn’t caught,” Wessler said.

But he said other government agencies are already stopping buying products that use huge amounts of cellphone location data. The services can be expensive, data usage is invasive and there is little evidence that these services have made investigations much easier or solved many cases, he added.

“It’s just as if it’s not worth the effort,” Wessler said. “We shouldn’t spend taxpayers’ money on a haystack of data that they’ll then try to pick needles out of, should we?”