Tucson PD used border security money for controversial surveillance software

This article was originally published by Arizona Mirror.

The Tucson Police Department has deployed a controversial AI-powered surveillance tool that is also being used by Immigration and Customs Enforcement to scour social media, track locations and much more, according to documents obtained by the Arizona Mirror. 

In August 2023, the Tucson Police Department signed a 28-month contract with Cobwebs Technologies for its “Tangles Open-Source Intelligence” software. The police department then sent a request to the Arizona Department of Emergency and Military Affairs to get reimbursed from the state’s Border Security Fund. 

In the reimbursement document, which the Electronic Frontier Foundation received in response to a public records request and provided to the Mirror, TPD requested the state reimburse it $277,500.23 for the purchase and installation of the software.

The Border Security Fund allows law enforcement agencies across the state to seek reimbursement for its activities related to border enforcement or security. But TPD didn’t use the Cobwebs technology for border-related crimes, according to the documentation it sent to DEMA. 

While TPD wrote that it intended to use Cobwebs for “sex trafficking investigations,” the agency’s leading example of how it had successfully used the technology to locate a “serial robbery suspect.” The agency also detailed its use in surveilling the annual Gem and Mineral Show, the 4th Ave Street Fair and a visit by then Vice-President Kamala Harris to Tucson. 

The Tangles Open-Source Intelligence software scours social media for posts by targeted people and can connect them to contacts, locations and events. Some versions of the software also include “AI face detection.” 

A leaked user manual given to law enforcement showed how the software could be used to target protesters and journalists.

Critics call the technology “warrantless surveillance” that has largely gone unregulated by lawmakers and judges and should create a larger dialogue about big tech’s role in government surveillance.

“These companies like to say they are just packaging open source information or information that is publicly available, but if you look at their offerings, you can see that they are violating people’s privacy and going beyond the information that is already publicly available on social media,” Lena Cohen, staff technologist at EFF, told the Mirror. 

The Mirror asked DEMA, which authorizes the disbursement of Border Security Fund money, if it approved TPD’s reimbursement request for Cobwebs. The agency didn’t directly answer the question, instead responding  that it worked with the Arizona Department of Public Safety and the Arizona Department of Homeland Security to review the reimbursement requests. 

TPD told the Mirror that its use of the software has “been minimal and primarily exploratory” and that “no significant investigative outcomes have resulted from its use.” 

The agency confirmed that DEMA approved and reimbursed them for the purchase and use of the software, though it acknowledged it hadn’t yet used the program for any border-related crimes. 

“The software has not been used for border-related or surveillance purposes. The scope of work submitted in the grant application was for costs related to programs that reduce human trafficking,” TPD said in response to the Mirror’s question about how the technology fits into the scope of the Border Security Fund. 

TPD also said it does not intend to renew the contract at the end of the 28-month period. 

Several Democratic state legislators from Tucson said they were concerned about TPD’s use of the technology.

Rep. Betty Villegas said in a statement to the Mirror that she has sought more information from DEMA.

“Tucson is a community that values transparency, accountability, and the protection of civil rights, and we must ensure that any technology purchased with public funds is used responsibly and within the law,” she said. “I will continue to seek clarification to ensure that all technology acquired with public funds is used transparently, responsibly, and in a manner that upholds the constitutional rights of our community.” 

And Democratic Sen. Sally Ann Gonzales said she was alarmed that TPD had purchased the surveillance software. Like Villegas, she said that she has been unable to get Tucson police or state officials to answer her questions on its use and procurement. 

“This Tangles technology or software is scary, and it is very upsetting. It seems to be unconstitutional for what it is doing because, normally, in order to surveil people, you need a warrant. So it seems it would be violating the Fourth Amendment,” Gonzales told the Mirror. “From the standpoint of a lawmaker, our laws really need to catch up with the advancement of these technologies that are out there.”

Gonzales, who voted against the state budget last year due to an increase in border enforcement money, said she was also concerned about how money meant for border security is being used to purchase software that has been used to spy on “just general people in Tucson.” 

“I’m just flabbergasted,” Gonzales said. “I for sure don’t want anybody surveilling me on the basis of being in the city of Tucson, in my district, just going about my personal business.”

TPD rejected the assertion that its use of the Tangles software presented constitutional concerns. 

“No warrant, subpoena, or similar legal authorization is required to use the system, as it only collects publicly available information,” the department told the Mirror, adding that it “does not raise Fourth Amendment concerns.” 

Additionally, TPD told the Mirror that it is able to audit who uses the system to verify it is not being misused, and said an internal audit of it was conducted during the grant application period. 

What is Cobwebs? 

In 2021, approximately 50,000 Facebook users were alerted that they may have been targeted by surveillance companies that were abusing the platform. One of those companies was Cobwebs Technologies. 

Meta ultimately banned Cobwebs for platform manipulation because it was creating fake accounts, getting into private Facebook groups and asking people for identifying information. 

“Our investigation identified customers in Bangladesh, Hong Kong, the United States, New Zealand, Mexico, Saudi Arabia, Poland, and other countries,” a report by Meta says about Cobwebs. “In addition to targeting related to law enforcement activities, we also observed frequent targeting of activists, opposition politicians and government officials in Hong Kong and Mexico.”

The Office of Naval Intelligence awarded the company a contract that same year. The federal contract gives a bit more insight into how the software works, what it does and what it means for Tucson residents who may get caught up in the dragnet. 

Tangles is one of two pieces of software created by Cobwebs that are known to be used by law enforcement. It allows law enforcement to search and monitor specific individuals online, using AI to do so. However, much of what Tangles does is proprietary, and the company has fought to try to shield itself from public record releases. 

Another tool created by Cobwebs, called WebLoc, can “monitor trends of mobile devices that have given data at those locations and how often they have been there,” according to a government study first reported on by Forbes. TPD said that they do not have access to WebLoc under their current contract.

Stolen Cigarettes 

In its reimbursement request to the state, TPD detailed one of the ways it had already used Tangles to track a suspect. 

After a string of cigarette thefts totalling “thousands of dollars” from two Circle K stores, TPD used the software to search “advertisement identification numbers” to “identify unique identifiers of cellphones that were present at each of the crimes that were the same.” 

They found one phone that would frequent a local neighborhood bar, which also had been a burglary victim.

“The case reports for the burglary, which had been unsolved for many months, indicated that one of the female bar employees suspected the burglaries were committed by her ex-boyfriend who had been fired from the bar just prior to the bar burglaries,” TPD wrote in its reimbursement narrative. “The female bar employee lived at the apartment address that the phone identifiers kept ending up at after each crime at the Circle Ks. At the time of the string of thefts, the female and the suspect were still dating, and he was staying at her apartment. This information was provided to undercover officers and detectives for follow up.”

The “advertisement identification numbers” used to track the suspect are part of a larger privacy issue that constitutional experts and technology experts are concerned about. 

An advertisement identification number is a unique identifier that identifies a person across apps. It is also used by advertisers, developers and surveillance companies. 

“Without an Ad ID, it would be a lot harder for data brokers, and therefore law enforcement buyers, to filter the data for a signal associated with one person,” Cohen told the Mirror. 

These Ad IDs have gotten better in recent years, with Apple users being able to opt in and out of certain tracking, making it harder for certain companies to harvest location data. This type of location data harvesting was at the heart of an $85 million lawsuit between Arizona and Google. 

“The advertising industry has created a massive surveillance machine that can be co-opted by law enforcement, bad actors and anyone willing to pay,” Cohen said. 

The federal procurement document for Cobwebs’s Tangles software posted by the Office of Naval Intelligence shows that the program also appears to be able to target IDFV, or identification for vendors. 

While an individual user may be able to turn off their Ad ID, people cannot turn off the IDFV, which is a unique identifier that is used by a company with multiple apps — like Google, Meta and countless others.  

Using data gathered by advertisers for police surveillance creates new constitutionality issues, as well. 

“It is akin to giving a landlord an envelope of cash to access your apartment instead of getting a search warrant, and I believe, unconstitutional,” Don Bell, policy counsel at the Constitution Project at the Project on Government Oversight, told the Mirror. 

The U.S. Supreme Court in 2018 ruled that historical cell phone data, which includes location information, is something that law enforcement would need a warrant to access, Bell said. 

But surveillance companies used by police have been using data brokers to largely get around that by purchasing the data instead.  

“Our government — no matter the party in power — cannot circumvent our constitution in employing this tool of warrantless mass surveillance, and still claim to be committed to the rule of law,” Bell said. 

Big Data

TPD is utilizing that advertising identifier information and sending that information to federal authorities on at least two occasions, according to the document sent to DEMA. 

“On another occasion, the region was experiencing a great number of targeted damages to overhead communication lines owned by Cox Communication. Damage and repairs reached nearly one million dollars, and each damage caused widespread outages for entire neighborhoods of internet and phones,” TPD says. “Searches for advertisement identifiers were used to locate potential common devices, and this information was turned over to the FBI for follow up.”

And on Election Day last year, “the system identified a male subject” who said on X that he was going to “show up at Tucson area election sites armed with a rifle” and he was “tracked through Cobwebs.” The person was found to be in Phoenix, and TPD forwarded the information to “the appropriate law enforcement agencies,” including FBI. 

The agency also tried to use it to locate a person who was kidnapped, but found the “results were minimal.” 

When trying to use the software to look for potential “social media posts related to sex trafficking” during the 4th Ave Street Fair in Tucson, TPD identified “several posts,” but they were “ruled out after further investigation.” 

TPD also boasted about using the Cobwebs software to surveil protesters during former Vice-President Kamala Harris’ visit to the region. 

“To date, monitors are turned on to scrub and save posts related to terrorism, sex trafficking and hate and bias crimes,” the agency wrote in its reimbursement request.  

How Cobwebs gets all the data that is fed into its system that TPD uses is also not entirely clear. 

“It is going to be hard to track exactly where Cobwebs is getting their location data because the data broker industry is so opaque, but the way that this data flow works based on reporting we have on similar surveillance tools and data brokers is that, sometimes data brokers directly pay apps for location data of the apps users,” Cohen said. “Sometimes they can do that by sharing code that app developers can put in their apps, which will send location data when directly available.”

Data broker X-Mode recently entered into an agreement with the Federal Trade Commission after it was accused of selling the location information of users that included LGBTQ+ dating apps. In 2020, it was reported that the company was selling location information from Muslim prayer apps to the U.S. military. 

“PenLink surveillance tools are made possible by the failures of web developers, judges and lawmakers,” Cohen said, referring to the U.S.-based company that merged with PenLink in 2023. She added that even state privacy laws, like California’s, lack teeth as they rely on the government to take action. 

“Mobile platforms like Apple and Google should kill the mobile advertising identifier, because it allows data brokers and other companies to track people across the internet,” Cohen said. “Despite what some of these surveillance companies might claim, most people are not knowingly consenting to the sharing and use of their location data.” 

While TPD is the only Arizona police agency that is currently known to use the software, other law enforcement agencies across the country are using it and similar tech, and federal agencies have been purchasing it. 

ICE has spent over $5 million on Cobwebs’s tools, with $2 million of that being on Tangles alone.

***CORRECTION: An earlier version of this story said that Rep. Betty Villegas sought more information from Tucson Police Department; in fact, she sought information from the Division of Emergency and Military Affairs, which oversees the Border Security Fund.