Offering to LVMH: Dangerous surveillance tool spreads

A French luxury conglomerate, LVMH, has reportedly been presented with a surveillance tool capable of tracking mobile devices worldwide using data collected from the advertising industry. The tool, known as Webloc, is developed by Penlink, a U.S.-based company specializing in location-based intelligence. According to reports from German media outlet netzpolitik.org, which corroborated findings from French publication Mediapart, the technology could enable private companies, including LVMH, to monitor individuals based on their movement patterns, potentially with precision down to several meters. The system operates under the umbrella of ADINT, or Advertising-Based Intelligence, a term used to describe the collection and analysis of mobile device location data gathered through popular apps. These data flow through the ad ecosystem and are sold to firms like Penlink via data brokers. Legal experts argue that such practices violate the EU’s General Data Protection Regulation (GDPR), as users are not typically aware of or have consented to the use of their location data for this purpose. Previously, Webloc had been used by government agencies, including the U.S. Immigration and Customs Enforcement (ICE), as well as authorities in Hungary and Austria. However, its potential application by private entities remained unclear until recently. A report by Mediapart revealed that Webloc was introduced to a French luxury group, LVMH, through a private security firm. This came amid ongoing investigations into theft cases within one of LVMH's subsidiaries. LVMH, which owns brands such as Louis Vuitton and Moët & Chandon, responded to inquiries from netzpolitik.org. It stated that in the previous year, theft incidents occurred at one of its properties, and police were still investigating. The company confirmed that it had engaged a private security firm to address these concerns. Through this firm, a service provider presented a “new technology” to LVMH. The service provider, according to internal communications, was Penlink, and the technology in question was Webloc. In its response, LVMH emphasized that it was not informed about the underlying technology or its functionality during initial discussions. The company conducted a test to evaluate the proposed solution, but it was not made aware of the specific capabilities of Webloc. Once LVMH understood the nature of the proposal, it immediately terminated further conversations and did not pursue the offer further. The company noted that it had no access to reports, conclusions, or data generated from the test and was unaware of any resulting information. The potential use of ADINT tools like Webloc for criminal investigations raises ethical and legal questions. While tracking stolen goods or identifying suspects might seem justified, the method relies on data harvested without user knowledge or consent. In April, the Citizen Lab at the University of Toronto published a report detailing Webloc’s ability to track devices based on their locations, highlighting the risks associated with such technologies. Despite the controversy surrounding Webloc, LVMH maintains that it did not adopt the tool. The company’s stance underscores growing awareness among businesses of the implications of using surveillance technologies derived from non-consensual data collection. As more organizations grapple with the balance between security and privacy, the role of private security firms in facilitating access to such tools becomes increasingly scrutinized.