The Government’s Upping Its Phone-Tracking Game

Blufax sounds like some kind of faxing service, but it’s actually a high-tech system San Diego’s government is using to track smartphones.

On the federal level, officials have spent millions of dollars on these devices, and we’re seeing use crop up in more and more cities – San Diego included. Here’s how Blufax systems track phones without being detected, how the government is using it today and what might be some areas of concern.

Modern phones have tiny radios in them to connect to other devices wirelessly. These radios send out beacons like radar pings on a submarine. Each ping sends a unique sequence of letters and numbers called a MAC ID. By listening for that beacon, computers can record which devices are nearby. A typical smartphone has a radio to connect to cell phone towers, Wi-Fi and Bluetooth.

Blufax is a sensor system used to detect a device with its Bluetooth capability turned on, such as a smartphone or headset.

It’s marketed as a cost-effective way to measure traffic: Multiple units can be used to calculate speed as cars containing these smartphones or headsets move down a road. Blufax is made by Traffax, a Maryland manufacturer. Each unit costs about $2,500. The federal government has spent more than $9 million on these devices. Many local governments have deployed units as well.

Here’s an example of the information captured by one of these scanners:

One thing to point out about that sample: Most Bluetooth data lacks personally identifying information. But these systems may include names and email addresses in the ID field.

I wanted to find out how San Diego might be using this technology, so I sent a California Public Records Act request to SANDAG. You can browse through the documents they sent back to me here. I learned they have at least 16 Blufax units, and plan to add them to every roadside call box along our freeways. The stated intention is to measure traffic speed and volume here in San Diego.

Moving from collecting anonymous data to a system that personally identifies individuals and stores that data is cause for concern. In one SANDAG document I received, there’s discussion of doing exactly that using “sensors that re-identify vehicles specifically.” Some examples given are “electronic toll tag transponders, cell-phone tracking, license plate reading, Bluetooth sniffing, magnetic signatures, (and) video tracking.”

By combining a license plate or phone number with a Bluetooth serial number, it’s possible to track citizens via their phone.

This isn’t science fiction. Houston has linked toll road transponders, which record personal identities with Bluetooth scans. In another effort, researchers at the University of Washington cross-referenced license plate reader data with Bluetooth data, which then personally identified individuals. Video tracking could combine facial recognition with Bluetooth scans to personal identify Bluetooth owners as well.

I haven’t found any specific documents showing that San Diego is personally identifying Bluetooth devices. But authorities are intentionally withholding documents that might reveal more.

San Diego CityBeat revealed local law enforcement agencies are building a database to track where citizens travel using license plate scans. Does this data also collect Bluetooth serial numbers? I asked SANDAG to make that data public and they refused. I’ve filed a lawsuit, asking a judge to compel them to reveal this information. A court date is set for September.

The police have phony cell phone towers called StingRays that trick phones into revealing their whereabouts. Might these devices also be used in conjunction with Bluetooth scanning? It’s unclear because a request for documents on this technology was mostly rejected. San Diego police turned over a single — heavily redacted — document.

The government is invisibly collecting data on Bluetooth-equipped smartphones along roadways. It’s logical to assume this collection will expand to other public areas, as the scanners are relatively cheap and portable. Since smartphones are increasingly integrated into our everyday lives, they make a tantalizing tool for precise tracking.

While there’s no data suggesting individuals are being tracked in San Diego just yet, the technology exists, and the coordinated secrecy by law enforcement agencies makes it a real possibility.

Michael Robertson is an Internet entrepreneur and the founder of digital music company MP3.com. Robertson’s commentary has been edited for clarity. See anything in there we should fact check? Tell us what to check out here. Want to respond? Submit a commentary.