#340 Byron Tau - The Government Doesn't Just Spy on You. It Buys You.

The Shawn Ryan Show

In this episode of The Shawn Ryan Show, investigative journalist Byron Tau discusses the hidden world of corporate data collection and its i

Key takeaways

• Governments can bypass legal restrictions on surveillance by purchasing consumer data from private brokers instead of collecting it directly.
• The same data collected for advertising and marketing is now being used for mass surveillance, turning everyday digital behavior into a tool for tracking citizens.

Main topics

• Corporate data collection and surveillance
• Government acquisition of private data

Notable quotes

"If you just open your wallet, they can often get information that they would otherwise be forbidden from getting."

Conclusion

The episode underscores how deeply embedded surveillance has become in mo

Transcript preview

Speaker 4 (0:00) Most of us picked a bank at 16 and never looked back. Sound familiar? You're older now. You handle your money differently. But odds are you're still paying fees to a bank that hasn't done a thing for you in 20 years. That's where Chime comes in. Chime is changing the way people bank. They're not like traditional old banks who charge fees and gatekeep perks and rewards. Chime offers the most rewarding Fee-free banking, no overdraft fees, no monthly fees, no minimum balance fees. And the benefits stack. You get 5 % cash back on your Chime card in a category of your choice, like gas or groceries. All while building credit through regular, everyday spending with no credit check. You can grow your money faster with a savings rate that's 9 times the national average. And if you're ever in a pinch... SpotMe lets you overdraft up to $200 fee-free. Join the millions who are already banking fee-free with America's number one choice for banking. Head to Chime.com slash SRS. That's Chime.com slash SRS. Sign up now. It only takes a few minutes. Speaker 2 (1:14) Chime is a fintech, not a bank. Banking services and ChimeCard provided by Chime's bank partners. Qualifying direct deposits required. Terms and limits apply. Go to chime.com slash disclosures for details. If Speaker 4 (1:26) you spend any time off-road like I do, you already know how easy it is to end up second-guessing where you're at, whether you're still on a legal trail or if the route ahead is even worth taking. That's why I've been using OnX Off-Road. It's an off-road navigation app that shows trails, public and private land boundaries, places to camp, and detailed trail info all. in one place. And what makes it really useful is the amount of actual trail data. You can check difficulty ratings, terrain details, trail photos, even recent reports from other riders before you head out there. The other big thing is you can download maps ahead of time, because once you lose service out there, your phone is pretty much useless. But with OnX Off-Road, everything still works. offline. And, if you're riding with a group, their location sharing feature lets everybody stay on the same map so nobody gets lost or separated. What I like most about it is it gives me a lot more confidence when I'm exploring somewhere new. I'm not wasting time backtracking, accidentally ending up on private land, or trying to figure things out once I'm already deep into the trail system. I can plan ahead, know what I'm getting into, and spend more time actually enjoying the ride instead of worrying about navigation the whole time. Search OnX Off-Road in the App Store or Google Play. Again, that's OnX Off-Road in the App Store or Google Play. Byron Tao, welcome to the show. Thanks so much for having me. My pleasure, my pleasure. So, like I said, I heard about you in an earlier episode. Speaker 4 (3:08) Your book got shouted out, and so it took us a couple of years, but here you are. Well, glad to be here. Yeah, it's good to have you here. So we're going to be talking about... Speaker 4 (3:22) basically digital surveillance, what they do with all that information and all this stuff. And this can be kind of a dry subject, so I just kind of want to preface it before we get going. Have you heard about this pricing surveillance? Speaker 3 (3:36) Yeah, this is a new thing where essentially companies are trying to figure out what the maximum is that you're willing to pay. Speaker 3 (3:48) Try to extract as much money from you as possible through all the data they collect about you So Speaker 4 (3:54) I just want to paint a picture real quick, you know Cuz you get a lot of people and they're like, ah, what does it matter about what were they? What I'm not trying to hide anything, you know, and so I know Walmart is I think Walmart I think there's another big company too. Is it is it Amazon? I'd be surprised if most big companies weren't at least thinking about Speaker 2 (4:14) some Speaker 4 (4:14) of this stuff so Imagine, so basically Walmart is, they want to do surveillance on us all and figure out the maximum amount you're willing to pay. And so just here's a little scenario. You pull into Walmart, they got the flock cameras. Flock cameras talk to the internal cameras. They all talk to each other. And then they're going to have these digital price tags on all the products inside the stores that appear when you look at the product. Well, I mean, just through. facial recognition, your phones, all these other things, that those these cameras and these data systems are going to be able to talk to each other and display the price that they think that you specifically are willing to pay for each individual product within the store. And so it's it just falls into this mass surveillance hysteria that everybody is. getting extremely concerned about. And so this is some of the stuff that we're going to talk about today. Speaker 3 (5:19) Yeah, I think companies, generally speaking, for many, many years now have started to see consumers as data. Right? They want to know about you, they want to know about your purchase journey, they want to know about your background, they want to know about your interests, and they use all of that to... Historically, they've used it to target you with advertising. But increasingly, we're at an... We're in an environment where... There's enough data out there about you, and there's enough of a consumer profile out there about you, whether that's stuff you put out yourself or your purchase history or things they're inferring about you. But yeah, companies are going to be able to start making pricing decisions based on all the stuff that they know about you, and that's a lot. It's just crazy Speaker 4 (6:02) to think about, you know? Speaker 4 (6:06) You go to the store and you think it'd be the same price for everybody, no matter how much money you make, no matter any of that. But I mean... Speaker 4 (6:15) It's basically, I mean, it's all going to be individualized pricing based up what car you drive, what you bought on the internet, all of these, what you're wearing, everything, where you live, you know, and they'll talk to the store so that they can charge you the maximum amount that they think you're going to pay. And, you know, just going through the outline and doing some research on you, I mean, you know, I did not realize that I knew that the marketing. agencies that collect all this data. I knew it was horrible. I thought the government kind of had their own arm in this, but it sounds like they don't really need their own arm because the marketing agencies that collect all the data from your phone, through the apps, through your tires, through the vacuums, through TVs, through everything, they're so good at collecting that they just take the block of it and sell it to the US government. Speaker 3 (7:11) Yeah, that's right. And this has been going on for a while, but it's accelerated as we've all started putting more and more information about ourselves online. So, this originally started with stuff like, well, you know, these data brokers will collect your property history, like who bought a certain house. They might get a little information about your mortgage. They might, at some point, have started, you know, getting consumer lists, right? Were you the kind of person that subscribed to a magazine about pets or cooking or guns? And so they gradually started amassing more and more information about people right up to the current moment where they essentially can track a lot about your browsing history, they can track a lot about your movements through the world, they know how to link your social profiles to your real identity. And yes, governments have realized that there's a ton of corporate data out there that consumers are voluntarily handing it over in many cases. and that if they just open their wallet, they can often get information that they would otherwise either be forbidden from getting, because, you know, you've worked in the government, there are all sorts of rules and regulations about when you can target people and, you know, how you can target people. But if you buy the data on the open market, some of those rules go out the door. And so, yes, this is a phenomenon that's been increasing in recent years and is only gonna keep increasing as long as we keep... pouring data about ourselves onto the web. Speaker 4 (8:38) Well, that's what we'll be talking about for the majority of the day. So let me start you off with an introduction, though. Byron Tao, you're an investigative reporter currently at ProPublica following your tenure with Politico and the Wall Street Journal. You're the author of Means of Control, which focused on surfacing the intersection of corporate data gathering and government surveillance. And just this past May, you won the 2026 Pulitzer Prize for international reporting regarding an investigation into mass surveillance tools. built in Silicon Valley, advanced in China, and brought home for secret new uses by the Border Patrol. Congratulations on that, by the way. Thank you. And so before we get started, a couple of things to knock out here real quick. I have a Patreon account. They've been with me since the beginning. We've turned it into one hell of a community. I think it's almost 200,000 strong now. And so they get the opportunity to ask every single guest a question. Speaker 3 (9:36) Okay. Speaker 4 (9:36) This is from Jesse Martin. Speaker 4 (9:39) Your reporting has shown that commercially available location data can map the movements of phones around military installations, intelligence facilities, and the homes of the people who work there. If a foreign service can simply buy that from an ad broker, has the concept of OPSEC for operators and their families already collapsed? And does anyone in government have a serious answer for it? Speaker 3 (10:03) That's Speaker 4 (10:04) a Speaker 3 (10:04) great question. And I think even in this current conflict in Iran, we've seen reports out of CENTCOM that the Iranians may have indeed targeted American soldiers using commercially available data. This is a really, really hard problem to solve. There are some solutions. There are sort of hardened phones. There are rules you can put in place, but they're very, very difficult. And it takes... It takes discipline from the leadership of the military. It takes a certain amount of technical expertise, right? It's not just putting your phone in airplane mode. There's a lot of different things you need to do to harden a device and to make sure that, you know, operational security is maintained. And, you know, it requires understanding a bewildering array of data that's collected. And so there are people that are working on this problem. There's probably not enough people that are working on this problem, but it is a serious and ongoing threat to the people that go overseas and serve our country. Speaker 4 (11:00) Is there... I mean, I know the FTC's getting involved in the surveillance pricing stuff, but is this even a discussion in the U.S. government right now as far as just, you know... from a civilian standpoint? Speaker 3 (11:15) I Speaker 4 (11:15) mean, it's so invasive. Speaker 3 (11:17) So, I mean, I think, um... You know, historically, I think the government, and I think this is, you know, leading members of both parties, have not wanted to really interfere in the internet at the very beginning, right? Because they thought it was gonna be this tremendous tool for the advancement of human flourishing and freedom and commerce. And they thought that onerous regulations might... interfere with that. And that was a reasonable position to take, you know, 20, 30 years ago. I think as we've seen the internet mature, we've really seen a lack of serious policy discussion about what the rules should be around consumer data protection, and we've seen a real leadership vacuum in Congress. I mean, um... you know, the internet's 30-some years old at this point, and, you know, we're the last remaining major industrial democracy that does not have... a comprehensive privacy law. We have a patchwork of different laws that are state by state. Um, we have some executive orders that have been meant to deal with some of this from a purely national security basis, right? Like, trying to stop TikTok and other data flows out of the country. But writ large, I mean, our lawmakers, our political leaders have never really written rules of the road for digital services. Speaker 4 (12:30) Wow. You said we're the last one? Speaker 3 (12:34) I mean, that's something you hear scholars say, but essentially, I think that's correct. That at a national level, we're the last real remaining, you know, major democracy and major economy that doesn't have a privacy law that applies across the board to digital services. Yeah, I think that's true. Speaker 4 (12:52) Well, I mean, just, you know, from our previous discussion before we even started this, I mean, I'll bet they're thinking about it now. I mean, I wasn't even planning on going into this, but I mean, you're... So right now you're working on how foreign governments, specifically Iran, but there's a lot of other ones, I'm sure, are buying the data from U.S. marketing firms about us and targeting U.S. soldiers, operatives, State Department personnel overseas. Yeah, Speaker 3 (13:25) I mean, it's something I'm interested in because it... grows out of my book, but there was a letter, I think, a few weeks ago or a few months ago from Senator Ron Wyden's office, and he asked the Pentagon straight up, are there any reports that Iranians had targeted American soldiers? And the Pentagon answered that yes, they had received credible intelligence reports saying that, um, that... that Iranians had used commercially available information, information collected from data brokers, to potentially target U.S. soldiers. They didn't give... a tremendous amount of detail, but they said they had received that reporting. And so, yeah, this, you know, I've focused in this book primarily on what our government does with this data, but this data is out there and it's available for sale, and our adversaries can and do buy it. You know, there have been... there have been reports of other foreign governments getting this information, particularly Israeli companies, and... you know, Israel is an ally of the United States, but it would not be at all difficult for China, Russia, Iran to obtain the exact same data that we're talking about here. And CENTCOM seems to believe that it's at least credible that it was used to target Americans. Speaker 4 (14:35) Wow. Do you have a hardened phone? Speaker 3 (14:38) I do not. I do use a privacy-first cell carrier, and I do put my Apple phone in lockdown mode. But, you know, being a reporter, you have to balance the need for contacting people with putting your phone number out there in many instances and trying to encourage the public to deliver you tips. And so, I try to get a balance with my own personal security. Mm Speaker 4 (15:04) -hmm. Well, I got you a present. Oh, yeah? I sure did. So, here you go. Speaker 3 (15:11) Oh, thank you. You're welcome. Speaker 4 (15:14) This is Speaker 3 (15:15) a hardened phone. Should I open it now? Go ahead. Open it up. Speaker 4 (15:19) All right. How do I do this? Oh, boy. You're going to have to help me. Oh, boy. All right. Here we go. Oh, Speaker 3 (15:35) there's a snap. Speaker 4 (15:42) Tell me about this. All right. So I'll tell you about that. So you wrote about a company called Glacier. I did. In your book. And I wound up going into business with Glacier because this is something I've been extremely concerned with. My podcast got a little political. Now I'm affiliated with Heads of State and all these other people. Speaker 4 (16:04) used to work for the agency, I get paranoid about this stuff. So anyways, I reached out to them because I didn't want all these people to have my numbers. I don't know what they're sucking out of my phone, talking to people like you, talking to former colleagues and what's being sucked out of the phone. I wanted a hardened phone for everybody on my team. So I reached out to some former colleagues about what's the latest and greatest hardened phone, and they pointed me towards a company called Glacier. Speaker 3 (16:34) I Speaker 4 (16:35) wanted to go into business with Glacier. But first and foremost, I wanted their product. Well, their product is awesome, but it's $10,000 a phone, roughly, plus another... double that for the service. And so I lost interest and I said, look, I want something that we can do for everybody, that everyday consumers can afford. Nobody can afford this. And so we developed an application that takes a lot of the best features out of the phone and put it into an app. Speaker 3 (17:10) And Speaker 4 (17:11) the app's called Glacier. And so basically, in a nutshell, what Glacier does, I think you're going to love this. One, burner numbers. So my number gets leaked all over the internet. I'm sure your number, you know, if you're an investigative reporter, you know what that's like. And so we created, you can get up to five burner numbers. And so... What that is, you know, you pass your number out, it starts getting leaked, you're getting spammed, you don't want the hotel, the pizza place, the political campaign, you donate to any of that stuff, the nonprofit that you do. Everybody's selling your shit constantly. So you hand out the burner number. When you come to the realization it's been compromised, you burn the number, you get a new one. You can pick any area code in the U.S. Then the other thing we did is we did secure DNS, you know, which... keeps the applications that you're not using, that are selling all your information, where you are, what you buy, who you're with, all that stuff. It keeps that stuff localized on your phone and blocks it from being uploaded and sold to the marketing firms or the US government or foreign governments. And then the last thing that we did was we put the secure, we put a VPN in there that's, we don't hold any data other than the email that you sign up with. Speaker 4 (18:30) And they're all American VPNs. So that's what we developed. And we made the app as simple as you could possibly imagine. The real winner in there is the burner numbers and the DNS. And so Speaker 3 (18:47) that's built into a commercially available app that most consumers can get without dropping $10,000 on a secure phone? Speaker 4 (18:56) Yep. And it's super simple. Speaker 4 (19:00) You connect to the DNS, you shut the app off, and it is done. You don't ever have to open it again. Speaker 3 (19:08) So, can I ask you a question? What's your experience been like with the hardened phone? Because, like you mentioned, I did talk to Glacier in writing this book and a few other people who made hardened phones. And one of the things they said that the challenge was you have to make a hardened phone that people want to use, right? Because if you have a hardened phone and it doesn't work... in all the normal ways that people want to use a cell phone, then they end up just getting a non-hardened phone and carrying both of them around together, and then you've defeated the point of the hardened phone. So what's been your experience like using the hardened phone? Does it do everything a normal cell phone does? Speaker 4 (19:42) It does. It's an iPhone. You know, and so when talking to them, because I've had other hardened phones, but they weren't the iPhone. I think most Americans, life revolves around Apple. You know what I mean? Unfortunately, it just is what it is. It's Speaker 3 (20:00) hard to escape that ecosystem. Speaker 4 (20:02) And so they've found a way to harden the damn iPhone. And it's got some more advanced features on the app, but it's just having an iPhone. You know what I mean? And if they detect suspicious activity, you get an email. They follow up with it. They track where it went, what's happening. And if it is something malicious, then you get notified. You get a phone call from them. Some other stuff that they can do that the app can't do is, for me, we're all over the world. And we're kicking over some rocks that a lot of people don't want kicked over. Speaker 4 (20:44) And so what they can do is they can actually upload a footprint, like a false footprint, into your phone to make it look like you've been there for a long time. Speaker 4 (20:56) and delete it when you're gone. You know what I mean? So that it doesn't, so you come back to the U.S. Doesn't look like I was doing an interview in Taiwan. I go to Taiwan. It doesn't look like I came from the U.S. I go to Dubai to interview there. I have a whole new footprint uploaded. That's a, you know what I mean? So it makes you, it makes you blend in, you know, digitally. And it doesn't raise any red flags when you're in and out of all these countries. And there's some kidnapping type features, some of that kind of stuff. Speaker 3 (21:26) I'm looking forward to checking it out. Speaker 4 (21:27) I'd love to hear what you got to say. Speaker 4 (21:33) Here's the pitch. It takes two minutes, and you'll never think about it again. Download it, hit one button, close the app. That's the entire job. No manual, no settings, no tech background. Nothing for you to get wrong. And then, it just runs. Blocking the trackers, the phishing sites, and the surveillance ads across every app on the device. All day, quietly. without anybody having to do anything. It's first week out. It hit number six on Apple's top downloaded productivity chart. Built by former US intelligence professionals. I'm a co-founder. Glacier. Download it on the App Store. And remember, privacy isn't paranoia, it's protection. Speaker 4 (22:30) Look, if you're going to have a firearm in your home, it needs to be secure, especially if you have kids. But you also need access when it matters the most. And that's why I started using Stopbox. Most options force a bad trade-off. Locked away and slow, or accessible, but not secure. Stopbox fixes that. It's completely mechanical, no keys, no batteries, nothing to fail. The five-button design is built from muscle memory, so once you learn it, you can open it fast and with one hand. But it still keeps everyone else out. For me, that's the difference. It keeps things secure without slowing me down. It's also made right here in the USA, creating real jobs here at home. They've also got other products like the UCAN. which uses that same system but gives you more storage for your firearm, ammo, and gear so you can keep everything secure without sacrificing access. For a limited time, our listeners get 10 % off at Stopbox when you use code SRS at checkout. Head to stopboxusa.com and use code SRS for 10 % off your entire order. After you purchase, they will ask you where you heard about them. Please support our show and tell them our show sent you. Speaker 4 (23:52) So, how did you... I mean, how did you kind of get your start into this? What caught your attention? Because like I said, this can be a pretty dry subject, especially two years ago, you know what I mean, when you were getting into it. Speaker 3 (24:05) Yeah, actually, I mean, the story starts almost six years ago at this point, maybe even more. But, you know, I was at a dinner party and somebody was telling me about a program that... they were working on that involved the Department of Defense, or the Department of War, as it's now being called, buying up large amounts of commercially available information on the open market and using it to do Speaker 4 (24:34) some kind of counterterrorism work. Speaker 3 (24:37) And, you know, this was something I had never heard of, right? Like, I didn't know that you could just go out and broker information that showed pretty precise and granular movement of phones. And... you know, this was a vector of surveillance that I had simply not considered. You know, like, I thought I understood, you know, I was a Washington reporter, I'd covered courts on and off, I knew about how law enforcement was supposed to work. And the idea that there was this data set out there of the movement of hundreds of millions of devices, um, was kind of shocking to me. So I'm sitting there, you know, tell me more, that's an interesting program. Um, and, uh, you know... I got some of the tale. I got some of the technical explanation that, oh, you know, it comes off these apps, like weather apps and games. It comes when you opt in. Your phone number's not in there, your name isn't in there, you're known by an anonymized identifier, a string of letters and numbers. But, you know, we can generally figure out who you are, right? Because where a phone is at night, and where it goes during the day, and where it goes back to at night, it's pretty good... pretty good correlation to a person's real world movement and identity, right? I'm the only person that gets up at my home in Washington, D.C., and goes to my office in downtown Washington, D.C., and comes home every night, right? Like, my fiancé wakes up there, but she goes to a different office. And so, it's not all that difficult to get down to people's identity in these data sets. And so, hearing this story, I thought this was... rather extraordinary and a kind of surveillance I just hadn't considered. And so, you know, I kept it in the back of my mind and I started reporting on it. And, um... You know, the opportunity really came to delve deep into it when I was kind of a new reporter on the Justice Department and law enforcement beat back in 2020. I remembered this tip from a few years before and I started digging into it. And at this time, the program had matured a bit. DHS had started to use this data to do, um, kind of internal security and tracking of unlawful border crossings and trying to find, um, unlawful immigrants in the interior of the country, and had started to start using it for ordinary law enforcement, right? Kidnappings and all sorts of other things. And all doing it without a judge's supervision, without a warrant, and without most people in America knowing that this program was happening. And so... That's when I really started to delve into it. I published my first story on the topic of commercial data tracking in February of 2020, and I've been reporting on it ever since. Speaker 4 (27:20) Six years ago. Yeah. Speaker 3 (27:22) And I think, yeah, now that I think of it, I think the tip came in 2017 or 2018. Speaker 4 (27:26) Wow. Wow. How much is this advanced? Speaker 3 (27:30) You know, a couple things have happened since I started working on it. I mean, you know, on the one hand, people are much more privacy aware, and Apple and Google have made some changes into how much data... phones can collect without people realizing. So, I mean, in the early days of the iPhone, people were putting all sorts of crazy stuff on their device and clicking, sure, you can track my GPS location, and it would ping the phone every two seconds. And, you know, today Apple doesn't really like to let you, you as a developer, if you're trying to make a game or an app that does that, Apple doesn't really want you to do that, right? It wants people to know how many times an app has tracked your location. So now there's a big... pop-up that comes up every few days if an app tries to do that and says,