New: a key piece of this puzzle. Documents show how Venntel—a contractor that works with ICE—obtains location data from apps. Names the middlemen companies that feed the data. Unclear if ICE gets all data from this chain, but certainly Venntel gets it https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

These new findings are based on GDPR requests. In Europe, residents can request their data from companies, including US contractors. Norwegian broadcaster NRK did this to a ton of companies, and sketched out some of the Venntel supply chain https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

Here are some of the apps NRK installed. Including ones from a very popular GPS navigation company called Sygic, and "Fu*** Weather," a weather app. https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

The GDPR requests showed that Sygic (one of the app developers) said it shared information with two other firms. Complementics and Predicio. These companies are data middlemen, obtaining data from one place and selling it onto another https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

Then a request with Gravy, the huge advertising firm, said it obtained data from Complementics and Predicio. And crucially, Gravy said it supplied data to Venntel, the ICE contractor. We long suspected Gravy gave the data to Venntel but this is solid now https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

Here is a graphic for the data flow from apps/app companies, through middlemen brokers, to Gravy, and finally to contractor Venntel. What exactly happens to particular sets of data after that is unclear (Venntel said didn't send this person's data to ICE) https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

The supply chain is complex and nuanced, with some parties saying that their particular data transfer can't be used for U.S. law enforcement, etc. Regardless, these companies are linked. The hash of the same app appears in Complementics, Gravy, and Venntel https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

"It’s practically impossible for me to know about each possible data flow."

Again, devs of apps that actually collect this data have little insight into where their users' data is going. Some don't like to address responsibility for the collection either
https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

There is also a connection to X-Mode, the location data collector that we found sells information to U.S. defense contractors and by extension the U.S. military https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps

This was a cooperation between Motherboard and the Norwegian media organization NRK, which collected the GDPR responses. This thread has NRK's own pieces, which are in both Norwegian and English https://twitter.com/martingund/status/1334465877153095680

Here's what a former worker of another location data company that has contracts with U.S. law enforcement and military told me.

https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps