TI-2026-061T — The Utility That Sold You

Classification: HIGH · Carrier Location Sale · Involuntary Data / Utility Betrayal Confidence: HIGH on the reporting and the FCC fines (public record); MEDIUM on the "utility betrayal" framing. TLP:WHITE — public reporting, senatorial inquiries, public regulatory orders. Series: The Fake Umbrella — Part T. T is for "Telecom." The location brokers of Part D at least needed an app you installed. This one needed nothing — because the utility you cannot live without already knew where you were, and sold it. Facts are facts. They are good for some and bad for others. You decide.

The seed: a live phone, located for $300

In 2019, a reporter at Motherboard, Joseph Cox, ran a simple, devastating test. He had a colleague's phone. He paid a bounty-hunter source $300, and in return received the real-time location of that phone — pulled, through a chain of location middlemen, from data the major US wireless carriers had sold. No warrant. No court order. No notification to the person being tracked. A stranger's live position on a map, for roughly the price of a monthly phone bill, because the company that connects your calls had turned the location it holds into a product.

That is the seed, and it is the cleanest in the series, because there is no app to blame, no cookie to clear, no setting you failed to change. The location broker of Part D at least needed you to install something. The carrier needed nothing from you but your continued existence as a customer — which is to say, your continued participation in modern life. It already had your location, because it has to, and it sold it anyway. Part T is the letter where "you could have opted out" stops being available as an answer.

Why this data is not like the others: you were never free to withhold it

Every consumer letter in this series has had, somewhere in it, a version of "you consented" or "you could have declined" — the loyalty card you didn't have to sign up for (L), the smart speaker you chose to buy (S), the free VPN you installed (P). Those defences are weak, but they at least exist. Here they do not, and that is the whole point.

A phone must tell the network where it is. That is not a feature or a policy — it is physics. To route a call or a text to your handset, the carrier's network must know which cell tower you are near; the moment your phone is on, it is announcing its approximate location to the carrier, continuously, unavoidably. You cannot use a mobile phone at all without giving your carrier your location. It is, uniquely, the one dataset in this entire series that you had no ability to withhold — the price of being reachable, of having a phone, of functioning in a world that assumes you do.

And that is precisely the datum the carriers sold. Not something you overshared, not something you clicked "agree" on without reading — the involuntary exhaust of an unavoidable relationship. To decline this surveillance, you would have had to decline having a phone. That is not consent. That is a toll.

The chain: from your carrier to a bounty hunter, unpoliced

Follow the money downhill and watch the safeguards evaporate at every step. The four major carriers — AT&T, Verizon, T-Mobile, Sprint — sold access to subscriber location to aggregators like LocationSmart and Zumigo. The aggregators resold it to a sprawling tier of downstream customers, and the controls on who could query whom were, in practice, thin to nonexistent. The result was a market in which live phone locations reached:

• Bounty hunters (the $300 purchase),
• bail-bond agents,
• and, notoriously, Securus — the prison-telecom company whose portal was reported (NYT, 2018) to let officials locate phones with minimal verification that the request was lawful.

At the top of that chain is a regulated utility that everyone must use; at the bottom is a stranger with a credit card. The carrier could tell itself it only sold to "legitimate location services," but "legitimate" evaporated one hop down, and the carrier collected the same regardless. In 2024, the FCC fined the four carriers roughly $200 million for selling access to customers' real-time location without valid consent and without adequate safeguards — a formal ruling that the whole program was unlawful. As with Cellebrite (C), Vizio and Ring (S), the accountability arrived after the exposure — after Securus, after the $300 demonstration — never before.

The seven questions

Who is this? The major mobile carriers, the location aggregators (LocationSmart, Zumigo) they sold to, and the downstream buyers (bounty hunters, bail bondsmen, Securus).

Why did it attack? No attack — a sale. The carrier monetised the location data it already held by physical necessity.

Who does it claim to be? A regulated utility providing "location services" for legitimate purposes (roadside assistance, fraud checks). Neutral infrastructure.

Whom is it related to? The location brokers (061D — same product, voluntary source), the lawful-intercept mandate (061I — the carrier's other surveillance role), and the whole "commercially available location" defence.

Where is the money? Carrier-to-aggregator data deals, aggregator-to-reseller markups, reseller-to-anyone sales — a supply chain that turned an involuntary datum into revenue at every tier.

What is the official anchor? The carriers' status as regulated utilities — which is exactly what makes the betrayal worse, because it is the relationship you are least able to leave.

What if it is not who it claims? It is who it claims — a utility selling location services. The finding is that a utility selling the involuntary location of a captive customer base to an unpoliced resale chain is mass tracking with a phone bill attached.

What if…

• What if carriers need location to operate? They do — and that is the fig leaf. Holding your location to route your call is a necessity; selling it to bounty hunters is not. The legitimate operational need is exactly what the carriers pointed at while monetising far beyond it.
• What if there are legitimate location services (911, roadside)? There are, and they can be built with real, per-instance consent and tight controls. The program the FCC fined was not that; it was bulk access with safeguards so weak a reporter bought a live location for $300.
• What if I consented in the terms of service? The FCC found the consent invalid, and structurally it could not be real: you cannot meaningfully "consent" to the terms of the utility you must use to have a phone, when declining means having no phone. Consent requires a genuine ability to refuse, which a captive customer does not have.

Steelman: the strongest defence — and why it fails

Built at full strength:

"Carriers necessarily process location to deliver service, and location-based services (emergency response, fraud prevention, roadside assistance, fleet management) provide real value that customers want. The carriers sold to vetted aggregators under contracts requiring consent, terminated the programs when abuses surfaced, and are now heavily regulated. This was a controls failure by intermediaries, not a decision to betray customers."

Where it breaks:

• "Under contracts requiring consent" is what the FCC rejected. The regulator found the consent invalid and the safeguards inadequate; the contractual fig leaf did not survive scrutiny, and could not, given that the customer could not truly refuse.
• "A controls failure by intermediaries" is the carriers' own choice of chain. They chose to sell into a resale market they did not control, took the revenue at the top, and the foreseeable result — location reaching bounty hunters and Securus — is the design working, not a surprise.
• "Terminated when abuses surfaced" is reactive, again. The programs were curtailed after Securus, after the $300 buy, after Wyden's inquiries, after the FCC — the same post-exposure accountability the whole series documents. Reform that only arrives when caught is not a safeguard.
• The one true thing: legitimate, consented, tightly-controlled location services — genuine 911 dispatch, opt-in roadside help — are real and valuable, and this dossier does not oppose them. Their honesty lives in per-use consent, tight scope, and no onward resale. The moment the carrier sells the involuntary location of every subscriber into an unpoliced chain, "location services" has stopped meaning "help you asked for" and started meaning "you, for sale, because you needed a phone."

Verdict: consented, controlled carrier location services are legitimate. The carrier location-sale program — involuntary data, captive customers, an unpoliced resale chain reaching bounty hunters, ruled unlawful and fined ~$200M — is HIGH, and categorically worse than the app-broker version because there was no way to opt out. "Telecom / location services" is not a mitigation. It is the utility's word for selling the one thing you could never take back. Confidence: HIGH on the reporting and fines; MEDIUM on the framing.

Read between the lines

The quiet horror of Part T is the word utility. We grant utilities a special trust precisely because we have to use them — you cannot boycott the company that carries your calls the way you can skip a loyalty card, so the relationship is built on an assumption of stewardship: I must give you this, so you must not abuse it. The carrier location sale broke that assumption at its root. It took the trust that comes from being unavoidable and spent it — monetising the data you were compelled to provide, precisely because you were compelled and could not walk away. That is a different and worse thing than a company selling data you volunteered; it is a company selling data you were forced to generate, using the very inescapability of the relationship as the guarantee of supply. And notice it required no euphemism at all for the public, because the public never saw it — it happened in business-to-business contracts between the carrier and aggregators you have never heard of, and the only reason you know is that a reporter spent $300 to prove it. The most involuntary surveillance in the series was also the most invisible, and those two facts are the same fact.

The human layer

There is a specific person for whom this is not abstract, and she is the reason the $300 mattered: the woman fleeing someone dangerous. She does the impossible, careful work of disappearing — but she cannot disappear from her carrier, because to call for help, to hold a job, to reach her lawyer, to be a person in the modern world, she needs a phone, and the phone tells the network where she is, every minute, whether she likes it or not. She cannot opt out of that; no one can. And for a stretch of years, anyone — an abuser with a credit card, a bounty hunter he hired, a "bail agent" who asked no questions — could buy her live location down a chain that started at her own phone company, for less than she paid it each month. She gave the carrier her location because the physics of being reachable required it, and the carrier sold it because the economics of being a business permitted it, and between those two facts stood nothing but a "consent" the government later ruled was never real. That is the utility that sold you: not a company you chose and could leave, but the one you could not, monetising the one thing you could not withhold, and finding out it was wrong only when someone bought the proof.

Defense — the fix is legal, because the exit doesn't exist

(1) Understand there is no consumer opt-out from carrier location — only regulation. Unlike apps you can decline or devices you can leave off, you cannot use a phone without your carrier knowing where you are; the only real defence is legal (the FCC action, and laws banning the sale of carrier location), which is why supporting and enforcing them is the actual mitigation. (2) For the highest-risk (survivors, sources): assume the carrier knows your location and treat carrier-level exposure as a legal/threat-model problem — safety planning, address-confidentiality programs, and legal pressure on data sales, not a settings toggle. (3) Demand per-use consent and no-resale for real location services. Legitimate 911/roadside location can be built with tight, per-instance consent and a ban on onward sale; that is the honest version, and the standard to hold carriers to. (4) Read "location services" from a carrier as "your involuntary location, monetised" until proven otherwise — the program that reached bounty hunters wore exactly that phrase, and only a $300 purchase and a $200M fine revealed what it meant.

Investigation metadata

Next — TI-2026-061U: U is for "Updates" — the auto-updating agents, "observability" tools and remote-management software with god-mode over the machines they watch, and the supply-chain trust that turns a helper into a backdoor.

The location brokers needed an app you installed; the carrier needed nothing but your need for a phone. It held your position because physics demanded it, and sold it because the market allowed it, and for the price of a phone bill a stranger could put your live location on a map — a survivor's, a source's, anyone's. It is the most involuntary surveillance in the series and, until a reporter spent $300, the most invisible, because you cannot opt out of the utility, and the utility sold the one thing you could never take back. Facts are facts. They are good for some and bad for others. You decide.