Sign up for the daily CJR newsletter.
“Look for the margarita machine,” Francesca D’Annunzio’s source told her. D’Annunzio, an investigative reporting fellow at the Texas Observer, was delving into Operation Lone Star, Texas governor Greg Abbott’s more-than-eleven-billion-dollar anti-immigration crusade that the American Civil Liberties Union has flagged in a report for “unchecked cruelty.” D’Annunzio recalled her source saying, “With this much money being spent so quickly, I wonder if these little sheriff’s departments are spending money on things that they have no business buying. Like a margarita machine.” D’Annunzio heeded that advice, and requested a “bunch of records from some sheriff’s departments to try to see: Well, how are they spending their Operation Lone Star funds? And is there a proverbial margarita machine? And I did not find a margarita machine. I found a warrantless phone-tracking software.”
D’Annunzio printed out all the records and combed through overtime hours, new trucks, device purchases, paper orders. She paused on an item for “Cobwebs”—a company, she came to learn, that produces a tracking tool, Tangles, by bulk-buying location data from various smartphone apps and advertisers. The Texas Department of Public Safety (DPS) had signed a $5.3 million contract with PenLink, the parent company of Cobwebs, and would be using this tool for years. (The name “PenLink,” Cooper Quintin of the Electronic Frontier Foundation told me, is a reference to “pen/trap” orders, which have long allowed investigators, with less justification than probable cause, to collect incoming and outcoming numbers for a phone of interest.) D’Annunzio also found that, since first contracting with Cobwebs, in 2021, DPS had expanded its contract each year. Her story for the Observer noted how Cobwebs had been banned by Meta for “participating in an online surveillance-for-hire ecosystem” and how, even after that, multiple Texas sheriffs had used Tangles to “identify, link, and track the movements of cartel operatives throughout the region.” DPS’s rationale for employing the technology was counterterrorism.
“The idea that our patterns of life can be followed is frightening,” D’Annunzio told me. Surveillance, she observed, can be a tool of authoritarianism. She raised the Department of Homeland Security: “We have seen, in Minneapolis, stories of people saying that their car was followed by a DHS agent who said, ‘We saw you following us, we started following you, we know where you live,’” as she put it. “I wanted to be able to show the buildup, even though maybe this subject feels abstract to a lot of people. Like, maybe somebody thinks, ‘Why should I care about drones or license plate readers? I know police are tracking.’” D’Annunzio paused. That “so much can be learned about us and our patterns of life without a warrant,” she said, “is something that should concern everybody, regardless of their political persuasion.”
D’Annunzio is one of an increasing number of journalists and researchers arriving at this conclusion, from different points of entry. When I googled Tangles, I found a website called Surveillance Watch, which referenced D’Annunzio’s reporting for the Observer as well as reporting at 404 Media by Joseph Cox, who explored how Tangles and its WebLoc feature, which allows investigators to watch the movement of phones within a geofenced area, are used by Immigration and Customs Enforcement (ICE) to track people to their homes and workplaces. Surveillance Watch, a resource for journalists and the general public, started in 2024 by Esra‘a Al Shafei, aims to sharpen the contours of an industry that is “opaque by design,” Al Shafei said, amid an “unprecedented rise in both the development of and the demand for surveillance and spyware tech in the context of the US.”
On Surveillance Watch, Al Shafei explained, you can find “the companies building the surveillance and spyware tools, but also their subsidiaries, their partners, financial backers, and where this technology is typically deployed.” As she told me, “contracts are being awarded with little public oversight or accountability, and most of these surveillance tools don’t require warrants to use.” ICE is a major user, and one “long-term contractor” with ICE, she noted, is LexisNexis. “A lot of people are like, ‘Oh, boring librarians and academia, you know.’” But LexisNexis, Al Shafei said, “compiles billions of records from sources such as government databases, utility bills, phone records, license plate tracking, even medical records, and integrates all of this into analytics tools that basically link relationships and provide all of this type of analysis, extremely detailed.” Another entity, BI Incorporated, which contracts with ICE to fit almost two hundred thousand immigrants with ankle and wrist monitors while they await court proceedings, started, Al Shafei said, as a system by which to monitor cattle.
Cox, who helped break the original story of ICE’s use of Tangles for 404 Media, has been covering surveillance technology for ten years. “In that time, I’ve seen a lot of trends or fads in the industry,” he said. “Activists and civil liberties experts have always warned that technology is going to start with one purpose and will trickle down to local law enforcement.” At 404 Media, which is a worker-owned publication, he’s been able to dip into stories big and small: “When it comes to ICE and the technology that ICE is using, we’ll do almost incremental stories,” he said. He still manages to feel a sense of shock—for instance, when he covered ICE’s use of its own facial-recognition app for 404. “They point their cameras at someone’s face. They use it to verify someone’s citizenship. And then they detain them. Or they don’t. Whatever they want to do,” he said. “We kind of all knew that was coming. And now they finally did it.” And sometimes, as Cox has reported, they screw up.
This form of journalism is less about telling stories than mapping how government interests are finding stories about the rest of us. Often, that poses a narrative challenge: “It’s really hard to find a target or a victim of surveillance,” Cox told me. “These systems are so opaque.” Quintin, at the Electronic Frontier Foundation, put it this way: “The hardest part of it is that it’s hard to find facts. It’s hard to find victims. We know for a fact that ICE has a contract with PenLink for Tangles. But it’s unclear how they’re using it, unless you can get firsthand ICE testimony, which is going to be hard.”
Also difficult: the way this work places reporters and researchers in view of the systems they cover. Al Shafei, a human rights activist, originally designed Surveillance Watch to focus on Southwest Asia and North Africa; she has also worked to build anonymity tools for queer communities, music apps for censored artists, and interactive investigative reporting on migrant worker rights in the wider Gulf region. “Unfortunately, all of this has meant that our team was and continues to be intensely targeted by spyware and surveillance tech,” she said. As we spoke, via Zoom, she concealed herself behind an illustrated portrait of her face—she has a hard rule of maintaining visual anonymity. “I made this decision as a precaution more than twenty years ago, when I first started using the Web,” she told me. “I stuck to it because I knew we were going to live in a surveillance state.”
Has America ever needed a media defender more than now? Help us by joining CJR today.
