Android users’ location tracked by ‘snooping beacon’ technology in apps - despite it being banned by Google

Hundreds of Android apps sent user location data to a data broker that had been banned from the Google Play Store since December 2020.

Close to 200 messaging apps, video and file converters, dating sites, and religious and prayer apps downloaded tens of millions of times had X-Mode installed. Despite the ban, only ten per cent of these apps have been removed from Google Play.

The tracker caused controversy after Vice’s Motherboard reported that the United States military was buying the granular movement data of users of a a Muslim prayer and Quran app that had more than 98 million downloads worldwide. The US military has reportedly used location data to target drone strikes.

Alongside X-Mode’s location SDK (Source Development Kit, a package of code that provides functionality for app developers) called “io.xmode”, the researchers from ExpressVPN’s Digital Security Lab found an additional SDK called “io.mysdk”.

SDKs – which could include mapping software, Bluetooth compatibility, or graphics and emojis - are difficult for Apple and Google to track because they are bundled into the app’s code before they reach the app store, and smartphone users are not made aware of their presence when they are being installed.

The five providers found in io.mysdk are “location-snooping beacons” which include “Placed (a subsidiary of Foursquare), Sense360, Wireless Registry (aka SignalFrame), BeaconsInSpace (aka Fysical), and OneAudience”. The researchers go to say that at least seven apps targeting Muslim audiences contain X-Mode.

Some of these beacons have been used to reportedly determine the real-world location of millions of devices, are in legal battles over privacy violations, and are “prominent players in location surveillance”, the researchers say.

“Static analysis on Apple iOS apps is limited by logistical barriers and uncertain legal status”, the researchers say, meaning they cannot examine X-Code on iPhones as easily, but point out that Android has a 73 per cent market share globally.

In response to the investigation, X-Mode’s chief executive Josh Anton told TechCrunch: “The ban on X-Mode’s SDK has broader ecosystem implications considering X-Mode collected similar mobile app data as most advertising SDKs. Apple and Google have set the precedent that they can determine private enterprises’ ability to collect and use mobile app data even when a majority of our publishers had secondary consent for the collection and use of location data”

He continued: “We’ve recently sent a letter to Apple and Google to understand how we can best resolve this issue together so that we can both continue to use location data to save lives and continue to power the tech communities’ ability to build location-based products. We believe it’s important to ensure that Apple and Google hold X-Mode to the same standard they hold upon themselves when it comes to the collection and use of location data.”

Google did not respond to a request for comment from The Independent before time of publication.