1

Yesterday, Msgr. Jeffrey Burrill of the U.S Council of Catholic Bishops resigned because an investigation by Pillar, a Catholic newsletter, alleged that he had used Grindr to find hookups. Fairly standard stuff, but the truly perplexing part was the investigation method:

According to commercially available records of app signal data obtained by The Pillar,
a mobile device correlated to Burrill emitted app data signals from the location-based
hookup app Grindr on a near-daily basis during parts of 2018, 2019, and 2020 — at both 
his USCCB office and his USCCB-owned residence, as well as during USCCB meetings and 
events in other cities.

To me, this scenario sounds extremely unlikely. An article in the Washington Post cites a few experts who say that they don't know of any other cases where commercially available advertiser data was deanonymized succesfully. A Grindr spokesperson rejects the possibility, stating that 'the alleged activities listed in that unattributed blog post are infeasible from a technical standpoint and incredibly unlikely to occur'.

I can think of a number of possible scenarios:

  • The folks from Pillar (who are pretty conservative) found Burrill's account manually, but don't want to admit they used Grindr themselves. This seems unlikely, because it wouldn't explain the source of a lot of other information contained in the article.
  • The data was obtained through a Grindr data breach. I don't know of any, so this seems unlikely.
  • Pillar was somehow able to extract advertising ID's from Burrill's device, which would have given the proverbial needle a bright red color and flashing lights. This seems possible, but I don't know how difficult this is (e.g. would this require Pillar to have breached his phone).
  • The data was procured illegally in another way. This article called to mind the investigation by Bellingcat that was able to track Navalny's killers using hacked geolocation data available on Telegram. Could something similar have happened here?

Is the story put forth by Pillar in any way feasible? If so, how could they have obtained this data?

New contributor
Benthlin is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
0
0

The article at Ars Technica is more informative:

The Pillar says it obtained 24 months' worth of “commercially available records of app signal data” covering portions of 2018, 2019, and 2020, which included records of Grindr usage and locations where the app was used. The publication zeroed in on addresses where Burrill was known to frequent and singled out a device identifier that appeared at those locations. Key locations included Burrill's office at the USCCB, his USCCB-owned residence, and USCCB meetings and events in other cities where he was in attendance. The analysis also looked at other locations farther afield, including his family lake house, his family members’ residences, and an apartment in his Wisconsin hometown where he reportedly has lived.

The de-anonymized data revealed that a mobile device that appeared at those locations—likely Burrill’s phone, The Pillar says—used Grindr almost daily. It also says that data “correlated” with the priest’s phone suggests that he visited gay bars, including while traveling for work. The Pillar presented this information to the USCCB in advance of publication, and yesterday, the conference announced Burrill’s resignation.

My personal guess is they had a tip that started them looking, rather than a blind data troll.

0

From this article in The Verge, it seems that Grindr has been monetizing the data that it collects from users of its app for some time. Note the prophetic subtitle of the article (written in January 2021), "The information could potentially indicate someone’s sexual orientation without their consent".

From this article in Vice, it seems that the data was anonymized, but records for each user were tagged with a unique user id. So, all records for a particular user are tagged with the same user id, and each record contains the user's location at a particular time. If that's the case, then it doesn't seem too far fetched that someone could easily mine the data to determine whether or not a particular person uses the app, simply by knowing a few locations which that person frequents (such as the person's home, workplace, etc). If there are a large number of records in the data with the same user id and the locations in these records are points where that person is known to frequent, then it's likely that that person uses the app.

With regard to the question as to how the data was obtained: It's possible that the data could have been obtained through an advertising platform called MoPub, that Grindr uses to serve advertisements in its app. See this article by the EFF that explains how MoPub's SDK "gathers as much data as it can about the user’s phone... including phone’s advertising ID, its precise GPS-derived location, and data from Grindr itself, like age and gender". This information is sent back to MoPub, so that MoPub can serve relevant ads to the user. According to MoPub's privacy policy, MoPub also shares the information that it collects with its partners. This page on MoPub's site lists over 100 of these partners. In light of the way that app data is collected, bought, and sold - Pillar's claim that the data was commercially available doesn't seem all that hard to believe.

Your Answer

Benthlin is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.