Yesterday, Msgr. Jeffrey Burrill of the U.S Council of Catholic Bishops resigned because an investigation by Pillar, a Catholic newsletter, alleged that he had used Grindr to find hookups. Fairly standard stuff, but the truly perplexing part was the investigation method:
According to commercially available records of app signal data obtained by The Pillar,
a mobile device correlated to Burrill emitted app data signals from the location-based
hookup app Grindr on a near-daily basis during parts of 2018, 2019, and 2020 — at both
his USCCB office and his USCCB-owned residence, as well as during USCCB meetings and
events in other cities.
To me, this scenario sounds extremely unlikely. An article in the Washington Post cites a few experts who say that they don't know of any other cases where commercially available advertiser data was deanonymized succesfully. A Grindr spokesperson rejects the possibility, stating that 'the alleged activities listed in that unattributed blog post are infeasible from a technical standpoint and incredibly unlikely to occur'.
I can think of a number of possible scenarios:
- The folks from Pillar (who are pretty conservative) found Burrill's account manually, but don't want to admit they used Grindr themselves. This seems unlikely, because it wouldn't explain the source of a lot of other information contained in the article.
- The data was obtained through a Grindr data breach. I don't know of any, so this seems unlikely.
- Pillar was somehow able to extract advertising ID's from Burrill's device, which would have given the proverbial needle a bright red color and flashing lights. This seems possible, but I don't know how difficult this is (e.g. would this require Pillar to have breached his phone).
- The data was procured illegally in another way. This article called to mind the investigation by Bellingcat that was able to track Navalny's killers using hacked geolocation data available on Telegram. Could something similar have happened here?
Is the story put forth by Pillar in any way feasible? If so, how could they have obtained this data?