US government contractor Anomaly Six collects and sells location data from hundreds of millions of phones globally via an SDK that is embedded in 500+ apps
Byron Tau / Wall Street Journal :
Context & Ripple Effects
This 2020 Wall Street Journal report is the origin point of the Anomaly Six story arc: a government contractor harvesting location data at scale not through its own apps but through an SDK embedded in hundreds of third-party apps, turning ordinary consumer downloads into a global tracking feed. Later coverage filled in what that feed was used for — the paper's own follow-up examined how geolocation harvested from common apps endangers US intelligence officers and military personnel (risk to US intelligence and military phones), and The Markup mapped the collectors, aggregators, and marketplaces that monetize this data into a $12B industry ($12B location data industry).
First-order effects
- App developers who embedded the SDK unknowingly became suppliers to a government contractor, exposing their users' movements to sale without any direct relationship between Anomaly Six and the tracked individuals.
Second-order effects
- Government agencies buying this data get intelligence capability without surveillance warrants, but the same feed cuts both ways: as the later leaked sales pitch demoing tracking of CIA and NSA staff showed, adversaries or auditors can trace agency personnel through identical commercial data.
Third-order effects
- If the pattern holds, the structural fix moves upstream from data brokers to the SDK itself — platform-level restrictions on location access by third-party libraries and procurement rules governing commercially purchased geolocation, reshaping how the entire aggregation marketplace operates.
The trend: Commercially harvested phone-location data is collapsing the boundary between consumer analytics and government surveillance, with SDKs as the quiet collection layer.