Leaked sales pitch: Anomaly Six, a US government contractor that claims it can track ~3B phones, demonstrated its capabilities by tracking CIA and NSA personnel
In partnership with — In the months leading up to Russia's invasion of Ukraine, two obscure American startups met to discuss …
Context & Ripple Effects
Anomaly Six has been building this capability quietly for years: a 2020 Wall Street Journal report detailed how its SDK embedded in 500+ apps lets it collect and sell location data from hundreds of millions of phones worldwide. The new leak shows what that infrastructure was being sold as — a sales demo that tracked CIA and NSA personnel themselves, pitched to buyers ahead of Russia's invasion of Ukraine.
The leak lands in a familiar lineage. Palantir's leaked documents showed intelligence-agency staffers helping shape commercial analysis tools that became integral to NSA and GCHQ; now the arrow points the other way, with a contractor demonstrating it can surveil the agencies it sells to.
First-order effects
- CIA and NSA face an immediate counterintelligence problem: their own personnel's movements were used as a sales demo, meaning any buyer of Anomaly Six data — foreign or domestic — could potentially do the same.
- Anomaly Six's government business is at risk, since the leak exposes both the scale of its ~3B-phone claim and its willingness to demonstrate against US intelligence staff to win contracts.
Second-order effects
- The commercial location-data supply chain — app SDKs feeding brokers who sell to governments — comes under scrutiny, pressuring app developers embedding such SDKs and pushing agencies toward stricter vendor vetting.
- Rival surveillance vendors face the same exposure risk: as the Tracer case showed with a US tool resold by Moscow-based OpenGSM, capabilities built for one customer migrate to others, forcing buyers to assume anything purchasable is purchasable by adversaries.
Third-order effects
- If commercially sourced location data keeps proving powerful enough to track intelligence personnel, the line between government surveillance and the open market blurs structurally — regulation of data brokers becomes a national-security issue rather than a privacy one.
- Intelligence agencies may respond by treating commercial geolocation vendors as both suppliers and threats, hardening operational security around staff devices and reshaping procurement toward audited, sovereign pipelines.
The trend: Commercially collected phone-location data is maturing into a strategic commodity that contractors can aim at anyone — including the intelligence agencies themselves — outpacing the rules governing who may buy it.