New: we've obtained a large dataset of the precise movements of people using a Muslim prayer app. People near mosques. Source was concerned this data could be abused. Company selling this data linked to supply chain to U.S. contractor which works with ICE

We previously reported how Muslim Pro sold data to X-Mode which sold to U.S. military contractors. Now, through a leaked dataset and independent analysis, we've found another highly popular Muslim app called Salaat First also sold granular location data https://t.co/y9iJHoDuQe
This leaked dataset of precise locations of Muslims shows not only the continued use of religious apps to harvest and sell location data without informed consent, but also just how easily this data is being traded in the location industry. https://t.co/y9iJHoDuQe
The leaked location data we got from a source isn't just for the Muslim prayer app Salaat First, but also for other apps selling data to Predicio. Because it had their advertising ID, let me filter down and follow specific Muslim app users https://t.co/y9iJHoDuQe
As for how we know the prayer app Salaat First with 10 million users was selling location data:
- leaked data of actual GPS coords included data marked as Salaat First
- my own analysis of apps that use Predicio SDK includes Salaat
- the dev confirmed it https://t.co/y9iJHoDuQe
I spoke to a Salaat First user and told them about the location data selling. Unsurprisingly, because the app is not clear about the issue, this user had no idea the app was selling their granular location data https://t.co/y9iJHoDuQe
Before receiving the leaked data, we were already making a list of apps that contained the Predicio SDK. We did this by searching them for the string sdk[.]predic[.]io, and then verifying one by one. This helped confirm leaked data https://t.co/y9iJHolTYG
Another app included in both the leaked location data and our own analysis of apps is Weawow, a weather app. App was selling some location data to Predicio (this was off by default, however) https://t.co/y9iJHoDuQe
Through the app analysis and by finding some (now deleted) documentation online, Predicio's SDK is called Telescope. The doc claimed it could also harvest hashed emails. https://t.co/y9iJHoDuQe
After Motherboard and NRK reported how app data gets sent to ICE contractor Venntel, and Motherboard reported how X-Mode sells Muslim location data to military, Predicio added this to their website. Failed to say they were collecting info from a Muslim app https://t.co/y9iJHoDuQe
Council on American-Islamic Relations said "In light of these latest revelations, the owners of all major Muslim applications should thoroughly investigate how their companies handle user data" https://t.co/y9iJHoDuQe
Activist group Foxglove, which previously threatened legal action against prayer app Muslim Pro, says that companies who do this could end up facing a lawsuit https://t.co/y9iJHoDuQe
Google said apps selling personal/sensitive data (including location data) is against Google's terms. That's quite big—Google confirming publicly that a lot of these location data companies shouldn't be on the Play Store at all. But they haven't enforced https://t.co/y9iJHoDuQe
Multiple app devs wouldn't tell us how much Predicio paid them for users' location data. But regardless, we've confirmed Predicio pays the devs for the data. That is against Google's policies. If Google does enforce, it could remove all Predicio apps, like it did with X-Mode
And with that in mind, Senator Wyden says Apple and Google need to take action on the location data industry as a whole, not bit by bit https://t.co/y9iJHoDuQe

You May Also Like

The entire discussion around Facebook’s disclosures of what happened in 2016 is very frustrating. No exec stopped any investigations, but there were a lot of heated discussions about what to publish and when.


In the spring and summer of 2016, as reported by the Times, activity we traced to GRU was reported to the FBI. This was the standard model of interaction companies used for nation-state attacks against likely US targeted.

In the Spring of 2017, after a deep dive into the Fake News phenomena, the security team wanted to publish an update that covered what we had learned. At this point, we didn’t have any advertising content or the big IRA cluster, but we did know about the GRU model.

This report when through dozens of edits as different equities were represented. I did not have any meetings with Sheryl on the paper, but I can’t speak to whether she was in the loop with my higher-ups.

In the end, the difficult question of attribution was settled by us pointing to the DNI report instead of saying Russia or GRU directly. In my pre-briefs with members of Congress, I made it clear that we believed this action was GRU.
@franciscodeasis https://t.co/OuQaBRFPu7
Unfortunately the "This work includes the identification of viral sequences in bat samples, and has resulted in the isolation of three bat SARS-related coronaviruses that are now used as reagents to test therapeutics and vaccines." were BEFORE the


chimeric infectious clone grants were there.https://t.co/DAArwFkz6v is in 2017, Rs4231.
https://t.co/UgXygDjYbW is in 2016, RsSHC014 and RsWIV16.
https://t.co/krO69CsJ94 is in 2013, RsWIV1. notice that this is before the beginning of the project

starting in 2016. Also remember that they told about only 3 isolates/live viruses. RsSHC014 is a live infectious clone that is just as alive as those other "Isolates".

P.D. somehow is able to use funds that he have yet recieved yet, and send results and sequences from late 2019 back in time into 2015,2013 and 2016!

https://t.co/4wC7k1Lh54 Ref 3: Why ALL your pangolin samples were PCR negative? to avoid deep sequencing and accidentally reveal Paguma Larvata and Oryctolagus Cuniculus?