What does surveillance capitalism look like?

The problem with reading too much about modern surveillance and technology is that inevitably, without meaning to, you start building a crazy wall in your mind. Your mental corkboard becomes plastered with torn-out news clippings and blurry surveillance photos, post-it notes scrawled with “WHO’S REALLY IN CHARGE?”, all criss-crossed with a spider web of red string, leading you ever-more improbable connections.

Soon you have an impossibly dense map of world governments, tech firms, billionaires, and special interests. You become increasingly paranoid and depressed about the state of the world, and increasingly overwhelmed by the complexity of it all.

So today, instead of trying to look at the whole wall at once, we’re going to narrow in, tracing just one path along the red string. We’ll figure out where it leads, and then we’ll follow it backwards, seeing how it got there and what it can tell us about the vast web that is the modern surveillance-industrial complex.

ICE has been stepping up their attacks on American communities, targeting especially (but not exclusively) migrants and visible minorities. The force has expanded rapidly under the country’s new regime, with an annual budget of $28.7 billion, which would make it the 14th largest military in the world, right between Ukraine and Israel.

As a thoroughly modern military, much of ICE’s focus is on technology and surveillance. And, as a thoroughly modern military, ICE outsources much of that work to private contractors. In September 2025 alone, ICE took out $1.4 billion in new contracts with private surveillance technology firms.

There’s good work by both the Electronic Frontier Foundation and 404Media, attempting to catalogue all the different contracts and what they allow ICE to do. A sample:

• ONYX by Fivecast (a $4.2 million contract): social media tracker

• Graphite by Paragon ($2 million): mobile spyware

• Graykey by Magnet Forensics ($3 million): mobile device unlocker

• Cellebrite ($11 million): mobile device unlocker and data downloader

• Clearview AI ($10 million): facial recognition

• Vigilant Solutions by Thomson Reuters ($6 million): license plate tracker

• ImmigrationOS by Palantir ($30 million): pulls together data from government databases to build profiles on people

Uh oh, we’re getting lost in the red strings again.

Focus in.

Today I want to talk about one specific tool, called Webloc, made by PenLink. ICE bought in as part of that September 2025 spending spree, with a $5 million contract, covering both Webloc and Tangled, another PenLink tool for monitoring social media.

Webloc is a cell phone tracking tool. Companies like PenLink don’t advertise a lot in public, but 404Media found a Portuguese-language marketing document (gotta love investigative journalists!), which shows its handy visual display:

Webloc allows users to create a list of mobile devices that were in a specific location, at a specific point in time. Users can also choose a specific device, and Webloc will build a historical map of everywhere that phone (and therefore that person) has been. PenLink offers helpful suggestions, like tracking where the target device spends most of its nights to figure out the person’s home address, or looking at where it goes during the day to figure out the person’s place of work.

It’s not hard to imagine how this tool could be used to track and harass migrant workers… or indeed protesters and political enemies. Police have already used similar phone-based geo-tracking to find out who attended Black Lives Matter protests, and ICE director Todd Lyons has stated that ICE is “dedicated to the mission of going after” antifa and other left-wing organizations.

Again, the company is cagey about its methods, but based on 404Media’s investigations, it appears that Webloc isn’t hacking phones or tapping surveillance, but instead is using data that’s already out there, thanks to internet ad networks.

On the internet, ads typically aren’t sold the way they are in the regular world, where an advertiser would pick a space (say, page 13 of a magazine) and then be told how much it costs. Instead, any time an internet ad space becomes available (say, by you clicking on a webpage where an ad should appear), it triggers an automatic, instantaneous auction. In real time, advertisers submit bids for how much they’re willing to pay for the ad space, and whoever wins get the space. This is called real-time bidding, or RTB.

For RTB to proceed, advertisers have to know what, exactly, they’re buying. After all, much of the value of online advertising is the ability to micro-target an ad, based on the user’s personal data. And so, the auction announcement includes relevant information: in addition to the target’s ad ID (a unique identifier tied to the user’s mobile device), it lists certain targeting information, including their physical location. (You don’t want your ad for auto repair in Des Moines showing to a poet in Minneapolis, do you?)

All of this happens in the blink of an eye, using automated systems, but theoretically, if a company were to submit themselves as an ad bidder, they could monitor the auction announcements, keep track of all those ad IDs and physical locations, and build a database of each device and its full location history.

Let’s follow another red string, leading back to a particularly well-worn pin, because the RTB system was pioneered by our old friends at Google, and Google remains the largest online ad company in the world. However, I can’t definitively tie Google to Webloc, because online advertising is now a whole industry, with its own network of sellers, resellers, brokers, and go-betweens. 404Media notes that a lot of ad-based tracking happens via ads within popular mobile apps, meaning this particular corkboard needs pins for the likes of Tinder, Candy Crush, and MyFitnessPal.

There’s been a lot of discussion of surveillance capitalism over the past few years – I may have even used the term once or twice in these pages – but I think Webloc is the first time I really understood it. It isn’t just about new companies popping up with shiny new surveillance tools to hawk, but about a whole nascent industry supported by a brand-new commodity: data.

It’s not like data didn’t exist before the internet, but extracting and refining it was a time-consuming and labour-intensive process, requiring things like getting a warrant to tap a phone line or physically following someone around and taking notes on their activities. The invention of computers gave a huge boost to the ability to refine and analyse that data, with databases high-powered mathematical algorithms, but drilling for raw data remained a problem.

But now, it’s the dawn of the internet, and suddenly data just starts burbling up to the surface.

A company like Google defines itself as “data-first” from its earliest days. They realise they can track every single search, and every single click that follows. They use that data to improve their search algorithm… but it’s not enough. The data is flowing now, thick and fast, any time anyone uses the internet, and it’s only a matter of time before someone finds a way to turn it into money.

Advertising is the first solution. Advertisers can’t believe the bounty of data that users are just willingly (or unsuspectingly) giving up, and all the new opportunities it creates to sell to them. Online advertising becomes a $500-billion-a-year industry (and takes down a lot of traditional media along with it, since they can’t possibly compete with all this data), but it’s not enough.

The data is a torrent now, an unending, gushing waterfall, covering every single person on earth, guilty or innocent. People carry phones now, that track their location and send a full report of all their activities back to Big Tech HQ. They join social media and spend whole days voluntarily posting their personal data to the internet for everyone to see, and where that’s not enough, the metadata of how they’re posting and when and from where is yet another bonanza. Now they’re installing cameras on their doorbells, buying always-online smart refrigerators, tracking their menstrual cycles in apps, and holding all their most private conversations in spaces where Meta and Google are always listening.

There’s a glut of cheap data invading the market. It’s a commodity now, and it’s inevitable that companies will find new ways to repackage and resell it. Thankfully, there’s 9/11, and the new and terrified America is in need of a new fuel. In their anti-terrorism fervour, the country lifts basically all restrictions on data extraction and refinement, either formally or… beside the law. Well-funded terrorism-fighting intelligence agencies and increasingly-militaristic domestic police forces keep the data burning, ever hotter and brighter.

From there, it only takes the tiniest shift in intent, for all that data to become a primary fuel for a new fascism.

What I’m saying is that I can’t blame Google for ICE surveillance (as much as that would help the theme of this newsletter), but I can point to a self-replicating, rapidly accelerating system that benefits both Google and ICE, and that both Google and ICE (among many, many others) help to perpetuate.

For those who don’t care about ad tracking because they don’t care about being advertised to, or because they think they have nothing to hide from Google, this is what it leads to. The data is flowing, the fires of surveillance capitalism are burning, and we have yet to see how much they engulf.