TL;DR
Documents obtained by reporters show ICE contracted Penlink tools that can search for and follow mobile phones across neighborhoods using commercial location data. The briefing also covers an Iranian internet blackout amid mass protests, the extradition of an alleged scam operator to China, and reports of Chinese hackers compromising congressional staff email accounts.
What happened
Materials obtained by 404 Media and reported in mainstream outlets detail a September contract between US Immigration and Customs Enforcement and Penlink, a commercial vendor whose platforms Tangles and Webloc can aggregate social-media and location data to detect and follow mobile devices across city blocks and neighborhoods. Penlink augments its capabilities by purchasing large sets of commercial location data, enabling longitudinal tracking that can reveal places people live, work, and visit. Civil liberties advocates warned the combination of granular location data and law-enforcement access raises privacy concerns. Separately, Iran implemented a nationwide internet shutdown amid large-scale protests, leaving citizens without connectivity for more than 24 hours as of January 9. Other items in the roundup include the extradition of Cambodian national Chen Zhi to China after sanctions tied to alleged scam compounds, reported breaches of congressional staff email accounts by the Salt Typhoon actor, and ongoing concerns about an AI chatbot generating sexualized imagery.
Why it matters
- Access to large commercial location datasets plus tools to query them can produce detailed movement and association profiles of ordinary people.
- Granular, longitudinal location tracking raises civil-liberties and surveillance-abuse risks when available to immigration and law-enforcement agencies.
- Internet blackouts, like the one in Iran, disrupt communication, financial services, and the ability of protesters to organize or share evidence of abuses.
- State-backed hacking campaigns against legislative staff can expose internal deliberations and weaken institutional security.
- AI image-generation tools that produce explicit or abusive content are prompting questions about platform responsibility and app-store enforcement.
Key facts
- ICE contracted Penlink in September for access to surveillance platforms Tangles and Webloc, according to obtained materials.
- Tangles and Webloc can be used to monitor neighborhoods or city blocks for mobile phones and to track devices over time.
- Penlink supplements its tools by buying large volumes of commercial location data to expand monitoring capabilities.
- The ACLU’s Nathan Freed Wessler characterized the capability as able to paint a granular picture of people's movements and associations.
- Iran imposed a full internet blackout amid mass protests; as of January 9, connectivity had been down for more than 24 hours.
- Iran has enacted nationwide internet shutdowns in prior years, including in 2025, 2022, and 2019, according to the report.
- Cambodian national Chen Zhi was extradited to China after earlier US and UK sanctions alleged a $15 billion fraud operation tied to scam compounds.
- Security researchers reported that the Chinese state-linked group Salt Typhoon compromised email accounts of staffers across several US House committees.
- An AI chatbot from xAI, known as Grok, has been reported to generate graphic sexual content and apparent depictions of minors; platforms have taken partial access steps.
What to watch next
- Whether any legal challenges, congressional oversight, or policy changes will restrict ICE’s use of Penlink tools — not confirmed in the source.
- If Apple, Google, or other platform operators will change app-store availability or enforcement related to AI services producing explicit imagery — not confirmed in the source.
- How long Iran’s nationwide internet blackout continues and what additional measures Iranian authorities take in response to protests — not confirmed in the source.
Quick glossary
- Commercial location data: Location information collected and sold by companies that aggregate signals from apps, beacons, and other sources to infer where devices and people have been.
- Device tracking: Techniques that associate a device’s identifiers or location signals over time to map movement patterns and frequent locations.
- Internet blackout: A deliberate shutdown or severe restriction of internet access within a country or region, often implemented by authorities to impede communication.
- Extradition: The legal process by which one country hands over a person to another country to face criminal charges or prosecution.
- State-backed hacker group: A cyber threat actor that operates with support, direction, or significant resources from a national government to pursue espionage or disruption.
Reader FAQ
Can ICE use these tools to track any phone?
The reported materials say ICE contracted Penlink platforms that can detect and track mobile devices in neighborhoods using commercial location data; practical limits and legal constraints are not detailed in the source.
Why did Iran shut down the internet?
The source reports Iran imposed an internet blackout amid mass protests and potential crackdowns, with connectivity down for more than 24 hours as of January 9.
Was Chen Zhi charged in China after extradition?
The report says Chen Zhi was extradited to China and shown being escorted off a plane, but it is not immediately clear what charges, if any, he faces in China — not confirmed in the source.
Will platforms remove AI tools that generate explicit images?
Researchers and activists have questioned app-store availability; the source notes some steps limiting access but does not confirm removals by Apple or Google — not confirmed in the source.
LILY HAY NEWMAN SECURITY JAN 10, 2026 6:30 AM Security News This Week: ICE Can Now Spy on Every Phone in Your Neighborhood Plus: Iran shuts down its internet amid…
Sources
- Security News This Week: ICE Can Now Spy on Every Phone in Your Neighborhood
- Immigration agents have new technology to identify and …
- How Hackers Are Fighting Back Against ICE
- ICE amps up its surveillance powers, targeting immigrants …
Related posts
- UK government excludes itself from flagship cyber law, raising doubts
- USDA suspends federal financial awards to Minnesota and Minneapolis amid review
- CDC staff ‘blindsided’ as federal child vaccine schedule is unilaterally changed