Texas Police Invested Millions in a Shadowy Phone-Tracking Software. They Won’t Say How They’ve Used It.

3 hours ago 20

Editor’s Note: This story is the third installment in a series produced in partnership with the Pulitzer Center’s AI Accountability Network.

Goliad County police kicked off one human smuggling investigation not with a suspect’s name, but with a discarded receipt and cell phone surveillance software. In June 2021, Chief Deputy Tim Futch chased a speeding F-150 headed toward Houston on U.S. Highway 59; he believed the vehicle was carrying undocumented immigrants, concealed in the truck bed beneath plywood, according to a police report. Trying to evade the cops, the driver pulled into a ditch, and around ten people bailed out and took off sprinting.

In the aftermath, Roy Boyd, the sheriff in this county of 7,000 situated halfway between Laredo and Houston, surveyed the scene. The driver proved hard to identify via the pickup’s plate. But, on the ground, he spotted a fresh receipt from a liquor store in Pasadena, a Houston suburb, he recalled in a June 2024 interview with the Texas Observer.

The stub of paper was enough, Boyd said, to justify deploying an expensive—and controversial—artificial intelligence-powered surveillance tool called Tangles. A specially-trained analyst used the receipt, Boyd said, to conduct warrantless surveillance on the suspected driver—and on other smart phone users—by utilizing a Tangles add-on feature called Webloc, which tracks mobile devices’ movements in a client-selected virtual area through a capability called “geofencing.”

After the bailout incident, Boyd acquired a license for the tool with about $300,000 in state border security grants—though the sheriff admits that he’s not a tech guy: In 2024, he still used a hand-me-down iPhone 10, which hit the market in 2017.

A tall, slim, seventh-generation Texan, Boyd fits the archetype of a small-town Southern sheriff with his firm handshake and light drawl. He usually wears his sand-colored cowboy hat, leather belt, and a matching holster manufactured by prisoners in a neighboring county. The latter encases a silver Colt pistol engraved with “Remember Goliad,” referencing the Mexican army’s massacre of Anglo combatants who lost a battle in which Boyd says his ancestors died.

Boyd worked as a career cop in the neighboring South Texas city of Victoria before being elected sheriff of Goliad County in 2020. He’s since hobnobbed with President Donald Trump at Mar-a-Lago and met repeatedly with border czar Tom Homan, and he leads a multijurisdictional task force named after Operation Lone Star, Governor Greg Abbott’s multi-billion dollar border militarization mission. The task force pools deputies and resources from nearly 60 Texas agencies mainly for anti-smuggling operations. It began with mostly rural departments, but it expanded to include more populous counties, the Texas National Guard, the U.S. Border Patrol, Immigration and Customs Enforcement (ICE), and the Coast Guard. Task force members have spent at least $300,000 on Tangles, and according to emails obtained from Goliad County, many have been granted access to the software, which can track mobile device movements via third-party commercial data.

Tangles scrapes information from the open, deep, and dark webs and is the premier product of Cobwebs Technologies, a cybersecurity company founded in 2014 by three former members of special units in the Israeli military. In 2023, the Nebraska-based tech firm PenLink Ltd acquired the company.

The software has been met with criticism from civil liberties advocates, especially given that its WebLoc add-on enables warrantless device tracking. Normally, when U.S. police officers seek cell phone records or location data, they must obtain a warrant by presenting probable cause of a crime to a judge. In 2018, the U.S. Supreme Court ruled in Carpenter v. United States that warrants are required for obtaining location data from cell phone providers. But the rise of the multi-billion dollar data broker industry has created a free-for-all that enables police and others to purchase massive amounts of cell phone location data without judicial review.

Nathan Wessler, an ACLU attorney who argued the Carpenter case, said data broker-built services like Tangles pose the same privacy issues as those decided in the supreme court case and that law enforcement’s ability to buy location data constitutes an erosion of constitutionally protected rights. “Police are doing an end run around this well-articulated system of judicial oversight by just paying money instead of going to a judge,” he said. “There’s just no checks of police abuse against that.”

In the Goliad County case, a police analyst drew a virtual fence to examine an area that spanned about 300 miles between the Pasadena liquor store and the U.S.-Mexico border based on the day and time stamped on the receipt. He discovered that six phones used within a mile of the store had been tracked again later at a Texas immigration checkpoint, Boyd said. He didn’t specify which checkpoint; the U.S. Border Patrol has over a dozen of them in Texas, some permanent and some temporary.

Boyd rattles off statistics about the success of his task force in tracking gangs, but he provided only the one example involving Tangles and never said whether the information they obtained by geofencing helped lead to any arrest. In response to records requests, the department said it had no reports that mentioned Tangles, despite the fact that Goliad has had the software for more than three years. The corresponding incident report for the case Boyd cited doesn’t mention Tangles, though he said an analyst used the software. It does state that the department collaborated with a Homeland Security Investigations analyst.

Generally, Boyd said his office uses the software to find “avenues for obtaining probable cause” or “to verify reasonable suspicion that you already have”—not as a basis by itself to make arrests.

Beyond Goliad, Tangles has more powerful, deep-pocketed users. The Texas Department of Public Safety (DPS), for example, has invested heavily in the software. DPS spent nearly $200,000 on Tangles in 2021 as an emergency purchase related to Operation Lone Star, and the agency has repeatedly expanded its contract. In 2024, DPS inked a 5-year, $5.3-million contract for 230 named users. ICE’s Office of Intelligence signed a contract worth around $2 million to use the software in 2025, and the DEA in that same timeframe committed more than $10 million.

Boyd and Caleb Breshears, a Goliad County deputy and the task force commander, argued in interviews that Tangles presents no privacy concerns since its location tracking software doesn’t reveal names, only device identification numbers in the online advertising ecosystem. Tangles users cannot search by name or by phone number; its location data is sourced from applications in which consumers consented to sharing their whereabouts, Breshears said.

Nor does Tangles reveal what vehicle is associated with a device, but combined with Texas’ broader arsenal of surveillance tools, which includes a fleet of drones and a network of automated license plate readers, “Those are things that we might be able to piece together,” Boyd said.

PenLink Ltd, Tangles’ present owner, touts its worldwide successes in combating human trafficking, drug smuggling, and money laundering, but the company declined to provide specific examples to the Observer of how the platform has assisted in U.S. cases. “Penlink is proud to provide law enforcement with solutions that keep communities safe, protect people, rescue victims and solve crimes,” company spokesperson Kristine German said in a written statement. “Our technology enables law enforcement to spot threats faster and use evidence more efficiently to advance criminal investigations. The solutions we provide to the government exclusively use commercially available data. We follow industry best practices and comply with all relevant privacy laws, platform policies, and ethical standards.”

In El Salvador, where authoritarian president Nayib Bukele has suspended civil liberties, the national police force purchased Tangles in 2020, according to the investigative outlet El Faro. Just 13 months later, the state’s Bukele-controlled legislative assembly approved criminal code reforms that allowed the judicial use of information obtained via warrantless surveillance by tools like Tangles, clearing the way for the dictator’s state police to legally spy on citizens, El Faro reported. When asked about a repressive regime using its products, PenLink said the company does “not discuss specific customers or contracts.”

PenLink pitches Tangles as an “open source intelligence” software that compiles publicly available information. Yet even Meta, the social media giant that owns Facebook and Instagram and has been denounced for stockpiling too much of its own users data, has accused Cobwebs Technologies, the company that invented Tangles, of operating as a “surveillance-for-hire” outfit; Meta banned Cobwebs Technologies from its platforms in 2021.

In a separate emailed statement, PenLink distanced itself from the Meta ban: “Penlink acquired Cobwebs in 2023, after those issues had been addressed and we are not aware of any issues since.”

But critics find U.S. law enforcement’s growing domestic use of an array of surveillance tools presents major risks to civil liberties by enabling police to build a robust profile of almost anyone’s life and movements without a warrant or probable cause. They find phone-tracking tools like Tangles to be particularly troubling.

“There’s this veneer of respect for privacy that is painted over all of this data aggregation and consolidation,” said Beryl Lipton, a researcher at the Electronic Frontier Foundation (EFF), a California-based nonprofit focused on digital privacy-related civil liberties. Watchdog organizations like the EFF and ACLU have been forced to go to court to discover more information about its use: Last January, PenLink sued a California sheriff’s office in an attempt to prevent the department from releasing public records to EFF that contained details about the company’s products and prices, arguing they were “trade secret-protected information.” EFF intervened in the case and ultimately prevailed. The sheriff’s office handed over the records.

So far, federal and Texas agencies combined have committed to spending at least $8 million dollars specifically for Tangles, according to a year-long Observer investigation. Yet, agencies refuse to say how Tangles has benefitted Texas criminal or immigration probes. Boyd said he couldn’t think of a time that phone-tracking data has been directly linked to any arrest or prosecution in Goliad County, despite his agency’s task force role. “Most of that is probably going to be on the federal side and not so much on the state side,” Boyd said. “I can’t think of any time when [Tangles] has been used for the prosecution of somebody. … It has not been a key component in our cases.”

DPS declined comment on its use of the costly technology. In response to a records request, the agency told the Observer it has no incident reports and only seven confidential internal investigative reports from 2023 and 2024 that mention “Cobwebs” (a shorthand sometimes used to refer to the the software named after the company that created it) or “Tangles,” but it withheld them claiming that releasing the documents could “provide wrong-doers, drug traffickers, terrorists, and other criminals with information concerning how Department operations are planned, implemented and staffed.”

In the last three years, many DPS investigators, police departments including those of major cities such as Dallas and Houston, and nearly twenty Texas sheriff’s offices have obtained a Tangles log-in. The larger agencies have been evasive about how and when they use the tool, declining to provide examples to the Observer.

No agencies contacted for this story provided examples of Tangles’ use in any specific criminal cases. Dallas Police Department spokesperson Corbin Rubinson said only that “Tangles has been in use by the Department for several years and is used consistently in criminal investigations. The WebLoc add-on is used less frequently and produces fewer investigative leads.” A Houston police spokesman said Tangles is used for “crime analysis, for supporting criminal Investigations, and for supporting situational awareness/threat assessments” and that the department does not use the WebLoc add-on that enables warrantless device tracking. Other agencies that purchased it, including the Killeen Police Department and the Montgomery County Sheriff’s Office, did not respond.

Texas agencies’ failure to produce reports on arrests or other results linked to the controversial technology has two possible interpretations, experts say. “Either this is just a massive waste of taxpayer money, right? They’re spending all this money on the tool that they’re not actually using,” said Wessler, the ACLU attorney, “or they’re using it and hiding it from judges, criminal defense attorneys, criminal defendants and the press, which is a big story in itself.”

In April, state Senator Sarah Eckhardt, an Austin Democrat, raised questions during a border security committee hearing about DPS’ investment of $20 million in multi-year contracts for various AI-powered social media monitoring tools like Tangles, following an earlier Observer report on the state police agency’s spending on surveillance tech.

In response, DPS Director Freeman Martin told Eckhardt and other committee members that such software has been critical in preventing mass shootings and said DPS had identified a potential school shooter using the technology.

But when the Observer approached Martin a few days later at a border sheriffs’ conference, he added only a few general observations, saying that the software has helped police save lives and make arrests.

“If I talk about technology now, and we’re asking for funding, some people like it, some people hate it,” he said, clarifying that Tangles in particular was controversial after the Observer asked about the software. “We don’t want to lose those tools,” he said. “We want all the tools. When somebody’s threatening to shoot up the school, we got to find them. We can’t wait till school starts.”

Martin initially promised to speak more about the agency’s successes with Tangles after the legislative session, which ended in June. But he never responded to requests for a follow-up interview made through his secretary and the agency’s communications office, nor did he answer a list of questions sent by the Observer.

Wessler, the ACLU attorney, is skeptical that Tangles has been used to prevent mass casualty events. He said in emergencies police can obtain warrants and send rapid requests to cell phone service providers, who generally can supply more up-to-date and accurate location data than third-party tools. “The claim that this has helped prevent mass shootings is really interesting, and sounds pretty far-fetched to me.”

Breshears, the Goliad County task force leader, explained that the software’s underlying location data are typically days old. That means it does not allow for real-time tracking and is only useful when multiple factors align. “When you say ‘track’, technically it’s correct, but … I’m not tracking you live. I can only see where you have been,” Breshears said. “It’s all historical information.”

Texas law does not explicitly require police to document use of AI-powered surveillance tech, so police reports may not be a reliable indicator of whether Tangles has been used even in investigations that led to arrests. In the 2025 legislative session, Southlake Republican Giovanni Capriglione introduced a bill that would have mandated government agencies using AI to disclose use of these systems to “consumers.” It is unclear how that might have applied to police reports, which under the public information act already can be heavily redacted under certain circumstances, especially if an investigation is ongoing. Legislators ultimately passed an overhauled version of the bill that does not explicitly require police to document or disclose use of AI.

Under due process rules and Texas’ Michael Morton Act, prosecutors must share relevant investigative reports, videos, and other related information to anyone charged with a crime. But the Observer reached out to all 80 federal public defender offices, emailed Texas defense attorneys and Dallas’ district attorney, and interviewed a longtime Houston public defender and a former Goliad-area prosecutor, yet no one provided information about Tangles being mentioned in records disclosed to them while representing a client or charging a defendant in criminal court.

Amrutha Jindal, executive director of Lone Star Defenders, which provides public defenders for migrants prosecuted under Operation Lone Star, said she had never come across any evidence the software had been used in any of the nonprofit’s cases. “Alarms are ringing in my head,” Jindal said in a phone interview. “There’s also a question of—are we even being told?”

The Observer found many examples in police records of how Texas state troopers have surveilled the homes of immigrants or made pre-textual traffic stops to help ICE target and detain people who were not charged with a crime. However, it is unclear whether state police used Tangles or other surveillance tools. The Observer reached out to a network of more than 60 immigration attorneys in Texas and beyond, and none offered examples of how this software may have been used against their clients.

In Washington D.C., the district’s Homeland Security and Emergency Management Agency (HSEMA) has purchased Tangles for several years, though it has not said how it deploys the tool; in August, the ACLU of DC filed a Freedom of Information Act request seeking records.

One of the executives at PenLink, the parent company that sells Tangles, is Derek Maltz, a former DEA agent who participated in Border 911, a political nonprofit, with others who are now homeland security leaders in the Trump administration. He served as PenLink’s executive director of government relations from 2014 to 2025. Throughout that time, the DEA doled out more than $100 million in contracts with PenLink for its various products, according to public federal spending data. Maltz left the company to serve as the DEA’s acting director for five months after Trump’s second inauguration. Last summer, Maltz pivoted back to PenLink, where he became senior vice president of global business growth and strategy. Since Maltz re-joined PenLink last July, the company has garnered about $3.4 million more in federal contracts.

In a written statement, a PenLink spokesperson said: “Derek Maltz is a veteran national security and law enforcement leader who brings 28 years of federal law enforcement experience to his role at Penlink. His appointment as Acting Administrator speaks to his expertise in this field, and we are pleased to welcome him back to Penlink. We are compliant with Federal Post-Employment Restrictions.” Maltz did not respond to a request for comment.

Paromita Shah, an attorney and co-founder of Just Futures Law, a legal advocacy group focused on the intersection of immigration and surveillance issues, said Maltz’s case illustrates a well-established revolving door between tech companies and the federal government. “As much as these guys complain about the swamp, they certainly benefit from it,” Shah said.

Local agencies from New York to California have also bought Tangles. In Arizona, the Pinal County Sheriff’s Office—a populous county about halfway between Phoenix and Tucson—paid more than $90,000 in 2022 and 2023 to use the platform. In an email, Pinal County Sheriff’s Office spokesperson Sam Salzwedel noted that deputies have deployed Tangles for a “variety of investigations, large and small,” but declined to share any success stories, citing law enforcement sensitivity. Salzwedel said that WebLoc, the warrantless phone tracking feature, appeared to be used sparingly.

“I have not surveyed our handful of users, but one of our analysts just told me he has only used it a few times,” Salzwedel wrote in an email. “No warrant was obtained.”

A reimbursement request released by the Electronic Frontier Foundation, the privacy-focused nonprofit, and first reported by the Arizona Mirror, offers a few anecdotes about how Tucson police have used Tangles: To surveil protesters during one of former Vice President Kamala Harris’s visits to the state and to track and identify a suspect accused in a string of Circle K cigarette robberies. Tucson police also apparently used Tangles in an attempt to find the culprit behind an attempted abduction of a young woman, but without success.

Even police who possess Tangles, like Boyd, warn of its potential for abuse. He says his department seldom deploys it for fear of violating constitutional privacy rights—and that despite leading a police task force, the sheriff is skeptical of cops collecting too much sensitive information.

“Do you really want all your stuff in a database where any law enforcement official can go in and just find out what you’ve got going on, or where you’ve been going on any given day?” he said. “I just don’t think that the government needs a catch-all where they can obtain whatever information they want on you at a moment’s notice.”

The post Texas Police Invested Millions in a Shadowy Phone-Tracking Software. They Won’t Say How They’ve Used It. appeared first on The Texas Observer.

Read Entire Article