Webloc and ad-based surveillance: How everyday app data fuels a global intelligence effort. 

Detected Manipulations & Suggested Changes

Biased language

Use of emotionally loaded or value-laden wording that nudges the reader toward a particular judgment.

Examples: - "This way ads become a kind of hidden Trojan horse for your data. Not just for advertisers, but for governments and surveillance vendors. That’s what turns this system from a nuisance into a real privacy and security threat." - "stretching its tentacles into at least 20 countries" - "Given these associations, it’s perhaps no surprise that Penlink’s broader work continues to be rooted in controversial data collection and surveillance practices." - "the temptation to surveil is too big" / "where things start to go south" / "it’s almost inevitable that even if a system is introduced with a narrow justification, it will become a general-purpose surveillance tool, leading to the creation of a society where surveillance is easy, constant, and increasingly normalized." These phrases go beyond neutral description and frame the actors and systems in a strongly negative, sometimes metaphorical way, which can bias readers’ perceptions.

5 suggestions

Replace metaphors like "hidden Trojan horse" with neutral descriptions, e.g., "This means advertising systems can also be used to collect and repurpose user data for non-advertising purposes, including by governments and surveillance vendors."

Change "stretching its tentacles into at least 20 countries" to a neutral phrase such as "operating in or affecting at least 20 countries."

Instead of "Given these associations, it’s perhaps no surprise that Penlink’s broader work continues to be rooted in controversial data collection and surveillance practices," use: "Given these associations, Penlink’s work has been linked to data collection and surveillance practices that some observers and civil society groups describe as controversial."

Replace "where things start to go south" with a more neutral formulation like "where risks of overuse and misuse increase."

Change "it’s almost inevitable" and "a society where surveillance is easy, constant, and increasingly normalized" to a more cautious, evidence-based statement such as: "There is a significant risk that such systems, once deployed, will be used more broadly than originally intended, contributing to more pervasive surveillance if not tightly regulated."

Appeal to emotion

Using emotionally charged framing to provoke fear or anxiety rather than relying solely on evidence and reasoning.

Examples: - "This way ads become a kind of hidden Trojan horse for your data... That’s what turns this system from a nuisance into a real privacy and security threat." - "Bottom line, it’s almost inevitable that even if a system is introduced with a narrow justification, it will become a general-purpose surveillance tool, leading to the creation of a society where surveillance is easy, constant, and increasingly normalized." - "the temptation to surveil is too big" and references to "vigilantism" in the Skull Games example without quantifying actual harms or oversight mechanisms. These passages emphasize fear of a dystopian surveillance society and moral alarm more than they present quantified risk, counterexamples, or legal safeguards.

4 suggestions

Explicitly separate evidence from interpretation, e.g., "These capabilities raise concerns among privacy advocates that such systems could contribute to more pervasive surveillance if not subject to strict legal and technical safeguards."

Avoid deterministic language like "almost inevitable" and instead use conditional phrasing: "There is a risk that..." or "Without strong oversight, such tools may be used..."

When describing Skull Games, add concrete details about safeguards or lack thereof, and attribute concerns: "Critics argue that this blurs the line between formal investigations and private initiatives, potentially increasing the risk of misuse."

Balance descriptions of risks with brief mention of intended benefits and existing oversight mechanisms, while still critically assessing their adequacy.

Unsubstantiated claims

Claims presented as fact or near-certainty without sufficient evidence or clear attribution.

Key examples: - "Even that is likely just the tip of the iceberg." (about the number of countries using Webloc) - "So the real scale of the system’s deployment might be even bigger." (speculative, not quantified) - "Bottom line, it’s almost inevitable that even if a system is introduced with a narrow justification, it will become a general-purpose surveillance tool..." (strong inevitability claim without systematic evidence) - "The uncomfortable but undeniable fact is that this surveillance system is built on the normal plumbing of the internet." ("undeniable" overstates consensus; some may dispute the framing or scope) These statements go beyond what is directly supported by the cited documents and are not clearly marked as opinion or hypothesis.

4 suggestions

Qualify speculative language: change "likely just the tip of the iceberg" to "may represent only a subset of deployments, given that some agencies declined to answer questions."

Replace "the real scale of the system’s deployment might be even bigger" with a more precise, sourced statement, e.g., "Because some agencies did not respond and server infrastructure appears in additional countries, the total number of deployments is uncertain and could be higher than confirmed cases."

Change "it’s almost inevitable" to "there is a documented pattern in some jurisdictions of surveillance tools being used beyond their original stated purpose (mission creep)."

Replace "undeniable fact" with "According to the report and other research, these surveillance practices often rely on the same technical infrastructure used for online advertising."

Oversimplification

Reducing a complex situation to a simple narrative that omits important nuances or conditions.

Examples: - "Bottom line, it’s almost inevitable that even if a system is introduced with a narrow justification, it will become a general-purpose surveillance tool..." This implies a uniform trajectory across jurisdictions and ignores cases where strong oversight or legal constraints may limit mission creep. - "What makes systems like Webloc hard to pin down is that they don’t technically operate outside the law. Instead, they operate inside it, or rather at the edges of it — in a gray zone." This compresses diverse legal contexts (EU, US, other countries) into a single "gray zone" narrative without distinguishing where practices may be clearly unlawful, clearly lawful, or contested. - The article presents law enforcement’s stated goals (e.g., trafficking, terrorism) briefly, but does not explore any evidence of successful or proportionate use, or internal controls, which simplifies the picture to primarily abuse and mission creep.

3 suggestions

Acknowledge variation across legal systems: "In many jurisdictions, these systems operate in legal gray areas, where existing laws did not anticipate this kind of data use. In others, regulators have begun to take enforcement actions."

Replace deterministic language about inevitability with conditional statements and examples: "Past investigations in places like Tucson show that such tools have sometimes been used for relatively minor crimes, a pattern privacy advocates describe as mission creep."

Add a brief note on potential legitimate uses and oversight: "Law enforcement agencies argue that these tools can help in cases such as trafficking or terrorism, though independent evaluations of effectiveness and proportionality are limited or not publicly available."

Unbalanced reporting

Presenting one side’s perspective in detail while giving limited or weaker representation to the other side.

The article: - Extensively details Citizen Lab’s findings, examples of misuse, and privacy risks. - Briefly mentions Penlink’s position (that it obtains data with consent, filters sensitive locations, and only uses location data) but then immediately undercuts it with phrases like "even if we take Penlink’s claims at face value" and "calling it 'just location' is misleading" without exploring Penlink’s full arguments, any compliance programs, or independent audits. - Mentions intended purposes (trafficking, terrorism, missing persons) only to contrast them with examples of mission creep, without presenting any data on successful or proportionate uses, or law enforcement’s perspective on safeguards. - Does not include any direct quotes from Penlink, Cobwebs, or law enforcement beyond a single paraphrased statement, nor any external legal or technical experts who might provide a more neutral assessment. This creates a strong tilt toward the privacy-advocacy perspective.

4 suggestions

Include more detailed, direct quotations or summarized arguments from Penlink and relevant agencies about their safeguards, legal justifications, and internal controls, clearly labeled as their perspective.

Explicitly note where information is unavailable: "Penlink did not provide detailed information on independent audits or oversight mechanisms, so we cannot assess how effectively its stated safeguards are implemented."

Add a short section summarizing law enforcement’s rationale for using such tools and any public oversight mechanisms (e.g., warrants, internal policies, court approvals), while still critically evaluating their sufficiency.

Clarify that the article focuses on risks and documented abuses rather than providing a comprehensive cost-benefit analysis of such systems.

Selective use of sources / Cherry-picking data

Highlighting evidence that supports one narrative while omitting or minimizing potentially relevant counter-evidence or context.

The article relies heavily on: - Citizen Lab’s report and selected examples (e.g., Tucson, Skull Games, Abu Dhabi device) that illustrate risk and misuse. - A single academic experiment showing that bidstream data can track a device. It does not mention: - Any independent evaluations of Webloc’s or Tangles’ effectiveness in serious crime investigations (if any exist), or explicitly state that such data is unavailable. - Any regulatory or judicial decisions that might have upheld or constrained such tools. - Any technical or policy measures Penlink or agencies may have implemented to mitigate abuse, beyond the brief mention of consent and filtering. This selection pattern emphasizes negative outcomes and risks without clarifying whether the evidence base is complete or partial.

4 suggestions

Explicitly state the limits of available evidence: "Public information about Webloc’s effectiveness in serious crime investigations or about independent oversight is scarce; most available documentation comes from leaked or procurement documents and civil society research."

If available, reference any regulatory decisions, court cases, or official reviews that have examined similar tools, even if they do not fully support the article’s concerns.

Clarify that the examples (Tucson, Skull Games, Abu Dhabi device) are illustrative case studies rather than statistically representative of all uses.

Where no counter-evidence is available, say so transparently instead of implying that none exists.

Confirmation bias / Narrative fallacy

Arranging facts into a coherent story that strongly supports a pre-existing narrative (surveillance capitalism leading to inevitable abuse) and interpreting ambiguous information in line with that narrative.

The article builds a narrative arc: ad-tech data flows → Webloc → global surveillance → mission creep → normalized surveillance society. Within this frame: - Ambiguous or partial evidence (e.g., server infrastructure in "dozens more" countries, agencies refusing to answer) is interpreted as supporting a larger, more pervasive deployment. - The Skull Games example is used to illustrate a slide into vigilantism, though the article notes that access was mediated by a company representative; it does not explore whether any concrete harms occurred or what controls were in place. - The conclusion that surveillance will become "easy, constant, and increasingly normalized" extrapolates from limited case studies to a broad societal prediction. This creates a compelling story but may overstate certainty and generality.

4 suggestions

Explicitly distinguish between documented facts, plausible inferences, and speculative projections, labeling each clearly.

Avoid using isolated examples as proof of a general trend; instead, present them as case studies and note the lack of comprehensive data.

Add a sentence acknowledging uncertainty: "While these examples raise serious concerns, there is limited public data on how widespread such practices are across all jurisdictions using similar tools."

Rephrase broad predictions about a "normalized" surveillance society as conditional scenarios: "If such tools continue to expand without stronger regulation and oversight, they could contribute to more normalized and pervasive surveillance."

Conflict of interest / Implicit promotion (related to authority bias & social proof)

Embedding promotional content for a specific product or company within an ostensibly neutral explanatory article, which can leverage perceived authority and social proof.

The article introduces a specific product and brand: - "Tools like AdGuard can help reduce exposure by blocking tracking requests, and cutting down RTB-style data flows at the browser and network level. On mobile it’s more restricted due to operating system limits, but partial protection is still possible, especially with DNS filtering and system-wide blocking features." This is: - A concrete recommendation of a named commercial product, not a generic category ("ad blockers" or "privacy tools"). - Not clearly labeled as sponsored content, an advertisement, or an editorial recommendation. - Not balanced by mentioning alternative tools or independent evaluations. This creates a bias toward AdGuard and may exploit readers’ trust in the article’s investigative tone to promote a specific solution.

4 suggestions

Either remove the specific brand reference or broaden it to a neutral category, e.g., "Ad-blocking and tracking-protection tools can help reduce exposure..."

If the article is produced by or affiliated with AdGuard, clearly disclose this at the beginning and label the recommendation as coming from an interested party.

If keeping the brand mention, add that other tools with similar functionality exist and encourage readers to compare options based on independent reviews.

Separate investigative/explanatory content from product promotion with clear headings or disclaimers so readers can distinguish analysis from marketing.

Framing effect

Presenting information in a way that emphasizes certain aspects (risks, abuses) and downplays others (intended uses, oversight), influencing interpretation.

Throughout the article: - The framing is consistently that ad-tech data flows are a "Trojan horse" and that surveillance vendors and law enforcement are primarily vectors of abuse and mission creep. - Intended benefits (e.g., combating trafficking, terrorism, missing persons) are mentioned only briefly and mainly as a foil to highlight misuse. - Legal frameworks (GDPR, FTC actions) are framed as struggling or insufficient, with little exploration of where they have been effective. This framing steers readers toward viewing the ecosystem almost exclusively as a threat, rather than as a contested space with both risks and claimed benefits.

4 suggestions

Add a short, clearly labeled section summarizing the stated goals and claimed benefits of such tools from the perspective of law enforcement and vendors, while still critically assessing them.

When discussing GDPR and FTC actions, include examples of where enforcement has had tangible impact, not only where it falls short.

Use more neutral section headings (e.g., "Risks of mission creep" instead of "‘Mission creep’ or when temptation to surveil is too big").

Explicitly acknowledge that different stakeholders (law enforcement, vendors, civil society, regulators) may reasonably disagree about the appropriate balance between security and privacy.