News

Just after 9 pm on an August night in 2020, Kimberly Thompson and Brian James pulled the car into a driveway in Akron, Ohio, and stepped out into a barrage of gunfire. They were shot in the legs, rushed to a hospital, and survived. But Thompson’s 20-month-old grandson, Tyree Halsell, who was still sitting in the car, was shot in the head and mortally wounded.

In the aftermath, Akron police collected video footage from the neighborhood and asked for the public’s help with identifying two men who’d been seen approaching the victims, firing, then fleeing in a truck. Within months, detectives narrowed in on a suspect, Phillip Mendoza, and obtained a search warrant for his cell phone location data from Sprint, according to court records. They also served a geofence warrant on Google, seeking information on devices whose GPS, Wi-Fi, or Bluetooth records placed them near the scene of the shooting. Neither warrant turned up any evidence locating Mendoza or his devices on the 1200 block of Fifth Avenue, where the shooting occurred, that night.

The investigation stalled until August 2022, when Akron police received a three-page report containing the evidence they’d been seeking. It came from a little-known Canadian company called Global Intelligence, which for the past several years has been selling an extraordinary service to police departments across the United States.

Global Intelligence claims that, using only open source data—public information that doesn’t require a warrant—and a suite of more than 700 algorithms, its Cybercheck system allegedly can geolocate an individual in real time or at a specific time in the past by detecting the wireless networks and access points the person’s “cyber profile” has interacted with. The company’s founder, Adam Mosher, has testified under oath that the process is entirely automated, requiring no human intervention from the time an investigator enters basic details about a case into the Cybercheck portal until the time the system produces a report identifying a suspect and their location.

If the technology works as advertised, then Global Intelligence is selling police departments previously unknown surveillance capabilities for as little as $309 a case that rival the open source tools used by national spy agencies. But a WIRED review of investigations involving Cybercheck from California to New York, based on hundreds of pages of court filings, testimony, interviews, and police records, suggests Cybercheck is a much less effective tool—one that has provided evidence in high-profile cases that was either demonstrably incorrect or couldn’t be verified by any other means.

Open source intelligence experts allege to WIRED that much of the information Cybercheck provides in its reports to law enforcement would be impossible to obtain using only open source data. Indeed, over the past several months, Global Intelligence’s work in Ohio has faded away, with prosecutors ultimately deciding not to use Cybercheck reports as evidence in several murder cases, including Mendoza’s.

“Either they’re somehow doing the Minority Report now, or somehow it’s just BS,” says Stephen Coulthart, director of the Open Source Intelligence Laboratory at the State University of New York at Albany, who reviewed Cybercheck reports and transcripts of Mosher’s testimony at WIRED’s request. Cases Pending

During a November 2022 trial, Mosher testified that 345 different law enforcement agencies had used Cybercheck to conduct approximately 24,000 searches since 2017. WIRED identified more than a dozen cases involving Cybercheck, including 13 in which prosecutors intended to use Cybercheck reports as evidence at trial.

Two of the cases in which courts allowed Cybercheck reports to be admitted as trial evidence resulted in murder convictions.

The agencies we found using Cybercheck ranged from small suburban police departments to county sheriffs and state police. The alleged crimes ranged from those related to child sexual abuse material to drive-by shootings, as well as cold cases that have haunted communities for decades. Last year, for example, the New York State Police arrested a man for murder after receiving evidence from Cybercheck that allegedly placed his cell phone at key locations on the night of the homicide, roughly 20 years ago, according to the indictment. The case is scheduled to go to trial in 2025.

While Mosher has testified on numerous occasions about Cybercheck, his explanations of what data sources the algorithms draw on and how they reach their conclusions do not fully explain Cybercheck’s ability to produce its reports. Global Intelligence did not answer WIRED’s questions about who designed Cybercheck’s algorithms or what data the company used to train them. When asked how the tool could determine that a person’s cyber profile had pinged a particular wireless network—oftentimes years after the incident occurred—an unnamed Global Intelligence employee wrote in an email: “There is no specific single source of information with regard to wireless network interactions.” Accuracy Ratings

In 2022, more than two years after Halsell was shot and killed in Akron, Cybercheck produced a report for police that claimed Mendoza’s cyber profile had pinged two wireless internet devices located near 1228 Fifth Avenue after 9 pm. A cyber profile, from what Mosher has testified, is the amalgamation of names, aliases, emails, phone numbers, IP addresses, Google IDs, and other online identifiers that combine to create a person’s unique digital fingerprint.

Summit County prosecutors charged Mendoza with murder. But when Mendoza’s defense attorney, Donald Malarcik, dug into the Cybercheck report, he found a problem. The police department employee who entered the information into Cybercheck’s system had allegedly made a mistake: They had asked the system whether it could locate Mendoza at the scene on August 20, 2020. The shooting occurred on August 2. Cybercheck had nonetheless claimed to locate Mendoza at 1228 Fifth Avenue with 93.13 percent accuracy, even though it was on the wrong day. Stranger still to Malarcik, at some point after delivering the first report, Cybercheck produced another report. It was identical in all respects to the first report—from the MAC addresses, which are unique IDs assigned to networked devices, to the time of day when Mendoza’s cyber profile allegedly pinged them, and the accuracy rating—except it had the correct date of the shooting.

The warrants served to Sprint and Google hadn’t produced any evidence that Mendoza’s devices or accounts were at the scene. But according to Cybercheck's entirely automated algorithms, Mendoza’s cyber profile had not only been at 1228 Fifth Avenue at the time of the shooting, it had also been at the exact same location, at the exact same time of day, for the same amount of time, pinging the same wireless networks, 18 days later.

The unnamed Cybercheck employee who responded to WIRED’s questions says the company stands by the accuracy of both reports in the Mendoza case. “It is not uncommon to have the same cyber profile with the same device at a location on a different date,” they wrote.