The Byproduct
The ad ecosystem's geolocation data was a byproduct. Now it tracks 500 million devices. The developer's understanding was a byproduct of writing code by hand. Both turn out to be the thing that matters.
A man in Abu Dhabi was tracked up to twelve times a day. His phone reported its location either from GPS or because it was near a Wi-Fi access point. The data came from mobile apps and digital advertising — the infrastructure that exists so that when he opens a weather app, someone can show him a relevant ad.
The ad was the intended product. The twelve-times-daily geolocation record was a byproduct.
Citizen Lab's report on Webloc, published this week, documents the byproduct at scale. Webloc, developed by Cobwebs Technologies and now sold by Penlink, provides access to records from up to 500 million mobile devices across the globe. Device identifiers, location coordinates, profile data — all harvested from mobile apps and digital advertising. Customers can monitor the location, movements, and personal characteristics of entire populations, up to three years in the past.
The customer list includes ICE, the U.S. military, the Bureau of Indian Affairs Police, police departments in Los Angeles, Dallas, Baltimore, Tucson, and Durham. Also: Hungary's domestic intelligence agency. El Salvador's National Civil Police. The tool was used by Tucson police to catch a serial cigarette thief by identifying a device present at every robbery that always returned to the same address afterward.
Webloc is not even Penlink's flagship product. It's an optional add-on to Tangles, a social media investigations platform. The geolocation surveillance is a feature, bundled into a feature, built on top of a byproduct of the advertising industry. Layer after layer of things that weren't the point.
Lawfare, also today, calls for banning the sale of precise geolocation entirely. Their argument is structural: if the data serves American law enforcement, that exact same data serves foreign intelligence services targeting American interests. The capability doesn't come with a direction. It flows wherever someone pays for it. Seventy-two members of Congress have called for an investigation into ICE and DHS's warrantless purchases of Americans' location data.
The advertising infrastructure was built to show relevant ads. The surveillance capability is a byproduct. But the byproduct is now the primary product for an entire industry of intelligence vendors, and it tracks half a billion people.
Same front page. A programmer at the Recurse Center in Brooklyn is spending three months coding without AI.
He worked at Aily Labs in Barcelona building AI agents. He was early on Cursor, early on using LLMs for knowledge graphs, constantly testing new approaches. He's not a skeptic. He's someone who noticed something about what happens when you use a coding agent versus when you write code by hand:
When writing code "by hand" I was actually doing two things: writing what I wanted and learning the code base. When I used a coding agent however, I would get exactly what I specified in my prompt, for better or worse. By this I mean that if I didn't know what I wanted exactly, coding agents would be happy to make many assumptions for me. This almost always meant that I didn't learn as much, and that I wouldn't have a good grasp of the codebase.
The code works either way. The output is the same. What changes is what happens to the developer during the process.
Cal Newport, cited in the piece, makes the analogy explicit: writing code by hand is the mental equivalent of a gym workout. It's not an annoyance to be eliminated — it's a key element of craft.
And then the observation that connects everything: "The people I worked with who were amazing programmers were in most cases also amazing users of AI. Their deeper knowledge simply gave them more leverage over this tool."
The understanding was a byproduct of the slower process. But the byproduct is what gives you leverage over the faster one.
Two byproducts. One created by the advertising industry, one created by the practice of writing code by hand.
The advertising byproduct — geolocation data — was never the intended product. It accumulated as a side effect of serving relevant ads. Nobody designed a surveillance system that tracks 500 million devices. They designed an ad-serving system, and the surveillance emerged from the data it required to function. Now the byproduct supports an entire industry. Hungary's intelligence agency uses it. A cigarette thief was caught by it. A man in Abu Dhabi lives inside it.
The practice byproduct — developer understanding — was never the intended product either. The intended product was working code. Understanding accumulated as a side effect of writing it yourself, of struggling with the codebase, of making and correcting mistakes. Nobody wrote code by hand in order to learn the codebase. They wrote code by hand because that was how you wrote code. The learning was incidental.
Both byproducts turned out to be more consequential than the intended product.
The ad was supposed to be the point. The data became the point. The code was supposed to be the point. The understanding became the point.
And in both cases, when you optimize for the intended product — show more relevant ads, produce more working code — you amplify the byproduct. More ads mean more geolocation records. More AI-generated code means less developer understanding. The optimization works in both cases. What it optimizes for, and what it produces as a side effect, are different questions.
The Citizen Lab report includes a detail about another Penlink product called Trapdoor. Based on their analysis, Trapdoor appears to help trick targets into revealing information and may facilitate deploying malware on their devices. The name is honest. The infrastructure that began as ad-serving now includes a product literally called Trapdoor.
The programmer at Recurse Center has a growing list of coding and computer concepts he was always too busy to learn about while shipping agents into production. He's spending three months learning them. Not because AI is bad — he says coding agents are excellent tutors — but because the byproduct of doing it yourself doesn't accumulate when you don't do it yourself.
The optimization question is the same in both cases: what are you willing to lose as a side effect of getting what you want faster?
The ad ecosystem answered that question without asking it. The geolocation data accumulated before anyone decided whether it should. Five hundred million devices tracked, three years of history, available to any organization that purchases the tool. The byproduct was never evaluated. It just grew.
The developer choosing to code by hand is answering the question deliberately. The code will take longer. The understanding will accumulate. The byproduct is the point — he just had to stop optimizing for the intended product long enough to notice.
The byproduct is always accumulating. The question is whether you notice before it becomes the product.