Prove Your Vendors Behaved
Issue 027 | Friday Brief | October 23, 2026
Weekly field intelligence for enterprise and mobile security leaders
LocateUrCell was approved to help customers find missing phones. It reused the approved campaign identifier to supply location data to companies in the bail-bonds business without customer consent. T-Mobile could not distinguish those requests from authorized ones, according to the D.C. Circuit’s August 2025 account of the case. [1]
After Charlotte, I’d bring one recent vendor action to the people who approved the work. Ask them to connect it to the permission in force at the time, then compare that permission with what the records show. Keep the conclusion specific to that action, and give any unanswered question an owner and a follow-up date.
Signals & Moves You Shouldn't Ignore
This week’s signals come from one historical case, examined through the FCC’s 2024 findings and the court’s 2025 opinion.
The identifier survived the change in use
T-Mobile required providers to describe proposed uses of location data and assigned approved uses a campaign ID. Providers included that ID with their requests. [2]
The campaign ID pointed to an approved use. The reviewer still needed evidence that the person whose location was requested had consented to that use.
The carriers did not see the whole chain
Sprint had not known that its aggregator Zumigo was giving MicroBilt access. T-Mobile had approved MicroBilt, but said its application had not disclosed onward sharing. [1] [2]
The destination belongs in a review of a data transfer. Establish which recipient was permitted and what evidence shows where the information went. Changing access at the original source cannot retrieve copies already passed along, so an unresolved recipient needs attention even after access has been restricted.
Removing one provider left a wider decision
The carriers terminated Securus’s access after its abuse became public. The FCC still found the protections across the continuing location programs inadequate, including their continued reliance on the system Securus had exploited. [1]
A finding about one vendor can expose a control that other relationships also depend on. The response needs to reach the owners of those workflows. They have to decide whether work can continue under the existing conditions and what must change before they can rely on that control again.
The Control Gap
A reviewer needs to connect the action to the permission that applied when it happened. A login record may identify the account that accessed a system while leaving the permitted purpose unresolved. Where consent is required, its scope and validity also need to cover the use being examined.
The finding then needs a decision. The vendor owner and system owner should agree whether the work can continue, whether more evidence is needed or whether a restriction is warranted. Existing incident procedures may already authorize immediate containment. Somebody also has to confirm that any resulting access change reached the system.
My Take
I’d use the assessment and contract review already in the vendor file. They establish the conditions worth checking. Then I’d ask the system owner for the records of one consequential action under those conditions. That gives the team a specific piece of work without reopening the entire supplier assessment.
The record needs room for an unresolved conclusion, with a person responsible for investigating it. Missing evidence does not establish misconduct. And a later access change does not settle what happened before it. The original action still needs its own conclusion, even when the application team has finished the restriction and tested it.
One Thing Worth Doing This Week
Review one vendor action with the people who approved the work and operate the system.
Choose a recent action with a meaningful consequence, such as a customer-data export or an account recovery. Bring the applicable approval and the records of the action. Work through what those records establish, then assign any gap to the person who can obtain the evidence or make the access decision.
Hypothetical worked example: a supplier completes a CRM migration and stays on for limited support. The reviewer selects the last export before handover. The source records exist, but the destination receipt has not been produced.
Action selected
Export job 42 ran under the vendor’s migration account before handover. The review follows that specific transfer.
Permission in force
The approved work order permitted that account to export the specified customer records to a named migration workspace. Export permission ended when the business owner accepted the migration.
Evidence and gap
The job record references the work order. The source log and export manifest match the approved account, data scope and time window. No delivery record establishes that this export reached the approved workspace.
Decision and owner
The business owner confirms migration acceptance. Under the access policy, the application owner approves removal of export permission while retaining limited support viewing. The vendor owner is assigned to obtain the delivery record by the next business day.
Change and check
The administrator removes export permission and records the change. An approved test account with the vendor’s support permissions can view the permitted test records; the application’s export function denies the attempt. The test result is linked to the change ticket.
Conclusion
The original export is only partly substantiated because its destination remains unproven. The later test supports the export restriction for the tested role and function. It does not resolve the earlier transfer or cover other accounts, copying methods or data already held by the supplier.
Use the same fields for your selected action. Reference the underlying records in the systems that already hold them. Record an unknown as an unknown, with an owner and a follow-up date. A controlled test can answer a current access question; historical claims need evidence from the action being reviewed.
Y 0 / N 0
Checklist v1.0 · Case status as of October 22, 2026: fines upheld on the merits; AT&T refund on remand; T-Mobile and Sprint petition pending. Bookmark this page; this line updates as the cases move.
Field Notes
I’d want both owners looking at the same review. The application owner may have finished the access change while the vendor owner still owes a delivery record. That question needs to remain open after the change ticket closes.
Which record supports the vendor action you selected, and who owns any part that remains unproven?
William
EVERY FRIDAY. SIGNALS. ONE CONTROL GAP. ONE ACTION.