#PrivacyNightmare- CDC Tracked Millions of Phones to See If citizens Followed COVID Lockdown Order

 

The Centres for Disease Control and Prevention (CDC) bought access to location data harvested from tens of millions of phones in the United States to perform analysis of compliance with curfews, track patterns of people visiting K12 schools, and specifically monitor the effectiveness of policy in the Navajo Nation, according to CDC documents obtained by Motherboard. The documents also show that although the CDC used COVID19 as a reason to buy access to the data more quickly, it intended to use it for more general CDC purposes. 

 Location data is information on a device`s location sourced from the phone, which can then show where a person lives, works, and where they went. The sort of data the CDC bought was aggregated—meaning it was designed to follow trends that emerge from the movements of groups of people—but researchers have repeatedly raised concerns with how location data can be deanonymized and used to track specific people. 

 The documents reveal the expansive plan the CDC had last year to use location data from a highly controversial data broker. SafeGraph, the company that CDC paid $ 420,000 to access the data for the year, counts among investors Peter Thiel and the former head of the Saudi Arabia General Information Agency. Google banned the company from its Play Store in June. The 

  CDC used the data to monitor lockdowns, and the SafeGraph data used a document stating that "it is important for ongoing response efforts such as:" The document is from 2021. After reviewing the document, cybersecurity researcher 

 Zach Edwards,  who closely tracks the data market, told Motherboard in an online chat: Curses, visits between neighbours, visits to churches, schools, pharmacies, and various analyses using the data with a particular focus on "violence" (documents refer to "places of worship", not just churches. ") The 

 motherboard obtained the document through a request for the Freedom of Information Act (FOIA) to the CDC. The 

 document contains a long list of what the CDC describes as 21 different "potential CDC use cases for data". They include:

• “Track patterns of those visiting K-12 schools by the school and compare to 2019; compare with epi metrics [Environmental Performance Index] if possible.” 
• “Examination of the correlation of mobility patterns data and rise in COVID-19 cases [...] Movement restrictions (Border closures, inter-regional and nigh curfews) to show compliance.”
• “Examination of the effectiveness of public policy on [the] Navajo Nation.”

At the begin of the pandemic, mobileular telecellsmartphone place records turned into visible as a probably beneficial tool. Multiple media organizations, which includes the New York Times, used place records supplied via way of means of corporations withinside the enterprise to expose wherein human beings had been touring to as soon as lockdowns began out to lift, or spotlight that poorer groups had been not able to safe haven in area as a whole lot as richer ones. 

 The COVID-19 pandemic as an entire has been a flashpoint in a broader tradition war, with conservatives and anti-vaccine companies protesting towards authorities masks and vaccine mandates. They`ve additionally expressed a particular paranoia that vaccine passports might be used as a monitoring or surveillance tool, framing vaccine refusal as a civil liberties issue. Robert F. Kennedy Jr.'s Children's Health Défense, one of the extra influential and monied anti-vaccine companies with inside the U.S., has promoted fears that virtual vaccine certificate can be used to survey citizens. QAnon promoter Dustin Nemos wrote on Telegram in December that vaccine passports are "a Trojan horse getting used to create a very new kind of managed and surveyed society wherein the liberty we experience these days could be a far off memory." 

 Against that infected backdrop, the usage of mobileular telecellsmartphone place records for this kind of huge style of monitoring measures, even though powerful for turning into higher knowledgeable at the pandemic`s unfold or for informing policy, is in all likelihood to be controversial. It's additionally in all likelihood to offer anti-vaccine companies a real-global records factor on which to pin their darkest warnings. 

 The procurement files say that “This is an URGENT COVID-19 PR [procurement request],” and asks for the acquisition to be expedited. 

 But a number of the use instances aren't explicitly related to the COVID-19 pandemic. One reads “Research factors of hobby for bodily interest and continual sickness prevention along with visits to parks, gyms, or weight control businesses.” 

 Another segment of the report elaborates at the place records' use for non-COVID-19 associated programs. 

 “CDC additionally plans to apply mobility records and offerings received thru this acquisition to assist non-COVID-19 programmatic regions and public fitness priorities throughout the agency, which includes however now no longer confined to journey to parks and green spaces, bodily interest and mode of journey, and populace migration before, during, and after herbal disasters,” it reads. “The mobility records received below this agreement could be to be had for CDC agency-huge use and could assist several CDC priorities.” 

 The CDC did now no longer reply to more than one emails inquiring for touch upon which use instances it did installation SafeGraph records for.

SafeGraph is a part of the ballooning place enterprise, and SafeGraph has formerly shared datasets containing 18 million cellular telephones from the United States. The files say this acquisition is for statistics this is geographically representative, “i.e., derived from as a minimum 20 million energetic mobile phone customers in keeping with day throughout the United States.” 

 Generally, businesses on this enterprise ask, or pay, app builders to encompass place statistics amassing code of their apps. The place statistics then funnels as much as businesses who might also additionally resell the uncooked place statistics outright or bundle it into merchandise. 

 SafeGraph sells both. On the evolved product facet SafeGraph has numerous distinctive merchandise. “Places” issues factors of interest (POIs) together with in which specific shops or homes are located. “Patterns” is primarily based totally on cellular telecellsmartphone place statistics which can display for a way lengthy human beings go to a place, and “Where they got here from” and “Where else they go,” in step with SafeGraph`s website. More lately SafeGraph has began out presenting aggregated transaction statistics, displaying how a whole lot customers generally spend at unique locations, beneathneath the “Spend” product. SafeGraph sells its merchandise to a extensive variety of industries, together with actual estate, insurance, and advertising. These merchandise encompass aggregated statistics on moves and spends, as opposed to the place of unique gadgets. Motherboard formerly offered a hard and fast of SafeGraph place statistics for $200. The statistics turned into aggregated, that means it turned into now no longer speculated to pinpoint the moves of unique gadgets and subsequently human beings, however on the time, Edwards said "In my opinion the SafeGraph statistics is manner past any secure thresholds [around anonymity]." Edwards pointed to a seek bring about SafeGraph`s statistics portal that displayed statistics associated with a selected doctor`s office, displaying how finely tuned the company`s statistics can be. Theoretically, an attacker ought to use that statistics to then try and unmask the unique customers, some thing which researchers have again and again validated is possible. 

 In January 2019, the Illinois Department of Transportation offered such statistics from SafeGraph that associated with over 5 million telephones, activist business enterprise the Electronic Frontier Foundation (EFF) formerly found. 

 The CDC files display that the business enterprise offered get entry to to SafeGraph`s “U.S. Core Place Data,” “Weekly Patterns Data,” and “Neighbourhood Patterns Data. That ultimate product consists of statistics together with domestic residing time, and is aggregated through country and census block. 

 “Safe-graph gives vacationer statistics on the Census Block Group degree that permits for extraordinarily correct insights associated with age, gender, race, citizenship status, income, and more,” one of the CDC files reads. 

 Both Safe-graph and the CDC have formerly touched on their partnership, however now no longer with inside the element this is discovered with inside the files. The CDC posted a have a look at in September 2020 which checked out whether or not human beings across the us of a had been following stay-at-domestic orders, which regarded to apply Safe Graph statistics.

Safe-graph said in a blog post in April 2020: -Several location data companies have provided data to governments and media organizations by promoting the data as a potential containment of a peak pandemic  in the United States. .. 

 A year later, according to the documentation, Safe-graph didn't want the data to be available for free, so the CDC gained access to the data. The data usage agreement for the data provided by In kind expired on March 31, 2021. Access to the  data was still important when the United States was opened, and the CDC insisted in writing. 

 "CDC is interested in further access to this mobility data when the country reopens. This data is used by several teams/groups in the response and have been resulting in deeper insights into the pandemic as it pertains to human behaviour,” one section reads. 

 Researchers at the EFF separately obtained documents concerning the CDC`s purchase of similar location data products from a company called Cubeiq as well as the Safe Graph documents. The EFF shared those documents with Motherboard. They showed that the CDC also asked to speed up the purchase of Cubeiq`s data because of COVID, and intended to use it for non COVID purposes. The documents also listed the same potential use cases for Cubeiq`s data as in the Safe-graph documents. 

 Google banned Safe Graph from the Google Play store in June. This meant that  app developers using Safe Graph's code had to either remove the code from the app or face the removal of the app  from the store. It is not entirely clear how effective this ban was. Safe-graph has previously stated that it will acquire location data through Veraset, a spin-off company that works with  app developers. 

 Safe-graph is not responding to multiple requests for comments.