The Dangers of Location Surveillance During a Pandemic

Nathaniel Adams
Policy Review @ Berkeley
November 14, 2020
 The COVID-19 pandemic has mobilized countries in ways our world has not

seen since World War II. Through rapid policy implementation, countries are

attempting different ways to curb the virus from spreading faster than the current

healthcare infrastructure can handle. One method is tracking how people move using

cellular data.

How it’s implemented

Local and state governments have deployed COVID-tracking apps throughout

the United States. While some have succeeded, many states have failed to convince

residents to allow the tracking of their movement.1 This is an understandable outcome

considering 84% of Americans are worried that data collection for COVID-19

containment will sacrifice too much of their privacy.2 Local and state governments have

moved onto a different strategy. Many agencies are turning to location-data companies

for this data to bypass the consent of its citizens.

Most apps passively collect timestamped geolocations. Consider the places

you’ve traveled to using a maps service, the photos you’ve tagged on social media

platforms, or other location-based apps you might have used recently. This data, called

mobility data, is aggregated and sold to location-data companies due to its value in the

1 Bethany Rogers, “Utah’s expensive coronavirus app won’t track people’s movements
anymore, its key feature,” The Salt Lake Tribune, July 11, 2020; Pierre Valade, “Jumbo Privacy
Review: North Dakota's Contact Tracing App,” Jumbo Privacy, May 21, 2020.
2 Juniper Research, “Cost of Privacy Report on the State of Digital Identity in 2020,”
Okta, Inc., May 6, 2020.

1
advertising industry. Companies that serve this type of data, such as Foursquare Labs,

Inc., have engaged with local governments to deploy this data in the fight against

COVID-19.3 Unlike other sources of data, location data is highly unregulated, and local

policymakers often do not have the resources or capability to handle this sensitive data.

Unintended Consequences

Many unintended consequences arise from the rapid deployment of these

tracking tools. One consequence is how this data under-represents specific groups of

people. Rural communities and lower-income citizens show lower rates of smartphone

usage shifting the deployment of resources based on mobility data out of their favor.4

Additionally, there exist implicit biases of policymakers who have unregulated access

towards collecting and interpreting the results of this mobility data. These biases may

influence them to prioritize some communities over others.

The other consequences of the lack of policy regulations are the violations to

privacy. While very few government agencies have outlined how they handle the

collection of mobility data, the Centers for Disease Control and Prevention indicated its

use of anonymized mobility data.5 While the data in this study is publicly available, the

3 Sahil Patel, “Foursquare Merges With Factual, Another Location-Data Provider,” The
Wall Street Journal, April 6, 2020.
4 Andrew Perrin, “Digital Gap Between Rural and Nonrural America Persists,” Pew
Research Center, May 31, 2019.
5 Amanda Moreland, J.D. et al., “Timing of State and Territorial COVID-19 Stay-at-Home
Orders and Changes in Population Movement,” CDC Morbidity and Mortality Weekly Report,
September 4, 2020.

2
Wall Street Journal reports that the CDC, state, and local governments are receiving

mobility datasets drawn from advertisers.6 By mapping anonymized mobility data onto

addresses, identities are easily obtained from these datasets.7 It is illegal for

telecommunication companies to offer this data directly, so it is obtained from largely-

unregulated secondary data brokers.

The United States has not implemented regulations preventing the misuse of

mobility data on a federal level, and this has dark implications on our civil liberties.

Historically, the United States has used data collected on its citizens. From surveilling

protestors to detaining Americans deemed a threat, datasets collected for benevolent

purposes have often been misused by local and federal governments.8 The lack of

regulation on how COVID-19 mobility data can be used poses a grave threat to the

human rights of all Americans.

Stakeholders

In addition to the costs to human rights, collecting and deploying COVID-19

tracking has its own budgetary costs for departments across the United States. It is yet

6 Bryon Tau, “Government Tracking How People Move Around in Coronavirus Pandemic,”
The Wall Street Journal, March 28, 2020.
7 Daniel Kondor, Behrooz Hashemian, Yves-Alexandre de Montjoye, Carlo Ratti, “Towards
Matching User Mobility Traces in Large-Scale Datasets,” in IEEE Transactions on Big Data,
September 24, 2018.
8 Caroline Haskins, “Amazon Requires Police to Shill Surveillance Cameras in
Secret Agreement,” Vice, July 25, 2019; Lori Aratani, “Secret use of census info helped send
Japanese Americans to internment camps in WWII,” The Washington Post, April 6, 2018.

3
to be seen if mobility data collection used for timing stay-at-home measures and the

deployment of public health resources will outweigh the potential costs.

Public health departments from the local to the federal levels of U.S. government

have a vested interest in seeing the success of COVID-19 responses. Their ability to

handle the virus in the respective jurisdictions will determine both their perception by

the public as well as funding to their departments. Their power has expanded

drastically in the past few months in response to the pandemic. H.R. 6074 alone, passed

in March, offered $8.3 billion in emergency funding for federal agencies to respond to

the coronavirus outbreak.9 Of this amount, $730 million has been deployed by the CDC

to state, local, territorial, and tribal jurisdictions. This has greatly inflated the capacities

of local and state governments.

These departments, in partnership with their encompassing governments, have

enforced policies in response to COVID-19. Many of these partnerships serve conflicting

interests. While governing bodies of cities and states may use mobility data to enable

COVID-19 responsiveness, regions experiencing protests would benefit from using this

data to identify dissidents and curb civil unrest. Understanding this mobility data

would also enable creative politicians to distribute ballot boxes in a way that

disproportionately affects who can vote, a tactic many politicians have opted for in

9 U.S. Congress, House, Coronavirus Preparedness and Response Supplemental

4
recent U.S. history.10 Under ordinary circumstances, legislation can prevent bad actors

from using these tactics. Amid crises, however, executive power is often handed to

leaders of states with little to no oversight.

Who Did It Right

Despite the need for rapid response to the pandemic, thoughtful legislators can

and have been averting these risks. Consider Germany, where its COVID-19 platform

provides self-reported exposures to the virus.11 Due to the previously-established

privacy laws in Germany, the names of those who use the app are not exposed.

Singapore emphasizes privacy even further by doing away with geolocation data

entirely. Singapore’s contact tracking platform, TraceTogether, stores the proximity to

other citizens around you using Bluetooth locally on your device.12 It is deleted after a

short period of time or upon your request. Despite these restrictions, these countries

and many others with similar implementations have succeeded in curbing the spread of

the virus.

Many states within the U.S. have deployed contact tracing successfully as well.

Many states rely on private solutions that adhere to privacy and thoughtful design.

10 Corey McGehee, “In Staying Injunction, the Sixth Circuit Effectively Upholds Ohio’s
Limitation of Ballot Drop Boxes to One Per County,” National Law Review, October 12, 2020;
Emma Platoff, “Texas Counties Can Offer Only One Drop-off Ballot Location, Federal Appeals
Court Rules, Upholding Gov. Greg Abbott’s Order,” The Texas Tribune, October 13, 2020; Max
Brantley, “Lawsuit Filed to Protect Absentee Ballots,” Arkansas Times, September 22, 2020.
11 Rob Schmitz, “How Germany Staffed Up Contact Tracing Teams To Contain Its
Coronavirus Outbreak,” NPR, June 22, 2020.
12 “TraceTogether,” Government of Singapore, accessed on October 30, 2020, https://
www.tracetogether.gov.sg/.

5
Apple and Google partnered to create the Exposure Notification framework. This

framework generates COVID-19 notifications in a similar fashion to Singapore’s

TraceTogether. The Exposure Notification framework provides an API to Apple and

Android developers which allows them to communicate to their users when they’ve

been in proximity with someone who has a probable COVID-19 diagnosis. The

framework uses rotating keys sent to other users near you using Bluetooth. If you are

diagnosed with COVID-19, you can opt in to send your keys to a central server where

users who received one of your keys are notified. Eleven U.S. states have deployed the

Exposure Notification framework within their own platforms.

The Power of Place

While the collection of data may be successful, the policy’s effectiveness is

determined by how well other government agencies act on the information gleaned

from it. A government that serves its citizens will swiftly use the data to learn how we

behave in response to a pandemic then delete it to protect its citizens. A malevolent

government might find alternative ways to use this information to expand its own

power at the expense of its citizens.

In addition to how the data is used, how it is collected is just as important for the

rights of citizens. If a government collects this data voluntarily from citizens who opt-in,

the people are indicating their trust in the institution getting the data. If a government

needs to route through third parties, it bypasses this trust. As we continue navigating

6
this pandemic, it is in the hands of policymakers to determine how mobility data is

collected by governments to respect the rights of all citizens.