Dangers of Location Surveillance During COVID-19

Nathaniel Adams
Policy Review @ Berkeley
First Draft
October 31, 2020
 The COVID-19 pandemic has mobilized countries in ways our world has not

seen since World War II. Through rapid policy implementation, countries are

attempting different ways to curb the virus from spreading faster than the available

healthcare infrastructure can handle. One such way is tracking how people move

around using cellular data.

How it’s implemented

Local and state governments have deployed COVID-tracking apps throughout

the United States. Many states have failed to convince residents to allow the tracking of

their movements.1 This is an understandable outcome considering 84% of Americans

are worried that data collection for COVID-19 containment will sacrifice too much of

their privacy.2 Knowing this, local and state governments have moved onto a different

strategy. Instead of asking citizens to participate, many agencies across the country are

turning to location-data companies to provide this data.

Most of us use apps that passively collect timestamped geolocations. Consider

the places you’ve traveled to using a maps service, the photos you’ve tagged on social

media platforms, or other location-based apps you might have used recently. This data,

called mobility data, is aggregated and sold to location-data companies due to its value

1 Bethany Rogers, “Utah’s expensive coronavirus app won’t track people’s movements
anymore, its key feature,” The Salt Lake Tribune, July 11, 2020; Pierre Valade, “Jumbo Privacy
Review: North Dakota's Contact Tracing App,” Jumbo Privacy, May 21, 2020.
2 Juniper Research, “Cost of Privacy Report on the State of Digital Identity in 2020,”
Okta, Inc., May 6, 2020.

1
in the advertising industry. Companies that serve this type of data, such as Foursquare

Labs, Inc., have engaged with local governments to deploy this data in the fight against

COVID-19.3 Unlike other sources of data, location data is highly unregulated, and local

policymakers often do not have the resources or capability to handle this sensitive data.

Unintended Consequences

With the rapid deployment of these tracking tools come many unintended

consequences. One consequence is how this data under-represents specific groups of

people. Rural communities and lower-income citizens have lower rates of smartphone

usage, shifting the deployment of resources based on mobility data out of their favor.4

Additionally, there exist implicit biases of policymakers who have unregulated access

towards collecting and interpreting the results of this mobility data. Biases that might

influence them to prioritize some communities over others.

The lack of policy regulations doesn’t just affect underrepresented groups. It

affects all citizens through violations of privacy. While very few government agencies

have outlined how they handle the collection of mobility data, the Centers for Disease

Control and Prevention indicated its use of anonymized mobility data.5 While the data

3 Sahil Patel, “Foursquare Merges With Factual, Another Location-Data Provider,” The
Wall Street Journal, April 6, 2020.
4 Andrew Perrin, “Digital Gap Between Rural and Nonrural America Persists,” Pew
Research Center, May 31, 2019.
5 Amanda Moreland, J.D. et al., “Timing of State and Territorial COVID-19 Stay-at-Home
Orders and Changes in Population Movement,” CDC Morbidity and Mortality Weekly Report,
September 4, 2020.

2
in this study was publicly available, the Wall Street Journal reports that the CDC, state,

and local governments are receiving mobility datasets drawn from advertisers.6 By

mapping anonymized mobility data onto addresses, identities are easily obtained from

these datasets.7 It is illegal for telecommunication companies to offer this data directly,

so it has only been obtained from largely-unregulated secondary data brokers.

The United States has yet to implement regulations that prevent the misuse of

mobility data, and it has dark implications on our civil liberties. Historically, the United

States has used data collected on its citizens in unforeseeable ways. From surveilling

protestors to detaining Americans deemed a threat, datasets collected for benevolent

purposes have often been misused by local and federal governments.8 The lack of

regulation on how COVID-19 mobility data can be used poses a grave threat to the

human rights of all Americans.

Stakeholders

In addition to the costs to human rights, collecting and deploying COVID-19

tracking has its own budgetary costs for departments across the United States. It is yet

6 Bryon Tau, “Government Tracking How People Move Around in Coronavirus Pandemic,”
The Wall Street Journal, March 28, 2020.
7 Daniel Kondor, Behrooz Hashemian, Yves-Alexandre de Montjoye, Carlo Ratti, “Towards
Matching User Mobility Traces in Large-Scale Datasets,” in IEEE Transactions on Big Data,
September 24, 2018.
8 Caroline Haskins, “Amazon Requires Police to Shill Surveillance Cameras in
Secret Agreement,” Vice, July 25, 2019; Lori Aratani, “Secret use of census info helped send
Japanese Americans to internment camps in WWII,” The Washington Post, April 6, 2018.

3
to be seen if mobility data collection used for timing stay-at-home measures and the

deployment of public health resources will outweigh the potential costs.

Public health departments from the local to the federal levels of U.S. government

have a vested interest in seeing the success of COVID-19 responses. Their ability to

handle the virus in the respective jurisdictions will determine both their perception by

the public as well as funding to their departments. Their power has expanded

drastically in the past few months in response to the pandemic. H.R. 6074 alone, passed

in March, offered $8.3 billion in emergency funding for federal agencies to respond to

the coronavirus outbreak.9 Of this amount, $730 million has been deployed by the CDC

to state, local, territorial, and tribal jurisdictions. This has greatly inflated the capacities

of local and state governments.

These departments, in partnership with their encompassing governments, have

enforced policies in response to COVID-19. Many of these partnerships serve conflicting

interests. While governing bodies of cities and states may use mobility data to enable

COVID-19 responsiveness, regions experiencing protests would benefit from using this

data to identify dissidents and curb civil unrest. Understanding this mobility data

would also enable creative politicians to distribute ballot boxes in a way that

disproportionately affects who can vote, a tactic many politicians have opted for during

9 U.S. Congress, House, Coronavirus Preparedness and Response Supplemental

4
in recent U.S. history.10 Under ordinary circumstances, legislation can prevent bad

actors from using these tactics. However, in the midst of crises, executive power is often

handed to leaders of states with little to no oversight.

Who Did it Right

Despite the need for rapid response to the pandemic, thoughtful legislators can

and have been averting these risks. Consider Germany, where their COVID-19 platform

provides self-reported exposures to the virus.11 Due to the previously-established

privacy laws in Germany, the names of those who use the app are not exposed.

Singapore emphasizes privacy even further by doing away with geolocation data

entirely. Singapore’s contact tracking platform, TraceTogether, stores the proximity to

other citizens around you using bluetooth locally on your device.12 It is deleted after a

short period of time or upon your request. Despite these restrictions, these countries

and many others with similar implementations have succeeded in curbing the spread of

the virus.

Many states within the U.S. have deployed contact tracing successfully as well.

Many states rely on private solutions that adhere to privacy and thoughtful design.

10 Corey McGehee, “In Staying Injunction, the Sixth Circuit Effectively Upholds Ohio’s
Limitation of Ballot Drop Boxes to One Per County,” National Law Review, October 12, 2020;
Emma Platoff, “Texas Counties Can Offer Only One Drop-off Ballot Location, Federal Appeals
Court Rules, Upholding Gov. Greg Abbott’s Order,” The Texas Tribune, October 13, 2020; Max
Brantley, “Lawsuit Filed to Protect Absentee Ballots,” Arkansas Times, September 22, 2020.
11 Rob Schmitz, “How Germany Staffed Up Contact Tracing Teams To Contain Its
Coronavirus Outbreak,” NPR, June 22, 2020.
12 “TraceTogether,” Government of Singapore, accessed on October 30, 2020, https://
www.tracetogether.gov.sg/.

5
Apple and Google partnered to create the Exposure Notification framework. This

framework generates COVID-19 notifications in a similar fashion to Singapore’s

TraceTogether. The Exposure Notification framework provides an API to Apple and

Android developers which allows them to communicate to their users when they’ve

been in proximity with someone who has a probable COVID-19 diagnosis. The

framework uses rotating keys sent to other users near you using bluetooth. If you are

diagnosed with COVID-19, you can opt in to send your keys to a central server where

users who received one of your keys are notified. Eleven U.S. states have deployed the

Exposure Notification framework within their own platforms.

The Power of Place

While the collection of data may be successful, the policy’s effectiveness is

determined by how well other government agencies act on the information gleaned

from it. A government that serves its citizens will swiftly use the data to learn how we

behave in response to a pandemic then delete it to protect its citizens. A malevolent

government might find alternative ways to use this information to expand its own

power at the expense of its citizens.

In addition to how the data is used, how it is collected is just as important for the

rights of citizens. If a government collects this data voluntarily from citizens who opt-in,

the people are indicating their trust in the institution getting the data. If a government

needs to route through third parties, it bypasses this trust. As we continue navigating

6
this pandemic, it is in the hands of policymakers to regulate how mobility data is used

by governments.