Location-tracking companies were under fire from privacy advocates, but now officials are using them to monitor populations as the economy reopens
16 June 2020 (Chania, Crete) – At the end of April I was in one of those early COVID-19 marathon Zoom sessions (130+ participants). This one addressed Bluetooth-based approaches to finding new cases of COVID-19 and why it was likely to fall short. A combination of human behaviors and technical challenges seemed likely to limit the effectiveness of a pandemic response scheme that relied on our phones passively pinging each other wherever we went. At the same time, several suggested the more “old-fashioned approach” – using human beings to make phone calls and identify people who may have been exposed to the disease – which seemed much more promising.
Then Apple and Google announced that they were building a Bluetooth-based COVID tracking system (originally branded as “contact tracing” but after some negative feedback switched to the more accurate “exposure notification”).
“HURRAH! SAVED BY BIG TECH!” the media trumpeted. Yes, its effectiveness aside, it was clearly a good-faith effort to make a real difference in reducing the spread of COVID-19, and over the next several weeks Apple and Google worked diligently to refine their approach based on the feedback they were getting.
But the seasoned tech mavens that have seen this all before – Azeem Azhar, Casey Newton, Ben Thompson and many others – said “Hold on. Silicon Valley is only ever going to be able to provide one or two pieces of a comprehensive response to COVID-19. Elected officials and public health agencies are really gong to need to supply the rest: the systems and the infrastructure for it to work”.
And, of course, they did not supply “the rest” and it failed. Back in April it was easy to see that Apple and Google’s approach alone couldn’t stop the spread of the disease. What we couldn’t foresee back then was just how alone they would be.
The first phase of the project, which allowed whitelisted public health apps to make enhanced use of the Bluetooth features of your phone, launched on May 20th with three U.S. states on board. The hope was that more states would sign on, creating a more effective patchwork of notifications across the country.
But that did not happen. States that had committed to using contact tracing apps or expressed interest were backing away from those claims. The few states that did roll them out have seen only tepid responses. There was simply no indication of any momentum for the apps at a national level.
California Governor Gavin Newsom, an early supporter of contact tracing apps, said “we will build capacity and partnerships as part of the state’s plans”. But California did not. And state after state reported how hard it was to get people to download these apps; there has been no endorsement of the approach — or coherent response strategy — from the federal government. And reports on Bluetooth-based approaches conducted in countries where COVID-19 was more under control were mixed.
And so the battle turned to reopening the economy after the coronavirus lockdowns. But with a different tech. And, oh, the irony. Because governments have turned to location-tracking firms, data brokers and other middlemen – part of the ad-tech industry, which has come under increasing fire in recent years for building what critics call a surveillance economy. And data for targeting ads at individuals, including location information, is now also ending up in the hands of law-enforcement agencies or political groups, often with limited disclosure to users.
NOTE: most of the companies I note below I have met with at the Mobile World Congress over the past few years. I had chats with representatives of a few of them for purposes of this article.
But for public-health authorities the mantra has been “we need to set aside those concerns to fight an unprecedented pandemic. We are desperate for all types of data to identify people potentially infected with the virus and to understand how they are behaving to predict potential hot spots – whether those people realize it or not.”
Four of my favorite stories from a Wired magazine series this month :
• While an undergraduate at the University of Virginia, Joshua Anton created an app to prevent users from drunk dialing, which he called Drunk Mode. He later began harvesting huge amounts of user data from smartphones to resell to advertisers. Now Anton’s company, called X-Mode Social Inc., is one of a number of little-known location-tracking companies that are being deployed in the effort to reopen the country. State and local authorities wielding the power to decide when and how to reopen are leaning on him and other like vendors for the data to underpin those critical judgment calls.
• In California, Governor Newsom’s office is using data from Foursquare Labs to figure out if beaches were getting too crowded; when the state discovered they were, it tightened its rules. More on Foursquare below.
• In Denver, the Tri-County Health Department is monitoring counties where the population on average tends to stray more than 330 feet from home, using data from cross-channel ad tech company Cuebiq Inc.
• Researchers at the University of Texas in San Antonio are using movement data from a variety of ad-tech companies, including the geolocation firm SafeGraph, to guide city officials there on the best strategies for getting residents back to work.
So that is giving data-collection companies a chance to revive their battered public image. What you hear from public authorities and from the vendors themselves is the same thing: when you’re sharing your location data, you’re sharing it to potentially be part of an overall bigger solution that could potentially save someone’s life. X-Mode, which says it collects location information from about 30 million devices a month in the U.S., says there is a wide swath of the population that has already consented to that. The Wall Street Journal has identified dozens of local governments and agencies that are employing or considering using data from companies that market tracking information, particularly as businesses reopen.
Tracking a Pandemic From Your Pocket
Tech companies that harvest user location data from smartphones are supplying that information to governments trying to get a handle on how communities are behaving during the coronavirus pandemic. In brief, here’s how the technology works:
• Apps that want to know where you are, say, to deliver a local weather forecast or navigate a mall, sometimes include software from location-tracking companies.
• The companies collect information such as your latitude, longitude as well as sometimes speed and direction, along with a unique advertising ID tied to your phone.
• That information is stored in a massive database of every breadcrumb of movement for each device, sometimes with advertising IDs obfuscated to make it more difficult to determine the original number.
• Contractors and clients will sometimes get the full data set to visualize, and sometimes they get only aggregated data, showing averages for local data, say at the level of a census block group, which generally include between 600 and 3,000 people.
• Some companies are marketing dashboards that summarize the data and generate analytics on hotspots.
• Some of these tools allow users to focus on devices that were spotted at specific points of interest, for instance showing where people who gathered in Golden Gate Park in San Francisco later travelled in San Francisco or elsewhere.
• Or the now famous X-Mode/Tectonix dashboard visual which showed the density of people visiting points of interest in Florida in March during Spring Break. It allowed authorities to track thousands of spring breakers who traveled to Florida, and then to track them as they dispersed to cities across the U.S. amid the coronavirus outbreak:
I spoke with a programmer at Tectonix who told me me tech companies, including X-Mode and Skyhook Wireless, have supplied detailed location data to federal-government contractors or to agencies such as the Centers for Disease Control and Prevention. And remember: these efforts are distinct from the Apple/Google project I noted above to build an infrastructure to help notify people who have been close to others known to be infected with the virus. That project relied on apps that users must find, download and activate before they start collecting data.
Which points out the beauty (or horror if you are a data privacy advocate) of the ad tech system. By contrast, the data being offered by location-tracking companies usually don’t come from a dedicated app. Instead those companies rely on stores of information they have already collected – and continue to collect – from millions of devices running unrelated mobile apps to which users have granted permission to access their locations.
And because, for privacy reasons, Apple and Google said they won’t allow the exposure-notification apps using their system to access location services on users’ phones, many local officials said the Apple/Google option makes them less useful for tracking population movements or finding hot spots. That is paving the way for other data providers to rush in.
Some public health authorities are going further. In California, authorities are using data collected from “smart” thermometers made by the private company Kinsa Inc. to track flare-ups of fever around the San Francisco area. They are even using data that companies have been posting free online. When the virus first began to spread in the U.S., California authorities turned to data from OpenTable, the restaurant-reservation company, to track where residents of San Francisco were gathering. By the end of February, there were far more vacant seats at restaurants in San Francisco than in Los Angeles and New York, as more people stayed home.
The Foursquare story is one of the most intriguing just based on its continuing, multi-part series on COVID-19 data and its in-depth Zoom calls over the last few months. Founded in 2009, it became a social-media darling, allowing users to share their locations with friends and check in as the “mayor” of their favorite dive bar. I use it throughout the summer to locate friends across the Greek islands to set “meet ups”. Realizing the potential for selling its data, it pivoted to providing location-based services for other apps, such as AccuWeather Inc. Foursquare collects data from about 30 million devices globally through location check-in apps that it runs, such as Swarm, or dozens of apps that it partners with that it doesn’t disclose. Less than six months ago, Foursquare was publicly calling for increased regulation, saying it was needed to restore trust in the location-tracking industry.
Now … well, the state of California is just one state (among many countries) using Foursquare data for pandemic response. Foursquare has (obviously) declined to provide details. A Foursquare spokeswoman would only say Foursquare collects data only from users who have apps with location services turned on: “We are proud of our reputation for being a responsible, trusted partner, and we hold ourselves to a high standard”. But the California Department of Public Health said in a statement:
The data provided by Foursquare are helping us deliver the right messaging in different jurisdictions. We are accessing free data from Foursquare that tracks population movement on an aggregate, rather than an individual, level.
Trade offs
Debates over the use of such data have flared up among local government officials nationwide – particularly in cities and counties that have never had to rely on outside companies to track their residents, and they now need to determine if they should scramble to secure contracts. Everything is a little bit of a privacy trade-off. But in general we do privacy trade-offs every single day in the course of our normal business of life.
For instance, NYC has built … via data exchange operators … a sort of pandemic management platform that incorporates geolocation data. The platform is not mentioned much in the press. It integrates mobile data to display aggregated information about population movements in the city. Officials could, for instance, use the system to visualize which residential communities are home to many people who work in nursing homes, which it would determine by looking at the nighttime locations of phones that visited the facility every day. But should it?
Or take X-Mode which has a deal to provide location data to San Francisco-based OmniSci, which is pitching analysis and mapping services using detailed mobile data. It could help officials identify potential virus outbreaks as the country reopens location-by-location. How detailed? Two reporters from the New York Times and Wall Street Journal watched the system filter data from five million devices to focus only on those that had spent at least 24 hours in a Florida hospital over the last two weeks of May. You could then drill down to show which points of interest those phones had visited earlier in the month, including major attractions like Walt Disney World and minor ones, like a large supermarket in Fort Myers, which the data indicated had been visited by 12 of the devices. The point? You could determine what the transmission vectors are for the disease and potentially shut down hot spots you might not otherwise be able to see.
So we’re between a rock and a hard place. There is a point to be made that when you have a global pandemic, conventional thought about data privacy can destroy your attempts to use the technology you need to resolve the problem. But the worse part is that (most) of us have lost total trust of the government and all of their agencies holding that data. I say “most” because one of the disturbing things about this pandemic is the enthusiasm with which about 25-30% of the U.S. adult population seems to have embraced authoritarianism.
But at the end of the day we’ll embrace all the technology we can to fight the pandemic. The rise of what Shoshana Zuboff calls “surveillance capitalism” over the last two decades went unchallenged. We were told “digital was fast, and stragglers would be left behind”. So off we rushed down that rabbit hole. As all of these systems became more sophisticated and more ubiquitous – general data collection, embedded mobile device sensors, cameras, facial-recognition technology, etc. – we experienced what data analysts call “phase transition” from collection-and-storage surveillance to “mass automated real-time monitoring”.
Much more importantly, the changes were done at scale, so these tools now challenge how we understand the world and the people in it. We cannot go back. We need this monster.
