Who is tracking your smartphone data during coronavirus pandemic?

Smartphone companies have always gathered data on their users. But in the weeks since the covid-19 pandemic gained traction in the U.S., special attention has been given to data’s role in curbing the spread of the disease. Experts say data can be used to trace individuals’ contact with others who have tested positive for covid-19.

In a process known as “contact tracing,” location data can show where an infected individual traveled and what establishments they entered. Bluetooth signals from smartphones can help authorities see who an infected person came in contact with.

“A lot of people don’t realize how much data their smartphone (and smartphone apps) are collecting on them,” said Jason Hong, a professor at Carnegie Mellon University’s Human-Computer Interaction Institute.

Apple and Google announced last week a joint contact tracing effort using Bluetooth technology. A person infected with covid-19 can voluntarily identify themself to health authorities through a mobile application. Then, using Bluetooth signals that phones are always sending to one another, the app would notify anyone whose smartphone had come near the infected person’s in the last 14 days.

South Korea, which has been widely praised for its swift handling of covid-19, has used contact tracing to curb the disease’s spread, as has China and Singapore. Some researchers are considering what tracing will look like in the U.S.

Even before the tech giants’ announcement, location data was being used in relation to the pandemic. The company Unacast created a “Social Distancing Scoreboard” to rate each county and state on how well they’ve limited travel since late February. Pennsylvania was given a C-.

Under normal circumstances, Hong said these tools are most often used by advertisers. Phones use GPS data to search for Wi-Fi signals, and apps track users’ ZIP codes to provide insight on income, interests and demographics. Knowing a user’s exact location allows companies to launch targeted advertisements — that’s why when a person is in a convention center, they receive ads for goods and services around and inside the convention center, Hong said.

These practices have come under scrutiny in the past, with several tech companies testifying before Congress in 2018. With no clear opt-in or opt-out, Hong said, the lack of transparency surrounding data collection caused unease and concern over privacy. But amid a pandemic, there is no denying this data could be supremely valuable, he said.

“If you know a person who has been sick, you can see all of the places that they went to and you can also contact the people who were also at those same places at the same time,” Hong said. “That could be really useful.”

Google and Apple already have access to the location tools to put these measures in place, but the logistics of creating such a system may be problematic. Hong predicted Google and Apple will have to combine their data — to create one data set with IOS and Android users. Then it would have to be decided who would be in charge of the information and exactly what purposes they could use it for.

Many questions remain unanswered: Who would they trust to use this data? Do we trust the government to do this? A university? Will data be shared with other entities, and which ones? How do we guarantee it’s only going to be used for this purpose? Will the data be disposed of once the pandemic is over?

Still in the early stages of launches the application, Apple and Google have stressed that data collected would be anonymous by not collecting users’ physical locations or personally identifiable information. But if health authorities are able to contact an individual who came in contact with an infected person there is still uncertainty about how protected users will be.

“If they can reach you, there’s a question about whether or not they can identify you,” said Sandy Garfinkel, a Pittsburgh-based litigator and chair of the Data Security & Privacy Group at the law firm Eckert Seamans Cherin & Mellott. “Or, can it be reassembled by someone who knows how to put the pieces of the puzzle back together?”

Jennifer Granick, surveillance and cybersecurity counsel for the American Civil Liberties Union, expressed doubts that the tracing application proposed by tech companies last week could be effective without widespread testing for the disease and the trust of smartphone users.

“People will only trust these systems if they protect privacy, remain voluntary and store data on an individual’s device, not a centralized repository,” Granick said in a statement. “At the same time, we must be realistic that such contact tracing methods are likely to exclude many vulnerable members of society who lack access to technology and are already being disproportionately impacted by the pandemic.”

Granick said Apple and Google’s proposed approach seems to mitigate the worst privacy concerns, but the ACLU intends to monitor them closely.

Garfinkel said the intentions and possibilities of the application are probably all good ones. Users just need to be aware of what they’re signing up for.

“A personal assessment needs to be made,” he said. “It’s a balance.”

There is a sense of emergency in a pandemic that may cause people to act rashly. There are examples throughout history — like 9/11, Garfinkel said — when privacy concerns were overlooked with a mindset of “the ends justify the means.”

“There is a tendency for people in crisis to be more willing to give up personal rights,” Garfinkel said. “Later, when things die down, there may be some regret that some things that were given up can’t be retrieved.”

Data can be used not only for contact tracing during pandemics but also to improve urban planning, sustainability and health care. On the other hand, the same information can be used for spyware, invasive advertising and abuses by authoritarian governments, Hong said.

“It’s a huge opportunity, but it’s also hugely problematic,” Hong said. “The same data can be used for tremendous amounts of good and can also be hugely abused.”

While the concerns are real, Hong said the pandemic has spurred an important conversation about the potential lifesaving uses of data.

“It actually might be worth trying to set something up now, so that if anything like this happens in the future, we’re ready,” he said.