Location data brokers say they can help contain COVID-19. Here's why that's a problem

Location data brokers, who have long gathered the whereabouts of hundreds of millions of people for the purposes of delivering ads, are coming into the spotlight, suggesting that their data can be used to help fight the COVID-19 pandemic in the US. But privacy watchdogs, who have warned about the industry's practices, are skeptical, arguing that the location data collected is inaccurate and could cause more harm than good.  

The explosive growth of the coronavirus has spurred a number of countries to use geolocation data to help address the outbreak. The data can help authorities spot movement across regions, track quarantining efforts and measure shelter-in-place effectiveness. 

China, which gathered data from popular apps like WeChat and AliPay, and South Korea have touted these surveillance efforts as positive measures to contain COVID-19's spread. In Singapore, the government's Trace Together app uses Bluetooth tracking to keep tabs on the infected and who they've been in contact with. The UK government is looking into a similar app, and MIT is leading an effort to develop one.  

The US government hasn't developed its own app for tracking phone data, but it's getting guidance from an influx of data from the mobile advertising industry. The industry has collected location data on hundreds of millions of Americans for years to better target ads to people near certain stores. Now that data is being used for a public health crisis, and it comes with privacy concerns. 

"The potential benefits of big data to help contain the virus and limit future outbreaks could be significant," Sen. Roger Wicker, a Republican from Mississippi and chairman of the Senate Committee on Commerce, Science and Transportation, said in an opening statement at a hearing on Big Data and the coronavirus on Thursday. "To maximize these benefits, however, privacy risks to consumers will need to be minimized."

Several mobile advertising companies that are looking to help halt the spread of COVID-19 have now published their own dashboards and aggregated data sets, collected from millions of people, many of whom don't know they're being tracked by their apps or what the data is being used for. 

For years, location data brokers and advertisers have acquired information by paying to put trackers in popular apps like weather services or cheap gas finders. Unless you're analyzing every app you're using, it's hard to figure out which apps are sending your location to advertisers.

That same data is now being used to track the COVID-19 outbreak. Privacy advocates and lawmakers in the past have called out location data brokers for how they gather and give away people's information, and the flaws haven't disappeared just because the data could be used for a public good, advocates say. 

"This is an essentially corrupt ecosystem of companies spying on people without any meaningful understanding or meaningful consent," said Jay Stanley, a senior policy analyst for the American Civil Liberties Union. "There is a danger that we allow these companies to validate these activities and to whitewash their reputation by repurposing their data for COVID-19." 

Locating data

Some advertising companies are working together to provide location data to researchers, noting they can help direct government decisions and policies surrounding COVID-19. 

The COVID-19 Mobility Data Network gathers information provided by Facebook and Cuebiq, a mobile advertising company that says its data is accurate to 30 feet and that tracks up to 15 million people in the US every day. 

The group says it has direct connections with departments of health at the city, state and country level, and provides aggregated data to get reports on people's movements and how well social distancing interventions are working. The group also says it doesn't share raw data with governments, third parties or the public. 

Leigh Freund, the president of the Network Advertising Initiative, highlighted this effort in a statement at the Senate commerce committee hearing.

"This information could help officials understand changes in essential trips that can then shape recommendations on business hours or inform delivery service offerings," Freund said. "Similarly, persistent visits to transportation hubs might indicate the need to add additional buses or trains in order to allow people who need to travel additional room to spread out for social distancing."

Antonio Tomarchio, president of Cuebiq, says it isn't providing data directly to any government agency, but he noted the COVID-19 Mobility Data Network has been in contact with policymakers dealing with the pandemic. 

The company's data isn't detailed enough to determine whether people are complying with the Centers for Disease Control and Prevention's guidance to stay six feet away from others, but Tomarchio says it could be useful for assessing compliance with shelter-in-place rules. 

"What we're interested in, is trends in certain areas," Tomarchio said. "If you have a big crowd in a park, this could be an indication that social distancing is not being respected." 

X-Mode, which gets location data from weather and map apps, posted a viral clip on social media that showed the movements of people from a single beach in Fort Lauderdale, Florida, during spring break. It received more than 6.5 million views.

The intent was to show how this population could be spreading the coronavirus infection from Florida to other parts of the country. 

X-Mode said it hasn't provided any data to government agencies for the purpose of tracking COVID-19. The company declined to disclose what apps its trackers are installed in. 

"[Seventy percent] of our location is in a 20M (meter) accuracy and we also collect speed, bearing and altitude as well," the company said in an email. "This allows data scientists to have an extremely dense data set to better identify how far away certain unique locations pings are from one another to build a confidence score for a specific area or county."

Data inequality  

While the advertising industry lays out the benefits of its data collection, privacy watchdogs warn that using location data collected from apps and mobile phones will lead to disproportionate policies. 

A big problem is consistency. Not every person is using a certain, say, weather app with the location data company's trackers in its code. So if government officials are making decisions based on that data, it would mean only those people would benefit. 

"The mobile industry's location data set is especially incomplete and varied," said Angel Diaz, liberty and national security counsel at the Brennan Center for Justice. "This data comes from users that choose to share their location information with particular mobile apps . Some users might only share their location while using the app, others indefinitely, and still others may opt out entirely."  

The data could be helpful to analyze wider trends, but it's limited in how representative it actually is, Diaz said, calling it "more of a snapshot than an accurate accounting." 

That snapshot of the population could be fine for advertising purposes, but for public health decisions, it could mean that communities not using these apps aren't getting the help they need during the pandemic. 

"There could be tragic consequences if their allocation of medical resources is misdirected because of the differences in technologies and app uses," the ACLU's Stanley said. 

Tomarchio said that Cuebiq in the past has tested to see how representative its demographics are, and believes its data is reflective of the population at large. 

He noted that Cuebiq gets geolocation data from a handful of sources, including weather and travel apps. Those apps include Gas Buddy, My Radar and the Coupon App. 

"Considering that we work with general consumer apps that are used across the country, it is pretty representative," he said. 

Certain apps and devices are more widely used by affluent and younger communities, Stacey Gray, senior counsel for the Future of Privacy Forum, told lawmakers. That could leave out some of the most vulnerable segments of the population. 

"This includes underrepresentation of the elderly, very young or lowest-income people who do not own cellphones, or anyone who does not own a cellphone for other reasons, such as refusal on religious grounds," Gray said in her testimony to Congress on Thursday. 

Faking it  

Researchers who study how apps gather location data have also noted that the data collected isn't accurate, or doesn't have any safeguards from it being altered. 

Devices are able to spoof their location data, which people have done to cheat games like Pokemon Go. Geolocation trackers for advertisers don't prevent that because it doesn't frequently happen, and the consequences are low-stakes. 

Fighting coronavirus: COVID-19 tests, vaccine research, masks, ventilators and more

+30 More

See all photos

But the stakes are higher when it comes to this pandemic. 

"They're not particularly interested in accuracy. Ad companies don't have to be," said Jennifer Stisa Granick, the ACLU's surveillance and cybersecurity counsel. "But the cost of inaccuracy in these kinds of pandemic situations can be quite consequential."

Will Strafach, CEO of mobile security company Guardian, explained how it was very simple to fake and scale up with botnets using spoofed identifiers sending altered data to the trackers' servers. This doesn't usually happen because in the past, all that it would really affect is what kinds of ads are sent to people's phones. But if it can affect government policy, malicious actors could take advantage of this vulnerability, Strafach warned. 

With click farms using hundreds of thousands of phones to commit ad fraud, relying on advertising data to affect public policy could end up doing more harm than help. Cuebiq's Tomarchio said his company can detect anomalies with location data, like when data sent from a phone jumps from one place to another that would be physically impossible. But researchers are skeptical.

Strafach has researched hundreds of trackers embedded in apps and has never found any way to prove that the location data isn't faked.

"Someone could write a script to send a bunch of fake data and they have no way to sort it out," Strafach said. "If there is someone who wanted to deprive somewhere of resources or get a lot of resources somewhere, all they would have to do is fake this data on multiple phones."