Coronavirus: Thread

grarpamp grarpamp at gmail.com
Wed May 11 20:02:24 PDT 2022


CDC Tracked Millions Of Americans During Lockdowns To Monitor Movement

https://www.vice.com/en/article/m7vymn/cdc-tracked-phones-location-data-curfews
https://www.vice.com/en/article/5db4ad/google-bans-safegraph-former-saudi-intelligence
https://www.nature.com/articles/srep01376

The Centers for Disease Control (CDC) spied on millions of Americans
using cell phone location data in order to track movements and monitor
whether people were complying with lockdown curfews during the
pandemic.

According to CDC documents from 2021 obtained by Motherboard via a
Freedom of Information Act (FOIA) request, the program tracked
patterns of people visiting K-12 schools - and in one case, monitored
"the effectiveness of policy in the Navajo Nation." The documents
reveal that while the CDC used the pandemic to justify purchasing the
data more quickly, it actually intended to use it for general agency
purposes.

    The documents reveal the expansive plan the CDC had last year to
use location data from a highly controversial data broker. SafeGraph,
the company the CDC paid $420,000 for access to one year of data to,
includes Peter Thiel and the former head of Saudi intelligence among
its investors. Google banned the company from the Play Store in June.
-Motherboard

The data which was purchased comes from cell phones - meaning
SafeGraph can track where a person lives, works, and where they've
been, and then sell that data to various entities. The data which the
CDC bought was aggregated - which is designed to follow broad trends
in how people are moving around, however researchers have raised
concerns over how location data can be deanonymized to track specific
individuals.

According to the CDC documents, SafeGraph's data "has been critical
for ongoing response efforts, such as hourly monitoring of activity in
curfew zones or detailed counts of visits to participating pharmacies
for vaccine monitoring."

"The CDC seems to have purposefully created an open-ended list of use
cases, which included monitoring curfews, neighbor to neighbor visits,
visits to churches, schools and pharmacies, and also a variety of
analysis with this data specifically focused on ‘violence,'" said Zach
Edwards, a cybersecurity researcher who closely follows the data
marketplace.

As far as unmasking individuals, Edwards noted how SafeGraph's data
can be used to pinpoint certain people.

"In my opinion the SafeGraph data is way beyond any safe thresholds
[around anonymity]," he said, pointing to one result in SafeGraph's
user interface that showed individual movements to a specific doctor's
office - indicating how finely tuned the 'aggregated' data actually
is. If a bad actor wanted to unmask someone, they could theoretically
do so using similar techniques.

    The documents contain a long list of what the CDC describes as 21
different “potential CDC use cases for data.” They include:

        “Track patterns of those visiting K-12 schools by the school
and compare to 2019; compare with epi metrics [Environmental
Performance Index] if possible.”
        “Examination of the correlation of mobility patterns data and
rise in COVID-19 cases [...] Movement restrictions (Border closures,
inter-regional and nigh curfews) to show compliance.”
        “Examination of the effectiveness of public policy on [the]
Navajo Nation.” -Motherboard

A screenshot of the use cases proposed by the CDC. Image: Motherboard.

Cell phone location data has been used throughout the pandemic for
various purposes - including by media organizations reporting on how
people were traveling once lockdowns began to lift.

That said, the CDC wanted the data for more than just tracking
Covid-19 policy response. While the procurement documents say the data
is for "an URGENT COVID-19 PR [procurement request]," one of the
included use cases reads "Research points of interest for physical
activity and chronic disease prevention such as visits to parks, gyms,
or weight management businesses."

Another section expands on non-Covid-19 related uses.

"CDC also plans to use mobility data and services acquired through
this acquisition to support non-COVID-19 programmatic areas and public
health priorities across the agency, including but not limited to
travel to parks and greenspaces, physical activity and mode of travel,
and population migration before, during, and after natural disasters,"
it reads. "The mobility data obtained under this contract will be
available for CDC agency-wide use and will support numerous CDC
priorities."

The data purchased by the CDC was SafeGraph's "U.S. Core Place Data,"
"Weekly Patterns Data," and "Neighborhood Patterns Data," the latter
of which includes information such as 'home dwelling time' which is
aggregated by state and census block, per Motherboard.

"SafeGraph offers visitor data at the Census Block Group level that
allows for extremely accurate insights related to age, gender, race,
citizenship status, income, and more," reads a CDC document.


More information about the cypherpunks mailing list