Location data used for tracking COVID-19 has its limits, ACLU warns

In a report published Wednesday, the ACLU noted multiple flaws with how location data is collected and has been used for tracking the COVID-19 outbreak. The report, written by ACLU senior policy analyst Jay Stanley and surveillance and cybersecurity counsel Jennifer Stisa Granick, points to issues with inaccurate data collected, governments failing to properly anonymize the data, and algorithms making mistakes for public health policy. 

Location data used for tracking COVID-19 has its limits, ACLU warns Picture 1

Countries like China, South Korea, Israel, and Singapore have adopted surveillance methods for COVID-19 by using phone location data to enforce social distancing policies and establish quarantines in affected regions. The US government has expressed similar interests, getting data from the mobile advertising industry. Tech giants like Facebook and Google have also released aggregated data they've collected for the public health crisis. 

The idea is that the location data would help government officials know if people are abiding by shelter-in-place rules, as well as provide a history of who COVID-19 patients have been in contact with to bolster quarantining efforts. 

The ACLU report points out that the data the government officials are using could be flawed, since much of what's collected isn't specific enough for making health policy decisions. Location data collected can come from a variety of sources, including cell towers, GPS and Bluetooth. 

While it's narrow enough to track people's movements throughout the day, it's not accurate enough to measure if people are keeping a distance of six feet apart, which is the Centers for Disease Control and Prevention's recommendation for preventing COVID-19's spread. 

"Commercial location databases are compiled for advertising and other purposes and are simply not accurate enough to reliably determine who was in close contact with whom," the report states. 

GPS data can only get down to an accuracy of about 5 to 20 meters, while cell tower data provides just a general location or direction of travel, the ACLU said. 

The Chinese government had considered using cell towers for location data, but found that method had too many inaccuracies, according to the New York Times. 

The mass, regional data that can be collected would be useful for measures like detecting movements between areas, and figuring out if people are sheltering in place, but governments haven't provided guarantees that this data is properly being protected. 

The ACLU cited a case in South Korea in which a man who tested positive for COVID-19 provided data to government officials about his whereabouts. The intent was to allow officials to warn the public about going into certain areas, and for people who may have been in contact with him to get tested. 

But the data published on the man was specific enough to identify his age, where he worked, where he lived, and the fact that he got infected while attending a sexual harassment class, according to the BBC. 

The report also raised issues with government officials relying on algorithms to make decisions based on location data it receives. The ACLU pointed to a case in Israel in which a woman was automatically selected for quarantine because data showed she had been in contact with her partner, who tested positive for COVID-19. But the data failed to show that she was actually waving at her partner through his apartment window. 

The report isn't entirely opposed to using technology to help the fight against the coronavirus, but emphasizes that there are limits to the effectiveness of location data and that governments need to properly protect privacy while using the information it's gathering. 

"The potential for invasions of privacy, abuse and stigmatization is enormous," the report says. "Any uses of such data should be temporary, restricted to public health agencies and purposes, and should make the greatest possible use of available techniques that allow for privacy and anonymity to be protected even as the data is used."