[
According to the CDC documents obtained by motherboard, the Centers for Disease Control and Prevention (CDC) purchased location data obtained from tens of millions of mobile phones in the United States to analyze the compliance with the curfew, track the patterns of people visiting K-12 schools, and especially monitor the effectiveness of the policy. These documents also show that although CDC purchases data faster on the grounds of covid-19, it intends to use it for CDC's more general purposes.
Location data is from mobile Device location information, and then can display a person's life, work and whereabouts. The data purchased by the CDC is aggregated - which means it is designed to track trends from the movement of a group of people, but researchers have repeatedly raised concerns about how location data can be anonymized and used to track specific people.
These documents reveal the huge plan developed by the CDC last year to use location data from a highly controversial data intermediary. The CDC paid $420000 for safegraph, a company whose investors included Peter Thiel and the former head of Saudi intelligence. Google banned the company from the play store in June.
The CDC used the data to monitor the curfew, and the document said that safegraph's data "is crucial to the ongoing response, such as hourly monitoring of curfew activities or detailed statistical visits to pharmacies involved in vaccine monitoring". These documents were generated in 2021.
Zach Edwards, a cyber security researcher who pays close attention to the data market, told motherboard in an online chat after consulting the documents: "the CDC seems to have deliberately created an open use case list, including monitoring curfews, visits between neighbors, visits to churches, schools and pharmacies, as well as various analyses conducted with these data, with special attention to 'violence'.". (the document does not stop at the church; it refers to "places of worship").
Motherboard obtained these documents by applying to the CDC for the freedom of Information Act (FOIA).
These documents contain a long list, which CDC calls 21 different "CDC potential data use cases". They include.
"Track the pattern of people visiting K-12 schools by school and compare it with 2019; if possible, compare it with EPI index [environmental performance index ]."
"Check the correlation between the flow pattern data and the rise of covid-19 cases [... ] flow restrictions (border closures, interregional and night curfews) to show compliance."
"Review the effectiveness of public policies in [Navajo ] countries".
At the beginning of the pandemic, mobile location data was seen as a potentially useful tool. Several media organizations, including the New York Times, used location data provided by companies in the industry to show where people would go once the blockade began to be lifted, or stressed that poorer communities could not take refuge in place like richer communities.
The covid-19 pandemic as a whole has become a tipping point in the broader cultural war, with Conservatives and anti vaccine groups protesting against the government's mask and vaccine enforcement. They also expressed a particular paranoia that vaccine passports would be used as a tracking or surveillance tool, attributing refusal to vaccinate to civil liberties. Robert Kennedy Jr.'s child health protection organization is one of the more influential and funded anti vaccine organizations in the United States. They advocate that digital vaccine certificates may be used to monitor citizens' concerns. The vaccine passport is "a Trojan horse used to create a new controlled and monitored society in which the freedom we enjoy today will become a distant memory," Dustin Nemos, the founder of qanon, wrote on telegraph in December
In the context of this intensification, the use of mobile location data for such a wide range of tracking measures may be controversial, even if it is effective for better understanding the spread of the pandemic or providing information for policies. It may also provide anti vaccine organizations with a real-world data point to issue the darkest warnings.
The procurement document states, "this is an urgent covid-19 PR [procurement request ]" and calls for accelerated procurement. But some use cases are not explicitly linked to the covid-19 pandemic. "Research on sports activities and chronic disease prevention, such as visiting parks, gyms or weight management companies," one wrote.
Another part of this document describes the use of location data in non covid-19 related projects.
"CDC also plans to use the mobility data and services obtained through this acquisition to support non covid-19 program areas and public health priorities throughout the organization, including but not limited to access to parks and green spaces, physical activities and travel methods, and population migration before, during and after natural disasters," it wrote. "The liquidity data obtained under the contract will be used by CDC as a whole and will support many of CDC's priorities."
The Centers for Disease Control and prevention did not respond to multiple emails asking for comments on which use cases it deployed safegraph data. Safegraph is part of the balloon positioning industry. Safegraph has previously shared a data set containing 18 million mobile phones in the United States. The document said that the acquisition is geographically representative data, "that is, at least 20 million active mobile phone users from all over the United States every day".
In general, companies in this industry require or pay application developers to add location data collection code to their applications. The location data is then sent to companies that can resell the original location data directly or package it into products.
The event organization Electronic Frontier Foundation (EFF) previously found that in January 2019, the Illinois Department of transportation purchased such data related to more than 5 million mobile phones from safegraph. CDC documents show that the agency purchased safegraph's "US core location data", "weekly pattern data" and "neighborhood pattern data". The last product includes information such as family residence time, which is summarized by state and census area. "Safegraph provides visitor data at the level of census District groups, allowing extremely accurate observation capabilities related to age, gender, race, citizenship, income, etc.," said a CDC document
Both safegraph and CDC have mentioned their partnership before, but they are not as detailed as disclosed in the document. The Centers for Disease Control and Prevention published a study in September 2020 that investigated whether people across the country complied with orders to stay at home, which seemed to use safegraph data.
Safegraph wrote in a blog post in April 2020: "in order to play our role in combating the covid-19 health crisis and its devastating impact on the global economy, we decided to further expand our plan to make our pace data free to non-profit organizations and local, state and federal government agencies." Several location data companies touted their data as potential mitigation measures at the peak of the pandemic in the United States, and provided data to governments and media organizations.
According to these documents, a year later, CDC purchased the right to use the data because safegraph was no longer willing to provide the data for free. The document added that the data use agreement for providing data in kind will expire on March 31, 2021. The CDC said in the document that as the US epidemic prevention measures come to an end and the society begins to reopen, these data are still important access objects.
"As the country reopens, the CDC is interested in continuing to obtain these liquidity data. These data are used by several teams / groups to respond and lead to an in-depth understanding of the pandemic because it is related to human behavior," a part of the document wrote.
Eff researchers obtained documents about CDC's purchase of similar location data products from a company called cubeiq and safegraph. Eff shared these files with motherboard. These documents show that CDC also requested to speed up the purchase of cubeiq data because of covid-19 and intends to use it for non covid-19 purposes. These files also list the potential uses of the same cubeiq data as in the safegraph file.
Google banned safegraph from its Google play store in June. This means that any application developer who uses safegraph code must remove it from the application, otherwise it will face the fate of deleting the application from the store. It is not entirely clear how effective the ban will be. Safegraph previously said that it obtained location data through veraset, a spin off company connected with application developers.