fb-pixel Skip to main content

Health care or spyware? Lawsuit attacks Mass. COVID-tracking app

A class action lawsuit has been filed against the Massachusetts Department of Public Health for secretly installing COVID-tracking software onto millions of smartphones without permission from the phone users.Chris Goodney/Bloomberg

A nonprofit law firm has filed a class action lawsuit against the Massachusetts Department of Public Health for allegedly working with Google to secretly install COVID-tracing software onto as many as a million smartphones.

“Conspiring with a private company to hijack residents’ smartphones without the owners’ knowledge or consent is not a tool that the Massachusetts Department of Public Health may lawfully employ in its efforts to combat COVID-19,” says the complaint, which was filed in Boston federal court last week. “Such brazen disregard for civil liberties violates both the United States and Massachusetts Constitutions, and it must stop now.”

Advertisement



The suit was filed by the Washington-based New Civil Liberties Alliance, an organization that often litigates on behalf of conservative and libertarian causes. The organization receives much of its funding from conservative philanthropist Charles Koch.

The alliance sued on behalf of Massachusetts resident Robert Wright and Johnny Kula, a New Hampshire resident who commutes to Massachusetts every day. Both men objected to having a COVID-tracing app installed on their phones without permission. Kula also said that when he deleted the app, it reappeared on his phone.

At the height of the COVID pandemic, tech giants Apple and Google developed a system that used a smartphone’s Bluetooth radio to warn people if they came into contact with someone infected with the disease. An infected person’s phone would transmit a warning to nearby people running the same app. These people would get a message urging them to get tested for COVID.

Dozens of states issued such apps, including Massachusetts. But few people voluntarily used the Massachusetts version. According to the lawsuit, the state health department worked with Google to develop a version that was installed on all Android phones, without permission from the phone owner.

Advertisement



Sheng Li, litigation counsel for the New Civil Liberties Alliance, said that this involuntary download policy violates the US Constitution’s Fifth Amendment, which forbids government agencies from taking a citizen’s property without just compensation. The memory inside a smartphone belongs to the owner, and “the government cannot take your property without giving you some sort of justification,” said Li.

Android owners are given the choice of whether to activate the Massachusetts app. But the suit alleges that the app transmits and receives data through its Bluetooth radio even when it’s not activated. This data can be accessed by Google and by a variety of apps installed on Android phones, the suit claims. If enough data is collected from enough phones, data scientists can “de-anonymize” the information and figure out the identities of the phone users.

Li said that a government-sponsored app that collects user data without permission violates the Fourth Amendment, which forbids random searches and seizures of personal property. Li added that the lawsuit doesn’t involve Apple’s iPhone, which offers a similar contact-tracing system, because his organization has received no complaints from iPhone users about possible invasions of their privacy.

The lawsuit was viewed with skepticism by Kade Crockford, director of the Technology for Liberty program at the American Civil Liberties Union of Massachusetts.

“The technology at issue in this case is very low on the list of things that should concern smartphone users,” said Crockford. “While the technology’s value in terms of reducing viral transmission has not been demonstrated, we have seen no evidence that the system is violating people’s privacy.”

Advertisement



A spokesperson for the Department of Public Health declined to comment on the lawsuit, and Google did not respond to requests for comment.


Hiawatha Bray can be reached at hiawatha.bray@globe.com. Follow him on Twitter @GlobeTechLab.