RI ‘Crush COVID’ App Raises Privacy Concerns

PROVIDENCE  — If you need help staying on top of COVID-19 pandemic updates, resources or recording who you might have been close enough to infect, RI’s Crush COVID app can help, with voluntary GPS tracking that raises privacy concerns.

Gov. Gina M. Raimondo unveiled the app during her Tuesday pandemic briefing at the State House. State officials and local representatives of the Bangalore, Karnataka, India – based consulting and information technology firm Infosys, with offices on Fountain Street in Providence, collaborated on the app, she said.

The app allows users to track their personal contacts via the My Location Diary tab, valuable to health officials if a person has tested positive for the coronavirus that causes COVID-19.

The feature uses smart phone GPS location data to track places the user visited during the past 20 days. All data will be stored on the phone, and can only be shared with the user’s permission, Raimondo said. If you test positive for COVID-19, and agree to share this information with the Rhode Island Department of Health, they can quickly identify places you went and people you were in contact with and reduce the spread of COVID-19.

The My Symptom Checker feature allows you to report any symptoms and asks you to provide your zip code.

“If you submit this quick survey daily, it will help give us early indicators of COVID-19 spread in certain zip codes so we can respond by doing things like setting up testing sites in that area,” the RIDOH explains on its website dedicated to the app.

“This app is going to help epidemiologists and other folks working in public health get COVID-19 under control in the state of RI,” wrote Dr. Sarah Andrea, postdoctoral fellow in epidemiology at University of Washington.

But the app’s ability to track individuals presents a privacy tradeoff.

“As the Governor has acknowledged and most people recognize, potentially substantial privacy issues are raised by the government’s use of any technological location tracking program. That is certainly true in this case with the state’s efforts to control spread of Covid-19,” said Steven Brown, director of the American Civil Liberties Union of RI.

“We therefore greatly appreciate the fact that the Governor and her staff have understood that voluntary participation is a crucial aspect of any such program, and that steps have been taken in developing the app to help ensure that any sharing of a user’s private information is done only on an opt-in basis,” Brown wrote.

Brown also lauded state officials for arranging for it to be deleted from a person’s phone after 20 days.

” At the same time, a handful of significant questions remain about the program’s operation and its true voluntariness in practice. We consider it important for those questions to be answered in order to definitively assuage concerns about the potential ‘Big Brother’ aspects of electronic contract tracing,” Brown continued.

Some in particular that warrant clarification, he said, include:

• Since the state is encouraging employers to have their employees use the app, what protections do those employees have if an employer seeks to require its use? What prevents a supermarket or other establishments from demanding its use as a condition of entry by customer?

•  What guarantees are there that DOH will not end up sharing information it collects with law enforcement officials and others, even if for purported public health purposes, just as the Department has done with addresses in its database of COVID-19-positive individuals?

•  Will the state have the app subjected to an independent third-party audit to ensure that it is working as proposed and providing the privacy protections that have been assured?

•  The privacy policy states that app users “may choose to share with us precise geolocation or Bluetooth information using iOS and Android location services.” Since this is not how the app has been described, what is that language for?

•  How will people be informed about future updates to the app so that they can choose whether to uninstall or otherwise stop using it if the features change?

Having an effective contact-tracing app in place will allow people to safely move more freely again, Andrea said.

“Typically in infectious disease epidemiology, “contact tracing” is one of the key tools in the tool belt. If you quickly know who is sick and who they’ve been in contact with, you can isolate only those people (until they are no longer contagious) and everyone else is free to be out an about. If you want to be one step closer to being able to have the backyard barbecues and be able to watch sporting events/concerts live again… this is the way forward,” she wrote in a recent Facebook post.

“We recognize the urgency of stemming the pandemic, and are not opposed to technological tools that may offer public health benefits.  We therefore applaud the Governor for keeping privacy concerns front and center in the development of this app. However, deployed incorrectly, the app has the potential to interfere with public health efforts, undermine trust, and violate individuals’ rights. We therefore look forward to additional information so that members of the public can truly feel comfortable making use of this program and help tackle this continuing medical crisis,” Brown said.