U.S. Senator Josh Hawley (R-Missouri) is calling for Apple CEO Tim Cook and Google-parent Alphabet Inc. CEO Sundar Pichai to be held personally accountable for any potential privacy lapses or misuses of Apple’s and Google’s joint COVID-19 contact tracing technology.
Dear Mr. Pichai and Mr. Cook:
Your recently announced project to respond to COVID–19 by tracking when and where Americans interact with each other raises serious concerns. Especially because of Google’s poor record on privacy, I fear that your project could pave the way for something much more dire.
The possible implications this project could have for privacy are alarming. For example, your materials state that the data necessary for this project will be anonymized. But anonymity in data is notoriously unstable. Data typically can be reidentified simply by cross-referencing it with another data set. Pairing the data from this project with the GPS data that both your companies already collect could readily reveal individual identities.
Worse, when paired with other data sets, the data from this project could create an extraordinarily precise mechanism for surveillance. Both your companies collect GPS data, but the GPS system has significant limits. It works poorly indoors and cannot pinpoint the floor a person is on. Combining the data from this project with GPS data (or other data, such as Wi-Fi positioning), could greatly erode privacy by making precise surveillance much easier.
Americans are right to be skeptical of this project. Even if this project were to prove helpful for the current crisis, how can Americans be sure that you will not change the interface after the pandemic subsides? Once downloaded onto millions of phones, the interface easily could be edited to eliminate previous privacy protections. And any privacy protection that is baked into the interface will do little good if the apps that are developed to access the interface also choose to collect other information, like real-time geolocation data. When it comes to sticking to promises, Google’s record is not exactly reassuring. Last year a Google representative had to admit, under oath, that Google still tracks location history even when a person turns location history off. As the Associated Press put it, “Google wants to know where you go so badly that it records your movements even when you explicitly tell it not to.”
A project this unprecedented requires an unprecedented assurance on your part. Too often, Americans have been burned by companies who calculated that the profits they could gain by reversing privacy pledges would outweigh any later financial penalty levied against the company. The last thing Americans want is to adopt, amid a global emergency, a tracking program that then becomes a permanent feature in our lives.
If you seek to assure the public, make your stake in this project personal. Make a commitment that you and other executives will be personally liable if you stop protecting privacy, such as by granting advertising companies access to the interface once the pandemic is over. The public statements you make now can be enforced under federal and state consumer protection laws. Do not hide behind a corporate shield like so many privacy offenders have before. Stake your personal finances on the security of this project.
I look forward to hearing about how you intend to try to provide Americans with assurance.
United States Senator
MacDailyNews Take: Regardless of the efficacy issues with contact tracing*, this should put another nail in its PR coffin as we doubt Cook or, especially, Pichai (suffice to say that Google is not held is high regard for protecting user privacy) would stake their personal reputations and finances on this quixotic, feel-good effort at producing pablum for the masses.
No location data is truly anonymized. It can be cross-matched with other publicly-available data to identify and track individuals. The idea of any government requiring cellphone tracking to monitor its citizens’ movements, regardless of the reason, is chilling. — MacDailyNews, April 2, 2020
Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety. — Benjamin Franklin
Lastly, Apple should be careful here. Google has an awful reputation regarding user privacy. Apple must be wary of tarnishing (or destroying) the reputation for user privacy that they’ve carefully built over many years with a system that not only involves Google, of all companies, but that also has a slew of obvious privacy issues. — MacDailyNews, April 13, 2020
*Beyond risks with contact tracing privacy, no matter how well-designed the Apple-Google system is on paper, in practice too few people will install and use it, while reliance on Bluetooth connectivity (range, materials penetrance, public transport, etc.) will result in myriad false positive issues. This seems like something designed to provide a digital security blanket to help increase confidence for going back to work more than anything else. More about the myriad issues of Bluetooth COVID-19 contact tracing apps can be found in our Takes here and here.