26 ms·

CDC tracked millions of phones to see if Americans followed lockdown orders

406 points by KoftaBob 4y ago

samschooler 4y ago
See the issue here is that this data exists at all and it’s purchasable by any group. I feel like the CDC are the least scary people buying this data. And from the looks of it they used it for medical research, which if similar in style to other medical research is bound by boards and ethics committees. What we aren’t writing about in this article are the groups using this data Cambridge Analytica style to sway political opinion, and other less than stellar purposes.
- Proven 4y ago
  [dead]
- LorenPechtel 4y ago
  Yeah. I have no problem with researchers getting anonymized data. CDC, snoop all you want. It's the business guys I don't like having it.
  - nickff 4y ago
    Governments have a long and storied record of data abuse, from the Stasi in East Germany to LoveInt at the CIA.
    - Nextgrid 4y ago
      Yes, but those threats already exist regardless and stopping the sale of carrier data won't stop them. Ideally you'd want to stop both, but if I had to choose I'd prefer that only the government has access rather than the highest bidder (which can be the government if they so desire, so in the end you're back at square one anyway).
      - maerF0x0 4y ago
        Did you know there are many classes of crime that follow the pattern you spoke of "It already exists out there, and will persist even if I stop, I'm not creating it just propagating it..." One pretty nasty example would be revenge porn. a lesser one would be piracy of copyright material
    - lucb1e 4y ago
      Of course one has to keep government( agencie)s in check, but to compare the CDC to the Stasi.... I don't know if that's really an apt or appropriate comparison
    - modriano 4y ago
      Humans have a long and storied record of using tools and information to do malicious things. But we also have a long and storied record of using tools and information to produce the incredible advances of the past few centuries, where the median life expectancy has nearly doubled from the baseline over the past 50k years. Personally, I would really prefer a system where health information was centralized and easily transferrable to healthcare providers, as I think it would be massively better if we could learn from the bad outcomes of others rather than creating thousands of information silos that have to learn these expensive lessons in parallel, and it would also allow us to know the prices of healthcare services thereby enabling efficient markets to develop.
      - chaps 4y ago
        Are you suggesting that this location information is "health" data and is okay for them to use and store?
        jonathankoren 4y ago
        Yes. Location data is health data. It has been since 1854. https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outbreak https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outb...
        chaps 4y ago
        Just because data is used in understanding something related to health doesn't mean that it's "health data" in a legal, protected, or regulatory sense. Nor does it mean that they should have de facto access to the data without limitations. Hell, the closest thing I'm aware of that's close to it (at least under HIPAA) is the name or address of a hospital that a person's visited. Would you be okay if the CDC purchased data from period-tracking apps to track periods? Or how many bottles of soap I purchase in a year? Or how much booze everyone buys?
        jonathankoren 4y ago
    - arcticbull 4y ago
      Right, because businesses have never done anything bad with data, it's all those government guys. The government of course being the one tasked with improving the health and welfare of the population, not with turning a profit.
      - bendbro 4y ago
    - pirate787 4y ago
      The U.S. Govt used individuals' Census data to round up Japanese-Americans for FDR's World War II internment camps. They also lied about it and claimed that they were only using anonymized data. https://exhibits.lib.berkeley.edu/spotlight/census/feature/japanese-americans-in-world-war-ii-and-the-census https://exhibits.lib.berkeley.edu/spotlight/census/feature/j...
    - tablespoon 4y ago
      >> Yeah. I have no problem with researchers getting anonymized data. CDC, snoop all you want. It's the business guys I don't like having it. > Governments have a long and storied record of data abuse, from the Stasi in East Germany to LoveInt at the CIA. "Governments" is far too coarse-grained of a category; it invites sloppy thinking.
    - ChrisLomont 4y ago
      They also have a long and storied history of helping the public avoid widespread disasters and preventing larger outbreaks of disease through using data. Which of these is more common and useful?
    - epgui 4y ago
      That's either a straw man argument or a moral equivalence fallacy, depending on what point you believe you're making.
    - LorenPechtel 4y ago
      Note that I said "anonymized". The first step should be to separate the identity from the data. The phone's ID is plenty for research purposes, keep the name out of it.
  - chrisco255 4y ago
    Right, because governments have never done anything wrong in the history of the world. It's all those evil business guys.
  - 0xy 4y ago
    You're right, because there's never been a leak of personal data from any researcher or government department.
- dontcare007 4y ago
  Problem is that once they use it for a benign reason, use of the data will expand into other, less palatable uses.
  - mywittyname 4y ago
    The problem is that this data is available for anyone to purchase. And anyone includes groups that you don't want to have it. Some people focus their attention on limiting the government's ability to collect this information, but just go about ignoring businesses being legally allowed to keep and sell this data. Now the government is leveraging privatized markets for all of their spying needs and it is neatly kept out of the courts. As the article points out, it wasn't just the CDC performing these kinds of analysis. News organizations were doing the same thing. If we want to curb government surveillance, we need to curb corporate surveillance by legally enshrining a right to privacy that limits the information that companies can collect and sell. Which, ironically, will mean government regulation and enforcement.
    - landemva 4y ago
      More than one facet to the problem and potential solutions. How about... The problem is this data is not owned by the individual. Which will mean government guidelines and optional private enforcement via lawsuit with meaningful minimum penalties.
    - cmroanirgo 4y ago
      The problem could also be said to start with software. Particularly Apple and Google for allowing specific location information to be used in the same app as advertising. The problem is that all apps are granted access to the internet. Nip those two things in the bud and the problems will slow down, I think. But it's a pipe-dream, I know. In the early days of Android, I remember reading that Android was Android because you had to jump through all these permission hoops with j2me (Java 2 Mobile Edition). Hence, Android was better and more easy to use than j2me. Here we are, 15 years later with exactly the same set of permissions problems... with one exception, Android still gives out internet access without permission. Many devs here would be aghast at the idea of an app not being internet connected. I believe Google did it that way because Steve Jobs had done it that way in the iPod and iPhones. (I presume there's some HN'ers here that can refute this?) I remember my colleagues at the time remarking how refreshing it was to not have to deal with permissions (because customers disliked all the modal permissions that popped up in j2me)... and we all jumped on board the iPhone and Android development train, not knowing the problems that we'd have down the line.
- alephxyz 4y ago
  OC's point is that the data was _already_ being used for other less palatable uses.
- KoftaBob 4y ago
  Agreed. The data broker that the CDC got this data from is SafeGraph. What we really should be asking is what "partners" SafeGraph got this data from, and how.
- cm2187 4y ago
  Given the virtually unlimited executive powers the CDC believes it has, I am not sure I agree with your assessment that it is the least scary people. But I agree that the problem here is not that the CDC is buying it so much that this data is available to be bought.
  - loceng 4y ago
    - user_7832 4y ago
      > Fauci as the saviour in Stockholme Syndrome... Not a downvoter (to your comment, I rarely vote) but does anybody pro-mask/pro-vaccine/pro-lockdown actually consider him a saviour? All I see (as a non American) is folks on the right hating him being considered a saviour... but I don't find a single post glorifying him even on left-leaning reddit.
      - xapata 4y ago
        No, the language of "savior" tends to come from religious extremists.
      - loceng 4y ago
        It's just the psychological term used as part of explaining Stockholm Syndrome behaviour. It doesn't mean it's conscious behave or a conscious belief.
        pstuart 4y ago
        meh. not the best explanation or even use of the term.
        brewdad 4y ago
        It's invented bullshit? Got it.
      - dekhn 4y ago
- mensetmanusman 4y ago
  The government having it is the most scary, because they have a monopoly on violence.
  - BeefWellington 4y ago
    The second amendment contradicts this idea.
    - vkou 4y ago
      The treason and sedition act contradicts your idea.
    - deadbunny 4y ago
      Predator drones contradict this idea.
    - elihu 4y ago
      I think the more complete formulation is that the government has a monopoly on the legal use of violence. (Which I suppose isn't really true in all contexts: violence by private citizens can be legal when defending private property, for instance. But aside from small carve-outs for personal security, self-defense, and private property it generally holds.)
  - mhh__ 4y ago
    This is true in the abstract but adds nothing to the discussion if you actually had to make a decision. Lumping everything into "Government" and not government is partly why American society is completely broken in some regards.
    - thegrimmest 4y ago
      As long as every branch of "Government" has the authority to escalate to forcible imprisonment for noncompliance with their policy, I will be equally mistrustful of all of them.
      - 4y ago
- dfee 4y ago
  The mental gymnastics of this comment. > bound by boards and ethics committees Is there any evidence an ethics committee was party to this? If in fact, one was, they found it ethical to consume personally identifiable data without those persons’ authorization?
  - renewiltord 4y ago
    I don't think ethics committees are worth the chairs they sit on, but "personally identifiable data"? How did you conclude that it was personally identifiable?
  - cinntaile 4y ago
    https://www.cdc.gov/os/integrity/hrpo/index.htm https://www.cdc.gov/os/integrity/hrpo/index.htm I assume this classifies as research so it should be subject to the same ethical requirements.
    - junofan 4y ago
      Going off “CDC’s Policy on Distinguishing Public Health Research and Public Health Nonresearch” linked from that page, I would guess this activity they’d call “nonresearch.”
      - cinntaile 4y ago
        I read the guidelines for compliance and my interpretation is that it fulfills the requirements for research while it does not fulfill the requirements for nonresearch. The scope of this reaches all of society instead of the study participants.
- version_five 4y ago
  > CDC are the least scary people buying this data Most buyers probably just want to target advertising at me, or otherwise grab my attention. The CDC wants a say in how people live their lives and thinks they know better than individuals about risk tolerance and decisions. And they seem to think they can have unchecked power by invoking "science". Can someone name a scarrier entity that could be tracking you? I don't agree with anybody tracking me, but even say insurance companies which is the other worst thing that comes to mind have limited purview in what they might be interested in
  - pxeger1 4y ago
    > thinks they know better than individuals about risk tolerance They do.
  - jpgvm 4y ago
    If you are that scared of people that have more knowledge than you on topics that take decades of study to understand I can't imagine how scared you should be of politicians. On average they have close to zero knowledge about anything yet wield power to change almost any facet of your life. Personally I'm sticking with the scientists, atleast they earnt that power through real excellence rather than winning some popularity contest.
  - smt88 4y ago
    > Can someone name a scarrier entity that could be tracking you? FBI, CIA, local police, any branch of military, Oathkeepers (a group that did track me for a while because I organized a pro-voting event in my city)... it's a very long list. Basically anyone with a gun and a desire to harm me is a lot scarier. In the past, companies used to assassinate leaders of unionization efforts, too.
  - josho 4y ago
    I know we are getting off track here somewhat. But it's group A wants this data to better understand society in order to save lives, while every other group want this data to increase their profits. To your point, yes we shouldn't allow tracking. But, whatever fix we apply should not be so limited that it only affects the CDC, it should be generally applied to stop all groups as well.
- Romanulus 4y ago
- malwarebytess 4y ago
  This type of data collection should be illegal and heavily punished, public or private. The damage it is doing far outweighs the benefits of temporary profits.
- nsonha 4y ago
  the actual scary people would have the data locked up and be super secret about it. The non scary CDC employees would casually/accidentally leak it to other scary people because there is no reason to believe they are competent or care about security & privacy
- lenkite 4y ago
  Frankly the CDC are the scariest people buying this data. They have direct power and authority to harm people and their livelihoods with little resistance possible and their head-honcho seriously believes his authority exceeds the supreme court.
stephbu 4y ago
Headline feels a little misleading, they didn’t track phones per se, they bought data from one of the dozens of cellphone data-brokers that continue to operate despite legislation and congressional action/in-action.
- mindslight 4y ago
  Exactly! We need real privacy legislation, with consent framed similarly to the EU's GDPR. Without some type of general reform, every little bit of outrage about how our personal information is being abused is just a surface distraction. Furthermore with regards to the misleading headline, apart from a few counties in California there were no "lockdown orders" in the US. There were closed businesses [0], and there were suggestions that individuals stay home. There were no widespread orders with the force of law telling individuals that they must stay in their homes. [0] who I feel for, especially when things like small hardware stores had to shut down while Home Depot could remain open.
- Mountain_Skies 4y ago
  Just because something is legal doesn't mean it is ethical. The CDC was acting unethically here, though I'm sure they feel everything they do is ethical because they are above question when performing their mission.
  - stephbu 4y ago
    Pretty much every cellphone/app user dimension is available for a price on the open market. What you do think Facebook et.al, sells when an app user allows background tracking? Is it unethical to study behavior of the populous? If anything bringing it into a clinical study probably brought more oversight in terms of ethical handling, and aggregation/anonymization of data than the source would provide.
    - crtasm 4y ago
      Facebook sells targeted advertising, they don't sell the underlying data AFAIK?
0daystock 4y ago
Location tracking is a huge business and honestly CDC is probably the actor we should be least concerned about in that marketplace. I think the real story is the commodification of our physical presence and the resulting surveillance capitalism models it further enables and normalizes.
- EricE 4y ago
  Good point. I think the real value of this story is not that this data is readily available, but that the government is also consuming it - which most people (rightly!) have a problem with. If that's the wake up call it takes to make people pay attention to just how bad "surveillance capitalism" is, then I'm all for it.
- JacobThreeThree 4y ago
  It's feasible to be concerned about both corporate and government surveillance at the same time.
  - 0daystock 4y ago
    Definitely true and I'm of the same mind. Which is why I'm dissuading readers from unnecessary moral outrage over petty, inconsequential matters like this, and encourage everyone to think deeper about technology's role in our lives.
- mynameishere 4y ago
  least concerned about Why are people saying this sort of thing about the CDC? They have proven themselves out-of-control, irrational dictators.
  - 0daystock 4y ago
    Because they're an organization which is still bound by public laws and social norms, whereas the real sinister use of our location data goes entirely unnoticed and is far, far more insidious than will ever be printed in the subservient press.
eddyg 4y ago
It would be interesting to see the breakdown of how much of the location data SafeGraph/Veraset gets is from "free" apps that commoditize developers when they integrate various advertising APIs.
rolph 4y ago
this only works when people take thier phones everywhere they go
- daenz 4y ago
  So...it only works for 99% of the population?
  - rolph 4y ago
    but that can change, the deciding factor is which addiction is greater; cellphone, or tracking.
    - deleted 4y ago
      [deleted]
edmcnulty101 4y ago
Google had a creepy Covid functionality that automatically downloaded without my consent to my phone. Big tech is just chomping at the bit for the government to give them the go ahead to track everyone and enforce a 'papers please' society.
- newbamboo 4y ago
  On the other hand, we could have a zero Covid planet. A place without pandemics. Bill Gates is the hero we need.
  - spookthesunset 4y ago
    Zero Covid was and always will be a scam.
    - Enginerrrd 4y ago
      There was probably a window in time when cases were less than a few thousand or so when such a thing could have been possible. That's the real game in fighting emerging diseases. Early detection, identification of reservoirs and rapid vaccine development and aggressive isolation and ring vaccination if possible. But I agree, it's absolutely laughable to think enforced social distancing could ever control a fully airborne disease, already so widespread, and with an R_0 over 4, especially now with the current rate of emergence of immunity escaping variants. Check out BA.4 and BA.5 in south africa right now, both of which seem to elude immunity from BA.1 just 6 months after Omicron's emergence.
      - KerrAvon 4y ago
        Sure, it would have originally been rational to try to contain it until widespread vaccination could happen. That was no longer an option as soon as: (a) Trump decided that his followers should treat it by injecting bleach, fish tank cleaner, and horse dewormer (b) the WHO and the CDC decided it wasn't an airborne disease because apparently they were still relying on research from 1949 C.E. (c) the CDC decided not to tell Americans that masks were effective (because they didn't want panic buying) (d) Biden's COVID czar decided to ostrich the whole thing Now we're just fucked; everyone will get it, the question is how many times and how bad the next variants. And whether we'll ever develop effective treatment for long covid.
kurupt213 4y ago
Time to go back to leaving the phone at home, like when it was wired to the house
- StanislavPetrov 4y ago
  Faraday bags are quite inexpensive.
  - jiveturkey 4y ago
    Effectively leaving it at home? Once you unwrap it at your destination, haven't you not only given up your travel history (maybe not to an intermediate location), but also flagged yourself as someone that is hiding something? I guess my point is, you can't hide yourself from the government this way. From some random third party, sure.
    - StanislavPetrov 4y ago
      >Effectively leaving it at home? Once you unwrap it at your destination, haven't you not only given up your travel history (maybe not to an intermediate location), but also flagged yourself as someone that is hiding something? For me the utility in having a cell phone is the convenience. If my car breaks down or if I get a page on my 1-way pager that I deem important enough to call back then giving a random datapoint of my location is a conscious decision that I can make. This is vastly different than creating and offering up a record of everywhere I go to the government, the phone company and all of the 3rd parties along the way that hoover up my info as I pass by. >but also flagged yourself as someone that is hiding something? Or someone that values their privacy. >I guess my point is, you can't hide yourself from the government this way. The government can track you with satellites, helicopters or simply park someone outside your house and follows you every time you go out if they so choose, and there isn't much you can do about it. What you can do is refuse to voluntarily input all of your movements and activities into a massive database that can be accessed, retrieved and data-mined at will.
- criddell 4y ago
  It seems like you might be losing more than you gain, depending on how you use your phone.
anonquixey 4y ago
I got free academic access to this dataset. The data is anonymized and aggregated to the census block level (500 people). It does not allow for the kind of tracking that the article is fear mongering about.
- djbebs 4y ago
  No such thing as anonymity data
  - beej71 4y ago
    There is definitely data that can't be worked backwards.
  - zionic 4y ago
    Wow, this anonymous person leaves your house every morning and comes back!
- president 4y ago
  Not full anonymity if you can see where the phones are moving from-to
- dogleash 4y ago
  >The data is anonymized Anonymized... for you.
- Mountain_Skies 4y ago
  The average census block has a population of 30 people. Millions of census blocks have a population of zero while millions more have a population of only a couple of people. Surely it must be at the census tract level or higher?
  - jtsiskin 4y ago
    Census block group, not census block
- cmelbye 4y ago
renewiltord 4y ago
I was involved with this. SafeGraph data is aggregated to the CBG level and has differential privacy applied. You don’t have to guess. The data is self-serve purchasable from their website so you can go take a look at what it looks like. Go find a blog post of theirs and you’ll get a coupon code so you’re not paying and then you can look at what the data looks like.
EricE 4y ago
Time to go back to a non-connected Garmin GPS while in the car and slip my phone into a mesh bag when not in use :( So glad I don't own a newer car with a cellular modem built into it. Hope I can die and be buried with my current "dumb" cards.
- starwind 4y ago
  If you use an android, you can set it so that it does location just off GPS which is a lot less precise and doesn't seem to update as often. The other day I went downtown for a ballgame, sushi after, and then home, and the only place it picked me up for the day was the light rail station when I bought my ticket early that afternoon
- post_break 4y ago
  You better rip out your TPMS since those can be tracked. Same with anything that has bluetooth since those are widely tracked on highways for monitoring traffic flows. Oh and license plate readers, not sure how you block those. Can you live a cash only life as well since credit cards are obviously tracked. Do you own a home? Is it in your name or did you set up an LLC to purchase it? I'm not trying to be a jerk, just that I've had the same thoughts as you and just realized it's impossible.
  - StanislavPetrov 4y ago
    It's possible, just difficult. License plates happen to be incredibly susceptible to getting muddy.
    - vkou 4y ago
      In a world where being the wrong kind of skin colour can consistently get you pulled over and harassed for a 'broken tail light' and 'smelling weed in the car', it takes a lot of social privilege to think that driving around with an unreadable license plate is a workable solution.
      - 4y ago
empressplay 4y ago
In Australia the government freely admitted to using mobile phone tracking and tower 'pings' to determine lockdown compliance, the state of Victoria at one point using the data to justify extending a lockdown in Melbourne.
teeray 4y ago
This data needs to be a liability for companies to hold onto rather than an asset
- bob1029 4y ago
  The only way to make this data a liability would be to create consequences for its possession or dissemination. In the financial sector, I feel like a lot of really good progress has been made with regard to creating artificial forces that strongly encourage proper behavior around PII and other sensitive data. Just take a look at PCI-DSS for a good example of the lengths you could go to in order to protect a customer's assets and/or identity.
JaceLightning 4y ago
What's crazy is how far we've changed. The whole opinion of roe v Wade was predicated on the fact the government had no right to people's health information: > In January 1973, the Supreme Court issued a 7–2 decision in McCorvey's favor ruling that the Due Process Clause of the Fourteenth Amendment to the United States Constitution provides a "right to privacy" that protects a pregnant woman's right to choose whether to have an abortion. Now we have vaccine mandates, vaccine passports, and CDC surveillance.
- rootusrootus 4y ago
  > Now we have vaccine mandates, vaccine passports, and CDC surveillance. Not coincidentally, Roe is about to be a memory too.
- brimble 4y ago
  > vaccine mandates We've had those for decades. > vaccine passports These must not be a federal thing, because I still don't really know what people mean by this. Is it a state thing? > and CDC surveillance Private surveillance that the CDC and anyone else can buy. I agree that collecting this info in the first place, let alone selling it, should be very, very illegal.
  - JaceLightning 4y ago
    We have had federal vaccine mandates to hold a job before? I've never had to provide proof of vaccination.
    - brimble 4y ago
      There are ways around it (as there are with Covid vaccine requirements), but most folks are subject to vaccine mandates for school attendance (though, sure, those are state-level rules). IIRC I had to provide vaccination records for college, too. Plenty of states require vaccination to teach in a school (so, to hold a job). What's different about this isn't the presence of mandates, but that it was a novel virus so mandates were applied to (a small set of) adults rather than mainly to kids. In fact, the set of people to whom Covid vaccine mandates apply is surely way smaller than the set to whom a variety of others do. I'm pretty sure most states aren't requiring Covid vaccination for school attendance, for instance.
prepend 4y ago
I’m not sure how this is a story as mobility data has been shown on the cdc COVID data tracker web site for over a year [0] that lists the source. (disclosure, I did not work on these data) [0] https://covid.cdc.gov/covid-data-tracker/#mobility https://covid.cdc.gov/covid-data-tracker/#mobility
shawn-butler 4y ago
And they wonder why silly conspiracy theories gain traction in the public? Honestly this is the dumbest thing to do in secret. The CDC was supposed to be apolitical and gave that up entirely during the pandemic, and now it appears they are quite horrible at politics.
- triceratops 4y ago
  > The CDC was supposed to be apolitical and gave that up entirely during the pandemic If the politicians politicize a pandemic, and the CDC's job is to fight disease, then anything the CDC does becomes political by definition. Seems like that's on the politicians.
- renewiltord 4y ago
  It wasn't a secret. It's literally on their website with the sources listed. What exactly is secret. The dashboard they have lists the source: https://covid.cdc.gov/covid-data-tracker/#mobility https://covid.cdc.gov/covid-data-tracker/#mobility Ctrl-F "the mobility metrics are"
  - shawn-butler 4y ago
    Did you even read the article? They made a FOIA request and got the procurement documents which lists use cases such as "Examination of the effectiveness of public policy on [the] Navajo Nation" and monitoring "places of worship" both of which have extremely negative connotations. This sort of dataset gets used in all kinds of twisted ways that aren't limited to footnotes on cute graphs.
    - renewiltord 4y ago
      This is the problem with you Wikipedia Wise Men. The only knowledge you have is what you were told about. Your position is literally just the last “article” you read. All this shit is either in MMWRs or on preprint sites. It’s not “secret” beyond the basic fact that lots of hypotheses are studied constantly. Here’s an example https://www.medrxiv.org/content/10.1101/2020.12.02.20234989v1.full https://www.medrxiv.org/content/10.1101/2020.12.02.20234989v...
vmception 4y ago
> perform analysis of compliance with curfews, track patterns of people visiting K-12 schools, and specifically monitor the effectiveness of policy in the Navajo Nation what? one of these is not like the other
godelski 4y ago
Is there actually ways to use GPS data that is anonymous? Like could there be zero knowledge proofs to draw correlations without revealing actual location data? We've clearly seen that aggregating data is not enough. But I'm wondering if there is actually a form of strong anonymity that is possible when dealing with GPS data. To me GPS data seems the most concerning with user tracking.
derevaunseraun 4y ago
The CDC doing this (or any public agency for that matter) doesn't bother me, to be frank I think it's expected in order for them to make well-informed policy decisions. What bothers me is that if this data is not anonymized properly then that's one really bad leak waiting to happen. For example: if someone has someone else's location patterns they can plan a robbery on their home at the optimal time. Not only this, but I think that if we as a society are going to collect data en masse there has to be a legitimate opt out for the people who aren't interested. I think forcing blanket surveillance on everyone is just going to sew further trust issues down the road and a good compromise is letting people opt out, but providing additional services and conveniences if they opt in.
mistrial9 4y ago
I knew this was happening at the time, and I contacted several people generally past my level of influence, to tell them. The significant first paragraphs here show, not only is this a PR effort, but noting US Constitution protected places (churches), intimate family ties (school) and by law, other sovereign nations (First People lands in North America) show to me, a non-lawyer, that there is going to be a serious penalty sought legally by someone, somehow. I say, nail these companies to the wall. The industry was bursting at the seams to sell this, with super-fancy data viz eye-candy ala Palantir and crew. There is lust for this, not just the money. Mapbox I am looking at you.
sfink 4y ago
This is an excellent use of the data, a proof that it is worthwhile for the data to exist, and a terrifying demonstration that we need to grow the hell up with respect to data privacy. It actually sounds like the anonymization and aggregation was done pretty well for this. There's no such thing as 100% anonymity, but there are useful levels of anonymity. The fact that we don't have a standardized way of blessing data with varying known levels of privacy, checked and enforced by law, is kind of ridiculous in 2022. If you want to maximize privacy here, then let's pass laws to prevent doctors from knowing the gender, age, and weight of any of their patients. I 100% agree that privacy is handled way, way too loosely in general, and this does look like the CDC was a lot more interested in a grab bag of use cases than it was with maintaining anonymity. But surely that's an indictment of our societal failure to regulate data brokers? It shouldn't be up to the CDC to act counter to their mission.
- zdragnar 4y ago
  > If you want to maximize privacy here, then let's pass laws to prevent doctors from knowing the gender, age, and weight of any of their patients. I am fine with my doctor knowing this about me. I am not fine with any doctor who does not see me as a patient knowing anything at all about me. > This is an excellent use of the data, a proof that it is worthwhile for the data to exist The use of the data is fine, but as for the data existing, I also find that to be questionable (in its current form). The particular issue that I have is that the data is used without true consent, and as such is tainted. OTOH, I suspect that "being OK with the CDC tracking your movements via GPS" would eliminate a very important cohort from the study. Which brings me back to your original statement: > a terrifying demonstration that we need to grow the hell up with respect to data privacy I don't genuinely don't know that we can have both (informed consent) and (quality data).
  - sfink 4y ago
    >> If you want to maximize privacy here, then let's pass laws to prevent doctors from knowing the gender, age, and weight of any of their patients. > I am fine with my doctor knowing this about me. I am not fine with any doctor who does not see me as a patient knowing anything at all about me. I am ok with my doctor knowing there was a 12% chance that I broke curfew during a pandemic lockdown, given my zip code or whatever. I don't think it's a black and white thing. Especially since you can't have the extreme of no data—the data is already out there, in massive quantities, and mostly uncontrolled. >> a terrifying demonstration that we need to grow the hell up with respect to data privacy > I don't genuinely don't know that we can have both (informed consent) and (quality data). Oh, we can't, not anywhere near the optimal balance anyway. Because people. (And therefore governments, and laws, and everything else.) But I guess I still think that whatever crappy balance we can come up with is better than organizations that can make good use out of collections like this sticking their fingers in their ears and pretending there's no way to know certain things that all the bad actors already know because they're willing to buy this stuff on the black market. It leads to dogs and cats living together and people writing really bad run-on sentences like the previous one.
funstuff007 4y ago
I broke the lockdowns with impunity because if I did not my business would fail and my employees would be out of work.
Railsify 4y ago
Well, did we?
redmen 4y ago
Our institutions are ancient, with overly specific missions. Like doctors, we have some for feet, for spine, for brain, but very few that integrate everything and see the big picture. When things get complicated these narrow-minded institutions will fail us.
- travisporter 4y ago
  They’re called general practitioners and they are the most common medical subspeciality
  - redmen 4y ago
    Clever, reddit-type response. Hilarious. And yet general practitioners don't know anything about muscles, nutrition or how the pieces fit together.
deleted 4y ago
[deleted]
evocatus 4y ago
ramoz 4y ago
Yea, this data isn’t really anonymized. Draw a circle around your house, and simple algorithms for mobility data can detect and follow all patterns of life around, to & from your house. Most people don’t realize mobility data even exists. Let alone what you can do with it.
deleted 4y ago
[deleted]
greesil 4y ago
From a public health standpoint this is a great dataset. There are papers that show no correlation between lockdowns and covid spread, but this can show if the lockdown orders were actually followed.
alephnan 4y ago
DevKoala 4y ago
The road to hell is paved with good intentions.
- majinuub 4y ago
  Its disturbing how many people on HN are okay with this.
wanderingmind 4y ago
As a side question, any recommendations on how to fake GPS location in Android, preferably through using Fdroid, LineageOS
monksy 4y ago
This was mentioned in April 2020 ish and no one blinked an eye. It was showing how much people left their houses, how far out did they travel to, did they participate in entertainment venues, did they eat out etc. The data was never used for enforcement purposes. (if it was.. it wasn't very efficient at all)
- SV_BubbleTime 4y ago
  I might be in the minority, but I don’t care if it was used to make macoroni art. I also don’t care how harmless or good the CDC might be to someone. A government entity should not be a using tax payer money to purchase privacy sensitive data of citizens.
  - hypothesis 4y ago
    > A government entity should not be a using tax payer money to purchase privacy sensitive data of citizens. Nothing nefarious going on here, right? It's not like they are bypassing constitution here and checking if one visited place of worship, are they? [0] https://mobile.twitter.com/timmarchman/status/1521477790813597702 https://mobile.twitter.com/timmarchman/status/15214777908135...
  - avs733 4y ago
    they should only collect it themselves amiright? This was the least expensive and most responsible way to conduct this study. What alternative would you provide? Just not doing it?
    - SV_BubbleTime 4y ago
      > Just not doing it? An interesting proposal.
  - monksy 4y ago
    For anything other than a disease prevention and tracking agency (debatiable if the CDC follows into that.. insert Dr Glockenflocken video about that for reference) I agree with you. Enforcement agencies like the FBI shouldn't be getting that info to work with. With dieases similar to covid, measles, etc .. it's an invaluable tool to be able to determine how, and where infection occured. This allowed for some fantastic studies and finds in Korea. (I.e. https://jkms.org/DOIx.php?id=10.3346/jkms.2020.35.e415 https://jkms.org/DOIx.php?id=10.3346/jkms.2020.35.e415 would not have been possible without the phone data)
bogomipz 4y ago
>"The CDC used the data for monitoring curfews, with the documents saying that SafeGraph’s data “has been critical for ongoing response efforts, such as hourly monitoring of activity in curfew zones or detailed counts of visits to participating pharmacies for vaccine monitoring.” The documents date from 2021." What business does the CDC have with Monitoring for local curfews? Wouldn't curfew monitoring be more the purview of local law enforcement more so than the remit of national health agency. Further did the US actually have hard curfews anywhere?
- renewiltord 4y ago
  It’s a public health data decision. If people were not listening to local requests to stay home, that tells you that this is an ineffective policy. If you tell people “don’t go to weddings” and people are still going to convention centers you know something is wrong with your method of intervention.
bogomipz 4y ago
So are the 3 US carriers all selling customer location data to SafeGraph then? I'm assuming that's the only source of SafeGraph’s data? I'm guessing there is no opt-out for this either just like the other sleazy data brokers.
midislack 4y ago
Don't like this? Don't carry a phone. Because it's just going to get worse from here out and there is no asking permission, nor is there punishment.
cavisne 4y ago
How do these companies onboard apps, they always seem super vague about that. I understand the model, they provide a tracking sdk that app developers embed in their apps and get paid for. But I haven’t found any actual documentation on these sdk’s. Do they buy the apps themselves or reach out directly somehow?
Schopenhauer01 4y ago
Despicable country.
gregw2 4y ago
I've worked with the Safegraph data mentioned in the article. They draw a polygon around a set of geographic coordinates and tell you how many iPhones vs Androids we're in that polygon in a week and they associate that polygon+address with a named business. Yes, that polygon could be a doctor's office as the article raises but so what? There is nothing tying it to you/me/any person. It's a location-popularity index basically. I have a hard time coming up with a scenario where this is a threat to my liberty. The article especially at the end conflates tracking of persons with tracking of popularity, and is (imho) disappointingly fear-mongering.
claytongulick 4y ago
"It's also likely to give anti-vaccine groups a real-world data point on which to pin their darkest warnings." That's a very word-smithed way of saying "looks like they were right".

406 points by KoftaBob 4y ago

See the issue here is that this data exists at all and it’s purchasable by any group. I feel like the CDC are the least scary people buying this data. And from the looks of it they used it for medical research, which if similar in style to other medical research is bound by boards and ethics committees. What we aren’t writing about in this article are the groups using this data Cambridge Analytica style to sway political opinion, and other less than stellar purposes.

Proven 4y ago
[dead]
LorenPechtel 4y ago
Yeah. I have no problem with researchers getting anonymized data. CDC, snoop all you want. It's the business guys I don't like having it.
- nickff 4y ago
  Governments have a long and storied record of data abuse, from the Stasi in East Germany to LoveInt at the CIA.
  - Nextgrid 4y ago
    Yes, but those threats already exist regardless and stopping the sale of carrier data won't stop them. Ideally you'd want to stop both, but if I had to choose I'd prefer that only the government has access rather than the highest bidder (which can be the government if they so desire, so in the end you're back at square one anyway).
    - maerF0x0 4y ago
      Did you know there are many classes of crime that follow the pattern you spoke of "It already exists out there, and will persist even if I stop, I'm not creating it just propagating it..." One pretty nasty example would be revenge porn. a lesser one would be piracy of copyright material
  - lucb1e 4y ago
    Of course one has to keep government( agencie)s in check, but to compare the CDC to the Stasi.... I don't know if that's really an apt or appropriate comparison
  - modriano 4y ago
    Humans have a long and storied record of using tools and information to do malicious things. But we also have a long and storied record of using tools and information to produce the incredible advances of the past few centuries, where the median life expectancy has nearly doubled from the baseline over the past 50k years. Personally, I would really prefer a system where health information was centralized and easily transferrable to healthcare providers, as I think it would be massively better if we could learn from the bad outcomes of others rather than creating thousands of information silos that have to learn these expensive lessons in parallel, and it would also allow us to know the prices of healthcare services thereby enabling efficient markets to develop.
    - chaps 4y ago
      Are you suggesting that this location information is "health" data and is okay for them to use and store?
      - jonathankoren 4y ago
        Yes. Location data is health data. It has been since 1854. https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outbreak https://en.wikipedia.org/wiki/1854_Broad_Street_cholera_outb...
        chaps 4y ago
        Just because data is used in understanding something related to health doesn't mean that it's "health data" in a legal, protected, or regulatory sense. Nor does it mean that they should have de facto access to the data without limitations. Hell, the closest thing I'm aware of that's close to it (at least under HIPAA) is the name or address of a hospital that a person's visited. Would you be okay if the CDC purchased data from period-tracking apps to track periods? Or how many bottles of soap I purchase in a year? Or how much booze everyone buys?
        jonathankoren 4y ago
  - arcticbull 4y ago
    Right, because businesses have never done anything bad with data, it's all those government guys. The government of course being the one tasked with improving the health and welfare of the population, not with turning a profit.
    - bendbro 4y ago
  - pirate787 4y ago
    The U.S. Govt used individuals' Census data to round up Japanese-Americans for FDR's World War II internment camps. They also lied about it and claimed that they were only using anonymized data. https://exhibits.lib.berkeley.edu/spotlight/census/feature/japanese-americans-in-world-war-ii-and-the-census https://exhibits.lib.berkeley.edu/spotlight/census/feature/j...
  - tablespoon 4y ago
    >> Yeah. I have no problem with researchers getting anonymized data. CDC, snoop all you want. It's the business guys I don't like having it. > Governments have a long and storied record of data abuse, from the Stasi in East Germany to LoveInt at the CIA. "Governments" is far too coarse-grained of a category; it invites sloppy thinking.
  - ChrisLomont 4y ago
    They also have a long and storied history of helping the public avoid widespread disasters and preventing larger outbreaks of disease through using data. Which of these is more common and useful?
  - epgui 4y ago
    That's either a straw man argument or a moral equivalence fallacy, depending on what point you believe you're making.
  - LorenPechtel 4y ago
    Note that I said "anonymized". The first step should be to separate the identity from the data. The phone's ID is plenty for research purposes, keep the name out of it.
- chrisco255 4y ago
  Right, because governments have never done anything wrong in the history of the world. It's all those evil business guys.
- 0xy 4y ago
  You're right, because there's never been a leak of personal data from any researcher or government department.
dontcare007 4y ago
Problem is that once they use it for a benign reason, use of the data will expand into other, less palatable uses.
- mywittyname 4y ago
  The problem is that this data is available for anyone to purchase. And anyone includes groups that you don't want to have it. Some people focus their attention on limiting the government's ability to collect this information, but just go about ignoring businesses being legally allowed to keep and sell this data. Now the government is leveraging privatized markets for all of their spying needs and it is neatly kept out of the courts. As the article points out, it wasn't just the CDC performing these kinds of analysis. News organizations were doing the same thing. If we want to curb government surveillance, we need to curb corporate surveillance by legally enshrining a right to privacy that limits the information that companies can collect and sell. Which, ironically, will mean government regulation and enforcement.
  - landemva 4y ago
    More than one facet to the problem and potential solutions. How about... The problem is this data is not owned by the individual. Which will mean government guidelines and optional private enforcement via lawsuit with meaningful minimum penalties.
  - cmroanirgo 4y ago
    The problem could also be said to start with software. Particularly Apple and Google for allowing specific location information to be used in the same app as advertising. The problem is that all apps are granted access to the internet. Nip those two things in the bud and the problems will slow down, I think. But it's a pipe-dream, I know. In the early days of Android, I remember reading that Android was Android because you had to jump through all these permission hoops with j2me (Java 2 Mobile Edition). Hence, Android was better and more easy to use than j2me. Here we are, 15 years later with exactly the same set of permissions problems... with one exception, Android still gives out internet access without permission. Many devs here would be aghast at the idea of an app not being internet connected. I believe Google did it that way because Steve Jobs had done it that way in the iPod and iPhones. (I presume there's some HN'ers here that can refute this?) I remember my colleagues at the time remarking how refreshing it was to not have to deal with permissions (because customers disliked all the modal permissions that popped up in j2me)... and we all jumped on board the iPhone and Android development train, not knowing the problems that we'd have down the line.
alephxyz 4y ago
OC's point is that the data was _already_ being used for other less palatable uses.
KoftaBob 4y ago
Agreed. The data broker that the CDC got this data from is SafeGraph. What we really should be asking is what "partners" SafeGraph got this data from, and how.
cm2187 4y ago
Given the virtually unlimited executive powers the CDC believes it has, I am not sure I agree with your assessment that it is the least scary people. But I agree that the problem here is not that the CDC is buying it so much that this data is available to be bought.
- loceng 4y ago
  - user_7832 4y ago
    > Fauci as the saviour in Stockholme Syndrome... Not a downvoter (to your comment, I rarely vote) but does anybody pro-mask/pro-vaccine/pro-lockdown actually consider him a saviour? All I see (as a non American) is folks on the right hating him being considered a saviour... but I don't find a single post glorifying him even on left-leaning reddit.
    - xapata 4y ago
      No, the language of "savior" tends to come from religious extremists.
    - loceng 4y ago
      It's just the psychological term used as part of explaining Stockholm Syndrome behaviour. It doesn't mean it's conscious behave or a conscious belief.
      - pstuart 4y ago
        meh. not the best explanation or even use of the term.
      - brewdad 4y ago
        It's invented bullshit? Got it.
    - dekhn 4y ago
mensetmanusman 4y ago
The government having it is the most scary, because they have a monopoly on violence.
- BeefWellington 4y ago
  The second amendment contradicts this idea.
  - vkou 4y ago
    The treason and sedition act contradicts your idea.
  - deadbunny 4y ago
    Predator drones contradict this idea.
  - elihu 4y ago
    I think the more complete formulation is that the government has a monopoly on the legal use of violence. (Which I suppose isn't really true in all contexts: violence by private citizens can be legal when defending private property, for instance. But aside from small carve-outs for personal security, self-defense, and private property it generally holds.)
- mhh__ 4y ago
  This is true in the abstract but adds nothing to the discussion if you actually had to make a decision. Lumping everything into "Government" and not government is partly why American society is completely broken in some regards.
  - thegrimmest 4y ago
    As long as every branch of "Government" has the authority to escalate to forcible imprisonment for noncompliance with their policy, I will be equally mistrustful of all of them.
    - 4y ago
dfee 4y ago
The mental gymnastics of this comment. > bound by boards and ethics committees Is there any evidence an ethics committee was party to this? If in fact, one was, they found it ethical to consume personally identifiable data without those persons’ authorization?
- renewiltord 4y ago
  I don't think ethics committees are worth the chairs they sit on, but "personally identifiable data"? How did you conclude that it was personally identifiable?
- cinntaile 4y ago
  https://www.cdc.gov/os/integrity/hrpo/index.htm https://www.cdc.gov/os/integrity/hrpo/index.htm I assume this classifies as research so it should be subject to the same ethical requirements.
  - junofan 4y ago
    Going off “CDC’s Policy on Distinguishing Public Health Research and Public Health Nonresearch” linked from that page, I would guess this activity they’d call “nonresearch.”
    - cinntaile 4y ago
      I read the guidelines for compliance and my interpretation is that it fulfills the requirements for research while it does not fulfill the requirements for nonresearch. The scope of this reaches all of society instead of the study participants.
version_five 4y ago
> CDC are the least scary people buying this data Most buyers probably just want to target advertising at me, or otherwise grab my attention. The CDC wants a say in how people live their lives and thinks they know better than individuals about risk tolerance and decisions. And they seem to think they can have unchecked power by invoking "science". Can someone name a scarrier entity that could be tracking you? I don't agree with anybody tracking me, but even say insurance companies which is the other worst thing that comes to mind have limited purview in what they might be interested in
- pxeger1 4y ago
  > thinks they know better than individuals about risk tolerance They do.
- jpgvm 4y ago
  If you are that scared of people that have more knowledge than you on topics that take decades of study to understand I can't imagine how scared you should be of politicians. On average they have close to zero knowledge about anything yet wield power to change almost any facet of your life. Personally I'm sticking with the scientists, atleast they earnt that power through real excellence rather than winning some popularity contest.
- smt88 4y ago
  > Can someone name a scarrier entity that could be tracking you? FBI, CIA, local police, any branch of military, Oathkeepers (a group that did track me for a while because I organized a pro-voting event in my city)... it's a very long list. Basically anyone with a gun and a desire to harm me is a lot scarier. In the past, companies used to assassinate leaders of unionization efforts, too.
- josho 4y ago
  I know we are getting off track here somewhat. But it's group A wants this data to better understand society in order to save lives, while every other group want this data to increase their profits. To your point, yes we shouldn't allow tracking. But, whatever fix we apply should not be so limited that it only affects the CDC, it should be generally applied to stop all groups as well.
Romanulus 4y ago
malwarebytess 4y ago
This type of data collection should be illegal and heavily punished, public or private. The damage it is doing far outweighs the benefits of temporary profits.
nsonha 4y ago
the actual scary people would have the data locked up and be super secret about it. The non scary CDC employees would casually/accidentally leak it to other scary people because there is no reason to believe they are competent or care about security & privacy
lenkite 4y ago
Frankly the CDC are the scariest people buying this data. They have direct power and authority to harm people and their livelihoods with little resistance possible and their head-honcho seriously believes his authority exceeds the supreme court.

stephbu 4y ago

Headline feels a little misleading, they didn’t track phones per se, they bought data from one of the dozens of cellphone data-brokers that continue to operate despite legislation and congressional action/in-action.

mindslight 4y ago
Exactly! We need real privacy legislation, with consent framed similarly to the EU's GDPR. Without some type of general reform, every little bit of outrage about how our personal information is being abused is just a surface distraction. Furthermore with regards to the misleading headline, apart from a few counties in California there were no "lockdown orders" in the US. There were closed businesses [0], and there were suggestions that individuals stay home. There were no widespread orders with the force of law telling individuals that they must stay in their homes. [0] who I feel for, especially when things like small hardware stores had to shut down while Home Depot could remain open.
Mountain_Skies 4y ago
Just because something is legal doesn't mean it is ethical. The CDC was acting unethically here, though I'm sure they feel everything they do is ethical because they are above question when performing their mission.
- stephbu 4y ago
  Pretty much every cellphone/app user dimension is available for a price on the open market. What you do think Facebook et.al, sells when an app user allows background tracking? Is it unethical to study behavior of the populous? If anything bringing it into a clinical study probably brought more oversight in terms of ethical handling, and aggregation/anonymization of data than the source would provide.
  - crtasm 4y ago
    Facebook sells targeted advertising, they don't sell the underlying data AFAIK?

0daystock 4y ago

Location tracking is a huge business and honestly CDC is probably the actor we should be least concerned about in that marketplace. I think the real story is the commodification of our physical presence and the resulting surveillance capitalism models it further enables and normalizes.

EricE 4y ago
Good point. I think the real value of this story is not that this data is readily available, but that the government is also consuming it - which most people (rightly!) have a problem with. If that's the wake up call it takes to make people pay attention to just how bad "surveillance capitalism" is, then I'm all for it.
JacobThreeThree 4y ago
It's feasible to be concerned about both corporate and government surveillance at the same time.
- 0daystock 4y ago
  Definitely true and I'm of the same mind. Which is why I'm dissuading readers from unnecessary moral outrage over petty, inconsequential matters like this, and encourage everyone to think deeper about technology's role in our lives.
mynameishere 4y ago
least concerned about Why are people saying this sort of thing about the CDC? They have proven themselves out-of-control, irrational dictators.
- 0daystock 4y ago
  Because they're an organization which is still bound by public laws and social norms, whereas the real sinister use of our location data goes entirely unnoticed and is far, far more insidious than will ever be printed in the subservient press.

eddyg 4y ago

It would be interesting to see the breakdown of how much of the location data SafeGraph/Veraset gets is from "free" apps that commoditize developers when they integrate various advertising APIs.

rolph 4y ago

this only works when people take thier phones everywhere they go

daenz 4y ago
So...it only works for 99% of the population?
- rolph 4y ago
  but that can change, the deciding factor is which addiction is greater; cellphone, or tracking.
  - deleted 4y ago
    [deleted]

edmcnulty101 4y ago

Google had a creepy Covid functionality that automatically downloaded without my consent to my phone. Big tech is just chomping at the bit for the government to give them the go ahead to track everyone and enforce a 'papers please' society.

newbamboo 4y ago
On the other hand, we could have a zero Covid planet. A place without pandemics. Bill Gates is the hero we need.
- spookthesunset 4y ago
  Zero Covid was and always will be a scam.
  - Enginerrrd 4y ago
    There was probably a window in time when cases were less than a few thousand or so when such a thing could have been possible. That's the real game in fighting emerging diseases. Early detection, identification of reservoirs and rapid vaccine development and aggressive isolation and ring vaccination if possible. But I agree, it's absolutely laughable to think enforced social distancing could ever control a fully airborne disease, already so widespread, and with an R_0 over 4, especially now with the current rate of emergence of immunity escaping variants. Check out BA.4 and BA.5 in south africa right now, both of which seem to elude immunity from BA.1 just 6 months after Omicron's emergence.
    - KerrAvon 4y ago
      Sure, it would have originally been rational to try to contain it until widespread vaccination could happen. That was no longer an option as soon as: (a) Trump decided that his followers should treat it by injecting bleach, fish tank cleaner, and horse dewormer (b) the WHO and the CDC decided it wasn't an airborne disease because apparently they were still relying on research from 1949 C.E. (c) the CDC decided not to tell Americans that masks were effective (because they didn't want panic buying) (d) Biden's COVID czar decided to ostrich the whole thing Now we're just fucked; everyone will get it, the question is how many times and how bad the next variants. And whether we'll ever develop effective treatment for long covid.

kurupt213 4y ago

Time to go back to leaving the phone at home, like when it was wired to the house

StanislavPetrov 4y ago
Faraday bags are quite inexpensive.
- jiveturkey 4y ago
  Effectively leaving it at home? Once you unwrap it at your destination, haven't you not only given up your travel history (maybe not to an intermediate location), but also flagged yourself as someone that is hiding something? I guess my point is, you can't hide yourself from the government this way. From some random third party, sure.
  - StanislavPetrov 4y ago
    >Effectively leaving it at home? Once you unwrap it at your destination, haven't you not only given up your travel history (maybe not to an intermediate location), but also flagged yourself as someone that is hiding something? For me the utility in having a cell phone is the convenience. If my car breaks down or if I get a page on my 1-way pager that I deem important enough to call back then giving a random datapoint of my location is a conscious decision that I can make. This is vastly different than creating and offering up a record of everywhere I go to the government, the phone company and all of the 3rd parties along the way that hoover up my info as I pass by. >but also flagged yourself as someone that is hiding something? Or someone that values their privacy. >I guess my point is, you can't hide yourself from the government this way. The government can track you with satellites, helicopters or simply park someone outside your house and follows you every time you go out if they so choose, and there isn't much you can do about it. What you can do is refuse to voluntarily input all of your movements and activities into a massive database that can be accessed, retrieved and data-mined at will.
criddell 4y ago
It seems like you might be losing more than you gain, depending on how you use your phone.

anonquixey 4y ago

I got free academic access to this dataset. The data is anonymized and aggregated to the census block level (500 people). It does not allow for the kind of tracking that the article is fear mongering about.

djbebs 4y ago
No such thing as anonymity data
- beej71 4y ago
  There is definitely data that can't be worked backwards.
- zionic 4y ago
  Wow, this anonymous person leaves your house every morning and comes back!
president 4y ago
Not full anonymity if you can see where the phones are moving from-to
dogleash 4y ago
>The data is anonymized Anonymized... for you.
Mountain_Skies 4y ago
The average census block has a population of 30 people. Millions of census blocks have a population of zero while millions more have a population of only a couple of people. Surely it must be at the census tract level or higher?
- jtsiskin 4y ago
  Census block group, not census block
cmelbye 4y ago

renewiltord 4y ago

I was involved with this. SafeGraph data is aggregated to the CBG level and has differential privacy applied. You don’t have to guess. The data is self-serve purchasable from their website so you can go take a look at what it looks like. Go find a blog post of theirs and you’ll get a coupon code so you’re not paying and then you can look at what the data looks like.

EricE 4y ago

Time to go back to a non-connected Garmin GPS while in the car and slip my phone into a mesh bag when not in use :( So glad I don't own a newer car with a cellular modem built into it. Hope I can die and be buried with my current "dumb" cards.

starwind 4y ago
If you use an android, you can set it so that it does location just off GPS which is a lot less precise and doesn't seem to update as often. The other day I went downtown for a ballgame, sushi after, and then home, and the only place it picked me up for the day was the light rail station when I bought my ticket early that afternoon
post_break 4y ago
You better rip out your TPMS since those can be tracked. Same with anything that has bluetooth since those are widely tracked on highways for monitoring traffic flows. Oh and license plate readers, not sure how you block those. Can you live a cash only life as well since credit cards are obviously tracked. Do you own a home? Is it in your name or did you set up an LLC to purchase it? I'm not trying to be a jerk, just that I've had the same thoughts as you and just realized it's impossible.
- StanislavPetrov 4y ago
  It's possible, just difficult. License plates happen to be incredibly susceptible to getting muddy.
  - vkou 4y ago
    In a world where being the wrong kind of skin colour can consistently get you pulled over and harassed for a 'broken tail light' and 'smelling weed in the car', it takes a lot of social privilege to think that driving around with an unreadable license plate is a workable solution.
    - 4y ago

empressplay 4y ago

In Australia the government freely admitted to using mobile phone tracking and tower 'pings' to determine lockdown compliance, the state of Victoria at one point using the data to justify extending a lockdown in Melbourne.

teeray 4y ago

This data needs to be a liability for companies to hold onto rather than an asset

bob1029 4y ago
The only way to make this data a liability would be to create consequences for its possession or dissemination. In the financial sector, I feel like a lot of really good progress has been made with regard to creating artificial forces that strongly encourage proper behavior around PII and other sensitive data. Just take a look at PCI-DSS for a good example of the lengths you could go to in order to protect a customer's assets and/or identity.

JaceLightning 4y ago

What's crazy is how far we've changed. The whole opinion of roe v Wade was predicated on the fact the government had no right to people's health information: > In January 1973, the Supreme Court issued a 7–2 decision in McCorvey's favor ruling that the Due Process Clause of the Fourteenth Amendment to the United States Constitution provides a "right to privacy" that protects a pregnant woman's right to choose whether to have an abortion. Now we have vaccine mandates, vaccine passports, and CDC surveillance.

rootusrootus 4y ago
> Now we have vaccine mandates, vaccine passports, and CDC surveillance. Not coincidentally, Roe is about to be a memory too.
brimble 4y ago
> vaccine mandates We've had those for decades. > vaccine passports These must not be a federal thing, because I still don't really know what people mean by this. Is it a state thing? > and CDC surveillance Private surveillance that the CDC and anyone else can buy. I agree that collecting this info in the first place, let alone selling it, should be very, very illegal.
- JaceLightning 4y ago
  We have had federal vaccine mandates to hold a job before? I've never had to provide proof of vaccination.
  - brimble 4y ago
    There are ways around it (as there are with Covid vaccine requirements), but most folks are subject to vaccine mandates for school attendance (though, sure, those are state-level rules). IIRC I had to provide vaccination records for college, too. Plenty of states require vaccination to teach in a school (so, to hold a job). What's different about this isn't the presence of mandates, but that it was a novel virus so mandates were applied to (a small set of) adults rather than mainly to kids. In fact, the set of people to whom Covid vaccine mandates apply is surely way smaller than the set to whom a variety of others do. I'm pretty sure most states aren't requiring Covid vaccination for school attendance, for instance.

prepend 4y ago

I’m not sure how this is a story as mobility data has been shown on the cdc COVID data tracker web site for over a year [0] that lists the source. (disclosure, I did not work on these data) [0] https://covid.cdc.gov/covid-data-tracker/#mobility https://covid.cdc.gov/covid-data-tracker/#mobility

shawn-butler 4y ago

And they wonder why silly conspiracy theories gain traction in the public? Honestly this is the dumbest thing to do in secret. The CDC was supposed to be apolitical and gave that up entirely during the pandemic, and now it appears they are quite horrible at politics.

triceratops 4y ago
> The CDC was supposed to be apolitical and gave that up entirely during the pandemic If the politicians politicize a pandemic, and the CDC's job is to fight disease, then anything the CDC does becomes political by definition. Seems like that's on the politicians.
renewiltord 4y ago
It wasn't a secret. It's literally on their website with the sources listed. What exactly is secret. The dashboard they have lists the source: https://covid.cdc.gov/covid-data-tracker/#mobility https://covid.cdc.gov/covid-data-tracker/#mobility Ctrl-F "the mobility metrics are"
- shawn-butler 4y ago
  Did you even read the article? They made a FOIA request and got the procurement documents which lists use cases such as "Examination of the effectiveness of public policy on [the] Navajo Nation" and monitoring "places of worship" both of which have extremely negative connotations. This sort of dataset gets used in all kinds of twisted ways that aren't limited to footnotes on cute graphs.
  - renewiltord 4y ago
    This is the problem with you Wikipedia Wise Men. The only knowledge you have is what you were told about. Your position is literally just the last “article” you read. All this shit is either in MMWRs or on preprint sites. It’s not “secret” beyond the basic fact that lots of hypotheses are studied constantly. Here’s an example https://www.medrxiv.org/content/10.1101/2020.12.02.20234989v1.full https://www.medrxiv.org/content/10.1101/2020.12.02.20234989v...

vmception 4y ago

> perform analysis of compliance with curfews, track patterns of people visiting K-12 schools, and specifically monitor the effectiveness of policy in the Navajo Nation what? one of these is not like the other

godelski 4y ago

Is there actually ways to use GPS data that is anonymous? Like could there be zero knowledge proofs to draw correlations without revealing actual location data? We've clearly seen that aggregating data is not enough. But I'm wondering if there is actually a form of strong anonymity that is possible when dealing with GPS data. To me GPS data seems the most concerning with user tracking.

derevaunseraun 4y ago

The CDC doing this (or any public agency for that matter) doesn't bother me, to be frank I think it's expected in order for them to make well-informed policy decisions. What bothers me is that if this data is not anonymized properly then that's one really bad leak waiting to happen. For example: if someone has someone else's location patterns they can plan a robbery on their home at the optimal time. Not only this, but I think that if we as a society are going to collect data en masse there has to be a legitimate opt out for the people who aren't interested. I think forcing blanket surveillance on everyone is just going to sew further trust issues down the road and a good compromise is letting people opt out, but providing additional services and conveniences if they opt in.

mistrial9 4y ago

I knew this was happening at the time, and I contacted several people generally past my level of influence, to tell them. The significant first paragraphs here show, not only is this a PR effort, but noting US Constitution protected places (churches), intimate family ties (school) and by law, other sovereign nations (First People lands in North America) show to me, a non-lawyer, that there is going to be a serious penalty sought legally by someone, somehow. I say, nail these companies to the wall. The industry was bursting at the seams to sell this, with super-fancy data viz eye-candy ala Palantir and crew. There is lust for this, not just the money. Mapbox I am looking at you.

sfink 4y ago

This is an excellent use of the data, a proof that it is worthwhile for the data to exist, and a terrifying demonstration that we need to grow the hell up with respect to data privacy. It actually sounds like the anonymization and aggregation was done pretty well for this. There's no such thing as 100% anonymity, but there are useful levels of anonymity. The fact that we don't have a standardized way of blessing data with varying known levels of privacy, checked and enforced by law, is kind of ridiculous in 2022. If you want to maximize privacy here, then let's pass laws to prevent doctors from knowing the gender, age, and weight of any of their patients. I 100% agree that privacy is handled way, way too loosely in general, and this does look like the CDC was a lot more interested in a grab bag of use cases than it was with maintaining anonymity. But surely that's an indictment of our societal failure to regulate data brokers? It shouldn't be up to the CDC to act counter to their mission.

zdragnar 4y ago
> If you want to maximize privacy here, then let's pass laws to prevent doctors from knowing the gender, age, and weight of any of their patients. I am fine with my doctor knowing this about me. I am not fine with any doctor who does not see me as a patient knowing anything at all about me. > This is an excellent use of the data, a proof that it is worthwhile for the data to exist The use of the data is fine, but as for the data existing, I also find that to be questionable (in its current form). The particular issue that I have is that the data is used without true consent, and as such is tainted. OTOH, I suspect that "being OK with the CDC tracking your movements via GPS" would eliminate a very important cohort from the study. Which brings me back to your original statement: > a terrifying demonstration that we need to grow the hell up with respect to data privacy I don't genuinely don't know that we can have both (informed consent) and (quality data).
- sfink 4y ago
  >> If you want to maximize privacy here, then let's pass laws to prevent doctors from knowing the gender, age, and weight of any of their patients. > I am fine with my doctor knowing this about me. I am not fine with any doctor who does not see me as a patient knowing anything at all about me. I am ok with my doctor knowing there was a 12% chance that I broke curfew during a pandemic lockdown, given my zip code or whatever. I don't think it's a black and white thing. Especially since you can't have the extreme of no data—the data is already out there, in massive quantities, and mostly uncontrolled. >> a terrifying demonstration that we need to grow the hell up with respect to data privacy > I don't genuinely don't know that we can have both (informed consent) and (quality data). Oh, we can't, not anywhere near the optimal balance anyway. Because people. (And therefore governments, and laws, and everything else.) But I guess I still think that whatever crappy balance we can come up with is better than organizations that can make good use out of collections like this sticking their fingers in their ears and pretending there's no way to know certain things that all the bad actors already know because they're willing to buy this stuff on the black market. It leads to dogs and cats living together and people writing really bad run-on sentences like the previous one.

funstuff007 4y ago

I broke the lockdowns with impunity because if I did not my business would fail and my employees would be out of work.

Railsify 4y ago

Well, did we?

redmen 4y ago

Our institutions are ancient, with overly specific missions. Like doctors, we have some for feet, for spine, for brain, but very few that integrate everything and see the big picture. When things get complicated these narrow-minded institutions will fail us.

travisporter 4y ago
They’re called general practitioners and they are the most common medical subspeciality
- redmen 4y ago
  Clever, reddit-type response. Hilarious. And yet general practitioners don't know anything about muscles, nutrition or how the pieces fit together.

deleted 4y ago

[deleted]

evocatus 4y ago

ramoz 4y ago

Yea, this data isn’t really anonymized. Draw a circle around your house, and simple algorithms for mobility data can detect and follow all patterns of life around, to & from your house. Most people don’t realize mobility data even exists. Let alone what you can do with it.

deleted 4y ago

[deleted]

greesil 4y ago

From a public health standpoint this is a great dataset. There are papers that show no correlation between lockdowns and covid spread, but this can show if the lockdown orders were actually followed.

alephnan 4y ago

DevKoala 4y ago

The road to hell is paved with good intentions.

majinuub 4y ago
Its disturbing how many people on HN are okay with this.

wanderingmind 4y ago

As a side question, any recommendations on how to fake GPS location in Android, preferably through using Fdroid, LineageOS

monksy 4y ago

This was mentioned in April 2020 ish and no one blinked an eye. It was showing how much people left their houses, how far out did they travel to, did they participate in entertainment venues, did they eat out etc. The data was never used for enforcement purposes. (if it was.. it wasn't very efficient at all)

SV_BubbleTime 4y ago
I might be in the minority, but I don’t care if it was used to make macoroni art. I also don’t care how harmless or good the CDC might be to someone. A government entity should not be a using tax payer money to purchase privacy sensitive data of citizens.
- hypothesis 4y ago
  > A government entity should not be a using tax payer money to purchase privacy sensitive data of citizens. Nothing nefarious going on here, right? It's not like they are bypassing constitution here and checking if one visited place of worship, are they? [0] https://mobile.twitter.com/timmarchman/status/1521477790813597702 https://mobile.twitter.com/timmarchman/status/15214777908135...
- avs733 4y ago
  they should only collect it themselves amiright? This was the least expensive and most responsible way to conduct this study. What alternative would you provide? Just not doing it?
  - SV_BubbleTime 4y ago
    > Just not doing it? An interesting proposal.
- monksy 4y ago
  For anything other than a disease prevention and tracking agency (debatiable if the CDC follows into that.. insert Dr Glockenflocken video about that for reference) I agree with you. Enforcement agencies like the FBI shouldn't be getting that info to work with. With dieases similar to covid, measles, etc .. it's an invaluable tool to be able to determine how, and where infection occured. This allowed for some fantastic studies and finds in Korea. (I.e. https://jkms.org/DOIx.php?id=10.3346/jkms.2020.35.e415 https://jkms.org/DOIx.php?id=10.3346/jkms.2020.35.e415 would not have been possible without the phone data)

bogomipz 4y ago

>"The CDC used the data for monitoring curfews, with the documents saying that SafeGraph’s data “has been critical for ongoing response efforts, such as hourly monitoring of activity in curfew zones or detailed counts of visits to participating pharmacies for vaccine monitoring.” The documents date from 2021." What business does the CDC have with Monitoring for local curfews? Wouldn't curfew monitoring be more the purview of local law enforcement more so than the remit of national health agency. Further did the US actually have hard curfews anywhere?

renewiltord 4y ago
It’s a public health data decision. If people were not listening to local requests to stay home, that tells you that this is an ineffective policy. If you tell people “don’t go to weddings” and people are still going to convention centers you know something is wrong with your method of intervention.

bogomipz 4y ago

So are the 3 US carriers all selling customer location data to SafeGraph then? I'm assuming that's the only source of SafeGraph’s data? I'm guessing there is no opt-out for this either just like the other sleazy data brokers.

midislack 4y ago

Don't like this? Don't carry a phone. Because it's just going to get worse from here out and there is no asking permission, nor is there punishment.

cavisne 4y ago

How do these companies onboard apps, they always seem super vague about that. I understand the model, they provide a tracking sdk that app developers embed in their apps and get paid for. But I haven’t found any actual documentation on these sdk’s. Do they buy the apps themselves or reach out directly somehow?

Schopenhauer01 4y ago

Despicable country.

gregw2 4y ago

I've worked with the Safegraph data mentioned in the article. They draw a polygon around a set of geographic coordinates and tell you how many iPhones vs Androids we're in that polygon in a week and they associate that polygon+address with a named business. Yes, that polygon could be a doctor's office as the article raises but so what? There is nothing tying it to you/me/any person. It's a location-popularity index basically. I have a hard time coming up with a scenario where this is a threat to my liberty. The article especially at the end conflates tracking of persons with tracking of popularity, and is (imho) disappointingly fear-mongering.

claytongulick 4y ago

"It's also likely to give anti-vaccine groups a real-world data point on which to pin their darkest warnings." That's a very word-smithed way of saying "looks like they were right".