DC Government Used ‘Highly Sensitive’ Phone Location Records To Track Covid Spread

The Washington, D.C., government used phone GPS records provided by a private data broker to track citizens in order to study the spread of COVID-19, according to public records.

The D.C. government’s Department of Health acquired raw phone location data from location data broker Veraset, according to public records accessed by the Electronic Frontier Foundation, a digital privacy group. The data was acquired by the D.C. Office of the Chief Technology Officer (OCTO) and The Lab @ DC, a division of the Office of the City Administrator, as part of a program intended to inform the city’s response to COVID-19.

Veraset provided the D.C. government with daily updates on the movements of thousands of people within the city, according to the documents, between April and September 2020, the duration of the company’s agreement with the city. The company described the phone location data it provided to the D.C. government as “highly sensitive.”

While the data was ostensibly anonymized and its use restricted by a legal agreement between Veraset and the D.C. Department of Health to study COVID-19, EFF chief technologist Bennett Cyphers said indicators in the data could still be used to identify specific individuals.

“If you look at a map of where a device spends its time, you can learn a lot: where you sleep at night, where you work, where you eat lunch, what bars and parks you go to,” Cyphers told The Washington Post.

Veraset is a spinoff of data tracking company SafeGraph, a company that sold Android users’ location data for the purposes of COVID-19 contact tracing, the Post reported. SafeGraph was banned by Google in August 2021 for its data collection practices.

“A lot of these data brokers’ existence depends on people not knowing too much about them because they’re universally unpopular,” Cyphers said. “Veraset refuses to reveal even how they get their data or which apps they purchase it from, and I think that’s because if anyone realized the app you’re using … also opts you into having your location data sold on the open market, people would be angry and creeped out.”

Veraset did not immediately respond to the Daily Caller News Foundation’s request for comment. Sam Quinney, director of The Lab @ DC, told the EFF that the data was only used to help the city respond to COVID-19.

“DC Government received an opportunity from Veraset to analyze anonymous mobility data to determine if the data could inform decisions affecting COVID-19 response, recovery, and reopening,” Quinney said. “After working with the data, we did not find suitable insights for our use cases and did not renew access to the data when our agreement expired on September 30, 2020. The dataset was acquired for no cost and is scheduled to be deleted on December 31, 2021.”