The Centers for Disease Control (CDC) spied on millions of Americans using cell phone location data in order to track movements and monitor whether people were complying with lockdown curfews during the pandemic.
According to CDC documents from 2021 obtained by Motherboard via a Freedom of Information Act (FOIA) request, the program tracked patterns of people visiting K-12 schools - and in one case, monitored "the effectiveness of policy in the Navajo Nation." The documents reveal that while the CDC used the pandemic to justify purchasing the data more quickly, it actually intended to use it for general agency purposes.
The documents reveal the expansive plan the CDC had last year to use location data from a highly controversial data broker. SafeGraph, the company the CDC paid $420,000 for access to one year of data to, includes Peter Thiel and the former head of Saudi intelligence among its investors. Google banned the company from the Play Store in June. -Motherboard
The data which was purchased comes from cell phones - meaning SafeGraph can track where a person lives, works, and where they've been, and then sell that data to various entities. The data which the CDC bought was aggregated - which is designed to follow broad trends in how people are moving around, however researchers have raised concerns over how location data can be deanonymized to track specific individuals.
According to the CDC documents, SafeGraph's data "has been critical for ongoing response efforts, such as hourly monitoring of activity in curfew zones or detailed counts of visits to participating pharmacies for vaccine monitoring."
"The CDC seems to have purposefully created an open-ended list of use cases, which included monitoring curfews, neighbor to neighbor visits, visits to churches, schools and pharmacies, and also a variety of analysis with this data specifically focused on ‘violence,'" said Zach Edwards, a cybersecurity researcher who closely follows the data marketplace.
As far as unmasking individuals, Edwards noted how SafeGraph's data can be used to pinpoint certain people.
"In my opinion the SafeGraph data is way beyond any safe thresholds [around anonymity]," he said, pointing to one result in SafeGraph's user interface that showed individual movements to a specific doctor's office - indicating how finely tuned the 'aggregated' data actually is. If a bad actor wanted to unmask someone, they could theoretically do so using similar techniques.
The documents contain a long list of what the CDC describes as 21 different “potential CDC use cases for data.” They include:
- “Track patterns of those visiting K-12 schools by the school and compare to 2019; compare with epi metrics [Environmental Performance Index] if possible.”
- “Examination of the correlation of mobility patterns data and rise in COVID-19 cases [...] Movement restrictions (Border closures, inter-regional and nigh curfews) to show compliance.”
- “Examination of the effectiveness of public policy on [the] Navajo Nation.” -Motherboard
Cell phone location data has been used throughout the pandemic for various purposes - including by media organizations reporting on how people were traveling once lockdowns began to lift.
That said, the CDC wanted the data for more than just tracking Covid-19 policy response. While the procurement documents say the data is for "an URGENT COVID-19 PR [procurement request]," one of the included use cases reads "Research points of interest for physical activity and chronic disease prevention such as visits to parks, gyms, or weight management businesses."
Another section expands on non-Covid-19 related uses.
"CDC also plans to use mobility data and services acquired through this acquisition to support non-COVID-19 programmatic areas and public health priorities across the agency, including but not limited to travel to parks and greenspaces, physical activity and mode of travel, and population migration before, during, and after natural disasters," it reads. "The mobility data obtained under this contract will be available for CDC agency-wide use and will support numerous CDC priorities."
The data purchased by the CDC was SafeGraph's "U.S. Core Place Data," "Weekly Patterns Data," and "Neighborhood Patterns Data," the latter of which includes information such as 'home dwelling time' which is aggregated by state and census block, per Motherboard.
"SafeGraph offers visitor data at the Census Block Group level that allows for extremely accurate insights related to age, gender, race, citizenship status, income, and more," reads a CDC document.
Read the rest of the report here.