Stay up to date with notifications from The Independent

Notifications can be managed in browser preferences.

Coronavirus: US contact tracing app shares private data with outside firm

Passing information breaches app's own privacy policy

Geoffrey A. Fowler

Friday 22 May 2020 10:08 BST

Care19, the contact tracing app which the governors of North Dakota and South Dakota asked residents to download, has been found to breach its own privacy rules (Reuters)

As governments build coronavirus-tracking smartphone tech, who is making sure their apps live up to privacy promises?

A new analysis of one of the first US contact-tracing apps, North and South Dakota's Care19, found that it violates its own privacy policy by sharing location and other personal data with an outside company. The review was published on Thursday by privacy-software maker Jumbo.

The analysis suggests that state officials and Apple, both of which were responsible for vetting the app before it became available on 7 April, were asleep at the wheel. Americans are especially wary of location and health data, and privacy violations of any degree will hamper efforts to use smartphones both to trace contact and to provide exposure notifications.

The states turned to North Dakota app maker ProudCrowd to make Care19. ProudCrowd, which did not charge the states for the app development, confirmed that some data from its iPhone app goes to Foursquare, a prominent location-data provider for marketers - but says it is not used for commercial purposes (the Google Android version of Care19 uses Foursquare in a way that obscures the data, ProudCrowd said). Still, ProudCrowd says it plans to change Care19's privacy policy and will share less data in the future.

“Should this have been vetted? Yes. We are following up on that as we speak,” said Vern Dosch, North Dakota's contact-tracing facilitator. “We know that people are very sensitive.” Health officials in South Dakota did not immediately reply to requests for comment.

Inside US hospital: A day fighting the coronavirus

Show all 13

1/13Inside US hospital: A day fighting the coronavirus

Inside US hospital: A day fighting the coronavirus

Cheryll Mack, 46, a registered nurse in the emergency department, poses for a photograph after a 12-hour shift outside the hospital where she works. "The Covid-19 spread has affected a lot of livelihood, a lot of people's lives. It has created a crisis, death in general. So I would like to ask not one single person, but all people worldwide, to converge and join the platform that this is something that nobody can fight individually," said Mack.

Reuters

Inside US hospital: A day fighting the coronavirus

Dr Laura Bontempo, 50, an emergency medicine doctor wears her personal protective equipment she uses when she sees patients, while posing for a photograph after a nine-hour shift, outside the hospital. "The hardest moments have actually been separating families from patients, there is a no-visitor policy now and taking people away from their loved ones is very challenging," Bontempo said. "I'm used to treating sick patients. I treat sick patients all the time. It's very different knowing that the patient you are treating, is actually a risk to you as well. That's the main difference here. No one who works in hospitals is afraid of treating sick people. Just want to keep staff safe and the patients safe at the same time."

Reuters

Inside US hospital: A day fighting the coronavirus

Ernest Capadngan, 29, a registered nurse who works at a biocontainment unit poses for a photograph after a 12-hour shift, outside the hospital. "The hardest moment during the shift was just seeing Covid patients die helpless and without their family members beside them," Capadngan said.

Reuters

Inside US hospital: A day fighting the coronavirus

Martine Bell, 41, a nurse practitioner in an emergency department, poses for a photograph after a six-hour shift outside the hospital where she works. "The hardest thing in all of this, has been taking care of fellow healthcare providers. It really hits home and it's really scary when you see someone that could be you coming in and now you're taking care of them. It's also hitting home that once healthcare providers start getting sick, who is going to be taking care of the public," Bell said. "It's very stressful, everyone is on edge. We don't know who's coming in next, or how sick they're going to be, or if we are going to get a whole bunch of people or if we're not going to get no one. It's a really stressful and just a completely unusual time for all of us."

Reuters

Inside US hospital: A day fighting the coronavirus

Kaitlyn Martiniano, 25, a registered nurse who works at a biocontainment poses for a photograph after a 12.5-hour shift, outside the hospital. "We have a lot of patients and they are pretty sick right now but we have not yet been hit as hard as New York or Seattle, so I feel like we are very lucky with that so far. Every day you have to just be optimistic." Said Martiniano. "I think the reason that we are not being hit as hard right now is because so many things are closed, and because so many people are staying at home."

Reuters

Inside US hospital: A day fighting the coronavirus

Tracey Wilson, 53, a nurse practitioner in an intensive care unit (ICU), poses for a photograph after a 12-hour shift, outside the hospital where she works. "I had a patient fall out of bed today and I had to call his wife and tell her and she couldn't come see him, even though she pleaded and begged to come see him," Wilson said. "There is a lot of unknowns and with that unknown is a lot of anxiety and stress that we're not used to dealing with."

Reuters

Inside US hospital: A day fighting the coronavirus

Meghan Sheehan, 27, a nurse practitioner in an emergency department, poses for a photograph after a 12-hour shift, outside the hospital where she works. "I think the hardest moment has been the fear that lives within all of us. There is a lot of unknown right now. We fear what's going to happen tomorrow, how the emergency department will look next week when we come in. We have fears about our own colleagues, whether they will fall ill. We also fear that we could be asymptomatic carriers and bring this virus home to our families and our loved ones. There has been a lot of fear over our supplies and whether we'll run out. And then obviously there is the fear that we will see patients and not be able to do everything we normally can to help save patients' lives," Sheehan said.

Reuters

Inside US hospital: A day fighting the coronavirus

Kimberly Bowers, 44, a nurse practitioner in an ICU, poses for a photograph after a 13-hour shift, outside the hospital. "The hardest moment was a young woman who died and her family wasn't able to be here with her," Bowers said. "I think right now, it's just frustrating and scary just not knowing what comes next."

Reuters

Inside US hospital: A day fighting the coronavirus

Tiffany Fare, 25, a registered nurse who works at a biocontainment unit poses for a photograph after a 13-hour shift, outside the hospital where she works. "One of the hardest moments was having to see a family member of a Covid patient, say goodbye over an iPad, rooms away. That was a tough one, I can't imagine how hard it would be to be saying goodbye, you can't see your loved one and then they're gone," Fare said. "My team has been really great to me. We've worked really well together and we've really come together in this crisis. We don't really know each other, we all come from different units within the same hospital, so for us to come together and work so well as a team, it's been a journey but I think that's what is giving me hope."

Reuters

Inside US hospital: A day fighting the coronavirus

Dr Kyle Fischer, 35, an emergency medicine doctor, poses for a photograph after a 12-hour shift, outside the hospital where he works. "Since it's a new virus, we don't have any experience with it. For most diseases I am used to seeing it and taking care of it and this, I don't have any starting place. I know what I'm hearing from New York, I've read all of the papers it seems like, but no one knows what the correct answers are, so there's a huge amount of uncertainty and people are really, really sick. So it's hard to second guess whether or not you are doing the right thing when you think you are but you never quite know," said Fischer.

Reuters

Inside US hospital: A day fighting the coronavirus

Julia Trainor, 23, a registered nurse at a surgical ICU, poses for a photograph after a 14-hour shift, outside the hospital. "The hardest moment was having to put a breathing tube in my patient who could no longer breathe for herself and after the breathing tube went in, we called her family and the husband, of course, couldn't visit her because of visitor restrictions at the hospital. So I had to put him on the phone and hold the phone to her ear, as he told her that he loved her so much and then I had to wipe away her tears as she was crying," said Trainor. "I'm used to seeing very sick patients and I'm used to patients dying but nothing quite like this. In the flip of a switch, without the support, they're completely isolated. They're very sick. Some of them recover and some of them don't. But the hardest part, I would think, is them having to go through this feeling like they are alone."

Reuters

Inside US hospital: A day fighting the coronavirus

Lisa Mehring, 45, a registered nurse who works in a biocontainment unit with Covid-19 patients, poses for a photograph after a 12.5-hour shift, outside the hospital where she works in Maryland. "Seeing these new moms have babies has been the hardest moment along with having do their pumping for the new moms and them not being able to be with their newborn children, it's hard to think of the family that they are missing," Mehring said.

Photos Reuters

Inside US hospital: A day fighting the coronavirus

Jacqueline Hamil, 30, a registered nurse in an emergency department, poses for a photograph after a 12-hour shift outside the hospital. "The hardest moment of my shift today, I was in charge, and we had a really sick patient that was in a really, really small room and usually, when we have sick crashing patients, we can have a ton of resources and a ton of staff go in and help with the nurse and the doctors that are taking care of that patient. But due to the patient being ruled out for the coronavirus, we could only have five or six people in the room at a time and putting on all the gowns and gloves and masks and face shields to protect us in case the patient does have coronavirus, it takes a while, so the nurse that was in there, ended up being in the room for you know 6, 7 hours with minimal breaks and it was hard being in charge and knowing that she was stuck in the room and really nothing I could do to help her," Hamil said.

Reuters

Apple said it was investigating the report, and if it finds that an app is out of compliance it works with the developer to get it into compliance.

Foursquare does not “use the data in any way, and it is promptly discarded”, said spokesperson Jennifer Yu.

Health authorities are moving fast to build coronavirus apps, often with limited technical resources. They are relying on commercial tracking companies and murky privacy protections - and under those conditions, it is not clear whether consumers should trust them.

The Care19 app is upfront that its main purpose is to voluntarily collect location data, which differs from a new set of apps that use Bluetooth technology from Apple and Google to provide anonymous exposure alerts without collecting location data. Care19 calls itself a “digital diary” to help people remember where they have been over the previous 14 days so that they can retrace their steps and the people they have been in contact with, should they contract the coronavirus.

If users do test positive, the app lets them volunteer to share their location data with the state's health department to assist in its efforts to slow the spread of the virus.

But Care19's privacy policy says the location data is “private to you” and is “stored securely” on servers belonging to ProudCrowd. Location “will not be shared with anyone including government entities or third parties”, it says.

That is where the privacy review by Jumbo finds the app falling short. Tracing the flow of data from the app, it found Care19 sends data to Foursquare, including a user's location, their advertising identifier (a unique code representing a specific phone) and the unique “citizen code” generated by the app.

Care19's maker, Tim Brookins of ProudCrowd, told The Washington Post that the app uses a Foursquare service called Pilgrim SDK to convert the location data it collects as latitude and longitude into the names of recognisable places.

“The Care19 application user interface clearly calls out the usage of Foursquare on our 'Nearby Places' screen, per the terms of our Foursquare agreement,” Mr Brookins wrote in an email. “We will be working with our state partners to be more explicit in our privacy policy.” (He also said it would clarify privacy policy language about how it shares data to conduct diagnostics.)

Mr Brookins said his app would stop sharing the users' code with Foursquare. “It is important to note that our agreement with Foursquare does not allow them to collect Care19 data or use it in any form, beyond simply determining nearby businesses and returning that to us,” he said.

Foursquare does “not financially benefit from free users like Care19”, said Ms Yu, the spokesperson. “Essentially, any data we might receive is immediately discarded.”

Foursquare does have a significant business in marketing tech. Other apps use Pilgrim SDK to help send targeted notifications and put users into marketing audience segments, such as “fitness fanatic” and “beauty enthusiast”, based on where they go.

Pierre Valade, chief-executive of Jumbo, said Apple and Google have more-explicit rules for the new category of virus-tracking apps that use special access to a phone's Bluetooth signals to help anonymously notify people that they may have been exposed to people who have Covid-19. The rules for these “exposure” apps say they are not allowed to collect any location data or the user's advertising identifier.

Mr Brookins says he's making a second version of the Care19 app that will do exposure notification and comply with Apple and Google's rules.

The Care19 oversight exposes a common privacy hole in apps: They contain code from hidden third-party tracking companies.

A study of the data flowing out of a iPhone encountered more than 5,400 trackers in a week. Some of them were gathering personal information while the user was asleep and the phone's screen was turned off.

Third-party software makes it easier for app companies to code quickly. But it also often feeds the personal data economy, used to target us for marketing and political messaging.

As governments develop these apps, they are going to need the resources to develop their own technology that doesn't rely on commercial surveillance companies - or more help from Apple and Google.

Last week, a group of Democrats in the House and Senate introduced the Public Health Emergency Privacy Act, which includes new provisions for enforcing the use of citizen data in apps to fight the coronavirus.

Senator Maria Cantwell of Washington state, the top Democrat on a key tech-focused committee, said apps need strong privacy protections in the fight against the coronavirus. “If it doesn't have a strong privacy framework, it will undermine consumer confidence,” she said.

The Washington Post

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies