Documents from the Centers for Disease Control and Prevention (CDC) show that the agency tracked location data from at least 20 million phones to monitor compliance with COVID-19 policies, according to a new report revealed on Tuesday.
A Freedom of Information Act request from CYBER — a cybersecurity podcast hosted by Vice’s Motherboard — revealed that the CDC “bought access to location data harvested from tens of millions of phones in the United States” to perform “analysis of compliance with curfews, track patterns of people visiting K-12 schools, and specifically monitor the effectiveness of policy in the Navajo Nation,” according to Vice.
The CDC paid data broker SafeGraph $420,000 for one years’ access to location data “derived from at least 20 million active cellphone users per day across the United States,” according to the CDC documents, which add that the data “has been critical for ongoing response efforts, such as hourly monitoring of activity in curfew zones or detailed counts of visits to participating pharmacies for vaccine monitoring.”
Cybersecurity researcher Zach Edwards explained to Motherboard that “The CDC seems to have purposefully created an open-ended list of use cases, which included monitoring curfews, neighbor to neighbor visits, visits to churches, schools and pharmacies, and also a variety of analysis with this data specifically focused on ‘violence.’”
Among the “potential use cases” for the data listed by the CDC included:
- “Track patterns of those visiting K-12 schools by the school and compare to 2019; compare with epi metrics [Environmental Performance Index] if possible.”
- “Examination of the correlation of mobility patterns data and rise in COVID-19 cases […] Movement restrictions (Border closures, inter-regional and nigh curfews) to show compliance.”
- “Examination of the effectiveness of public policy on [the] Navajo Nation.”
The documents further show that “although the CDC used COVID-19 as a reason to buy access to the data more quickly,” they “intended to use it for more general CDC purposes.” Indeed, some of the use cases — including research data for “physical activity and chronic disease prevention such as visits to parks, gyms, or weight management businesses” — have little to do with COVID-19.
The CDC purchased SafeGraph’s “U.S. Core Place Data,” “Weekly Patterns Data,” and “Neighborhood Patterns Data.” The latter product “includes information such as home dwelling time, and is aggregated by state and census block.”
Although the CDC used SafeGraph’s data to analyze compliance with stay-at-home orders as early as September 2020, the CDC later bought access to the data “because SafeGraph no longer wanted to provide it for free,” according to Vice.
“CDC has interest in continued access to this mobility data as the country opens back up. This data is used by several teams/groups in the response and have been resulting in deeper insights into the pandemic as it pertains to human behavior,” one section reads.
Neither SafeGraph nor the CDC responded to Vice’s multiple requests for comment.