The Crush COVID RI app is trying to navigate the line
between public health and privacy rights
By Steve Ahlquist in
UpRiseRI
Rhode Island
Governor Gina Raimondo introduced Crush COVID RI, “the state’s pandemic
response mobile app with a privacy-first focus.” The app is designed to provide Rhode Islanders “easy access to all of the resources required during the public health crisis, including a location diary that helps users identify the people and places they are in contact with and a symptom checking survey.”
Governor Raimondo called
the app “a tool that’s going to really help Rhode island… We are one of the
first few states in the country to roll out a one-stop app of this kind.”
But privacy rights
advocates have some concerns.
“We… applaud the
Governor for keeping privacy concerns front and center in the development of
this app,” writes Steven Brown, executive director of
the ACLU of Rhode Island.
“However, deployed incorrectly, the app has the potential to interfere with public health efforts, undermine trust, and violate individuals’ rights.”
Among the many features of the app, which will allow users to easily access information about COVID-19 and resources to deal with the pandemic, “the app will prompt you once a day to take a ten second survey. How are you feeling today? What are your symptoms? Do you have a fever? If everybody does that, we, over time, are going to get a good view, across the state” of pandemic hot spots, “and act quickly,” said the Governor.
“However, deployed incorrectly, the app has the potential to interfere with public health efforts, undermine trust, and violate individuals’ rights.”
Among the many features of the app, which will allow users to easily access information about COVID-19 and resources to deal with the pandemic, “the app will prompt you once a day to take a ten second survey. How are you feeling today? What are your symptoms? Do you have a fever? If everybody does that, we, over time, are going to get a good view, across the state” of pandemic hot spots, “and act quickly,” said the Governor.
Privacy advocates are
wary of yet another app that will collect personal information, and Governor
Raimondo seemed aware of this.
A “key feature” of the app is the Location Diary, an opt-in feature that will create a map of places you’ve visited and spent ten minutes or more.
This private data will be stored on your phone only, assures Governor Raimondo, and may be accessed and shared only with your permission. The data is automatically deleted after 20 days.
A “key feature” of the app is the Location Diary, an opt-in feature that will create a map of places you’ve visited and spent ten minutes or more.
This private data will be stored on your phone only, assures Governor Raimondo, and may be accessed and shared only with your permission. The data is automatically deleted after 20 days.
No government or private
company has access to the data, assures the Governor. If you volunteer your
data to the Rhode Island Department of Health (RIDOH) the data will not be associated with your name,
but with a number, and that data will not be shared with any other government
agency or with any private company.
Raimondo said that when
she instructed her team to build the app, she wanted something that protected
people’s privacy and data in “an ironclad way.”
“No one is going to make
you download this app. No one is going to make you turn on the Location Diary
feature. No one is going to make you share the data,” said Raimondo.
RIDOH Director Dr Nicole Alexander Scott recognized that “some
people are not going to be able to download and use the app because they may lack
smartphone access.”
Dr Alexander-Scott recommended that people use the information lines available by telephone and the internet to keep up with COVID-19 news and resources.
Dr Alexander-Scott recommended that people use the information lines available by telephone and the internet to keep up with COVID-19 news and resources.
Local reporter Bill Bartholomew followed up on this noting that
the very communities most at risk to COVID-19 may may the same communities that
lack access to smart phones and apps.
“We are deliberately
focused on making sure that our communities of color that are
disproportionately impacted by COVID-19 continue to have to the services, to
the information that’s needed as everyone,” said Dr Alexander-Scott, “and even
more, because of the disproportionate impact.”
Dr Alexander-Scott also
stressed that the app, now available in English and Spanish, will be translated
into more languages.
The ACLU picked up on
the issue of access, writing, “…we also support the state’s recognition that
use of an app like this can only be part of the public health response to the
pandemic, especially since some people will not have phones that can run the
app or may have legitimate concerns about installing it, and those communities
cannot be left out.”
The ACLU of Rhode
Island, in their statement outlining privacy concerns regarding the app,
writes,
“On the positive side, we are very pleased that the app allows residents to access important health resources without having to opt-in to the location tracking function; requires affirmative steps to engage the location-tracking feature of the app; keeps the location-tracking information solely on the phone unless and until the user agrees to share it with health authorities; and automatically deletes the tracking information after 20 days. These are all very constructive and important privacy-protective features, and we commend the Governor for limiting the app’s potentially invasive use.”However, the ACLU seeks clarification on the following:
Since the state is
encouraging employers to have their employees use the app, what protections do
those employees have if an employer seeks to require its use? What prevents a
supermarket or other establishments from demanding its use as a condition of
entry by customer?
What guarantees are there that DOH will not end up sharing information it collects with law enforcement officials and others, even if for purported public health purposes, just as the Department has done with addresses in its database of COVID-19-positive individuals?
Will the state have the app subjected to an independent third-party audit to ensure that it is working as proposed and providing the privacy protections that have been assured? [Michael Bilow, a reporter with Motif Magazine, asked the Governor, during the press briefing, if she has asked for third party validation of the app’s privacy features, which Governor Raimondo said was a “good idea” and something she will look into.]
The privacy policy
states that app users “may choose to share with us precise geolocation or
Bluetooth information using iOS and Android location services.” Since this is
not how the app has been described, what is that language for?
How will people be
informed about future updates to the app so that they can choose whether to
uninstall or otherwise stop using it if the features change?
Steve Ahlquist
is a frontline
reporter in Rhode Island. He has covered human rights, social justice,
progressive politics and environmental news for half a decade. Uprise RI is his
new project, and he's doing all he can to make it essential reading.
atomicsteve@gmail.com
Can
we please ask a favor?
Funding for our reporting
relies entirely on the generosity of readers like you. Our independence is how
we are able to write stories that hold RI state and local government officials
accountable. All of our stories are free and available to everyone right here
at UpriseRI.com. But your support is essential to keeping Steve on the beat,
covering the costs of reporting many stories in a single day. If you are able
to, please support Uprise RI. Every contribution, big or
small is so valuable to us. You provide the motivation and financial support to
keep doing what we do. Thank you.