Subscribe!
Crush Covid 19 APP – About 3rd parties, privacy, Infosys, the ACLU, and Your Data
At the May 19th “press conference” of Gov. Gina Raimondo and Dr. Scott of the RI Department of Health, a new app for your phone – Crush Covid RI – was debuted. The Governor asked those in attendance, about a dozen or less in the cavernous Veterans Auditorium, to take out their phone and “download it now”.
The capabilities of this first iteration app were reviewed. They include a valuable resource bank of information about coronavirus, a GPS tracing feature which could feed back to the user every place they had been for 10 minutes or more, and a contact diary feature that was opt-in. 2nd and 3rd iterations are planned. They may include physical tracing that would be able to tell, for example, if someone in quarantine was no longer where they were supposed to be, to using data to track and contact any people you had been in contact with should you come down with the coronavirus. Technology repurposed from traditional GPS and Geo Targeting apps – the kind that feed you a text message picked for the kind of places you go – have you gotten a sandwich coupon message on your phone when you drive near a Subway? Or a message about a shoe sale when you drive down Route 2? Or leave another shoe store?
The Governor made sure to say features were opt-in at this time, and anonymous, capturing zip code identifiers only, and not specific names and addresses.
The app is described as “homegrown”, having been developed with the help of Infosys, an international data company, with offices in Rhode Island, based in India. Questions were asked about “open code” for other developers but were not answered. Questions about equity access – for those not having iPhone or Android phones – were also not addressed.
Who reads those privacy statements, anyway?
Stated in the app’s long privacy disclosure, under “3rd party agreement” – “We will never sell your information, but we may share it securely with authorized third parties working on behalf of the Rhode Island Department of Health to provide COVID-19 services to you. We also share information we are legally obligated to do so….” and it goes on.
Tamara Sacharczyk of NBC 10 did a story about additional fine print in the privacy policy. Not only was it unclear about who could share the information, the question of accuracy was mentioned, noting that 60% of the population needs to use the app for it to be purposeful. Tamara then interviewed the ACLU’s Steven Brown.
Now comes the ACLU…
The ACLU, founded “to ensure the promise of the Bill of Rights and the US Constitution, and to expand its reach to people historically denied its protections” has a stalwart purist protector of the mission in Rhode Island’s Steven Brown. He had an immediate reaction to the app – and their statement leaves many more questions to be answered:
“As the Governor has acknowledged and most people recognize, potentially substantial privacy issues are raised by the government’s use of any technological location tracking program. That is certainly true in this case with the state’s efforts to control spread of Covid-19.
“We therefore greatly appreciate the fact that the Governor and her staff have understood that voluntary participation is a crucial aspect of any such program, and that steps have been taken in developing the app to help ensure that any sharing of a user’s private information is done only on an opt-in basis. At the same time, a handful of significant questions remain about the program’s operation and its true voluntariness in practice. We consider it important for those questions to be answered in order to definitively assuage concerns about the potential ‘Big Brother’ aspects of electronic contract tracing.
“On the positive side, we are very pleased that the app allows residents to access important health resources without having to opt-in to the location tracking function; requires affirmative steps to engage the location-tracking feature of the app; keeps the location-tracking information solely on the phone unless and until the user agrees to share it with health authorities; and automatically deletes the tracking information after 20 days. These are all very constructive and important privacy-protective features, and we commend the Governor for limiting the app’s potentially invasive use.
“Nonetheless, a few additional questions remain that we urge be promptly addressed. Some in particular that warrant clarification are the following:
• Since the state is encouraging employers to have their employees use the app, what protections do those employees have if an employer seeks to require its use? What prevents a supermarket or other establishments from demanding its use as a condition of entry by customer?
• What guarantees are there that DOH will not end up sharing information it collects with law enforcement officials and others, even if for purported public health purposes, just as the Department has done with addresses in its database of COVID-19-positive individuals?
• Will the state have the app subjected to an independent third-party audit to ensure that it is working as proposed and providing the privacy protections that have been assured?
• The privacy policy states that app users “may choose to share with us precise geolocation or Bluetooth information using iOS and Android location services.” Since this is not how the app has been described, what is that language for?
• How will people be informed about future updates to the app so that they can choose whether to uninstall or otherwise stop using it if the features change?
“We recognize the urgency of stemming the pandemic and are not opposed to technological tools that may offer public health benefits. We therefore applaud the Governor for keeping privacy concerns front and center in the development of this app. However, deployed incorrectly, the app has the potential to interfere with public health efforts, undermine trust, and violate individuals’ rights. We therefore look forward to additional information so that members of the public can truly feel comfortable making use of this program and help tackle this continuing medical crisis.
“Finally, we also support the state’s recognition that use of an app like this can only be part of the public health response to the pandemic, especially since some people will not have phones that can run the app or may have legitimate concerns about installing it, and those communities cannot be left out.”
What Infosys says…
Shortly after the press conference, Ravi Kumar, president of Infosys did an interview on CNBC. Here is that interview:
This is their press release:
Infosys a global leader in next-generation digital services and consulting, today announced that it is partnering with the State of Rhode Island in launching a privacy-first contact tracing solution to help Rhode Islanders and state officials slow the spread of coronavirus throughout the state. This is part of the state’s effort to safely reopen businesses while reducing occurrences of community transmission.
Leveraging existing Infosys technologies, the company developed a mobile app that will help Rhode Islanders follow required health and safety guidelines, monitor their own activities and support the Rhode Island Department of Health by providing accurate data with user consent. The application, called “CRUSH COVID RI,” will utilize Infosys’ Location Based Services platform to create individualized location diaries, while protecting user privacy. The mobile app will serve as a one stop shop for pandemic response, connecting Rhode Islanders with resources about quarantine and isolation supports, symptom monitoring, and up-to-date disease information from the Rhode Island Department of Health.
“Rhode Island has been at the forefront of the fight against coronavirus and we are honored to have the opportunity to assist in developing this critically important asset for the state,” said Ravi Kumar, President, Infosys. “By repurposing existing technologies with proven results, Infosys was able to quickly deliver a contact-tracing solution that will hopefully turn the tide on coronavirus, all while protecting Rhode Islanders’ health and privacy. We are grateful to the state for including us in this important initiative.”
“We have been asking Rhode Islanders to keep a diary of who they come into contact with, each day,” said Governor Raimondo. “Especially now, as we begin the process of reopening our state, this type of contact tracing is critical to identifying and slowing the spread of the virus. Thanks to the generous work of our partners at Infosys, we now have a tool at our fingertips to do just that. I encourage all Rhode Islanders to download this app and be proactive in crushing COVID-19.”
The user interface for the application was designed at Infosys’ Providence Design + Innovation Center, and the app will include additional features, such as GPS-based location sensing, location maps and services and push notifications.
About Infosys
Infosys is a global leader in next-generation digital services and consulting. We enable clients in 46 countries to navigate their digital transformation. With nearly four decades of experience in managing the systems and workings of global enterprises, we expertly steer our clients through their digital journey. We do it by enabling the enterprise with an AI-powered core that helps prioritize the execution of change. We also empower the business with agile digital at scale to deliver unprecedented levels of performance and customer delight. Our always-on learning agenda drives their continuous improvement through building and transferring digital skills, expertise, and ideas from our innovation ecosystem.