Mass. Complaint Alleges COVID-19 Tracing App is Unlawful ‘Spyware’

Conspiring with Google to “hijack” consumers’ smartphones without their knowledge or consent isn't a tool the Massachusetts Department of Public Health (DPH) “may lawfully employ in its efforts to combat COVID-19,” alleged a Nov. 14 privacy complaint (docket 3:22-cv-11936) in U.S. District Court for Massachusetts in Springfield. “Such brazen disregard for civil liberties” violates the U.S. and Massachusetts constitutions, “and it must stop now,” said the complaint. The DPH developed a COVID-19 contact-tracing software app for Android devices using a Google application programming interface, it said. An initial version of the app was made available in April 2021, “but few Massachusetts residents voluntarily installed that version,” it said. To increase adoption, the DPH worked with Google starting in June 2021 to “secretly install” the app on more than a million Android devices in Massachusetts, it said. The app causes the device to constantly connect and exchange information with other nearby devices via Bluetooth and creates a record of such other connections, it said. “If a user opts in and reports being infected with COVID-19, an exposure notification is sent to other individuals on the infected user’s connection record,” it said. Even if a user does not opt into the notification system, the app “still causes the mobile device to broadcast and receive Bluetooth signals,” it said. “In sum, DPH installed spyware that deliberately tracks and records movement and personal contacts onto over a million mobile devices without their owners’ permission and awareness,” said the complaint. “On knowledge and belief, that spyware still exists on the overwhelming majority of the devices on which it was installed.” The complaint seeks an injunction barring continued installations of the app, plus an order requiring DPH to work with Google on uninstalling the app from existing devices. Google and DPH didn’t comment.