The state Department of Public Health was accused of working with Google to “secretly” install COVID-19 contact tracing “spyware” onto more than 1 million Android smartphones.
The New Civil Liberties Alliance, a Washington, D.C.-based nonprofit, filed a lawsuit this week in U.S. District Court on behalf of two Bay State Android users, who allege that a DPH contact tracing app was downloaded onto their phones on or around July 1, 2021, without their “permission or awareness.”
“Conspiring with a private company to hijack residents’ smartphones without the owners’ knowledge or consent is not a tool that the Massachusetts Department of Public Health may lawfully employ in its efforts to combat COVID-19,” the complaint stated.
“Such brazen disregard for civil liberties violates both the United States and Massachusetts Constitutions, and it must stop now.”
A DPH spokesperson declined comment, stating the department has not received any documentation related to the lawsuit, and “does not comment on pending litigation.”
The complaint alleges that DPH began working with Google on June 15, 2021, to install the app onto more than 1 million Android phones located in the Bay State, impacting people who live or work there.
This was allegedly done to “increase adoption” because “few Massachusetts residents voluntarily installed” the software.
Once the app is downloaded, the user’s phone is constantly connected to and information is exchanged with other nearby devices via Bluetooth, to create a record of those connections, the complaint stated.
If a user opts into the app and reports being infected by COVID-19, an exposure notification is sent to other individuals on the infected user’s connection record, the lawsuit said.
If someone doesn’t opt in, their information is still shared via Bluetooth, and becomes available to Google, DPH, and other third parties, which can trace the user’s identity and past contacts through device information, the complaint stated.
“This ‘Android attack,’ deliberately designed to override the constitutional and legal rights of citizens to be free from government intrusions upon their privacy without their consent, reads like dystopian science fiction — and must be swiftly invalidated by the court,” said Peggy Little, senior litigation counsel for NCLA.
At least two dozen other states have developed COVID-19 contact-tracing apps using Google API, but Massachusetts is the only state to “surreptitiously embed” the app onto mobile devices that DPH locates within its borders, the lawsuit stated.
Once downloaded, the app does not appear alongside other apps on the Android device’s home screen. It can only be found by opening “settings” and using the “view all apps” feature, which keeps users unaware of its presence in many cases, the lawsuit said.
When Android users discovered and deleted the contact tracing app, DPH allegedly proceeded to reinstall it onto their smartphones, the lawsuit stated.
According to NCLA, it appears iPhone users had to consent before a similar app was installed onto their devices.
“These secret installations not only invade owners’ reasonable expectation of privacy, but they also intrude upon owners’ property right in their mobile devices by occupying valuable storage space,” the complaint stated.
“Because the Massachusetts and United States Constitutions prohibit governmental entities from unreasonable searches and uncompensated takings, this court should enjoin DPH’s unconstitutional scheme.”