The Centers for Disease Control (CDC) spied on millions of Americans using cell phone location data in order to track movements and monitor whether people were complying with lockdown curfews during the pandemic.

According to CDC documents from 2021 obtained by Motherboard via a Freedom of Information Act (FOIA) request, the program tracked patterns of people visiting K-12 schools – and in one case, monitored “the effectiveness of policy in the Navajo Nation.” The documents reveal that while the CDC used the pandemic to justify purchasing the data more quickly, it actually intended to use it for general agency purposes.

The documents reveal the expansive plan the CDC had last year to use location data from a highly controversial data broker. SafeGraph, the company the CDC paid $420,000 for access to one year of data.

The data which was purchased comes from cell phones – meaning SafeGraph can track where a person lives, works, and where they’ve been, and then sell that data to various entities.

The data which the CDC bought was aggregated – which is designed to follow broad trends in how people are moving around, however researchers have raised concerns over how location data can be deanonymized to track specific individuals.

“The CDC seems to have purposefully created an open-ended list of use cases, which included monitoring curfews, neighbor to neighbor visits, visits to churches, schools and pharmacies, and also a variety of analysis with this data specifically focused on ‘violence,'” said Zach Edwards, a cybersecurity researcher who closely follows the data marketplace.

As far as unmasking individuals, Edwards noted how SafeGraph’s data can be used to pinpoint certain people.

“In my opinion the SafeGraph data is way beyond any safe thresholds [around anonymity],” he said, pointing to one result in SafeGraph’s user interface that showed individual movements to a specific doctor’s office – indicating how finely tuned the ‘aggregated’ data actually is.

Cell phone location data has been used throughout the pandemic for various purposes – including by media organizations reporting on how people were traveling once lockdowns began to lift.

That said, the CDC wanted the data for more than just tracking Covid-19 policy response. While the procurement documents say the data is for “an URGENT COVID-19 PR [procurement request],” one of the included use cases reads “Research points of interest for physical activity and chronic disease prevention such as visits to parks, gyms, or weight management businesses.”

The data purchased by the CDC was SafeGraph’s “U.S. Core Place Data,” “Weekly Patterns Data,” and “Neighborhood Patterns Data,” the latter of which includes information such as ‘home dwelling time’ which is aggregated by state and census block, per Motherboard.

Both SafeGraph and the CDC have previously touched on their partnership, but not in the detail that is revealed in the documents. The CDC published a study in September 2020 which looked at whether people around the country were following stay-at-home orders, which appeared to use SafeGraph data. 

Via Zerohedge

Original Story: Motherboard