Rhode Island ACLU Voices Concern About 'Crush COVID' App

PROVIDENCE, RI — The American Civil Liberties Union of Rhode Island voiced concerns about the state's new coronavirus app, saying although it is a beneficial tool to fight the pandemic, it raises security concerns for residents.

"As the Governor has acknowledged and most people recognize, potentially substantial privacy issues are raised by the government’s use of any technological location tracking program," Executive Director Steven Brown said in a statement. "That is certainly true in this case with the state’s efforts to control spread of COVID-19."

Brown went on to say that the organization appreciates that use of the app is on a voluntary basis especially when it comes to sharing private information such as the location diary. Despite these considerations, the organization raised several questions concerning participation and the voluntary nature of the app.

"We consider it important for those questions to be answered in order to definitively assuage concerns about the potential 'Big Brother' aspects of electronic contract tracing," Brown said.

The questions are listed below.

• Since the state is encouraging employers to have their employees use the app, what protections do those employees have if an employer seeks to require its use? What prevents a supermarket or other establishments from demanding its use as a condition of entry by customer?
• What guarantees are there that Department of Health will not end up sharing information it collects with law enforcement officials and others, even if for purported public health purposes, just as the Department has done with addresses in its database of COVID-19-positive individuals?
• Will the state have the app subjected to an independent third-party audit to ensure that it is working as proposed and providing the privacy protections that have been assured?
• The privacy policy states that app users “may choose to share with us precise geolocation or Bluetooth information using iOS and Android location services.” Since this is not how the app has been described, what is that language for?
• How will people be informed about future updates to the app so that they can choose whether to uninstall or otherwise stop using it if the features change?

“We recognize the urgency of stemming the pandemic, and are not opposed to technological tools that may offer public health benefits," Brown continued. "We therefore applaud the Governor for keeping privacy concerns front and center in the development of this app. However, deployed incorrectly, the app has the potential to interfere with public health efforts, undermine trust, and violate individuals’ rights. We therefore look forward to additional information so that members of the public can truly feel comfortable making use of this program and help tackle this continuing medical crisis."

The app, launched to the public Tuesday, was hailed by the governor as a one-stop shop to help the state "keep a lid on" the coronavirus pandemic and allow Rhode Island to continue its phased reopening plan. "Crush COVID" brings together symptom tracking, test scheduling, contact tracing and more resources into one app. Use of the app is voluntary, as is the decision to use location services to track where a person goes.

If a person tests positive for COVID-19, a contact tracer from the Department of Health will reach out and ask the person to share their location data, which is stored on the individual's phone, rather than an outside server. The person then has the option to not share the data, read it over the phone, or offer the department access to the data. The data is automatically deleted after 20 days, and is not identified with a person's name if shared with the department, Raimondo said.