Massachusetts, Google spied on 1 million phones during COVID-19, alleges lawsuit

The Massachusetts Department of Health (DPH) worked with Google to tap into over one million Android smartphones for contact tracing, according to a class-action lawsuit filed against the commonwealth last week.  

The lawsuit alleges that a tracking app was secretly auto-installed on the phones, though it was not visible alongside other apps. The MassNotify app could only be found by the user opening Settings and using the View All Apps feature. If a user found the app and deleted it, the DPH would simply have it re-installed. 

While other states and governments also used smartphones for contact tracing, they required an opt-in from the smartphone owners. But after its initial opt-in version did not yield the results it had hoped for, the DPH changed the program to not only require an opt-out from the user, but also to forcibly re-install the app if deleted. 

According to the New Civil Liberties Alliance (NCLA), who filed the lawsuit, iPhone users had to consent before the app could be installed on their phones. 

“The Massachusetts DPH, like any other government actor, is bound by state and federal constitutional and legal constraints on its conduct,” said NCLA Senior Litigation Counsel Peggy Little in a statement. “This ‘android attack,’ deliberately designed to override the constitutional and legal rights of citizens to be free from government intrusions upon their privacy without their consent, reads like dystopian science fiction—and must be swiftly invalidated by the court.” 

“Many states and foreign countries have successfully deployed contact tracing apps by obtaining the consent of their citizens before downloading software onto their smartphones,” said NCLA Litigation Counsel Sheng Li. “Persuading the public to voluntarily adopt such apps may be difficult, but it is also necessary in a free society. The government may not secretly install surveillance devices on your personal property without a warrant—even for a laudable purpose. For the same reason, it may not install surveillance software on your smartphone without your awareness and permission.” 

The NCLA’s lawsuit comes after the State of Texas filed a similar complaint against Google last month, alleging the tech giant has been using sophisticated technology to capture and store faces and voiceprints of Google users and non-users, including both adults and children. The alleged purpose is to enhance Google’s technology.  

One of the ways Google captures this information is through FaceNet, a face-mapping technology which allows Google to identify and group faces together on Google Photos. FaceNet scans and maps the faces of both users and non-users on the app, which has been downloaded over 6 billion times, and stores them “for an unreasonable amount of time.”  

“When a Texas mother uploads photos of her daughter’s third birthday party to Google Photos, for example, Google captures the face geometry of every child’s face that can be detected in those photographs,” says the lawsuit.  

“Even more troubling, when the mother uploads video of the birthday party, Google runs facial recognition on every face detected in that video, including the faces of uninvolved bystanders in the park, restaurant, or schoolyard.  

“And when a grandson drives to Midland to visit his grandmother on Easter and sends a series of photos taken on his Android phone to the family thread, those photos are sent to Google Photos by default, where Google captures grandma’s face geometry.”  

The practice gets more invasive with Nest Hub Max, the smart home controller Google debuted in 2019. Nest Hub Max is a tablet-sized device which functions as a camera and security camera, makes calls and video calls, and can operate certain house features on voice command. The device also uses facial recognition – all the time.  
The complaint explains that “the Nest Hub Max’s camera is designed to be a modern Eye of Sauron —constantly watching and waiting to identify a face it knows.” This includes bystanders, people passing in front of the camera, and curious children who stand in front of it.  

The device also includes Google Assistant, a voice-controlled personal assistant installed in a plethora of Google products. Google Assistant is always listening to every voice it hears so that it can record voices and audio “plus a few seconds before.” Google stores these recordings, including that of children, “indefinitely”.