Today U.S. Senator Josh Hawley (R-Mo.) sent a letter to Google CEO Sundar Pichai and Apple CEO Tim Cook demanding the executives commit not to hide behind a corporate shield and instead be personally liable for protecting privacy in their contact-tracing project. Senator Hawley raised concerns about whether data collected to trace the spread of COVID-19 would be kept anonymous and whether the companies could be trusted to end the tracking program once the pandemic has ended.
“If you seek to assure the public, make your stake in this project personal. Make a commitment that you and other executives will be personally liable if you stop protecting privacy, such as by granting advertising companies access to the interface once the pandemic is over. The public statements you make now can be enforced under federal and state consumer protection laws. Do not hide behind a corporate shield like so many privacy offenders have before. Stake your personal finances on the security of this project.”
Senator Josh Hawley
Senator Hawley pointed to Google’s admission during a March 2019 Senate Judiciary Committee hearing that the company still tracks location history even when a user has turned it off as a cause for skepticism.
Read the full letter here or below.
Dear Mr. Pichai and Mr. Cook:
Your recently announced project to respond to COVID–19 by tracking when and where Americans interact with each other raises serious concerns. Especially because of Google’s poor record on privacy, I fear that your project could pave the way for something much more dire.
The possible implications this project could have for privacy are alarming. For example, your materials state that the data necessary for this project will be anonymized. But anonymity in data is notoriously unstable. Data typically can be reidentified simply by cross-referencing it with another data set. Pairing the data from this project with the GPS data that both your companies already collect could readily reveal individual identities.
Worse, when paired with other data sets, the data from this project could create an extraordinarily precise mechanism for surveillance. Both your companies collect GPS data, but the GPS system has significant limits. It works poorly indoors and cannot pinpoint the floor a person is on. Combining the data from this project with GPS data (or other data, such as Wi-Fi positioning), could greatly erode privacy by making precise surveillance much easier.
Americans are right to be skeptical of this project. Even if this project were to prove helpful for the current crisis, how can Americans be sure that you will not change the interface after the pandemic subsides? Once downloaded onto millions of phones, the interface easily could be edited to eliminate previous privacy protections. And any privacy protection that is baked into the interface will do little good if the apps that are developed to access the interface also choose to collect other information, like real-time geolocation data. When it comes to sticking to promises, Google’s record is not exactly reassuring. Last year a Google representative had to admit, under oath, that Google still tracks location history even when a person turns location history off. As the Associated Press put it, “Google wants to know where you go so badly that it records your movements even when you explicitly tell it not to.”
A project this unprecedented requires an unprecedented assurance on your part. Too often, Americans have been burned by companies who calculated that the profits they could gain by reversing privacy pledges would outweigh any later financial penalty levied against the company. The last thing Americans want is to adopt, amid a global emergency, a tracking program that then becomes a permanent feature in our lives.
If you seek to assure the public, make your stake in this project personal. Make a commitment that you and other executives will be personally liable if you stop protecting privacy, such as by granting advertising companies access to the interface once the pandemic is over. The public statements you make now can be enforced under federal and state consumer protection laws. Do not hide behind a corporate shield like so many privacy offenders have before. Stake your personal finances on the security of this project.
I look forward to hearing about how you intend to try to provide Americans with assurance.
Sincerely,
Josh Hawley
U.S. Senator