Koch-funded group sues US state agency for installing 'spyware' on 1m Android devices
- Reference: 1668716014
- News link: https://www.theregister.co.uk/2022/11/17/kochfunded_group_sues_us_state/
- Source link:
The New Civil Liberties Alliance claims to be a "nonpartisan, nonprofit civil rights group." Its [1]biggest donors include right-wing backers such as the Charles G. Koch Foundation and the Charles Koch Institute. In September 2020, the group represented a Virginian landlord who [2]sued the Centers for Disease Control to allow him to evict tenants during the pandemic.
The Massachusetts app, according to the legal complaint, gave the public health department, Google, application developers, and others access to the device owners' media access control addresses, wireless network IP addresses, phone numbers, contacts and emails, thus making these parties privy to the owners' personal information, location and movement. If Android users discovered and deleted the COVID-19 tracer, the state's health agency would reinstall it on their devices, the lawsuit alleges.
[3]
"In sum, DPH installed spyware that deliberately tracks and records movement and personal contacts onto over a million mobile devices without their owners' permission and awareness," the lawsuit claims
[4]PDF
. "On knowledge and belief, that spyware still exists on the overwhelming majority of the devices on which it was installed."[5]
[6]
At least two dozen other states also developed COVID-19 apps using Google APIs, but they used community outreach to encourage residents to voluntarily download the apps and opt-in for contact tracing, the court documents say.
Massachusetts, they allege "is the only state to surreptitiously embed the Contact Tracing App on mobile devices that DPH locates within its borders, without obtaining the owners' knowledge or consent."
[7]
This violates Android device owners' federal privacy and unreasonable search protections as well as the state's computer crime laws, according to the lawsuit, which also names the Massachusetts Department of Public Health Commissioner Margret Cooke as a defendant.
"The Massachusetts DPH, like any other government actor, is bound by state and federal constitutional and legal constraints on its conduct," Peggy Little, NCLA senior litigation counsel, said in a [8]statement . "This 'android attack,' deliberately designed to override the constitutional and legal rights of citizens to be free from government intrusions upon their privacy without their consent, reads like dystopian science fiction — and must be swiftly invalidated by the court."
[9]Germany says nein to Qatari World Cup spyware, err, apps
[10]Apple sued for collecting user data despite opt-outs
[11]Google agrees to $391.5m settlement in privacy lawsuit
[12]COVID-19 contact tracing apps were suggested as saviors. They sometimes delivered
Per the legal challenge, the plaintiffs are asking the court to, among other things, stop secretly installing the contract tracing app without device owners' consent, and work with Google to uninstall the app in cases where the owner did not give permission and opt-in to downloading the tracer. They also want the court to declare that the "clandestine installations" of the tracing app violate state and federal protections.
The lawsuit seeks to make the health agency pay all costs and attorney fees related to the legal battle, and nominal damages of $1.
When asked about the lawsuit, a Massachusetts Department of Public Health spokesperson told The Register that the department hasn't received the lawsuit and doesn't comment on pending litigation.
[13]
Google did not respond to The Register 's request for comment. ®
Get our [14]Tech Resources
[1] https://www.sourcewatch.org/index.php/New_Civil_Liberties_Alliance#Funding
[2] https://nclalegal.org/brown-v-cdc/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y3a9BxXCGEN2EAm48N9LugAAANU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://nclalegal.org/wp-content/uploads/2022/11/Complaint_Wright-with-Exhibit.pdf
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y3a9BxXCGEN2EAm48N9LugAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y3a9BxXCGEN2EAm48N9LugAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y3a9BxXCGEN2EAm48N9LugAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.globenewswire.com/news-release/2022/11/15/2556568/0/en/NCLA-Files-Class-Action-Against-Massachusetts-for-Auto-Installing-Covid-Spyware-on-1-Million-Phones.html
[9] https://www.theregister.com/2022/11/16/germany_world_cup_apps/
[10] https://www.theregister.com/2022/11/14/apple_data_collection_lawsuit/
[11] https://www.theregister.com/2022/11/15/google_391m_privacy_settlement/
[12] https://www.theregister.com/2022/04/15/contact_tracing_apps_assessed/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y3a9BxXCGEN2EAm48N9LugAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
This isn't really all that news worthy, especially with the amount of $1.
They will just say "I'm sorry" and continue on as normal.
Lemme know when these data collectors are being with a $10,000,000,000 minimum. Maybe they will either stop collecting the data they don't need or actual secure things properly.
I think you are wrong in your assessment. Only asking for $1 in damages is a signal to all parties that they are taking this all the way to court and through any appeals if required and will not settle out of court.
Now, on the whole, the right are more likely to be COVID deniers but in this instance I don't care about that. The State did wrong and it needs to be on recorded at court that they did wrong, and that's the entire reason for the case. It's not about compensation for "victims". And with only token "damages", even the lawyers aren't going to get rich off this one other than their usual fees.
"Now, on the whole, the right are more likely to be COVID deniers but in this instance I don't care about that. The State did wrong and it needs to be on recorded at court that they did wrong,"
This is an excellent summary and deserves repeating. Possibly some of the people doing this have other objections to COVID policy which aren't justified, but the pandemic did not justify any action like the one alleged by the state government. Unless the state can prove that the allegations are simply false, it was unjustifiable and needs to be punished harshly so the next person who thinks up the idea, whatever purposes they envision for their spyware, knows it will not be allowed.
That's the real problem here. I don't see any real consequences for the people that approved this. If you or I installed malware on millions of people's phones without their permission, we would be going to jail for it. I want to see state officials going to jail!
I know that will never happen, but this kind of thing will continue until someone does go to jail.
New Civil Liberties Alliance
Not to be confused with the Civil Liberties New Alliance, nor with the Civil Liberties Alliance (New), I suppose? Splitters!
GJC