Expert Bill Marczak: What journalists should know about coronavirus cellphone tracking

Governments all over the world have been considering cellphone surveillance to help track and contain the spread of the coronavirus.In Italy, Germany and Austria, Reuters reports , telecoms companies say they are turning over data containing location information to public health officials, though aggregated and anonymized to prevent individuals from being identified. Other media reports say governments in South Korea and South Africa are monitoring individual cellphone locations, and Israel this month authorized security agents tracing the coronavirus infection to access location and other data from millions of cellphone users that The New York Times reports they had been collecting, previously undisclosed, since 2002. Prime Minister Benjamin Netanyahu said the program would “maintain the balance between the rights of the individual and needs of general society.”Separately, authorities in Iran , Poland , and India are among those developing apps to monitor whether people are observing quarantine or interacting with suspected COVID-19 patients, according to international news reports.Although public health experts say strict limitations on movement are required to contain the coronavirus, journalists are acutely aware of the risks posed to their work when governments and technology companies monitor citizens’ cellphone activities. In recent years, CPJ has tracked the journalist targets of Pegasus, a technology the Israeli surveillance firm NSO Group markets to help government agencies hack into individual phones. (The firm has told CPJ that it investigates allegations of abuse.) CPJ has separately documented how intelligence officials can abuse access to cellphone networks to track and lure reporters and their sources.CPJ spoke to Bill Marczak, a postdoctoral researcher at University of California, Berkeley, and a leading expert on cellphone surveillance technology, about the implications of coronavirus tracking measures for journalists and other targets of government surveillance. Marczak, who is also a fellow at the University of Toronto’s Citizen Lab and helped identify and analyze the first known use of Pegasus spyware against a civil society target, told CPJ that surveillance powers and technologies that emerge during this crisis could be very tough to roll back—and could be turned against journalists in vulnerable settings. His answers have been edited for concision and clarity.We’re at a moment now when a lot of governments are saying they need to ramp up cellphone surveillance to stop the spread of the coronavirus. Are you concerned about how systems may be built out?Anytime when there’s a sense of urgency around proposals to collect more data about people, those are the times when we need to pay attention, because bad things can happen. Systems can be very quickly spun up without careful review, because there’s a sense they need to get done now. Privacy and security can become an afterthought.What we know about location data from cellphones is that even if it’s assigned an anonymous identifier, it can be reverse engineered to see where people are—at home; at work; on their commute; walking up and down their block; and of course, journalists meeting with a source.We’ve seen lots of proposals for enhanced surveillance of cellphones during this crisis—how are you thinking about the range of what’s out there? On one side of the spectrum, we see places like Israel, where the authorities come out and say, “Hey, so we’ve actually been collecting location metadata since 2002. We never told you about it. And now we are going to use it for public health.”Then there’s these proposals for apps for people to download on their phones. Some do location tracking. Some claim they don’t.=In Singapore , for example, they’ve rolled out an app that claims to do proximity tracking. They use Bluetooth to ping nearby phones that have the app installed, to see which phones are near which people. And if someone is diagnosed, then the Ministry of Health can get that proximity data to map who might be exposed. These proposals sometimes don’t require the government to have a central database of everyone’s location history.Proximity data could be problematic too, depending on where it’s stored. Even if it’s stored on the phone itself, [that phone] could be seized by authorities. You can imagine a situation where some governments can say, “This person is a journalist or activist, let’s see who they were meeting with, let’s grab their phone.”So we do run into all of these troubling privacy possibilities with proximity tracking—though I would say there’s less potential for large scale abuse if the data is stored on a device itself.Government Technology Agency staff demonstrate Singapore’s new contact-tracing smartphone app called TraceTogether, as a preventive measure against the COVID-19 coronavirus on March 20, 2020. Bill Marczak, an expert in cellphone surveillance technology, told CPJ about the implications for journalists as governments ramp up their capacity to monitor citizens in a time of crisis. (AFP/Catherine Lai)There’s some confusion about how governments get access to these cell phone records. How does it work?From a technical perspective, all it would require is for the government to go to cellphone companies and say, “Hey, we need to access this data, can you please share it?” They could set up some sort of arrangement where the phone companies ship that data over to a government database. Or you could see a situation where it stays with the phone company and the government requests data over time.But the bottom line is phone companies can—and do—receive and log this sort of information.In the U.S., we’ve seen cases where bounty hunters have accessed people’s location through brokers who are reselling this data. I suggest an appropriate mental model of this is to assume phone companies are collecting and storing this data, and can be reselling and sharing it.We see some private companies coming in and making the case they can build a system to gather that location data, and perhaps make it useful for fighting the virus.There was reporting that the NSO Group was possibly spinning up a “new system.” It wasn’t clear from the limited information disclosed how that monitoring would actually work. But you can imagine a situation where someone is diagnosed, you get their number, and the NSO Group starts doing location tracking on that number. This could be combined with CCTV or facial recognition technology to issue notifications when others come in contact with the infected person. But we don’t know. NSO has released no information about this.[Editor’s note: CPJ emailed an NSO Group spokesperson in late March asking for more information about its coronavirus system but did not receive a reply before publication.]The private surveillance industry isn’t exactly known for its respect for human rights in general, and press freedom in particular. Last year, the U.N. special rapporteur for freedom of expression even called for a global moratorium on the sale of these technologies. Are you worried about these players stepping in now?Given the urgency with which a lot of governments are understandably approaching coronavirus, you are going to see authorities reaching for off-the-shelf solutions—they will look to buy solutions from existing surveillance firms. It’s problematic that a lot of the companies in this space have track records of working with intelligence agencies and aren’t exactly above board. They’ve potentially helped spy on journalists and activists in the past. And that’s concerning to me.There’s another thing I am concerned about. Once a government shells out a bunch of money for a new surveillance system for location tracking, justified by the coronavirus, what happens when the virus is over? How does it get used, how does it get repurposed? Once you implement a system to track a bunch of people—it’s not likely it’s going away in the future.In this moment where governments are reaching for more authority and technical capacity to monitor cell phones, how should journalists be thinking about these things? Should they be resisting?I wouldn’t encourage people to subvert efforts to track them if they are infected. But when the crisis is over and life returns to normal, people should be aware that this tracking and tracing could be used beyond the length of the crisis. If you are forced to install something on your phone—and you can’t really say no—you are going to have to imagine you’ve entered a country where you have a police minder. Perhaps don’t contact a super secret source.What role can journalists play here?We need journalists to dig into these new schemes. If the government says we are doing location tracking, or we are doing contact tracing, we need reporters digging into what exactly they are doing. What company did you buy that tool from? Who has access to the data?Are we at an inflection point here for cellphone surveillance?It’s early, but this is how I am thinking about it. For governments looking for tools to hone their authoritarianism—regimes who want to get more control, or get more visibility into their citizens’ lives—the coronavirus is an issue like “fake news” or cybersecurity or terrorism that can been used to justify enhanced powers. For a sufficiently authoritarian government, the barrier to knowing where everyone is all the time is basically just cost.In democratic contexts, it’s cost, plus getting over whatever oversight or checks are built into the system. We are going to hear more and more that we have to implement these tracking methods so we can go on about our lives.Report by: Avi Asher-Schapiro/CPJ Global Tech Senior Correspondent