Tracking in the name of Covid-19

As if being in lockdown wasn’t grim enough, Claudia Moreno saw a creepy ad while scrolling her Instagram one night last May. In red, black, and yellow, adorned with the Bogotá mayor office’s logo, the graphic warned: “Due to your location, you were likely in contact with people who have COVID.” Moreno tapped it, out of curiosity and hoping that it would stop showing up in her feed. “They were too flashy and unnerving,” she said.

Thousands of Colombians have seen similar ads on their phones, because in the capital Bogotá and in the department of Antioquia, health officials are using mobile data in their Covid-19 contact tracing efforts. But rather than relying on dedicated apps that require active downloads, Colombian authorities are using digital advertising data present in people’s phones — without first asking their permission. While activists say this is a privacy breach, authorities claim the action is justified because it helps in contact tracing and makes sure patients are identified and get treatment.

Bogotá did not only run geotargeted ads on Facebook and Instagram in the neighborhoods it deemed more at risk; officials also used the data to understand how the virus was moving within city limits and how residents were socially isolating. Bogotá health authorities declined an interview request from Rest of World to explain their contact-tracing initiative further.

Antioquia also leveraged the technology behind mobile ads to locate sick individuals in the capital Medellín and the rest of the region. “We wanted to be more proactive in identifying where infected people are,” said Juan Carlos Quiceno, spokesperson for the state’s ad-tech contact tracing initiative.

Both governments contracted local company Servinformación, which promised contact-tracing capabilities using regular mobile ad tech to “track individuals inside an area the government would like to monitor as well as to see how the virus propagates,” says Emiliano Isaza, a data scientist for the company.

Rather than relying on a custom-made app, as many governments around the world have done, Colombia’s tracking systems use the same geolocalized data that allow marketing companies to profile users and show them personalized ads.

One of the ways that mobile apps make money is by selling information about what people do with their phones, like what websites they visit or where they are at a given moment. That information is tied to a numerical code, known as an advertising ID, embedded in Google and Apple’s operating systems.

This ID is meant to single out each individual device, creating a profile for advertisers to target ads to specific audiences. All the data obtained is supposedly anonymous, in the sense that it doesn’t contain any identifiable information, like names or dates of birth. But it can show locations at a given moment in time or websites visited on a smartphone. While users can opt out or reset it on their phone settings, only 20% do it. 

According to Quiceno, every week, health officials in Antioquia send Servinformación a list of Covid-19 patients and their home addresses. The company first looks for IDs that usually spend the night at these locations. Then, the company searches for IDs found at least 10 meters from the patients’ devices for 30 minutes or more, and also for IDs that might have mingled with them and were at least 10 meters away from them for at least half an hour. Servinformación then blasts both sets of IDs with ads on social media and mobile games, asking the phones’ users to check for any Covid-19 symptoms.

There is a second part of this process. The company gathers all the spots where these IDs are spending most of their time and sends these locations to the Antioquia government. The officials then look up these properties’ owners in the state registry and send them text messages. “YOU MIGHT HAVE CORONAVIRUS,” the texts say in all caps.

Privacy activists worry that this system could give authorities too much information about people’s daily lives. “It might become a surveillance system, if the government has data from every person who uses a smartphone,” said Andrés Velásquez, a researcher from the Karisma Foundation, the digital rights organization that first denounced the use of ad tech by health authorities in Bogotá and Antioquia.

The question here is if the government can use these data to track and identify people against their will, particularly in a country where digital intelligence tools have been used to spy on journalists, activists, and politicians. “The data is not granular enough to know if two people were close enough for transmitting the virus. But it will expose where people have been and what they were doing,” said Katitza Rodríguez, international rights director of Electronic Frontier Foundation.

“I just have to know where this person lives and see what IDs appear there,” Velasquez said. For example, if John Doe tests positive for Covid-19, health officials will know his address. Once Servinformación checks which IDs are spending the night in that same place, it would be easy for the government to infer which advertising ID belongs to John by seeing his location history.  

Quiceno and Isaza say they don’t seek to identify people: The government doesn’t see the actual ID codes, and Servinformación claims it doesn’t have access to any information that could lead to people’s real identities. “The data only shows me the numerical code for the advertising ID and a time stamp,” Isaza said. 

They also said that law enforcement has nothing to do with the program, and only the pandemic response team has access to the data. Servinformación is also contractually bound to erase all the information once the program is done, and neither the government nor the company can use the data for any other purpose.

Quiceno also defends mobile ad tracking as a way to do direct testing in high-risk areas. “We tell the cities which specific blocks they should send an epidemiological team to, as there might be a lot of positive cases there,” he told Rest of World. They have sent more than 411,000 ads and text messages since April, triggering more than 1,600 calls to health services — a response rate of 0.4%, below the benchmark of 0.5–0.7% for this kind of digital marketing campaign.

However, Quinceno said the edge Antioquia gains is worth all the hassle. Colombia had almost 600,000 Covid-19 confirmed cases as of August 31, and it is one of the countries with the highest rates of new cases in the world, which puts it at a serious risk of overflowing the country’s healthcare capacity. Isaza says his company’s technology can help isolate the so-called Covid-19 “superspreaders.” “Just by locking down the blocks where these spreaders live,” he said, “the benefits would be huge.”

Colombians seem to acknowledge that. Once Moreno clicked the ad, she was redirected to a form that asked for private information, like her health antecedents and if she was experiencing Covid-19 symptoms. She filled it out, even though she felt like it was a bit too much. “I wanted to let them know I was here,” she said.

All that happened was the arrival of an SMS later that evening, at midnight: “We will call you if necessary.” No one did, but the ads kept showing up in her social feeds through the rest of the month, as a reminder that even in isolation, she was still surrounded by the virus.