Beware of Apps Bearing Gifts in a Pandemic

Co-authored with Johanna Gunawan, Dave Choffnes, and Christo Wilson

It might seem amazing how generous tech companies appear to be in midst of a pandemic. They’re helping track the spread of COVID-19 and offering lifelines like video conferencing and productivity software “for free.” But usually there’s a catch.

Even before COVID-19, our data was already at risk of collection, exposure, and misuse. But the pandemic has made us more vulnerable. People are isolated, which has made us more reliant on digital tools. And people are scared, which has made more vulnerable to attempts to pry our data from us. It’s past time to start looking these gift horses in the mouth. Peoples’ first priorities in a pandemic are naturally their health, safety, and ability to contact loved ones. Protecting their privacy usually isn’t at the top of their mind. Our precarious state invites privacy abuses.

We are a team of privacy and security researchers that have spent the past few years studying how companies extract and exploit personal data. We’ve got two big worries about all those free services and public health interventions by tech companies.

First, we worry about the blurry line between data collected for public health purposes and the general-purpose data coffers of tech firms. For example, people looking to get tested for COVID shouldn’t have to register for a separate data ecosystem like Google just to verify their identity. Project Baseline, a health study platform created…