(Credit: Flickr)
[Editor’s Note: Readers are asking how to find out if this app is on their Android device. A tipster says you must search for “Mass Notify” to locate it. If you live in Maine and find this spyware on your phone, please send us a screenshot or picture.]
The Massachusetts Health Department secretly installed surveillance software on New Englanders’ smart phones without their consent, a lawsuit filed Monday in U.S. District Court of Massachusetts alleges.
The lawsuit alleges that the Commonwealth of Massachusetts worked with Google to develop a contact tracing application for residents’ smartphones near the end of the COVID-19 epidemic.
But when few residents voluntarily downloaded the app, Massachusetts’ caused the surveillance app to be downloaded on the smart phones of Mass. residents — and even New Hampshire residents who worked in the state — without users permission or knowledge.
“To increase adoption, starting on June 15, 2021, DPH worked with Google to secretly install the Contact Tracing App onto over one million Android mobile devices located in Massachusetts without the device owners’ knowledge or permission,” the lawsuit states.
“When some Android device owners discovered and subsequently deleted the App, DPH would re-install it on to their devices. The App causes an Android mobile device to constantly connect and exchange information with other nearby devices via Bluetooth and creates a record of such other connections.”
“If a user opts in and reports being infected with COVID-19, an exposure notification is sent to other individuals on the infected user’s connection record,” the lawsuit states.”
Mass. Gov. Charlie Baker’s communications team did not respond to an email and a phone call seeking comment on whether the governor knew about — or authorized — the covert installation of the app on people’s phones.
The Mass. Department of Public Health declined to comment on the lawsuit and did not answer questions about where the information was stored or who authorized the permissionless installation.
Several other states used similar contact tracing applications; however, Mass. was the only state that surreptitiously installed and re-installed the app on users phones.
Users affected by the clandestine app had information about their travel, social interactions, and internet activity collected and delivered to state authorities. The app took measures to conceal itself on users’ phones, living within the “settings” feature rather than the “applications” file. If users discovered the application and deleted it, the app would re-install on their phones without their permission.
According to the lawsuit, there is no law in Massachusetts that allows state government to install spy software on residents’ phones without users consent.
Thousands of user reviews for the application show users across the state complaining about the app installing itself on their phones.
The lawsuit alleges that DPH began installing the spyware on the phones of individuals who lived in Mass. or traveled through the state on or around June 15, 2021. This is accomplished by accessing the geolocation data on smart phones.
“Massachusetts DPH developed the app using API provided by Google, and Google
has explicitly stated that its employees ‘have been working with the Massachusetts Department of Public Health’ to ensure the App would be ‘automatically distributed’ onto ‘Android devices’,” the lawsuit states.
“These ‘clear indices of Government’s encouragement, endorsement, and participation’ demonstrates that Google acted as an instrumentality of DPH when it installed DPH’s Contact Tracing App onto millions of Android devices without their owners’ permission or awareness,” it states.
The lawsuit alleges that DPH’s actions constitute a series of crimes that caused harm to an entire class of plaintiffs. The lawyers filing the suit allege that the Mass. DPH violated the Fourth Amendment of the U.S. Constitution, Article XIV of the Mass. Declaration of Rights, the Fifth Amendment of the U.S. Constitution, Article X of the Mass. Declaration of Rights, and the Computer Fraud and Abuse Act.
They are seeking an injunction against the continued installation of the spyware and an order requiring DPH to work to Google to facilitate the removal of the spyware from users devices. The suit seeks to have attorneys fees covered, but asks for symbolic damages of $1.
The attorneys filing the suit are Thomas H. Curran and Peter Antonelli of Curran & Antonelli, LLP, and Sheng Li and Margaret A. Little of the New Civil Liberties Alliance in Washington, D.C.
UPDATE: A reader in Maine sent along this shot of the app happily spying away on her cell phone, so Mainers may be affected as well. The woman in question has only travelled once to Massachusetts since the pandemic and that trip happened in September of this year, which suggests the illegal surveillance campaign is ongoing.
This story will be updated if spokespeople from Gov. Baker’s office or the Mass. Department of Public Health respond.