Class-action lawsuit filed against US state agency over mobile 'spyware'
theregister.com
theregister.com
The Register's article is a complete shitshow in emulating the confusing language from the lawsuit. Luckily the complaint itself [1] refers to an Ars Technica article from 2021 which finally explains a bit more [2].
[1] https://nclalegal.org/wp-content/uploads/2022/11/Complaint_W...
[2] https://arstechnica.com/gadgets/2021/06/even-creepier-covid-...
Really creepy that Google is willing to work with governments to force install apps like that. Makes me think nobody should run stock Android.
https://news.ycombinator.com/item?id=27558500
edit: I think it’s also worth pointing out that they are not suing for money (only lawyers fees and $1 nominal fee), they are just asking the government to stop working with google to install covid tracking apps that users cannot uninstall.
"Please use the original title, unless it is misleading or linkbait." - https://news.ycombinator.com/newsguidelines.html
edit: you ought to read the actual lawsuit - https://nclalegal.org/wp-content/uploads/2022/11/Complaint_W... before you make mistaken claims like "they are just asking the government to stop working with google to install covid tracking apps that users cannot uninstall". They have other goals.
Don’t you ever roll your eyes when you see a headline with “Soros-funded group does X” in it?
No. I try to ignore headlines because they are a waste of my limited time and intentionally provocative. I read the articles sometimes, though. In this case, it is a strategic lawsuit, leveraging a popular and reasonable cause (what Massachusetts and Google did was wrong) in order to incrementally weaken precedents towards other, mostly unrelated, goals (also wrong).
edit: The way groups like the NCLA operate is by weakening protections in a quiet way under the guise of populist and popular causes. I won't defend Mass or Google, because I don't agree with them here, but it does not follow that I should support the NCLA suit.
Seems like they ask for a lot of declarations that this was unlawful and they shouldn't do it again, $1 in nominal damages, and attorney's fees.
What sinister plans am I missing here?
Just for reference, I voluntarily installed a Covid tracking app on my phone.
Not sure what you're saying about standing, either. Seems like they've at least plead to a reasonable injury that the state should have jurisdiction over based on acts caused by the state & Google and they list various remedies. Now the other side can argue with all of that, but the pleadings don't seem obviously defective to me.
1. How did Mass install these apps in the first place if it was "clandestine" as the lawsuit alleges?
2. Google is not in the business, generally, of just giving access to private data to government agencies just because they asked. Was there some sort of legal requirement or court order involved here?
In other words, I'm taking this whole filing with a giant cup of salt until more details are available, never mind that legal filings are by definition highly biased to the side being represented.
The app was intentionally subtle, in that it had no application icon, which would presumably make it very difficult for user to disable contract tracing if they had enabled it. If you managed to uninstall the app, it would get reinstalled silently again.
2. The lawsuit alleges that there was no legal requirement or court order. Even if there had been, the lawsuit argues that the conduct would still have violated federal and state law and constitutions.
It is really pretty shitty, and, IANAL, probably is/was illegal, with the caveats that (a) I'm not sure whether Massachusetts or Google or both should be considered responsible; and (b) they might try to argue that a user's acceptance of Google's ToS and privacy policy constitutes permission.
I would think the lack of a legal requirement or court order would actually absolve Massachusetts, as it would leave the responsibility resting on Google. Surely within the terms of Play store etc, Google has the power to do anything they'd like to your device and personal information. And that power extends to Google's actions when working with other parties.
I'm most definitely not a fan of mass surveillance or centralized control. But running an operating system developed by a surveillance company, to which they have multiple backdoors and frontdoors, is fundamentally a surrender to these terrible things.
The main thing that makes this different than every other Google update is that the government of Massachusetts was also involved, for a "greater good" public health purpose rather than the usual lucre.
Now, if we had real privacy protection (either legislative or common law) to the point that processing individuals' private information were illegal, even regardless of any contracts purporting the opposite, then there could be a claim. But something tells me this suit isn't looking to go that far.
Nothing they did nears being as shitty as what the "Civil Liberties Alliance" represent. They are a bunch of bought and sold lawyers that trick us little people into believing they are pro-freedom with stunts like this, when their actual goal is deregulating in the context of worker safety, environmental, and food and drug safety to increase profits of industry. They get the votes they need for this from the evangelical movement, who they pay back by pushing for a radical reinterpretation the first amendment. Their end goal is a religious state with unregulated, unaccountable capitalism. To call them monsters is unfair to monsters.
Not everything requires a good guy and a bad guy. "Everybody Sucks Here" applied here.
There is a very old proverb from Abbot Bernard of Clairvauxin in the 1100s that is still applicable today, "The road to hell is paved with good intentions."
I don't care what Koch's other objectives might be, this is an ugly transgression of people's rights.
Arbitrary government surveillance is an incredibly bad thing and a very slippery slope.
We're witnessing governments around the world establishing '360 Surveillance' for all sorts of 'socially positive!', but ultimately dubious reasons.
If the government had specific reason to grab information about a specific person and a lawfully obtained warrant given a specific set of circumstances - then yes.
Or if we're talking the government buying generalized anonymoized information that is publicly available otherwise - then yes.
But slipping spyware onto phones is straight outrageous.
I'm generally a communitarian type person who believes we ought to step up and do the right thing as citizens but even I recognize this as the slipperiest of all slopes irrespective of their reasoning, and I can't fathom the tone of the comments here given that this is HN with usually a distinctly more libertarian-ish leaning.
"Not everything requires a good guy and a bad guy. "Everybody Sucks Here" applied here. "
Sorry but the 'Government of Mass' are the 'Bad Guys' here and the 'Koch Brothers' (or whoever is paying for this, I don't care) are the 'Good Guys' for going after them. That's it.
This will hopefully be resolved in the courts.
That's how the road to hell is paved.
“Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive. It would be better to live under robber barons than under omnipotent moral busybodies. The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for our own good will torment us without end for they do so with the approval of their own conscience.”
- C. S. Lewis
edit: To reply to your late edit, " It would be better to live under robber barons than under omnipotent moral busybodies" is magnificent, because it correctly frames the NCLA lawsuit "The robber baron's cruelty". I can recognize a wolf in sheep's clothing or trojan horse, whatever your preferred metaphor is.
I would reply "No thank you to either option, but thanks for the books, C.S. Lewis"
final edit: dmix, I am rate limited, so I can't reply to you, and I've written more than enough already. But you make a fair point, and it seems in good faith. I agree with you in general. I don't generally agree with something because someone claims, "it's for widows and orphans", which is the cliche. I just disagree with you in this particular set of circumstances. I would agree with a different lawsuit made in good faith meant to remediate the injury to the claimants.
So they are a very critical piece of the puzzle with this sort of abuse of power. They can very easily muddy the waters and obfuscate things.
It's often the side effects of their actions anyway. In this case the access the app provides is the side effect. The side effects outweighing the alleged benefits is what matters. Easily the most often recurring problem is politics. 1 step forward, 2 steps back.
So, that includes all possible versions of good intentions? All good intentions lead to torment? There are no sociopathic tyrants lacking conscience?
Anyway, I doubt Yahweh considers it a sin to install tracking software onto people's phones.
I don't give a damn what your god thinks. Or are you responding to C.S. Lewis's beliefs? Quoting a Christian doesn't make me a Christian, least of all when the quote doesn't even present a religious argument.
The suit, as described, leaves a lot of questions.
Google can push apps onto your phone and the apps can run without interaction on the phone. Often that's useful and authorized by the user --- you can use the google play website to push things, but this case shows it's not limited to that. I don't think you can disable this through settings, you would have to disable play services or block the networking or not have gapps installed or something.
Play services runs in a priviledged mode and generally updates itself, so there's a lot of trust needed.
Afaik, all modern commercial OSes intended for end users have a similar level of trust required for the vendor. The capability to push code run in a privileged space enables rapid response to emergent malware, but also enables the vendor to take actions without explicit consent.
I don't often need GPS, so I wonder if disabling Play Services would work for me without allowing forced spyware pushes.
Here's what the suit alleges:
>To increase adoption, starting on June 15, 2021, DPH worked with Google to secretly install the Contact Tracing App onto over one million Android mobile devices located in Massachusetts without the device owners’ knowledge or permission. When some Android device owners discovered and subsequently deleted the App, DPH would re-install it on to their devices.
https://nclalegal.org/wp-content/uploads/2022/11/Complaint_W...
Google made a statement confirming that the app was pushed by the Play Store at the time:
>We have been working with the Massachusetts Department of Public Health to allow users to activate the Exposure Notifications System directly from their Android phone settings. This functionality is built into the device settings and is automatically distributed by the Google Play Store
https://arstechnica.com/gadgets/2021/06/even-creepier-covid-...
You're saying a State Government can request Google installs a 3rd party app on 1 million phones? If that's true then I'm genuinely astonished. And more so that it wasn't headline news at the time.
Or maybe there's more to this than currently is apparent.
Yes. That's what happened. (I'm not sure if the 1E6 phones claim is accurate, but it was a non-trivial chunk of people near MA).
Discovery will probably shed some light on this. How would the plaintiff know the exact method used?
> never mind that legal filings are by definition highly biased to the side being represented.
Tell me you’ve never been a plaintiff in a lawsuit without telling me you’ve never been a plaintiff in a lawsuit. Why would the fillings _not_ be biased to the side being represented? Why would the side being represented be biased to the defense? That makes no sense at all.
This is not exactly difficult. They are alleging that this was installed on a million phones, I'm sure doing some straightforward technical forensics would make it clearly apparent what was going on.
> Why would the fillings _not_ be biased to the side being represented?
You've misunderstood my point, though I don't understand yours. Of course the filings are biased, that is exactly what I'm saying. I've just seen numerous cases (myself included) where people get out their pitchforks when they've only read one side's version of events, well before a complete picture emerges of what actually happened.
This allegation is based up the number reported by Google that is available to the public.
> I'm sure doing some straightforward technical forensics would make it clearly apparent what was going on.
Why? Why spend the money to hire a forensics analyst or a team, when through discovery you can learn that information straight from the source. In my opinion it would be worth it to wait to see if the lawsuit actually progresses and is not immediately slapped down by a judge. If immediately slapped down then you just wasted money, by waiting to ensure it’s approved to move forward you can save some money.
I will admit I have not read completely the actual filing, which probably will shed more light on it than an article.
Since when?
That's called asking with more steps.
> The Massachusetts Department of Public Health conspired with Google to secretly install a COVID-19 tracing app onto more than 1 million Android users' devices without their knowledge and without obtaining warrants...
(It is interesting the extent to which people don't tend to think in these terms. Yeah, the Koch's are terrible. But they're 100% correct on this one)
Why was this not brought by an organization like the EFF or ACLU? I remember writing to my Senators at the time because of how unprecedented and troubling this action was.
Here's an article from The Verge with more details from the time this was rolled out:
https://www.theverge.com/2021/6/21/22543486/massnotify-covid...
Here's a less political website:
https://www.bostonherald.com/2022/11/18/massachusetts-dph-go...
Ars Technica (from 2021!): https://arstechnica.com/gadgets/2021/06/even-creepier-covid-...
Frankly I think tagging them as a partisan group adds important context, though I agree that should be exposed in the article rather just left as code in the headline.
Should we start calling them a partisan organization?
https://www.cnbc.com/2020/07/02/most-liberal-tech-companies-...
[1] - https://nclalegal.org/wp-content/uploads/2022/11/Complaint_W...
All 12 of them?
If Google were able to I stall this without user interaction then android phones are compromised bemy default!
If the state asks an arbitrary person to break into your house, and that person breaks into your house, they should be prosecuted. Only if they are not prosecuted is there an argument to be made they're acting with de facto state authority.
What Google did here was not illegal. It should be, but it's not.
Of course there are other solutions besides the technical one of installing software that represents your interests. For example, effective privacy legislation would go a long way towards curtailing commercial surveillance, as well as giving users a way to distance themselves from companies that did objectionable things.
Not saying that's what happened here. I don't know. But it's a relevant bit of context.
You could say that about practically every Democrat. Usually they brag about it “we have the most donations under X amount.”
Or did they turn it on by default in US?
"To increase adoption, starting on June 15, 2021, DPH worked with Google to secretly install the Contact Tracing App onto over one million Android mobile devices located in Massachusetts without the device owners’ knowledge or permission" which is very different from installing an app!
Don't remember what happened then, I guess Google+apple updated the protocol or killed the app.
Framing is everything, y'know? You could just as easily call it a lawsuit to stop a blatant and unconstitutional power grab by the CDC.
In reality, the Koch brothers have an eclectic mixed bag of ideas, some of which are batshit crazy, some of which are good, most of which are meh.
Libertarianism in general seems to filter/select for people that insist mankind can’t possibly alter the climate and that it’s just a huge leftist plot.
It’s the primary try reason I stopped identifying with the concept.
Disappointing because there are a lot of good ideas / principles in the philosophy, but the degree of pedantic extremism exhibited by the community is weird.
I don't recall anything extreme or controversial. The gist was: gov regs too often have a winner and a loser. It all depends on who / what has the most influential on the legislature.
I guess that's controversial is that's what truth and honesty is.
Saying a system has faults and can he improved doesn't mean you are excluded from that system.