Massachusetts Gov. Charlie Baker and Dept. of Public Health Commissioner Margret R. Cooke are refusing to say who authorized the illegal installation of COVID-19 “Mass Notify” spyware on the smartphones of potentially millions of individuals who lived in or traveled through the Commonwealth of Massachusetts.
The revelation that Massachusetts authorities partnered with Google to install contact tracing spyware on Android devices without the permission or knowledge of users came to light as the result of a class action lawsuit filed against DPH on Nov. 14 in U.S. District Court.
Plaintiffs Robert Wright and Johnny Kula are suing the Mass. Department of Public Health (DPH) along with Cooke in a lawsuit that alleges numerous violations of New Englanders’ constitutional rights as well as a violation of the Computer Fraud and Abuse Act.
No one in the Baker administration has denied the allegations. If true, the claims raise serious questions about the government’s invasion of individuals’ privacy and whether proper steps were taken to keep data collected from the program secure. But the big unanswered question here is who ultimately authorized the intrusion into smart phones to secretly install the software without users’ permission?
The spyware app — “Mass Notify” — was originally a voluntary program the state encouraged residents to download onto their phones as part of an effort to fight the spread of COVID-19.
However, when too few people downloaded the app, a decision was made to force install the program onto smartphones without user permission.
The app would then collect data on individuals’ location, including the users’ proximity to others who had the app on their devices, and transmit that data back to Google and/or the state. The true scope of data collected on individuals and how that data was stored is unknown at this time.
Massachusetts residents were not the only ones targeted with the spyware. According to the suit, a New Hampshire resident who works in Massachusetts also found the program installed on his smartphone without his knowledge or permission.
At least two Maine residents have reported finding the app on their phones as well. One Maine resident whose only travel to Massachusetts in the last three years occurred in September said the “Mass Notify” app was installed on her phone without her permission.
State officials won’t say whether the program is ongoing and Baker’s office has not responded to multiple phone calls and emails.
Last week, DPH’s Media Relations Director Ann Scales said in an email the DPH doesn’t comment on pending litigation.
DPH Commissioner Margret Cooke did not return a phone call seeking comment Monday.
Instead, Scales called warning this reporter against contacting Cooke.
“There’s nothing you’re going to get from her that you won’t get from me. I’d appreciate it if you went through the Media Relations Office like everyone else,” she said.
The Boston Globe has not covered the lawsuit, but the Boston Herald dedicated a front page spread to to story on Saturday.
Scales issued the same statement to the Herald, but the Herald report doesn’t say whether it sought comment from Baker’s office.
Mass. Attorney General Maura Healey’s office did not respond to an email and phone call asking whether her office was investigating the allegations contained in the lawsuit.
Asked whether Maine Attorney General Aaron Frey would be investigating the cases of Mainers who found the spyware on their phones, his office declined to comment.
“If our office is investigating, we aren’t allowed to disclose that,” and spokeswoman said.