We don’t know how protests are being surveilled. Here’s why that’s a problem

The public outcry over the death of George Floyd was sparked by cellphone footage of his brutal treatment by a white police officer who kneeled on his neck for nearly nine minutes. But as protesters took to the streets to push for justice and police reform in the days that followed, many began to worry about how the camera was being flipped onto them.

Some types of surveillance are more noticeable than others. Protesters have spotted drones flying overhead, for example, a tactic that the Customs and Border Patrol commissioner said was deployed to monitor public safety, not spy on citizens. But other types are less visible, like the body cameras worn by police or Stingrays, which are briefcase-sized devices that mimic cell towers to pick up on cell phone information. 

At first blush, it may not be obvious why activists should be concerned about whether they’re being surveilled while protesting. After all, smartphones are almost constantly sending signals about users’ locations and protesters and journalists actively document the events with photos and videos. 

But surveillance and facial recognition data can be connected to many other pieces of information by government agencies and marketers. With the right tools, that data can easily be matched to social media profiles, criminal histories and credit reports.

What exactly that data will be used for, no one really knows yet. Activists and privacy researchers say that’s the problem. 

“We don’t know what happens to the data, we don’t always know where it’s collected from,” said Brandi Collins-Dexter, senior campaign director at Color of Change, an organization that advocates for racial justice. “It’s actually scary to imagine how much of our data bodies are kind of within law enforcement systems and how that will be weaponized against us.”

That fear speaks to the deep-seeded distrust of law enforcement that’s grown in the black community after years of documented brutality. This week, activists have called to defund the police, a movement that aims to redirect a portion of funds allocated for police departments to alternative programs, like sending mental health professionals on wellness visits rather than police officers. Similar programs have been successfully launched around the country.

State and federal lawmakers have already begun to act on efforts to reform policing. A veto-proof majority of Minneapolis city council members said Monday they supported disbanding the current police force and starting from scratch. That same day, Democrats from both houses of Congress unveiled a sweeping police reform proposal that includes restrictions on the use of body cameras to surveil First Amendment speech or conduct real time facial recognition. It also sets out rules about how long that footage can be retained.

But the public still doesn’t know all of the tools at police departments’ disposal to monitor them. Rules about what they need to disclose vary, making it difficult for privacy researchers to understand the potential consequences.

“If we don’t know what tools they have, we don’t know what rules we need and we don’t know what protections are missing,” said Albert Fox Cahn, executive director of the New York-based Surveillance Technology Oversight Project (STOP). The group has worked to introduce legislation at the state and local level to inject more transparency into police surveillance tools. The Public Oversight of Surveillance Technology (POST) Act, for example, would require the New York Police Department to submit reports to the City Council, the mayor and the public about the surveillance tools they use and safeguards in place.

Within the past couple weeks, dozens of lawmakers requested information from several government agency heads — the Department of Homeland Security, Department of Justice, Customs and Border Enforcement, Immigration and Customs Enforcement and the Department of Defense — about how they are collecting information about the protests. In the meantime, researchers are stuck in limbo wondering how that data could be used.

“We will not know the full extent of surveillance being used on these protests for potentially months, if not years, if not decades,” said Dave Maass, senior investigative researcher at the Electronic Frontier Foundation. “If you look back in history, being nonviolent and not doing anything wrong isn’t any form of protection from persecution.”

At the moment, researchers can only speculate on how data collected at protests might be used. Without regulation that requires transparency and limits on data sharing and retention, it’s up to individual agencies and tech suppliers to determine those boundaries.

The most immediate threat surveillance poses is its potential to chill speech. At a time when cellphone video helped expose the exact injustice protesters are fighting against, they also must be wary of being tracked. This forces activists to make a choice between bringing their smartphones for safety purposes or leaving them at home to prevent being tracked later on. Though there are some steps protesters can take to obscure the data their phones give out, nothing is entirely foolproof.

“I think there’s a serious risk of law enforcement engaging in fishing expeditions when there are these mass protests,” said Alan Butler, interim executive director of the Electronic Privacy Information Center (EPIC). “The protesters, knowing that that is a realistic threat, then may be forced to either chill their speech by not going out and engaging in protests” or not bringing their cell phones to document them.

As for how government agencies and even commercial marketers will use the data collected from protests, it’s still unclear. Researchers say the data will likely be stored in a government database and perhaps lay dormant until a person is suspected of committing an unrelated crime. At that point, the person’s presence at the protest could make up one of several data points about their history.

Or, the data could be used to try to tie a specific group to the locations of the protest, hypothesized Samuel Woolley, who leads propaganda research at the Center for Media Engagement at the University of Texas at Austin. 

Already, several conservative leaders, including President Donald Trump, have tried to pin the violence that’s broken out at the mostly peaceful protests on members of the far-left “antifa” movement. But little evidence has been offered to support those claims. 

In 2019, an investigator for the Manhattan District Attorney revealed in testimony that law enforcement had used a “reverse location” or “geofence” search warrant to obtain information on a particular area where they believed antifa members were victims of an assault, The New York Times reported. Rather than ask for a warrant on a particular person, the investigator testified they had obtained a search warrant to obtain information from Google on users in that location. They’d also given images of the supposed members to a facial recognition company.

Though unsuccessful in identifying the alleged victims, the testimony makes clear that law enforcement is already getting used to using such tactics. And little regulation is stopping law enforcement from using them.

Foursquare, a giant in location tracking whose technology underpins many consumer apps, has decided not to provide clients analytics on data from the recent protests, CEO David Shim told CNBC in a phone interview.

“It’s an incredible movement that’s occurring, but at the same time, we also don’t want to deliver analytics at a granular level that people could use for different purposes,” Shim said. “For us, it’s important to make sure that if a consumer’s opted in, that we’re also kind of maintaining that ‘Do No Harm’ tenet.”

Foursquare has an internal council that reviews different scenarios of how its data could be used. The council evaluates hypothetical scenarios as well as ad hoc circumstances as they come up, like what data they should share related to the Covid-19 pandemic.

Shim said that as the largest independent player in the location data market, “we have a duty to set the standard for the industry.” 

“As you kind of set the right tone across the industry, as you get consumers to understand that you’re taking this seriously, that this is a core tenet to your business, I think more people are open to sharing that information, especially if they understand what it’s being utilized for” he said, emphasizing that Foursquare aims to adhere to the “spirit” of its privacy agreements, rather than the “letter” of the law alone.

Still, Shim supports privacy legislation that would limit the types of data Foursquare could share with customers. Such proposals on the federal level hit roadblocks prior to the pandemic as Republicans and Democrats disagreed on whether states should be able to enforce their own privacy laws on top of the federal standard and if individuals should be able to sue over alleged violations.

“Federal regulation is important to have consistent rules across the board and to make sure that the players that are doing it in the right way are really able to grow while those that aren’t doing it in the right way have a light shone on them,” Shim said. “We are OK with that level of scrutiny.”

As protests are being surveilled, so is citizens’ health as the coronavirus pandemic persists. Those surveillance programs have generated their own pushback, though they are heralded by public health officials as key to an efficient response to the virus.

“We have two major competing crises in this country that both involve the government trying to address it with surveillance,” said EFF’s Maass.

Protesters’ heightened awareness of potential privacy violations could undermine digital contact tracing programs like the one developed by Apple and Google. The effort would minimize data collection and retention by only storing that data on a users’ device, but it would require users to turn on Bluetooth on their phones to keep track of others with whom they have sustained contact. If a contact were to get diagnosed with the virus, that person would be notified without disclosing who tested positive.

But such programs only work if they have widespread adoption because they track other contacts who have also opted in. 

Woolley, the UT-Austin researcher, said he fears the use of contact tracing and other forms of tracking could lead to a “slippery slope” of normalizing surveillance.

“If people become more used to contact tracing, then they’re likely to become more used to surveillance in general,” Woolley said. Without clear safeguards and reporting, he said, researchers are concerned that surveillance could eventually be used for more ethically ambiguous or nefarious purposes.

Jacqueline Seitz, a staff attorney at the Legal Action Center who advocates for privacy rights for people diagnosed with HIV/AIDS or with histories of substance use or involvement in the criminal justice system, said there are fewer protections on the books for public health data compared to other health matters like the ones she works on.

“The United States does not have a comprehensive consumer privacy protection law and so a lot of this will be happening in really gray areas where there [are] no privacy protections,” Seitz said of contact tracing efforts.

Collins-Dexter, of Color of Change, said she is concerned about how contact tracing efforts could seep into other forms of surveillance.

“What we’ve seen in this moment is that prior to the protest outbreak, there was a lot of kind of unleashing of new methodology and tools and surveillance that we’ve seen branded as the thing that we need to have to prevent further outbreaks of Covid-19,” she said. “And now, weeks later, we see that that same technology is what’s being weaponized for the purposes of surveillance. And so there’s a lot of different layers and concerns around the ways in which our data being collected through a number of vehicles, including and especially protests, are going to manifest in harms later on.”

Subscribe to CNBC on YouTube.

WATCH: How big data and contact tracing can help fight the coronavirus