The biggest privacy risks in post-Roe America

If you buy something from a link, they may make a commission. Our ethics statement can be found here.

Millions of Americans find it difficult to find abortion services in the US. The Supreme Court ruling on Friday made finding an abortion much more difficult than it was before.

Many states plan to outlaw abortion procedures in the coming weeks. Privacy advocates are warning that people who seek abortions in certain states may be at risk of prosecution or investigation because of their search history, medical records, or other data. They've seen it happen before.

The greatest privacy vulnerabilities for people seeking abortions are found in the United States, and how people can protect their information was the topic of a conversation with experts.

How law enforcement will know if you had an abortion

A person might be flagged for investigation in the beginning. If you don't use social media at all, you may think period trackers are involved in prosecutions. Many cases begin at the doctor's office. One of the most common ways for a prosecution to begin is with healthcare providers according to the National Advocates for Pregnant Women.

There have been many cases where people have been criminalized because healthcare providers have reported them to the police. Even in the pre-Dobbs reality, the site of care is still the site of criminalization.

The Health Insurance Portability and Accountability Act, also known as the HIPAA, makes it difficult for doctors to reveal personal health information. If a crime has been committed at the institution or if there is criminal activity at the site of a medical emergency, doctors and medical organizations are able to report personal health information. In states where abortion is a crime, a doctor can report that they think one was performed, and police can use that as grounds to start a more serious investigation.

According to a health law professor at the University of Connecticut School of Law, people who aren't very familiar with medical records tend to think that the law is more protective than it really is.

All groups that appear to be providing medical care are not covered by the law. The risk is particularly high at crisis pregnancy centers, where anti-abortion activists try to convince women to have abortions in order to provide healthcare. The sites can collect information on the pregnancies of people who walk through the door and tie it to contact information. Because these centers offer counseling instead of medical care, they are generally not subject to restrictions on health data, and because they are run with the explicit goal of discouraging women from getting abortions, they may be eager to collaborate with investigations.

There are states that are hostile to abortion rights that they are operating in. They can cause a lot of problems for people who are having an abortion.

More than 2,500 crisis pregnancy centers exist in the US, more than triple the number of abortion clinics. People who are pregnant should avoid them completely.

The importance of keeping the medical details private is emphasized by the police in other cases. The reproductive rights group If/When/How deals with many of these cases through its legal helpline and senior counsel says cases usually start with a personal report

The person reporting them to law enforcement has the power to seize people's devices. Understanding how to reduce one's digital footprint is important, but the first line of defense is not sharing information.

After the investigation starts, the risk to personal data increases

The picture gets more complicated when a person is under investigation. Simple precautions can go a long way in reducing the risk of a person's data being used against them.

For the purposes of this piece, we have avoided tracking systems that have a track record of being used in law enforcement investigations, and there are few ways to avoid them. We have focused on the most effective defenses.

The sheer volume of data makes it difficult for anyone to ignore it. The Legal Aid Society in New York City has a digital forensics unit that has more resources than they have ever had. There are a lot of places where police can find the abortion data.

How to protect your search history from an abortion investigation

A recent case in which Latice Fisher, a Mississippi woman, was charged with second-degree murder after a failed pregnancies, was a result of search history. The husband called the police because he thought his wife had given birth only to find the fetus unresponsive. Fisher confessed to a nurse at the local hospital that she wanted to end her unborn child's life, according to prosecutors.

Fisher had a search history that contained searches about buying abortion pills online. Local reporting claims that the police found a record of these searches on Fisher's phone.

Once an investigation is launched, a valid court order is enough to get a person's entire search history, even if they don't know it. It is a liability for anyone to research abortion services in places where abortion is not legal. It is easy to ignore. Signing up for a privacy-minded search engine such as DuckDuckGo will prevent searches from showing up in a search history.

There is a more aggressive version of the warrant called a reverse search warrant. It has given rise to a concern about dragnet snooping around terms related to abortion. The warrants have only been issued for questions related to specific incidents, such as the name of a trafficking victim or the address of a building. It is unlikely that a general term like "how to hide a body" would be enough to get a warrant.

Are period-tracking apps really a threat?

Period trackers are a good example of an app that is poorly protected. Digital health products are not covered by the Health Insurance Portability and Accountability Act. Period and cycle tracking apps could potentially be used to check if someone has been pregnant or if the baby is stillborn.

The strategy to prosecute people seeking abortions hasn't included data from health apps. One of the most common ways to begin an investigation is with a healthcare provider. Even the apps that say they don't sell user data have language in their privacy policies saying that they would share it with law enforcement in the event of a subpoena or warrant. This kind of data could be used against people in the future.

Photo by Amelia Holowaty Krales / The Verge

Health records can be accessed by police

The Health Insurance Portability and Accountability Act doesn't protect against court-issued warrants that force doctors and health organizations to hand over patient records. They can be used to show that a person tried to get an abortion.

A new law in Connecticut tries to close some of the gaps in the law for people from other states who might come to Connecticut for an abortion. The Reproductive Freedom Defense Act makes it illegal for other states to subpoena reproductive health-related information. The legislation is a good example for other states.

It is not clear how useful that type of law would be. Information-sharing rules help doctors see the types of treatments and care their patients received from other doctors. Imagine coming to Connecticut and getting an abortion and then going to see any other doctor in Alabama. She says that we are in a world where your medical record can follow you back to Alabama.

People who seek healthcare in states that criminalize abortion will risk their records being used against them. Some health records are hard to change. The medical systems own the health records of many patients.

Cash is good; gift cards are better

There is a question of how to pay for care without leaving a record, especially for remote treatments, which can be ordered online. Cash is not an option due to the remote nature of the treatment and it is difficult to make a digital transaction without leaving a record. It would be dangerous for a lay person to attempt this kind of private online purchase if they used cryptocurrencies in a robustly anonymous way.

The Digital Defense Fund suggests using a pre-paid gift card if the convenience of a credit card is required. Square will link a credit card with a person's email address and phone number and send a purchase receipt to an associated email account in other ways.

Don’t talk about your abortion over SMS or text

Cell phone network operators have a lot of visibility into the contacts we make in our day-to-day activities because of the way they route calls and messages from our mobile devices. They are often subject to subpoenas and search warrants.

If a subpoena request can be shown to be relevant to a criminal or civil case, most cell phone network operators will hand over your name, address, and other numbers.

Law enforcement agencies can get access to the contents of your mobile phone messages with a search warrant. More than 350,000 subpoenas, 80,000 search warrants, and 50,000 court orders were received by T-Mobile in the year 2020, according to its transparency report.

Regular texting is not a safe way to communicate. Some people want to avoid having their identity linked to cell phone records. If that isn't possible, you can use a messaging app like Signal or Facetime to give an extra layer of security.

After a certain amount of time, the message history is erased from both devices.

A phone can place you at the scene

Most mobile devices collect detailed location data that is stored in a user's history and associated with that online account. People who have visited abortion clinics are included in a large amount of location data that can be purchased from data brokers.

Vice reported that one location data broker sold partial information on visitors to 600Planned Parenthood centers across the US, complete with visit duration and final destination to a census block level. Many researchers warn that it is possible to de-anonymize users from aggregate data.

Cell phone location data can sometimes be used by law enforcement in criminal cases. In the past, these warrants have been used to investigate crimes such as arson attacks and protest violence, but could theoretically be used to obtain information on cell phones that have been in the vicinity of an illegal activity.

If you want to keep your location data private, you can switch your phone off completely or leave it at home when travelling. If this isn't possible, the option to stop location data collection is available on both the iPad and the iPhone.

Lawmakers are starting to highlight the responsibility of tech companies to intervene upstream to prevent the collection of data that could be used to criminalize abortion seekers. A group of more than 40 Democratic members of Congress called on the company to stop collecting and retaining more location data than was necessary after the draft abortion decision was made public.

It is possible to shore up personal privacy and limit risks despite the huge risks. The steps are most accessible to people who aren't already targets under anti- abortion regimes. Poor communities, communities of color, and communities with limited access to healthcare have been disproportionately affected by restrictive, banning, and criminalizing abortion.

Privacy protection at the individual level is not important. Consistency is needed in the way patients, doctors, and nurses are navigating the landscape after Rae. The challenge may be too difficult for someone to take on on their own.