Slashdot Mirror
Will London Monetize Wifi Tracking Data From Its Tube Passengers? (gizmodo.co.uk)
New questions are arising about how much privacy you'll have on London's underground trains. "For a month at the end of last year, Wi-fi signals were used to track passenger journeys across the network," writes Gizmodo. "The idea is that as we travel across the Tube network, Wi-fi beacons in stations would detect the unique ID -- the MAC address -- of our phones, tablets and other devices -- even if we're not connected to the Tube's wifi network." The only way to opt-out is to turn off your phone's Wi-Fi. An anonymous reader writes:
London is struggling with the transport network capacity so the ability to learn commuters' travel patterns is compelling... Now it emerged that TfL, the operator of London Subway system, is planning to use the system to monetize passengers' data. TfL is also not ruling out sharing the data with third-parties in future.
More information shows that the privacy protection could not be as good as TfL maintains, with reversible hashing and options of giving data to law enforcement. A privacy engineering expert points out additional issues in pseudonymisation scheme and communication inconsistencies. Final deployment has been initially scheduled to start in end of 2017.
"Once the tools are in place, there will inevitably be a temptation to make use of them," warns Engadget, raising the possibility of the data's use for advertising -- or even the availability to law enforcement of location data for every passenger.
More information shows that the privacy protection could not be as good as TfL maintains, with reversible hashing and options of giving data to law enforcement. A privacy engineering expert points out additional issues in pseudonymisation scheme and communication inconsistencies. Final deployment has been initially scheduled to start in end of 2017.
"Once the tools are in place, there will inevitably be a temptation to make use of them," warns Engadget, raising the possibility of the data's use for advertising -- or even the availability to law enforcement of location data for every passenger.
With 48bits and the number of people connected at one point to a wifi AP, wouldn't it be possible to randomize the MAC address ? Even with a thousand connected people, which I think could never occur, the rate of collision would be less then 1 in a hundred billion. I think nowadays most chips allows changing the mac, but I'm not sure about wireless mobile chipsets.
What sig ?
I can sympathise with TfL's stated aims - knowing how many people go from place A to place B via route C at certain times of day is useful and can be socially beneficial if it helps train scheduling.
But this can be done in a simpler way (albeit not in real time - but is that really necessary?).
Many years ago I recall using the metro and local trains in Copenhagen when they were doing a survey. When you entered the station they gave you a paper slip with the station name and timeslot written on it; when you reached your end destination there was a bin to drop the paper slip into. That's it from the passenger viewpoint - minimal inconvenience and no linking to you as a person (and you could even opt out by keeping the paper slip if you were so minded).
I'm guessing that at the end of the day they collected the slips at each station and could work out just how many people went on each journey within hour long blocks.
I do recall thinking that a bar code or QR block would simplify the counting process.
But that's not cool enough - it's too simple for today's management to consider (and it cannot be subverted or surveilled).
Slightly off topic - doesn't everyone turn off the phone wifi & bluetooth when not in use? -- doing so seems [in my experience -YMMV] to extend the time between charges by quite a useful margin.
The price of the London tube passes has grown at rates well above the inflation rate for more than 10 years now.
If some of the money made from WIFi tracking will go towards slowing down the price hikes, I would approve. But we all know that the fare prices will keep increasing faster than the inflation rate "as long as the market can bear it". Only when the passengers will all bike to work because they cannot afford the tube rides will the increases slow (or who knows, even stop)
And the money made from _public_ transport will go into private pockets.
Now that even supermarkets and other places are tracking customers via wifi as they walk around stores, it makes sense to have wireless turned off everywhere except where you need it on.
Wifimatic or similar can do this for you. It can save your battery too.
https://play.google.com/store/...
(I have no connection to this app - I just use it and find it helpful)
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
Paranoia much?
Pretty much if you're on a train (especially a Tube train) then you bought a ticket from A to B or - in London - you bought an Oyster card which records your every journey as you have to tap-in and tap-out.
This is quite normal for any train/subway system. What information do you think they are going to glean from Wifi that they can't glean in this manner about travel patterns? Only what you give them, and only of little use (does it REALLY matter that the guy going from Embankment to Mile End did a DNS lookup for slashdot.org, and how on earth would you ever properly correlate that if he only quickly checks a website at stations he never alights at, and then turns Wifi off?).
This is the "machine learning" rubbish all over again. Masses of data, lots of processing, no more insight into anything useful over and above monitoring ticket sales which you have to do anyway.
I wonder how they would account for someone having 2 phones and a tablet. Would they think this indicates more passengers?
As often there are multiple possible routes that someone can take between stations there are advantages in learning the quickest as most used routes for capacity planning.
... does not compute.
Not really news.
We suffer more in our imagination than in reality. - Seneca
But if they will admit they're doing it or not.
Really, once the data is anonymized it becomes useless to advertisers. So the fears here are pretty overblown.
Where is it when you need it most?
Not sure which "they" you mean -
TfL? they have no access to the wifi data outside of their physical infrastructure. If you are unclear about what that is then perhaps you might want to reflect on one of the names the system is known by, the underground. The wifi signals will not reach into retail premises unless they are within the station.
You could of course be referring to the company that is contracted to provide the wifi service (is this still O2? I can't be bothered to look it up) but then it relies on the retail, or other premises, using the same provider.
There is always the option that other people have mentioned. Turn off your wifi - properly. Aircraft mode and the power button are 2 options that spring to mind.
In addition to this one can always take the position of someone I was speaking to yesterday - they have a basic phone, no mobile data, no wifi, no email, self contained calendar. Photos extracted by USB cable. Now in their case this is a deliberate step away from technology rather than trying to be anonymous but if you really want to be anonymous why carry something that relies on being consistently identifiable during operation by non-physical contact means?
The London tube and public transport in general was an early adopter of electronic ticketing. What purpose could they have tracking passenger's via MAC address when they can already track them via Oyster card? What are they hoping to achieve via this? Evidence that people are walking down the tunnels?
It would seem that if you know where a person gets on, gets off, and where your carriages are a simple bit of data analytics could get them the same information.
Facebook does it. All those tiny like buttons on every page you go to.
Android helps improve your location tracking by combining wifi AND GPS through google maps...or anything with app rights on your phone.
In fact so many different organisations do it without explicit consent by cross referencing data, why would it matter if the TfL does it as well?
Here's the curious thing. Most tube passengers already use an oyster card. (some RFID-ed plastic to pay toll barriers) - so TfL already has movement and time and links to credit card data. In fact you can top-up your oyster card from your phone or online so it has a lot of identity data already.
What then can they want with WiFi/MAC tracking? - seems the only thing left is the option to snoop on people even when they do not use oyster cards or NFC contact-less payments via phone/credit card.
So when you pay for your kid they get to be tracked too! (because while only 8 they already have their own wifi enabled phone right?)
That old woman that still uses paper tickets or only uses cash to top-up her oyster card, she won;t turn her wifi off when not using it. She didn't even know there was a "WiFi" thing. She'll get tracked as well.
Keep digging along these lines...there's a lot of data they can get to this way...so they can get money from advertisers that will profile your MAC address because it's easy to know if you have a samsung or an apple. Are there more apple users in Knight's Bridge? -let's advertise out wireless apple headphones there!
Who benefits from this? -certainly not consumers that are averse to ad spamming like it's a disease.
Is it time to look at your phone and realise this is a personal tracking device. It tracks your location. Your buying habits. Your health. Your demographics. Your environment. Most of this data is not used to benefit you. -the problem is not TfL or anyone else exploiting the data (legally or not) it is us the consumers that have allowed these things to track everything about us. -wait til they cross reference your tinder profile with your facebook and your browsing habits to your amazon wish list.
Not only do these things happen and have happened, you cannot delete the data. It will most likely be accessible to a determined curious person for decades.
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
While Americans are slaughtered by the dozen by their own, apparently
... who was telling me something along the lines:
"I buy a lot of diapers. So the store I buy from will collect this data, process it through a very complicated algorithm, correlate it with other data they have on me, and at the end they will get a very important piece of information: I have a child !"
There needs to be a corollary to Betteridge:
"If a headline asks, 'Will X monetize Y', the answer is always yes."
How hard could it be? A-GPS should easily detect when I'm in an area where I don't have WiFii
(at least I only have Wifi at home, at work and at friends. Aside from that, unless I'm using some app like maps there is little reason for the wifi to be enabled.
...talk about how you can be tracked using WiFi if you have your phone on airplane mode on the London tube.
Oyster doesn't identify the passenger who paid cash.
Privacy. In England. ahahahah hohoho heheeheeheehee hahaha hohohoo hehehehahaha
You missed the word at the beginning of the title of this article. That word is How.
My UID is prime!