Slashdot Mirror
Will London Monetize Wifi Tracking Data From Its Tube Passengers? (gizmodo.co.uk)
New questions are arising about how much privacy you'll have on London's underground trains. "For a month at the end of last year, Wi-fi signals were used to track passenger journeys across the network," writes Gizmodo. "The idea is that as we travel across the Tube network, Wi-fi beacons in stations would detect the unique ID -- the MAC address -- of our phones, tablets and other devices -- even if we're not connected to the Tube's wifi network." The only way to opt-out is to turn off your phone's Wi-Fi. An anonymous reader writes:
London is struggling with the transport network capacity so the ability to learn commuters' travel patterns is compelling... Now it emerged that TfL, the operator of London Subway system, is planning to use the system to monetize passengers' data. TfL is also not ruling out sharing the data with third-parties in future.
More information shows that the privacy protection could not be as good as TfL maintains, with reversible hashing and options of giving data to law enforcement. A privacy engineering expert points out additional issues in pseudonymisation scheme and communication inconsistencies. Final deployment has been initially scheduled to start in end of 2017.
"Once the tools are in place, there will inevitably be a temptation to make use of them," warns Engadget, raising the possibility of the data's use for advertising -- or even the availability to law enforcement of location data for every passenger.
More information shows that the privacy protection could not be as good as TfL maintains, with reversible hashing and options of giving data to law enforcement. A privacy engineering expert points out additional issues in pseudonymisation scheme and communication inconsistencies. Final deployment has been initially scheduled to start in end of 2017.
"Once the tools are in place, there will inevitably be a temptation to make use of them," warns Engadget, raising the possibility of the data's use for advertising -- or even the availability to law enforcement of location data for every passenger.
With 48bits and the number of people connected at one point to a wifi AP, wouldn't it be possible to randomize the MAC address ? Even with a thousand connected people, which I think could never occur, the rate of collision would be less then 1 in a hundred billion. I think nowadays most chips allows changing the mac, but I'm not sure about wireless mobile chipsets.
What sig ?
I can sympathise with TfL's stated aims - knowing how many people go from place A to place B via route C at certain times of day is useful and can be socially beneficial if it helps train scheduling.
But this can be done in a simpler way (albeit not in real time - but is that really necessary?).
Many years ago I recall using the metro and local trains in Copenhagen when they were doing a survey. When you entered the station they gave you a paper slip with the station name and timeslot written on it; when you reached your end destination there was a bin to drop the paper slip into. That's it from the passenger viewpoint - minimal inconvenience and no linking to you as a person (and you could even opt out by keeping the paper slip if you were so minded).
I'm guessing that at the end of the day they collected the slips at each station and could work out just how many people went on each journey within hour long blocks.
I do recall thinking that a bar code or QR block would simplify the counting process.
But that's not cool enough - it's too simple for today's management to consider (and it cannot be subverted or surveilled).
Slightly off topic - doesn't everyone turn off the phone wifi & bluetooth when not in use? -- doing so seems [in my experience -YMMV] to extend the time between charges by quite a useful margin.
Paranoia much?
Pretty much if you're on a train (especially a Tube train) then you bought a ticket from A to B or - in London - you bought an Oyster card which records your every journey as you have to tap-in and tap-out.
This is quite normal for any train/subway system. What information do you think they are going to glean from Wifi that they can't glean in this manner about travel patterns? Only what you give them, and only of little use (does it REALLY matter that the guy going from Embankment to Mile End did a DNS lookup for slashdot.org, and how on earth would you ever properly correlate that if he only quickly checks a website at stations he never alights at, and then turns Wifi off?).
This is the "machine learning" rubbish all over again. Masses of data, lots of processing, no more insight into anything useful over and above monitoring ticket sales which you have to do anyway.
Really, once the data is anonymized it becomes useless to advertisers. So the fears here are pretty overblown.
The London tube and public transport in general was an early adopter of electronic ticketing. What purpose could they have tracking passenger's via MAC address when they can already track them via Oyster card? What are they hoping to achieve via this? Evidence that people are walking down the tunnels?
It would seem that if you know where a person gets on, gets off, and where your carriages are a simple bit of data analytics could get them the same information.