Slashdot Mirror
'How I Went Dark In Australia's Surveillance State For 2 Years' (cnet.com)
schwit1 shares a report from CNET, written by Claire Reilly: In 2015, during the transition from paper to Opal [contactless public transit cards], Australia passed sweeping new data retention laws. These laws required all Australian internet service providers and telecommunications carriers to retain customers' phone and internet metadata for two years -- details like the phone number a person calls, the timestamps on text messages or the cell tower a phone pings when it makes a call. Suddenly, Australians were fighting for the right to stay anonymous in a digital world. On one side of the fence: safety-conscious civilians. They argued that this metadata was a powerful tool and that the ability to track a person's movements through phone pings or call times was vital for law enforcement. On the other side of the fence: digital civil libertarians. They argued that the data retention scheme was invasive and that this metadata could be used to build up an incredibly detailed picture of someone's life. And sitting in a barn two paddocks away from that fence: me, switching out burner phones and researching VPNs. When it emerged that police had the power to search Opal card data, track people's movements and match this to individual users, it was the last straw. August 2016 rolled around, paperless tickets were phased out and I hatched my plan. The Black Opal. The concept of the Black Opal is simple. Buy your transport card. Pay cash. Top up with cash (preferably in a new location each time). Never register it. Never link it to your credit or debit card. Live off the grid. Stay away from The Man.
[Reilly discusses the problems she faced:] All the top-up machines at train stations, light rail stops and ferry terminals were card-only affairs. One tap on that baby and you were back in the system. So, if I was busing downtown for a work meeting, I'd have to factor in extra time to get to an ATM, get cash out and then find somewhere to top up my card. Running for the train with friends, I was the one who had to divert three blocks, change jackets, burn off my fingerprints and find a nondescript corner store to top up. Here's what I learned. No one likes the paranoid one. [...] I finally came undone last week. Racing for a flight, I forgot about my Black Opal. I'd had an unusually busy week on public transport, and my balance was low. On the train to the airport terminal, it hit me. Did I have enough money on my card to pay the AU$17.76 tap-off fee that they use to gouge tourists at the airport? As I rode up the escalators and the exit turnstiles came into view, my heart sank. No ATM. No cash in my wallet. Just a row of bright green Opal readers and a top-up machine. Card only. With one trip, my years of off-grid living were undone. I slumped against the top-up machine and swiped my debit card. I was just 9 cents short, but it cost me so much more than that. My Black Opal was dead.
[Reilly discusses the problems she faced:] All the top-up machines at train stations, light rail stops and ferry terminals were card-only affairs. One tap on that baby and you were back in the system. So, if I was busing downtown for a work meeting, I'd have to factor in extra time to get to an ATM, get cash out and then find somewhere to top up my card. Running for the train with friends, I was the one who had to divert three blocks, change jackets, burn off my fingerprints and find a nondescript corner store to top up. Here's what I learned. No one likes the paranoid one. [...] I finally came undone last week. Racing for a flight, I forgot about my Black Opal. I'd had an unusually busy week on public transport, and my balance was low. On the train to the airport terminal, it hit me. Did I have enough money on my card to pay the AU$17.76 tap-off fee that they use to gouge tourists at the airport? As I rode up the escalators and the exit turnstiles came into view, my heart sank. No ATM. No cash in my wallet. Just a row of bright green Opal readers and a top-up machine. Card only. With one trip, my years of off-grid living were undone. I slumped against the top-up machine and swiped my debit card. I was just 9 cents short, but it cost me so much more than that. My Black Opal was dead.
I only read the headline (mea culpa) but talk about the best way to raise a red flag... you want to blend in...
https://www.cnet.com/news/how-...
Now what?
What if you tapped in with a card bought for cash, then "lost the card on the train?" Could you buy another card in the final station to "tap out", thus preserving the sanctity of the "Black" Opal card?
Instead just enough money on your card for one trip you should have put $40 or $50 at a time on it. Then you wouldn't be constantly running around trying to add more. Moron.
The "black opal" idea is fairly ridiculous. Home IP + work IP is enough to uniquely identify someone. Simply tapping out at the airport might be enough to de-anonymize the card: passenger manifests are probably efficiently searchable by shrink-wrap surveillance software like Palantir's, and the small set of people departing the airport within a four-hour window plus some other weak bit of information is probably enough to uniquely identify you and thus all your past and future trips on that card. "Co-presence," this kind of correlation, is not exotic. It's the typical goal of these whole-take surveillance systems, so I would expect the attacks possible with it to be in use.
In London I think you can turn in your Oyster card and get a refund in cash, which you can then use to get a new Oyster card a couple hours later with a different serial number, but of course nobody does that so it might be like wearing a kick-me sign to attempt evasion that way. I don't know.
This is exactly why you have TWO cards. One that you use only occasionally that is traceable and used only for emergencies, and one that you use mostly, which you top up with loads of cash (and cash only), and keep frelling topped up. If you're really paranoid, you cycle the cash-only one every month or two for a new one, and don't frelling worry about the last dollar-and-a-half when you ditch it.
Basic engineering: make allowances for cockups.
Put my fist through my alarm clock with its ding-dong death inside my ear. - The Blackjacks.
Why did she hold onto one single card for so long and keep topping it up?
You'd think somebody who was truly paranoid would have multiple cards, and routinely discard older cards and acquire new cards through unorthodox means. For example, if you hang out at the airport outside the "tap off" exit from the train, you can find a lot of tourists who are flying out and just want to discard their old transit card. Or put just enough to "tap on" (there's usually a minimum balance to enter the train station) on your old cards, and then find homeless people who have a near-zero-value card and trade with them-- they get into the station, you get a new anonymous card with some random travel history on it.
I do not deploy Linux. Ever.
We have the perfect opening crawl for the next Star Wars film. It's better than reading about trade disputes....
A little known loophole: Your Opal card can go into negative balance. So long as you have enough balance to tap on, you can always tap-off. Tap on with $2.50 credit, tap off for $17.76, throw the card away and get another one. Simples! (You have been living off the grid for 2 years but you didn't know this? Hmm...)
Buy your transport card. Pay cash. Top up with cash (preferably in a new location each time). Never register it. Never link it to your credit or debit card. Live off the grid. Stay away from The Man.
Ya, because acting like that isn't suspicious. "The Man" knows someone is paying for that unregistered, un-linked card w/cash, at different locations. They know the card number, they know where and when it was reloaded and used. They have CCTV cameras. They have a picture of you from somewhere you used it and, if you have any official ID -- driver license, passport, etc... -- they can match them up. They know who you are, what you're doing and where you're doing it. They have devices to identify the mobile phone(s) you're carrying and can track them if they want to.
Either they've been tracking you all this time or determined that you're an idiot and have been ignoring you all this time.
Why do you think businesses and governments encourage, and make it easy to use, electronic payment systems over cash? Identification and tracking.
It must have been something you assimilated. . . .
This is a serious question. Whenever a US data privacy debate pops up online, Australians seem to weigh in with Europeans in calling privacy a paranoid American concern. When the government told them to turn in their guns, they did so in concern for the greater good. Why not agree to have their movements tracked and their telephony metadata archived? It's for the greater good too, isn't it?
Why did she hold onto one single card for so long and keep topping it up?
You'd think somebody who was truly paranoid would have multiple cards, and routinely discard older cards and acquire new cards through unorthodox means. For example, if you hang out at the airport outside the "tap off" exit from the train, you can find a lot of tourists who are flying out and just want to discard their old transit card. Or put just enough to "tap on" (there's usually a minimum balance to enter the train station) on your old cards, and then find homeless people who have a near-zero-value card and trade with them-- they get into the station, you get a new anonymous card with some random travel history on it.
I do all you described, and one more --- I dumpster dive, a trick I learned back in the 80's and 90's
Being truly paranoid, is a rare skill in our times.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
This has been the law in Europe for some time now. The data retention time can be up to 2 years, the laws are different between countries.
opal cards are free, so you should be discarding them, and getting a new one, every trip.
if you're reusing a card, it would be trivial to cross reference your travel times with social media access, phone records, and identify you.
wrt airport, you should certainly be discarding when you go to the airport. you need ~$4 credit to tap on, when you tap off, this goes to -$13. then discard the card!
this guy isn't thinking.
If you don't mind a bit of walking (15 min.), go to Wolli Creek station. The ticket is $3.50 instead of $18
... the solution is really a social one. ;-)
Lighten up Claire (pun intended
What the man dreads is critical mass. The man is just the point-1 percent, rmember? That critical mass will come, in fact it's already there, and my bet is that that smartphone you're going to get will be more of a help than a hinder when the time comes. It may even be a prerequisite.
They called me the nameless one, the ghost who commutes, the silent passenger who refused to get an Opal transport card.
I doubt "they" called you any of those things -- especially since you actually *had* an Opal transport card (that you simply paid for w/cash).
I'm going to call you "pretentious".
It must have been something you assimilated. . . .
Firstly Opal cards typically let you tap off with a negative balance. In fact itâ(TM)s been a relatively well known exploit for getting a cheaper fare to the airport. There are plenty of articles out there on the loophole, but none as far as I can see on it being closed. Iâ(TM)m pretty sure my balance has gone negative recently, but I suppose it is possible they have put different restrictions in at the the airport. Secondly, anyone paranoid about privacy would discard their Opal card (they are free) when it ran out of credit and get a new one so that trips arenâ(TM)t connected over time and one use of a debit card to top up wouldnâ(TM)t connect their whole history.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Depends on how criminal the State is.
At some point to be law abiding means abetting crimes, even murder, and/or being suicidal.
At some point many States want more than you earn, stealing your savings.
Some slaves, with enough goodwill, courage and intelligence, successfully escape.
As the legend would have it:
Crocodile Dundee will henceforth have different associations:
Yes, but in order to blend in and not be noticed she wore a fake mustache.
A rose is a rose is a rose. She was never dark. One of her many aliases was the number of the card. Its every move was tracked. Even the cash refills.
If they've got distributed database search capabilities, I bet they could peg her name with a query alone - something like which individual used their card to get cash at the nearest ATM to this card's refills within 10 minutes of a refill the greatest number of times.
I'd also bet they periodically run a query to list all cards that have never been linked to an identity and have been filled a bunch of times over a period of more than a few months. The list would be a short, rich target ground for people on the lam. If they have a regular travel pattern, it would be easy to check them out.
The third URL in the summary is to a CNet page, when I did a mouse-over the titles matched. Not sure if they updated the summary after you read it though.
My wife needs to write a book like that.
Unless an inspector comes on board. Then you're well and truly in the system.
Comment removed based on user account deletion
I agree two cards is a better idea so you can use a trackable one in a pinch....
But I really shouldn't understand the philosophy of keeping the card with around $20 of credit. If I were trying what he did I would have $100 of credit or so if possible, refilling any time it dropped below $50... being able to take several trips without an immediate refill.
However there is a giant hole in his plan. He was always using ATMS pretty much right before filling, so I'm almost certain they were matching cameras from the ATM and the cameras on the transit refill and they knew exactly who it was who had been filling his "dark" card. Temporal separation would be better but ideally he'd have his face totally covered while filling the transit card, or else they can match his face with other info pretty simply.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Comment removed based on user account deletion
This whole story is about somebody playing "don't step on a crack and break mom's back" head games.
It's really not worthy of a whole slashdot thread.
Disappointing, editors.
GIven you can just have the balance go negative when you tap off the entire article makes no sense at all.
Last time I was in Oz the opal card went in the bin when I got to the airport since it was at about $-10, and who would pay $10 to get the balance to 0 when you can just pay $10 for a new $10 balance card...
Pass is swiped on machine at entry to bus. There is no swipe upon exit from bus. All bus routes both in and out of downtown are handled the same way.
There is no deduct done on swipe as pass is fixed $20.00 per calendar month.
System knows when each card is swiped to board the bus. System does not know when you get off the bus. Swipe is via mag stripe, not presence. In fact, if you want to use credit card, you have to go to the window. Machine only takes cash.
Most Respectfully Yours Mark Allyn Bellingham, Washington
That's still following the letter of the definition, if not the spirit. Chastity just means the abstainment of sexual intercourse. I.E. no penile penetration of her genitalia since she was female.
To err is human; effective mayhem requires the root password!
She could have just buy a new opal and top it up with her credit card and use it for that trip only, and then destroy it and use her black card again once she has access to atm somewhere else.
It's a good story in the press but this person is hardly unique.
I only fill up my transit cards with cash (whenever I can) and recycle them every so often, but I don't have breathless stories in the press about how amazingly black my Oyster, OV, etc cards are.
I just like making total surveillance more difficult.
"For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled"
In this case it's simple.
The card likely has a unique ID, otherwise the system falls apart. This ID is flagged as having no credit card attached, which is a curiosity.
The card is used in cities A(delaide), S(ydney) and C(anberra). Cross-reference ATM withdrawals on cards NOT attached to an Opal card in those cities within, say, two hours of the Opal card being used.
Bam, after four or five withdrawals the Man has narrowed the list down to very few suspects.
-=This sig has nothing to do with my comment. Move along now=-
It was until that moment "Card number $whatever", just not linked to a certain person. That and how this card traveled was still recorded. Should it have raised some flags with someone, e.g. that this card was suspiciously close to some interesting events frequently, rest assured that they would have spent the time and money to find out who holds that card.
Now those 2 years of going out of your way are rendered moot, retroactively. The card is now not only for all future uses "yours", but the profile collected in those past 2 years now can be tacked to you, too.
That's the problem here. It gets increasingly inconvenient to stay "off". It's not like they force you to play along, but not doing it makes your life very uncomfortable. It's the usual "punishment and reward" system of getting people to do what you want them to do. Show them how easy others have it that conform to your wishes and make people question why they want to have it so hard instead.
Worked with so many regimes in the past, why should it fail now?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why did she hold onto one single card for so long and keep topping it up?
Because she's the type who is paranoid without any reason to be. You expect rational thought here with a brain that is incapable of exhibiting it. She's not a terrorist or a spy, she's just a crazy person.
Is this a real story from a real person trying to protect and preserve her privacy, or is it a propaganda story made up by the Australian government to try to convince people how futile it is to try to protect and preserve their privacy anymore?
One day, here in the U.S., the average people are going to wake up and realize what's been taken from them. On that day I will laugh sardonically at them all for having been so damned dumb.
Couldn't she have just bought a NEW card list a tourist would and then ditch it? At best, the "man" could determine she visited the airport once in her life. She could have also called a cab, had them take her to an ATM, and then paid cash. Or, she could have walked. Or, she could have called a friend/family.
Ninjas don't carry tic tacs
The SF BART marks your card electronically when you get on and only charges you to get off. So they will lock you in the station if you don't have enough or if your card is damaged in transit. Hopefully the station's ticket booth is open to have a human help you get your card fixed and let you out. BART's tickets are not centralized accounts, the only record of your balance is on the card's easily damaged magstripe.
And yes, I was locked in the BART station in Daly City for 20 minutes when the magnet in my Blackberry's leather case erased my card.
“Common sense is not so common.” — Voltaire
Being truly paranoid, is a rare skill in our times.
You're not being paranoid if they really are out to get you.
Taking guns away from the 99% gives the 1% 100% of the power.
No no, you got it all wrong again: being paranoid does not mean they are not out to get you!
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
That is why I have 5 different travel cards. If one is burned I just lend it to visiting friends and keep using any of the other four cards. I also refill them in random order so sometimes it could be a year between I use the same card again, meaning that anyone who think they have nailed me, only have nailed one of my cards.
The OP also misses the problem with differential privacy ( https://en.wikipedia.org/wiki/... ). Someone just have to following from his home to the nearest card reader a couple of times and then perform a DB-query "who used his hard at station A around 07:50 day 1, around 08:15 day 2 and around 08:10 day 3" and most likely only one card will fit all three conditions. Then you are burned again.