I mean, at the end of the day, there's someone that can SSH into some server if they were really determined. There's logging and auditing that happens, though, so you'd almost certainly get caught. Could you craft some sort of perfect crime to avoid detection? It would be super hard, but there's no universe with perfectly secure software. It's a big system, and there are thousands of moving parts, and the likelihood of you actually getting very far is insanely low.

But that's the same story with that one engineer at Google that has SSH access to the server with the keys to the storage cluster for Gmail. Or the person that writes queries for the Hive cluster that manages Cortana queries at Microsoft. Or the person that writes the API layer that sits in front of the order history service at Amazon.

There's a million ways an engineer at any big company could abuse their powers. But we put safeguards in place, we watch each other, and we do our best to serve our users as best we can. I say this in a general sense, not specifically to Uber. It comes down to trust.

> there's no universe with perfectly secure software

This is why it's important to minimize the attack surface. Yes, there is always going to be risk when you store tracking data. You are choosing to create that risk by storing any data beyond what is specifically necessary. Uses such as "Optimizing pickups and dropoffs" are optional, which you more or less admit when you said it was something "we could do".

Alternatively, you could prioritize the safety of your customers by minimizing the risks they acquire when they use your service. The data collected for the ride could be minimized. You could expunge user data when it is no longer needed. You could find ways to store only aggregate data instead per-user values.

> we put safeguards in place

You also made design and business decisions that created the need for those safeguards. You are protecting your users from a problem that you created.

edit:

> we do our best to serve our users as best we can

You could be indemnifying you users for any damages that derive from the data you are choosing to store.

I don't want to sound like I'm disagreeing with you, but I want to raise some important points. Collecting too much data is definitely a bad thing. But there are things to consider:

> You are choosing to create that risk by storing any data beyond what is specifically necessary.

That's an interesting point and it begs that question of what is "necessary". Does that mean a company should distill its product down the the absolute minimum viable product without collecting any information beyond what is necessary to do its job? Nobody should use Google Analytics because it's not necessary to run a website? "Necessary" isn't black and white.

Pickups and dropoffs are very troublesome parts of an Uber ride (and definitely can't be avoided...the riders need to get in and out of the car without being run over). Uber currently has no way of improving that, without data at least. So what data is "necessary" to make that experience better? How can Uber, or any for-profit company, improve their product if they have no idea what's wrong with it? What kind of data can be collected that falls into the bucket of "necessary"?

> You could expunge user data when it is no longer needed.

Other than when a user leaves the service, how do you know when data is no longer "needed"? How can trends be measured over time if old data is expunged? How can fraud trends be detected if historical payment data is not preserved? How can Uber choose the best restaurants for UberEATS if order history is dropped over time?

When a user leaves a service for a time and returns, do they return to find a completely empty account? Would you expect this from Gmail, or Facebook?

At what point do you draw the line where you say, "I'm sure we'll never need this again."?

> You could find ways to store only aggregate data instead per-user values.

This assumes the data is homogeneous, which it's not. Different people use Uber (and any other service, for that matter) in different ways. Lumping everything together makes it impossible to discern patterns that are substantial but do not represent a majority of your user base: Some folks only ride to and from work. Some folks only ride to and from bars. Some folks only ever use Uber to go to the airport. How do you identify and optimize for these use cases?

It also calls into question how you bucket your data. Location data in California is not relevant to location data in New York. Location data in Rochester is not relevant to location data in New York City. Location data in Brooklyn is not very relevant to location data in Manhattan. At what point do you stop scrubbing your data into an aggregate form? How do you avoid scrubbing too much data away such that you've painted yourself into a corner when you try to solve a problem in the future? How do you avoid scrubbing too little, such that even when the UUIDs are stripped away you can use a big ol' hadoop job against pickup and dropoff locations to figure out which trips belong to which user?

It's worth asking also how much value you can provide to the user if you do all of these things. When I go home for the holidays once a year, I take Uber quite a lot. Should Uber forget my favorite destinations every year because the data gets expunged? Should it only show common destinations because my trip history has been anonymized?

Anyway, this is meant to point out that it's not simply a matter of keeping things as minimal as possible. It's hard to add value while also protecting users, even when the users' best interests are in mind.

"Just because you can, doesn't mean that you should."

I think people could be picked up and dropped off just fine prior to this update so it's not something fundamentally broken. Could things be improved? Sure but the benefits need to be weighed vs. the tradeoff.

Given the many responses that you have gotten so far arguing against your stance, it might be helpful to consider why people are having such a reaction. We have valid concerns and they should be addressed.

Firstly, I just want to take the opportunity to thank you for sticking around and taking part in the conversation. While my own thoughts lie mostly with the other respondents in this thread, it's critical that we have channels somewhere in-between "press release" and "Wikileaks" for getting some insight into the workings of companies like Uber.

Having said all that, it's still creepy. And the examples you gave (Google/Gmail, Microsoft/Cortana) are almost certainly also instances where data collected is being systematically used in what many would consider creepy ways.

I don't want to sound like I'm minimizing the issue, when I say this, because I respect the sentiments expressed here greatly. But there's a very strong stigma around collection of location data, more so than other forms of more sensitive information. Almost every credit card company, bank, insurance company, and more share your every purchase. What you buy, what you eat, how you live. As far as the sensitivity of data goes, location data is serious, but far less serious compared to things that people are mostly okay with.

For me, I go to and from home, the gym, and work. Every day. If someone was looking at that data, I'd be creeped out, but they'd learn almost nothing about me. If someone saw my credit card statements, I'd be mortified. And yet, almost everyone forgets to fill out and mail back that little slip you get with a new credit card that says "hey, actually I don't want you to sell all of my data to everyone on the planet."

> For me, I go to and from home, the gym, and work. Every day. If someone was looking at that data, I'd be creeped out, but they'd learn almost nothing about me.

Ha, this sounds exactly like "I have nothing to hide, so I'm okay with the NSA gathering all of my data".

Some people do have things to hide: they are having affairs, visiting prostitutes, going to Planned Parenthood to have an abortion, going to a cancer center to get treatment,...

I'd suggest you read https://www.wired.com/2013/03/anonymous-phone-location-data/ if you have not previously seen this.

Part of the issue is that location has a lot more "physicality" tied to it. One can't easily change where they live, work etc. whereas it's much easier to switch credit cards.

> I say this in a general sense, not specifically to Uber. It comes down to trust.

Yeah, I suppose this is true. Thanks for sharing your thoughts, I appreciate it.

> But so you're saying it's possible?

People with access to hardware can probably do anything if they really want to. People at the bank can remove all your money in the account by going directly into the database as well.

If data exists inside an organization, it is always, by definition, possible that someone can abuse it.

A person who knows what they're doing can stalk 50 different ways. Saying that it's worth giving up all the improvements this can make to make that impossible through just this one venue is frankly ridiculous.

> Saying that it's worth giving up all the improvements this can make to make that impossible through just this one venue is frankly ridiculous.

It certainly is; it's also something I've never said