"Uber shares real-time rider information with government agency"?
It seems like Uber can't win. If they share information, they're violating the trust and privacy of their riders. If they don't they still don't care about privacy but they're now also flouting regulators.
Which is fine. They chose to collect the information, and they are facing a bad look following that decision.
Of course, their business model might not work without the collection, but not every business model is guaranteed to look good.
Like this is a little nuts, if you buy one of those GPS trackers for your kids you don't get to act shocked when you find out the company has their location records. You get to be angry if they use those records for anything other than providing you service but of course they have them.
Critcizing users afterwards that they "can't act shocked" for having these things done to them is only playing a blame game.
It's not even remotely shady for a service to inherently involve knowing where you are. That's something that is true of every brick and mortar store, and indeed every cab driver. Yet the government doesn't demand that those businesses provide real-time feeds of information about the movements of their customers, and if the government were to do so and they were to object on privacy grounds, we wouldn't take it to mean that their entire business model is inherently immoral and all shops should cease to exist.
But nobody actually getting the blame since it would be weird if anyone was actually mad at this. Does anyone seriously believe that using Find My iPhone doesn't allow Apple access to your phone's location for the purposes of showing you where it is?
That's the point. If you buy a GPS tracker, for example, by definition it will track your GPS location.
Would you expect a GPS tracker to not track your GPS location? Because that is what you are saying.
Uber's ride hailing service, sure. But the same is not true for the scooter and bike services, which have no need for such information.
No, they just need to know where they are when:
1. They run a collection routine 2. The bike/scooter is low on battery.
There is no info they need in association with the rider's trip. Or at least not, as the GP states, info required "by nature". That perspective is true of ride sharing (the driver needs to know where to pick up and drop off) but false in relation to bikes/scooters (no need to know start/end points, just need to know where the bike is during collection or low battery, and not in association with a rider).
Consider a similar system that would work with coin operated scooters. They can have GPS in the vehicle without constant association with users.
In any cases these two tracking databases, where is each scooter and who is on which scooter, should be separate so they can provide the former to law enforcement without disclosing citizens whereabouts.
But I avoid using Uber-anything, in part due to Uber's data collection, so my opinion on this data sharing is probably not that important.
The way that society does stuff like this is through government bodies. The real problem here seems like a lack of trust or oversight of government bodies, which creates the impossible situation you identify.
I don't necessarily disagree, but "data used for their benefit" covers all data used by all businesses, from your emails stored by your provider (assuming you don't self-host) to trade secrets, etc.
So either we say the government should be able to access all data from everywhere (except the few that individuals store on their own) for planning purposes and such, or we must define why this data is different from other.
There's also the idea that maybe we should have total access to a currently unthinkable amount of data [0]
That way the bike doesn’t even need internet. To unlock the bike it generates a code with a key which is on the bike.
I don’t see how GPS prevents theft for small items like a bike. There is a lot of bigger farming machinery stolen despite their GPS.
How do they tell the difference between the last user not returning it, and the bike being stolen with bolt cutters after the last user returned it properly?
Quite heavy and their specific number highly visible.
The lock is nearly unbreakable, a bolt which is locked inside the bike frame. I wouldn’t know of a way to crack this physically without demolishing the bike.
It’s much easier to steal any other bike instead.
I guess the main upside is vastly reduced technical infrastructure costs so you can get over a certain small percentage of stolen bikes after reducing this probability enough.
I would be very surprised if someone can dismantle them on the street. But nevertheless if you have another bike right next to it which is worth more, lighter, faster and easier to crack why even bother?
Combine this with a few anti-theft procedures that don't involve GPS / internet (as commonly used by bikeshare programs in various municipalities) and you've got something that might work.
I also don’t understand how mentioning JSON is even relevant in this thread.
This sort of dispute is probably going to end up in a legal forum at some point. In that case, video footage from a device that's not physically on the bike (and therefore much harder to tamper with) is going to carry much, much, much more weight than GPS traces. Also, you usually know exactly who is supposed to have access to CCTV camera systems / footage, and can therefore have those people make legally binding representations as to their accuracy / fidelity.
(Of course, with regards to this problem, your objective as a service provider is to end up in court as infrequently as possible. You'd be more likely to invest in anti-theft measures so you can get the probability of theft low enough to reasonably write off as part of opex.)
The same cannot be said for the government.
Why would you assume that without significant reason? This is a company that has, as you said, had problems with privacy.
2015, tracking concerns hit the news. [0]
2017, there's a class action. [1] And FTC auditing. [2]
2018, there's massive fines. [3]
We're in 2019, years on from actual problems being raised, and then being forced to confronted. How are Uber doing on that front?
> By focusing on global hiring, you will have people on the ground in other regions who can better understand the local laws, better understand the culture that drove the laws and how a new law is likely to be enforced, and build better relationships with regulators and other influencers.
Sounds more like they're interested in controlling the laws, not actually improving themselves overall.
(And none of this is to suggest the government is any way a better caretaker - they're worse in almost every way.)
[0] https://www.wired.com/insights/2015/01/uber-privacy-woes-cau...
[1] https://www.theguardian.com/technology/2017/apr/24/uber-hell...
[2] https://www.nytimes.com/2017/08/15/technology/uber-agrees-to...
[3] https://techwireasia.com/2019/08/uber-chief-privacy-officer-...
Uber cares about the confidentiality of their business records. They will continue to not give a single fuck about privacy. There is a difference.
Thus, either you are fine with the government getting this data, simply because you don't trust Uber, or you are agreeing that the ISP should also share its data with the government in real time.
Except, as far as I can see, according to the article, the only required info is start and finish point and journey length.
[1]: https://gawker.com/the-public-nyc-taxicab-database-that-acci...
1. The taxi medallions were extracted due to poor crypto choice (and simple structure of medallion IDs), so you can map from reality -> dataset
2. The celebrities were photographed entering/exiting the taxi, with the medallion captured.
If you broke the link -- the taxi medallion -- you wouldn't have de-anonymized trips. And NYC anonymization process clearly (and correctly) intended for that link to not exist.
That is, start, end and length was not the key motivators in de-anonymization in this case. However, you can still imagine this data is sufficient to de-anonymize when usage is rare (and you've captured either start or end destination), but otherwise, the taxi data is not indicative of anonymization futility but rather implementation failure.
In other cases, no photo is necessary (trips originating or ending at a residential address, linked to another sensitive location such as an abortion clinic).
There is a lot of research available on this topic. "Unique in the Crowd"[1], published in 2013, found that it takes only 4 GPS locations/timestamps to de-anonymize 95% of the population, with no other metadata. With 2 GPS pings, 50% of trips can be de-anonymized.
But really, the straightforward way is culturally. Like if there were a general expectation that a company would only use data for an immediate purpose and then delete it, employees confirmed the company culture and processes, their legal terms supported this, and there was a strong privacy law to backstop any bad actors.
But our culture is not there. We've just generally accepted that Uber will act as an attacker, exploiting their surveillance data on us as much as currently possible, storing it indefinitely to do "better" in the future, and turning it over to other third party attackers for "business purposes".
This article draws our attention because we're pretty sure if the city gets access to this data, they'll do the exact same things for their own ends - probably turning it over to the police to integrate with the ANPR data who will pass it to the feds for their own nefarious games.
It's an environment of zero trust with its corresponding high costs, which are becoming more and more apparent as wider society is hit with the implications. This is the true damage that the Surveillance Valley ethos has done, and it's going to take a hell of a long time to recover.
The city should be able to ensure regulatory compliance, while anonymity is preserved.
To address privacy issues, data needs to be aggregated, with trip clusters with less than 5-10 trips dropped. Differential privacy strategies also exist, but dropping groups with low number of user contributions is the easiest solution to implement.
Though I grant the general point that making the drop-off location more granular could satisfy both criteria, but you would need some kind of varying size to account for scooter density.
And if you know roughly where rides are going to / from and when, then that helps you integrate your different types of public transport - for example making sure that when the train arrives there are enough scooters there, or understanding how popular scooter ride paths interact with bike lanes, bus lanes, etc.
Mobile phone cell size is generally a pretty good proxy for population density - modern micro-cell sectors can be pretty small, and 5G will make them even small in urban areas.
(I work on this sort of stuff for a major engineering data science and asset management group in the UK).
I understand why a company needs to find a distinct schooter, but why does the city need the ability to find a distinct scooter?
I fail to understand why it's an issue if the government has this data but people are okay with Uber having it. Surely trusting the government is a more reasonable policy?
By your logic, it would be more reasonable to require that Google be barred from all data sent over email, but require that copies get sent to the NSA. Similarly, AT&T should be required to not collect any phone records, but also be mandated to provide a copy of every single call to the FBI.
Uber falls under the jurisdiction of a gigantic State apparatus with both a vested interest in and the ability to use violence to enforce it’s will on you. Being a good corporate citizen, Uber would dutifully hand over your data to said government when asked. This is a distinction without a difference.
Note that I don’t think they do this out of the goodness of the hearts or altruism, but rather that they’ve done the calculus and determined that giving this data to the government would cost them enough ill will and loss of revenue to make it not worthwhile. Uber, unlike a government, has to answer to the market, and thus its every consumer’s duty to punish those who would sell our liberties.
And even when they are threatened with (and now ultimately face) a shutdown that will cost them downtime in presumably a very profitable market.
And at the same time, the government is doing bad things with your data.
If they made a habit of doing that without a serious trail of justification under the law capital flight would be historic - damaging their income and GDP/the source of economic power, and damaging stability. It isn't even anything overtly sinister - just sensing that given the peril it is time to get the hell out of there.
And that is without lobbying and soft power aren't available.
Looks like you have not really read about what governments do to their people when it's convenient for them to do so. Current examples: check China. Of course the US is not China, but that should be an ample warning enough that trusting government with data + power is a bad combination.
The difference is that the CCP has every right to shut down businesses and they make the Law directly. No provisions can be made by external parties, there is no separation of power. So in practice all companies work in accordance with the CCP and will bend to their requests. In the US there are still companies which can and do refuse the federal government's requests to provide data without sufficient reason.
But a government like the US isn't a singular entity. There are all sorts of good, bad, and neutral actors within it. If you hand the government your data now those bad actors can abuse it now, rather than some hypothetical future where the US becomes an extreme authoritarian dictatorship.
And as soon as you know who rented what bike when, and where each bike went, you're going to start knowing customers' homes, workplaces and places of worship.
Although the government and uber knowing this data is less private than uber alone knowing, we all know uber doesn't give a shit about customer privacy. Personally I'd be much more worried about uber having the data in the first place than about the government also having the data.