6 ms·

Is Dublin Airport tracking passenger phones without their permission?

23 points by secfirstmd 11y ago

Frqy3 11y ago
These sort of solutions (Wi-Fi and/or Bluetooth based) are already growing in popularity amongst the retail sector (esp. large shopping malls), so no surprise that an airport is doing likewise. And to be clear, this in no way implies that I am okay with this state of affairs.
- Ao7bei3s 11y ago
  So maybe we should start randomizing MAC adresses whenever Wifi is turned on. (Would it be a privacy problem if MAC adresses were very short-lived? I really don't know.)
  - Usu 11y ago
    Apple is already doing it on iOS devices: http://www.techtimes.com/articles/8233/20140612/apple-implements-random-mac-address-on-ios-8-goodbye-marketers.htm http://www.techtimes.com/articles/8233/20140612/apple-implem...
    - 0x0 11y ago
      But I think it turned out to be ineffective because it doesn't kick in on real world configurations or something? http://m.imore.com/closer-look-ios-8s-mac-randomization http://m.imore.com/closer-look-ios-8s-mac-randomization
      - Usu 11y ago
        Thank you, I didn't know that
  - 746F7475 11y ago
    There would be at least service gaps if you changed MAC on the fly while connected to a network. At worst your packets would go to another device, unless your device announced it's MAC change, which would render the whole operation pointless. And sniffing for probe requests is way more revealing than just sniffing MAC addresses. Only real solution is to turn off all WiFi and bluetooth devices, latter is getting harder and harder with smart watches, wireless headphones and other stuff. That being said I'm not worried about being tracked while I move through an airport, since they already have cameras. Also your ticket is pretty telling, they know when it gets printed out, when it gets scanned in security and when it's scanned in the boarding, so you have always been tracked. This just brings more accurate data how long it takes for you to get from point A to B.
    - secfirstmd 11y ago
      I think the bigger point is that the roll out of MLA systems is happening in public spaces without any real public debate or knowledge that these things are happening. CCTV is obvious and normally sign posted in a public area, MLA is not...
jeremysmyth 11y ago
This article is based on a premise that is either incorrect or has not been defined or settled in law. The data protection law exists for the protection of personal data, defined as "data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller"[1] If the airport authority is not gathering any other information beyond the device MAC address, and is not connecting that information to other information sources (such as MAC addresses gathered from WiFi registrations) then the MAC address cannot be used to identify a living individual. Now, we all know that there is a correspondence between such a MAC address and a single individual, just as there is with DNA or fingerprints or footfall pattern or voice analysis or facial recognition, or car registration numbers or any of a number of other identifying characteristics. However, the law does not concern the gathering of data (however unique), merely the gathering of personal data that identifies someone in conjunction with other data in the possession of the data controller. Just because that data could be used to identify someone (in a different system) does not mean that it is covered under data protection obligations in this system. [1] https://www.dataprotection.ie/docs/What-is-Personal-Data-/210.htm https://www.dataprotection.ie/docs/What-is-Personal-Data-/21...
- kwhitefoot 11y ago
  How is my device's MAC address not personal information? It is unique and belongs to me, how much more personal can you get?
  - EwanToo 11y ago
    Because they don't know who you are from it - the MAC address is not a person, and you can't know who that person is without another database containing the actual personal information.
  - 746F7475 11y ago
    Well, imo you can argue that it belongs to the device and it's only tracking how the device moves through customs/security/whatever and if they don't attach that info to your name/picture/whatever-other-info then they aren't actually tracking you, just your device. But I wouldn't be worried about just MAC tracking, you get far better and accurate information by tracking probe requests. Just by capturing probe requests you can at times guess where the target lives, works and even where they spend their free time.
retube 11y ago
I just can't get outraged by this. You are walking around literally shouting out a personal identifier and demanding that no one listens. People need to take responsibility for themselves. If you have a problem with this, TURN YOUR WI-FI OFF.
- jeremysmyth 11y ago
  But I am broadcasting identifiers everywhere I go. The oldest means of recognition in the world is my face, and I don't cover that up wherever I go. I've also got a recognizable smell[1], a recognizable gait[2], a recognizable voice[3], and doubtless many other things that can be used individually or in aggregate to identify me, and that's before we get to contact-based or invasive techniques involving fingerprints, iris recognition, or DNA tests. Suggesting that people "need to take responsibility for themselves" is tantamount to victim blaming when it comes to broadcasting identities for gathering by third parties. The responsibility for correctly using data should really lie with those that collect the data, and that's what data protection acts in Europe tend to target. [1] http://www.livescience.com/5188-odor-unique-fingerprint.html http://www.livescience.com/5188-odor-unique-fingerprint.html [2] http://www.wired.com/2011/09/walking-biometric-identification/ http://www.wired.com/2011/09/walking-biometric-identificatio... [3] https://en.wikipedia.org/wiki/Speaker_recognition https://en.wikipedia.org/wiki/Speaker_recognition
  - enginnr 11y ago
    This sounds like a judgement on those who carry phones and don't think too hard about this but then call out those who go phoneless because they (the phone-equipped) don't understand the hardware. This is not a judgement. It's simply challenging the false narratives and assumptions citizens have when they carry a phone around: DO you feel empowered or enfeebled (weakened) by a phone?

23 points by secfirstmd 11y ago

Frqy3 11y ago

These sort of solutions (Wi-Fi and/or Bluetooth based) are already growing in popularity amongst the retail sector (esp. large shopping malls), so no surprise that an airport is doing likewise. And to be clear, this in no way implies that I am okay with this state of affairs.

Ao7bei3s 11y ago
So maybe we should start randomizing MAC adresses whenever Wifi is turned on. (Would it be a privacy problem if MAC adresses were very short-lived? I really don't know.)
- Usu 11y ago
  Apple is already doing it on iOS devices: http://www.techtimes.com/articles/8233/20140612/apple-implements-random-mac-address-on-ios-8-goodbye-marketers.htm http://www.techtimes.com/articles/8233/20140612/apple-implem...
  - 0x0 11y ago
    But I think it turned out to be ineffective because it doesn't kick in on real world configurations or something? http://m.imore.com/closer-look-ios-8s-mac-randomization http://m.imore.com/closer-look-ios-8s-mac-randomization
    - Usu 11y ago
      Thank you, I didn't know that
- 746F7475 11y ago
  There would be at least service gaps if you changed MAC on the fly while connected to a network. At worst your packets would go to another device, unless your device announced it's MAC change, which would render the whole operation pointless. And sniffing for probe requests is way more revealing than just sniffing MAC addresses. Only real solution is to turn off all WiFi and bluetooth devices, latter is getting harder and harder with smart watches, wireless headphones and other stuff. That being said I'm not worried about being tracked while I move through an airport, since they already have cameras. Also your ticket is pretty telling, they know when it gets printed out, when it gets scanned in security and when it's scanned in the boarding, so you have always been tracked. This just brings more accurate data how long it takes for you to get from point A to B.
  - secfirstmd 11y ago
    I think the bigger point is that the roll out of MLA systems is happening in public spaces without any real public debate or knowledge that these things are happening. CCTV is obvious and normally sign posted in a public area, MLA is not...

jeremysmyth 11y ago

This article is based on a premise that is either incorrect or has not been defined or settled in law. The data protection law exists for the protection of personal data, defined as "data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller"[1] If the airport authority is not gathering any other information beyond the device MAC address, and is not connecting that information to other information sources (such as MAC addresses gathered from WiFi registrations) then the MAC address cannot be used to identify a living individual. Now, we all know that there is a correspondence between such a MAC address and a single individual, just as there is with DNA or fingerprints or footfall pattern or voice analysis or facial recognition, or car registration numbers or any of a number of other identifying characteristics. However, the law does not concern the gathering of data (however unique), merely the gathering of personal data that identifies someone in conjunction with other data in the possession of the data controller. Just because that data could be used to identify someone (in a different system) does not mean that it is covered under data protection obligations in this system. [1] https://www.dataprotection.ie/docs/What-is-Personal-Data-/210.htm https://www.dataprotection.ie/docs/What-is-Personal-Data-/21...

kwhitefoot 11y ago
How is my device's MAC address not personal information? It is unique and belongs to me, how much more personal can you get?
- EwanToo 11y ago
  Because they don't know who you are from it - the MAC address is not a person, and you can't know who that person is without another database containing the actual personal information.
- 746F7475 11y ago
  Well, imo you can argue that it belongs to the device and it's only tracking how the device moves through customs/security/whatever and if they don't attach that info to your name/picture/whatever-other-info then they aren't actually tracking you, just your device. But I wouldn't be worried about just MAC tracking, you get far better and accurate information by tracking probe requests. Just by capturing probe requests you can at times guess where the target lives, works and even where they spend their free time.

retube 11y ago

I just can't get outraged by this. You are walking around literally shouting out a personal identifier and demanding that no one listens. People need to take responsibility for themselves. If you have a problem with this, TURN YOUR WI-FI OFF.

jeremysmyth 11y ago
But I am broadcasting identifiers everywhere I go. The oldest means of recognition in the world is my face, and I don't cover that up wherever I go. I've also got a recognizable smell[1], a recognizable gait[2], a recognizable voice[3], and doubtless many other things that can be used individually or in aggregate to identify me, and that's before we get to contact-based or invasive techniques involving fingerprints, iris recognition, or DNA tests. Suggesting that people "need to take responsibility for themselves" is tantamount to victim blaming when it comes to broadcasting identities for gathering by third parties. The responsibility for correctly using data should really lie with those that collect the data, and that's what data protection acts in Europe tend to target. [1] http://www.livescience.com/5188-odor-unique-fingerprint.html http://www.livescience.com/5188-odor-unique-fingerprint.html [2] http://www.wired.com/2011/09/walking-biometric-identification/ http://www.wired.com/2011/09/walking-biometric-identificatio... [3] https://en.wikipedia.org/wiki/Speaker_recognition https://en.wikipedia.org/wiki/Speaker_recognition
- enginnr 11y ago
  This sounds like a judgement on those who carry phones and don't think too hard about this but then call out those who go phoneless because they (the phone-equipped) don't understand the hardware. This is not a judgement. It's simply challenging the false narratives and assumptions citizens have when they carry a phone around: DO you feel empowered or enfeebled (weakened) by a phone?