11 ms·
Uber says it gave U.S. agencies data on more than 12M users
- capote 11y agoIs this totally new or have there been [rumors | accusations | scandals] about Uber with respect to privacy/data selling before?
- superuser2 11y agoHere is one of many articles from an ongoing spat between Uber and the Calfornia regulators over how much data they were demanding: https://www.theguardian.com/technology/2016/jan/13/uber-fined-millions-data-dispute-california https://www.theguardian.com/technology/2016/jan/13/uber-fine...
- capote 11y agoWhoa, I was unaware.
- magoon 11y agoThe tides turn when your government starts investigating people, versus investigating crimes.
- CamperBob2 11y agoFrom the article, it sounds like these investigations are mainly run-of-the-mill criminal cases: A large number of the law enforcement requests were related to fraud investigations or the use of stolen credit cards, according to the report. But why that would require 12 million user records to be disclosed to the government, of course, is another question entirely.
- ChrisAntaki 11y agoMight just be "incidental collection". https://www.documentcloud.org/documents/758637-lesson-4-job-aid-usp-info.html https://www.documentcloud.org/documents/758637-lesson-4-job-...
- ghayes 11y agoJust for perspective, 12 million users (assuming this is US-based) is 3.7% of the US population in aggregate. This is an even higher percentage of Uber's US user base (probably by a factor of 10 or 20).
- jcl 11y agoPer the article, the 12 million records were disclosed to "regulators", not law enforcement. From "transparencyreport.uber.com", it looks like the primary consumers were California (~5M) and NYC (~3M), followed by various other cities, states, and airports.
- krapp 11y ago"regulators" who likely share their data freely with the government or law enforcement anyway. I see no reason to make a distinction where no practical distinction exists.
- fleitz 11y agoYou have no idea the ungodly amount of accounts that carders create.
- bertil 11y agoI believe that for that particular type of fraud the distinction between people and users becomes important — especially with a product that has a user sponsor new user promotion, fakes accounts are probably common. That could explain the alarmingly large number of _accounts_ being investigated, presumably not as many individuals.
- magoon 11y agoThe weasel words here are "A large number" because the spin statement is intended to portray an image to the reader that is absent in actual fact. If there were a majority, or a high percentage, they surely would have trumpted said high percentage. Instead, the ambiguous "a large number" is used, which could mean "999"
- blackbagboys 11y agoThe report can be found here: https://transparencyreport.uber.com/ https://transparencyreport.uber.com/ Interestingly, Uber does appear to have included an explicit NSL warrant canary.
- eric_h 11y agoI only skimmed - I'm curious which portion you suggest is an explicit warrant canary?
- aeling 11y agoNot GP, but I would assume: > As of the date of this report, Uber has not received a National Security Letter or FISA order.
- corin_ 11y agoHas the legality of removing that canary, if they were to receive an order that requires secrecy, been confirmed or tested in court ever? I.e. the claim of "we didn't tell people you served us an NSL, we just stopped telling people we hadn't, so we didn't break the instruction to not tell anyone"?
- djcapelis 11y agoWell, by its nature it wouldn't be an open proceeding because of the pure ridiculousness of secrecy in these types of cases, so we might not be able to confirm it like that. That said, I haven't seen anyone arrested at any of the organizations that have removed their canaries yet, so it seems like the legal theory remains as sound as expected.
- deleted 11y ago[deleted]
- rtkwe 11y agoWarrant canaries are so vague that it may technically breach the gag but it doesn't give any information that the gag orders attached to/in NSLs mainly that the targets of NSLs can't find out that their information was requested. Once a year site/company wide canaries provide no actionable information and don't even threaten to expose abuses that would show up as an inordinate number of letters being sent to a particular company that I doubt the government really cares about them in the slightest.
- deleted 11y ago[deleted]
- civilian 11y agoIs the grammar in this headline really awkward to anyone else? "Uber says gave U.S. agencies data on more than 12 million users" Either it should be "Uber says they gave" or "Uber gave". :/
- dang 11y agoNewspaper headlines have a domain-specific grammar, in which this is perfectly legal. But ok, have an 'is'.
- cowsandmilk 11y agoyes, it is awkward (at the risk of being downvoted for my simple answer)
- dec0dedab0de 11y agounless "Uber says" is a service they provide to law enforcement.
- dmix 11y ago> Uber said it had not received any national security letters or orders under the Foreign Intelligence Surveillance act. An NSL is typically reserved for companies who can give broad access to user data, such as requiring all previous and any future data for x amount of time for 3-hops from a single persons social network (which could be hundreds of people). That plus obscure the target. So an NSL wouldn't be necessary if they could hit up the regulators for large data dumps. The only question then is providing real-time access/future data. I'm not sure Uber fits the profile for NSLs. Primarily given the fact that Uber likely doesn't have social network data on their riders so a simple court order for a single users rides and GPS locations is probably all that's available for an NSA/FBI investigations. Unlike an email provider like Yahoo/Lavabit, or an ISP for example, which could provide multi-hop data. I'm curious if they built the NSA/FBI a full realtime data feed access system the way Blackberry did [1] for their BBM system during G20 in Toronto in 2010. Since the founder of Uber spoke about having a "god-mode" system [2] in place to do pretty much the same. It wouldn't be hard to expose that same system to federal agencies (even voluntarily). [1] http://www.bloomberg.com/news/articles/2013-06-17/blackberry-defends-smartphone-security-after-g-20-spying-report http://www.bloomberg.com/news/articles/2013-06-17/blackberry... [2] http://www.buzzfeed.com/johanabhuiyan/uber-is-investigating-its-top-new-york-executive-for-privacy http://www.buzzfeed.com/johanabhuiyan/uber-is-investigating-...
- lfam 11y ago> I'm not sure Uber fits the profile for NSLs. Primarily given the fact that Uber likely doesn't have social network data on their riders so a simple court order for a single users rides and GPS locations is probably all that's available for an NSA/FBI investigations. Unlike an email provider like Yahoo/Lavabit, or an ISP for example, which could provide multi-hop data. Well, the Uber app on Android requires access to the user's address book, call log, and location, so I'd say Uber does have valuable social network information. This is not a unique capability for an Android app, however.
- jzwinck 11y agoKnowing who went to or from a single location at around the same time would be super interesting for counter-terrorism. Of course, the intelligent terrorist would pay with cash, which means no Uber except in India, Southeast Asia, and a few others [1]. Which raises real questions, since taxis in some regions have cameras but Uber cars may not. [1] http://techcrunch.com/2016/02/08/uber-begins-to-see-the-payout-from-accepting-cash-payments/ http://techcrunch.com/2016/02/08/uber-begins-to-see-the-payo...
- mavdi 11y agoThis is some mass data level submission. Thanks for the transparency but at the same time, goodbye Uber.
- capote 11y agoWell hang on a second. Shouldn't we at least let this play out so we see what exactly the data was, what their criteria for giving in to the requests were, etc? Or is there something immediately shocking about this besides the numbers?
- wavefunction 11y agoIt sounds like there was no subpoena attached to the request, which is immediately shocking that a company feels so free to divulge the details of their customers. They also divulged the details of that journalist they were miffed at a few years ago. To me it seems like a pattern with Uber.
- true_religion 11y agoThey divulge the parameters of their operation in NY and California because the state governments require them to in order to continue operating. Uber likely isn't giving up any more information than your typical taxi company does to ensure they aren't falling afoul of transport regulations.
- deleted 11y ago[deleted]
- op00to 11y agoBetter not take any yellow cabs in NYC either: http://www.nyc.gov/html/tlc/html/about/trip_record_data.shtml http://www.nyc.gov/html/tlc/html/about/trip_record_data.shtm...
- steven2012 11y agoLyft produces the same data to the same regulators.
- kobayashi 11y agoMy immediate thought was, "12 million? Either governmental bodies in the US are really ramping up their social mapping efforts (in a very unusually transparent way), or this isn't a typical privacy/intelligence-related article." The latter proved to be correct, and thus, I don't think it's as sensational a revelation as I'm sure many news agencies and privacy-conscious individuals will spin it to be. Relevant excerpts: >A large number of the law enforcement requests were related to fraud investigations or the use of stolen credit cards, according to the report. >Uber said it had not received any national security letters or orders under the Foreign Intelligence Surveillance act.
- therealmarv 11y agowait, did they gave an entire DB dump away? 12M users?!
- k-mcgrady 11y agoThe vast majority of the requests are by 'regulators'. Anyone able to provide info on what that actually means? Edit: Could the link be changed to the actual Uber post instead of the almost infoless Reuters article? After reading the actual report the regulator stuff doesn't worry me too much.
- jakelarkin 11y agoread the report https://transparencyreport.uber.com/ https://transparencyreport.uber.com/ the 12M users are mostly demands from regulatory authorities - 6M is California, likely CPUC - 3M is New York, probably the TLC there that's how you get the data sets for analysis like http://toddwschneider.com/posts/analyzing-1-1-billion-nyc-taxi-and-uber-trips-with-a-vengeance/ http://toddwschneider.com/posts/analyzing-1-1-billion-nyc-ta... which appear on HN periodically and are eagerly upvoted the regulators make this a requirement for Uber to open or continue operating in their respective regions. Uber tries to negotiate a narrow scope for info disclosure as much as possible. (disclaimer: uber employee)
- abrookewood 11y agoWhat are CPUC & TLC?
- function_seven 11y agoCalifornia Public Utilities Commission and the Taxi & Limousine Commission
- tlrobinson 11y agoEasily Googleable regulatory authorities in California and New York.
- bcook 11y agoand perhaps even more relevantly defined in an HN post...
- jakelarkin 11y agoCPUC is the state regulator of "Transportation Network Companies" (Uber, Lyft etc.) since 2013 https://en.wikipedia.org/wiki/California_Public_Utilities_Commission#Transportation https://en.wikipedia.org/wiki/California_Public_Utilities_Co...
- username223 11y agoAny pointers to your data collection and retention policies? After all, if you don't have it, you can't give it.
- guelo 11y agoThis is kind of cheeky from Uber because there's no reason they could not report the exact regulatory agency requests to give us a better understanding of what is going on. Did they hand over the names and trip routes of 12 million people? Or just aggregate data like "a million people took trips to SFO".
- vox_mollis 11y agoThis is a perfectly legitimate question by guelo. Instead of downvoting, could someone shed light on why transparency reports never give specifics on the actual authorities making the requests or the data given? With the exception of those under seal or gag, of course.
- matt4077 11y ago"Almost never", indeed. I think https://lumendatabase.org/ https://lumendatabase.org/ is a shining exception. (Where I just learnt that you can take down a Tweet with the DMCA: https://lumendatabase.org/notices/12083144 https://lumendatabase.org/notices/12083144)
- joshuaheard 11y agoThat was my first thought and details were thin in Uber's report.
- steven2012 11y agoIt's the exact same regulatory information that lyft and taxicab companies hand over to regulators.
- arca_vorago 11y agoWhich is?
- hackuser 11y agoHow do you know?
- 11y ago
- Gabriel_Martin 11y agoWhat to do when your self-driving car decides to drive you to the police? https://news.ycombinator.com/item?id=11149653 https://news.ycombinator.com/item?id=11149653
- shiftoutbox 11y agoCan we just stop talking about uber . There is no such thing as bad publicity. If hn spoke about taxes 1/15th as much as it does About uber maybe the world as a whole would fix public transit , and makes cabs free to ride. Wish !
- shiftoutbox 11y agoHow low can negative karma go !!!!
- shiftoutbox 11y agoMy new goal is to have the lowest karma . Make it happen people!
- dang 11y agoPlease stop.
- miracle_code 11y agoWhut? The agencies know no ends, lol.. Who'd thunk it?
- jessaustin 11y agoOK this is creepy, but it's even creepier when e.g. Progressive Insurance use their Snapshot® device to do the same thing without telling anyone.
- Scoundreller 11y agoNote to self: list my "home" address as the address a door or two down.
- deleted 11y ago[deleted]
- robotkilla 11y agoThe quote is actually: > provided information on more than 12 million riders and drivers to various U.S. regulators and on 469 users to state and federal law agencies The article title is wrong I think -- or am I confused? This sentence sounds like they gave away regulatory information as pointed out here https://news.ycombinator.com/item?id=11484270 https://news.ycombinator.com/item?id=11484270 -- 469 users were targeted, not 12+ million. > Uber said it got 415 requests from law enforcement agencies, a majority of which came from state governments, and that it was able to provide data in nearly 85 percent of the cases. A large number of the law enforcement requests were related to fraud investigations or the use of stolen credit cards, according to the report. My math might be off, but I'm pretty sure 415, 469, and 12m+ are three separate figures... and I'm also pretty sure there were not 12m+ requests for cases related to uber fraud.
- yason 11y agoThis could never happen in the old times when you paid taxis with cash. Nobody knew who you were and where you travelled to from where. At some point, there will be people who don't recognize that sort of notion of privacy: it will be the norm that each leg of everyone's journey is tracked and recorded. Yet, Uber is super convenient so it's only the logical thing to do today. I always imagined that governments would have to increasingly tighten their grip on control and surveillance to approach that 1984 envinronment which has been looming for a couple of decades now. I would have expected that welfare states where government control is generally considered a good thing and which thus receives little opposition would gradually sink deeper into it――like that frog in a kettle being heated till the water starts boiling――until the contrast to more free countries would be blatant. However, in the last ten years or so, it seems that people, and people even in the more free countries, are volunteering into all that very control by themselves, under the name of convenience. We use Facebook, Uber, Google, Android because it's easy and convenient and opens up social possibilities previously unheard of――surely an argument to be defended――and that is how most of us give up privacy practically for free. Things are generally so well these days that there's little need to worry about privacy in practice. It's only the more dubious circumstances where it suddenly begins to matter who knows what you've been doing and where. In contrast, if an average person is not online today he will partially be an outcast somewhat among his peers. Thus, the social incentives will, in the average, drive people to surrender their privacy online to get connected to their friends. On the other hand, I don't see the online world to be avoided either per se. It's simply enough that there's a backup. If things get bad, you can disappear from online services and revert to seeing people face to face. It'll be a bit more cumbersome but hey that's how it worked for centuries before. My concern there is whether the state itself still supports handling things offline. If you have to be online to pay (lacking cash), or to travel (no anonymous paper tickets), or to drive (no cars without live connection for telemetry, law enforcement and insurance purposes), or walk (face-recognising security cameras everywhere) then it becomes very difficult to revert back to the 1900's. People's behaviour can be reverted but if the non-private way of doing things gets cemented into the fabric of the society in the form of how the state operates, then it will be very hard to opt out.
- billions 11y agoThe problem with this theory is that every time 'big brother' is empowered, all other parties are empowered as well. People can organize easier than ever before against malicious causes. The number of communication channels available to us is growing each day, making it increasingly impossible for any one entity to control all of them. People and entities trying to leverage private information are increasingly under the microscope themselves. Perhaps one day congressmen are mandated to conduct all their work on camera, similar to the way policemen do. Technology doesn't care about intent. Some people will use it for good and others for bad. Edit: For clarity, my position is that no Uber customer's routes should be accessed without a warrant. However, even if they fail to observe the constitution, they will eventually loose. There may be a politician writing a law today so that his uber rides to visit his mistress stay private.
- nissehulth 11y agoThe most recent Uber Android app requested access to app history and browser history. There may be a legitimate reason for this but I can't see it.
- aranw 11y agoThis only mention's the data within the U.S. and U.S. Riders but would be interesting to see what countries try request regarding Riders from outside of there country. For example has the U.S. government agencies been requesting data for Riders in other cities/countries from around the world and have they given said data or not?
- trufflepiggames 11y agoI know who is stealing your data too. http://www.bridezilla-game.com http://www.bridezilla-game.com