51 ms·

Uber reportedly tracked Lyft drivers using a program named ‘Hell’

179 points by petergatsby 10y ago

freedomben 10y ago
I really hope that Uber's shenanigans get studied in ethics classes in Computer Science and other technology degrees. When I was doing my CS degree, we had a mandatory ethics class (which I hated at the time but in hindsight think is a good thing). Ethical implications were something I hadn't previously thought of much, but in the field I've encountered them many times. Based on the news that has been coming out from Uber, I think it's time for our industry to re-focus on the ethics of what we do. Being technologically cool, doesn't make something good.
- DaiPlusPlus 10y ago
  Mine focused on Therac-25... not quite the same problem-space. It's possible Uber's devs were misled about the nature of the software they were writing - for example I read their other secret system, "Greyball", was written under the guise of protecting Uber drivers from being physically assaulted by militant Taxi drivers - a common sight in certain parts of the world - nothing to do with the dual-use of shadow-banning public officials and journalists.
  - rosstex 10y ago
    Are you from Berkeley?
    - alpha_squared 10y ago
      Mine also focused on Therac-25, but I'm not from Berkeley. It's likely that it was used throughout several campuses. Though I feel that's not so much about ethics as it was appropriate safeguards/testing given the problem space.
      - jrockway 10y ago
        I think it's a pretty common ethics case study. Therac-25 almost seems like a meme to me these days: "What are the ethical implications in the field of software engineering?" "Therac-25." I don't think we've gotten any better, either. I'm surprised there aren't thousands of Therac-25s killing people every day, actually. I guess the hardware engineers got better at turning off software, because I don't think software engineers got better at software engineering.
        Gibbon1 10y ago
        > I guess the hardware engineers got better at turning off software, because I don't think software engineers got better at software engineering. Years ago (like 25 years) I read an author discussing safety critical system. He flat out said, safety must be a primary system level design goal. Attempts to band aid it in will fail. Properly designed systems have safeties, interlocks, and monitoring subsystems to prevent software bugs from propagating to the point where people are harmed. People designing safety critical systems tend to completely distrust software.
        bipson 10y ago
        Huh, I think I never heard of the Therac-25. We instead talked about flight Lufthansa 2904 [1] (Airbus A320-211 Warsaw accident), also as a case of overconfident engineers (although Wikipedia mostly blames the weather report). [1] https://en.wikipedia.org/wiki/Lufthansa_Flight_2904 https://en.wikipedia.org/wiki/Lufthansa_Flight_2904
      - noir_lord 10y ago
        Therac-25 featured on our syllabus here in the north of England. Its a pretty infamous case.
      - DaiPlusPlus 10y ago
        The "ethics" aspect came from the conduct of the engineers behind Therac that did not take the reports of malfunctions seriously, including a fatality - they were too overconfident and arrogant - as a result it took 2 more people to die, and many more seriously injured, before the problem was identified and fixed. We also covered other ethics-related case-studies that covered project-mismanagement leading to massive cost-overruns, especially of public-service projects - particularly when those overruns are caused by malfeasance instead of incompetence or ever-changing client requirements (e.g. embezzlement, fraudulent conduct, etc). Another one was the ethics of personal data collection.
- stass 10y ago
  What's unethical about this? They were doing market research. It's not much different from stalking your competitor on google and going after the users they advertise to.
  - jsmthrowaway 10y ago
    It's completely different, so far different as to be antonyms, opposites, completely diametrically opposed ends, because you just described a passive, orthogonal, ethical activity while Uber actively fooled with Lyft's systems to get the intel they wanted (emphasis mine): > Hell originated after Uber created fake rider accounts on Lyft and used software to trick Lyft’s system into thinking those riders were in certain locations. This allowed Uber to see the eight closest available Lyft drivers to each fake rider. You literally just typed the equivalent of "what's wrong with using an ad unit to deliver a zero day exploit? It's not much different from advertising."
    - JustSomeNobody 10y ago
      All of which /u/stass would have know had there been an ethics class for them to take. ;)
      - stass 10y ago
        There isn't the one and only standard for ethics. Perhaps a class would teach a certain version of ethics, but not a universally applicable one. As a somewhat relevant example, a lot of ethical norms in USSR (prosecution of successful individuals, outlawing free speech, destroying dissent, banning "unethical" literature and works of art) would be considered completely unethical in the Western society and vise versa, although the admiration of former became fashionable in tech circles lately.
    - _jezell_ 10y ago
      Creating fake accounts is pretty common for spiders... standard search engine tactics.
    - viraptor 10y ago
- watwut 10y ago
  I don't think it is lack of ethical knowledge that makes people act unethical. It is that being consistently ethical costs and may have bad impact on your career. It is also that company like Uber would punish overly ethical people too much and would pish them out. Ethical class won't solve that.
  - m_t 10y ago
    Ethical class might help a young developer understand why working at a company like that is a bad idea. Understanding that a company punishing you for being ethical is a big glowing red flag is important.
    - thewhitetulip 10y ago
      Yes, but the problem is that Uber pays well and it has a lot of interesting problems to solve, and as usual in our society, morality becomes the later priority than interesting work/pay
      - spcelzrd 10y ago
        It's not a problem limited to our society. Ethics, regulations, and consumer pressure can all help to keep corporations in check. The thing to remember is that a corporation can never have a moral compass, so we have to give it to them.
      - cjrp 10y ago
        But if there was the potential for future prosecution because of your actions, maybe that would alter the risk/reward profile enough for some people? Especially if you've taken an ethics course, and thus can't really argue plausible deniability.
      - wfo 10y ago
        If developers had a professional organization and working for Uber (or some company that does things which are banned by that organization) was a black mark on your resume that would ensure you never get a good job again, then we'd be in business. That's how it works for doctors and lawyers.
- astrodust 10y ago
  Since we all learned so much from Enron and ethical problems like that never cropped up again, stands to reason Uber's going to be the last of its kind.
  - asdfologist 10y ago
    Sorry I can't tell whether this is sarcastic.
- woodruffw 10y ago
  I've been designing a CS ethics class for the past few months, mostly as a personal challenge. I proposed it to a few professors in my department yesterday. The responses I got were mostly variants of "not until they make us," which is exactly the kind of attitude that results in our present state of affairs (thinking of the BMW emissions controversy, Uber, &c). I don't want another major teachable scandal to come out of the tech world, but that may be what it takes.
  - toss1 10y ago
    It was VOLKSWAGEN --NOT BMW-- that created the emissions scandal by programming their cars to change the engine running parameters when the detected the conditions of the emissions test. first article found of 641000 http://www.bbc.com/news/business-34324772 http://www.bbc.com/news/business-34324772 BMW is actually doing it right http://www.bmwblog.com/2016/02/16/top-five-current-diesel-bmws/ http://www.bmwblog.com/2016/02/16/top-five-current-diesel-bm... sheesh (edit: add BMW story link)
    - neoeldex 10y ago
      That's not true, All car manufacturers were pulling tricks in order to save adBlue. The BMW story is on a bmw blog... Here you can see other emissions, in a Guardian article, where it's clearly to be seen that BMW does not comply to the EURO 6 norms. https://www.theguardian.com/business/2016/apr/21/all-top-selling-cars-break-emissions-limits-in-real-world-tests https://www.theguardian.com/business/2016/apr/21/all-top-sel...
      - toss1 10y ago
        Perhaps the Guardian story is true and everyone is playing around the margins on the European tests, but that's trying to obscure the forest with one tree. In the actual context of the comment, which is the the USA "emissions controversy" with the massively fraudulent code, it was VOLKSWAGEN that was the main player, BMW was not involved. (also IMO, Diesels are a pretty bad way to burn fuel in any case; I don't think BMW should pursue it at all, and although I like my petrol-powered model, I wouldn't buy one of their diesels)
perfmode 10y ago
It's only because Uber's view of its own drivers is known as heaven/god view. edit: discussed in article. Call me a pessimist, but I am betting that, despite the long and rocky road ahead, Uber is eventually going to succeed. And we're going to see the emergence of a new corporate template.
- unlmtd 10y ago
  Uber is going to be rendered obsolete by an open platform based on blockchain identity.
dnautics 10y ago
I strongly prefer lyft's side, haven't used uber in years and the last year I drove for ridesharing I exclusively drove for lyft and not uber, but I really don't have a problem with this. OF COURSE you should collect intelligence on your competitor's activities - if they expose information publically (e.g. showing the cars on the app / API) and cross-correlating with the uber drivers that still are logged on - what is the objection to this? Mind you, some of the other things uber has done, like hail a lyft and repeatedly cancel, are totally not ok.
- fapjacks 10y ago
  Agreed. I think Uber is terrible, but I also think this is just no-brainer competitor research.
  - pyrale 10y ago
    There is a strong dichotomy in the minds of many american people, between large private companies and public offices. This is an instance of it: Uber has shown in the past that they can wield considerable powers, and are prone to misuse it. Therefore, them collecting data about drivers, a population that is vulnerable towards Uber (and a subset of which we know is shared between the two platforms), is dangerous. If you approach this dichotomy from the other side, can you imagine the NSA being described as doing no-brainer customer research ?
    - fapjacks 10y ago
      If Uber had been circuit-bending the Lyft app or Lyft's API or rider/driver devices, I would think it unacceptable. But this information is being provided by Lyft inside their app. Uber was just aggregating this information and storing and analysing the data. Also the NSA is doing a lot worse things and we know this for certain. I find it distressing how many people seemingly have forgotten about that. If the NSA were only going this far, I'd be pretty happy.
      - pluma 10y ago
sillysaurus3 10y ago
Lyft said “We are in a competitive industry. However, if true, these allegations are very concerning.” Notice the careful non-statement by Lyft. It's hard to believe Lyft isn't doing exactly the same thing. It's not questionable behavior to track what your competitor is doing. That's the first step toward beating them. And yes, Uber is trying to beat Lyft, just like Lyft is trying to beat Uber. That happy balance is a good thing for consumers. It's pretty strange that I have to second-guess whether to post this comment since it could be interpreted as a defense of Uber. But the PR spin is getting to be a feeding frenzy. Is all tracking now unethical? Under what circumstances should you be allowed to track other people? Google knows more about you than your significant other. Should they be allowed to do this? Is this ethically questionable? What is the categorical difference between Google and Uber? These are questions which have no clear and easy answer, but it's painted as if it's so clear-cut.
- rodorgas 10y ago
  Agree. Google not only tracked Bing but also set up fake results to catch them copying. There's an app that compares the price from Uber, Lyft and others services. These two examples are using data from computer systems in a way companies didn't intend. Have you guys ever thought that search engines scraping your site is opt-out? We are just repelling this because Uber has a bad reputation.
  - stordoff 10y ago
    > Google not only tracked Bing but also set up fake results to catch them copying. I'm not sure I see the similarity. Google never sent false queries to Bing - Google sent synthetic queries to their own infrastructure, and observed how Microsoft's software (search engine, toolbar etc.) responded to that. There's That seems closer to if Uber had just hired a team of people to use Lyft and record their observations (which is still problematic, as one of the results is tracking people without their knowledge, but for different reasons than falsifying queries to scrape this data).
- eridius 10y ago
  > It's hard to believe Lyft isn't doing exactly the same thing. No, it's actually really easy to believe that Lyft isn't tricking Uber's computer systems into giving Lyft real-time info on Uber's drivers and fare prices. Please stop trying to make excuses for Uber's shitty behavior.
mtgx 10y ago
That's appropriate, considering Uber itself seem to have been born in Hell.
JumpCrisscross 10y ago
> [Uber] used software to trick Lyft’s system into thinking those riders were in certain locations Could this be a CFAA violation? Are there any prosecutorial jurisdictions with lots of Lyfts and few or no Uber?
- pluma 10y ago
  I'd be surprised if this couldn't be spun into a federal crime if there's any interest in taking this to court and involving the authorities.
Buge 10y ago
Interesting how they didn't punish drivers who also drove for Lyft, they actually rewarded drivers who also drove for Lyft with better Uber offers.
- perfmode 10y ago
  always have a counter-offer.
- yesiamyourdad 10y ago
  Uber & Lyft need a large pool of drivers readily available. The quick pickup is a key part of the experience that makes them superior to taxis. Especially drivers who are rated well. I'd be kind of surprised if a driver's rating didn't factor into their entire incentive program. I carried a 4.9 Uber rating by the time I quit driving and they were issuing some really attractive incentives by the end.
_jezell_ 10y ago
Doesn't seem much different than Google indexing the web. They were just crawling Lyft.
- pluma 10y ago
  They created fake accounts with fake geolocation to extract information, then they exploited a design flaw in Lyft's software to perform an enumeration attack that allowed them to extract full information about all drivers in real time in order to exploit that information financially. Google crawls public websites while respecting counter-measures like the `robots.txt` protocol. They also don't create fake accounts. They most certainly don't perform enumeration attacks to find more content to index. This is nothing like what Google does. If Google did this, they'd be called out the same way. Heck, if anything, this is similar to what Aaron Swartz did, except Aaron did it to make the information public rather than profit from it for financial gain -- and the data he did it with was neither sensitive nor private.
free2rhyme214 10y ago
At this point, what hasn't Uber done?
- Razengan 10y ago
  At this point, is anyone else feeling like there's might be some vendetta-driven campaign directed against them?
  - douche 10y ago
    Somebody very much wants them to fail. It's starting to feel like the campaign to pump up all the Russophobia
    - pluma 10y ago
      Except there's more evidence of Uber's failings than for the accusations levied against Russia.
  - RoyTyrell 10y ago
    If there is, they don't have to do much other than to make Uber's shitty practices more public.
- noway421 10y ago
  became a viable stable enterprise?
- bbcbasic 10y ago
  Trafficking
- ClassyJacket 10y ago
  Used chemical weapons?
pkkim 10y ago
If I were Lyft, I might try to detect what traffic is coming from suspect clients and present an inaccurate view to them to maximize inefficient spending on Uber's part. This seems like it should be easy to do without harming someone in case you inaccurately label someone as illegitimate.
- pluma 10y ago
  It is interesting that Lyft didn't detect this malicious behaviour and this raises some questions. Did Uber try to obscure what they were doing by spreading the requests over various IPs to cover their tracks? This would indicate that they knew they were doing something malicious (which could affect sentencing if this is considered a federal crime under US law which it actually might be -- though IANAL). If this really was "realtime", why didn't Lyft notice the unusual request volume? What could they have done to detect this as suspicious and investigate? Are there some specific lessons other companies could learn from this?
  - kyrra 10y ago
    Detecting these kinds of behaviors is hard without generating false positives. GPS on phones arent always the most reliable thing, especially if the user is opening and closing the app. An app that did try to stop this type of behavior was Pokémon Go. It took them a while to do even halfway well.
JustSomeNobody 10y ago
>Hell originated after Uber created fake rider accounts on Lyft and used software to trick Lyft’s system into thinking those riders were in certain locations. This allowed Uber to see the eight closest available Lyft drivers to each fake rider. This is not ethical. It's not.
sebleon 10y ago
I don't see how this is nefarious, Uber is scraping data that Lyft is sharing publicly. And based on Lyft's response, my hunch is that they do the same thing. If anything, this story distracts us from legit nasty business practices - like repeatedly cancelling on Lyft drivers to waste their time and lower their earnings.
- onion2k 10y ago
  Uber is scraping data that Lyft is sharing publicly. Except they're really not. They accessed data from an API that is only available to the Lyft app by creating some fake profiles. That means their profiles couldn't legally have agreed to the app's terms and conditions, so it wasn't legally permissible for them to access the API. So no, they weren't just accessing information that Lyft were "sharing publicly".
  - averagewall 10y ago
    Do you think it's OK for violating the T&Cs of an app to be illegal? Isn't that the same as using the F word on a forum when you agreed not to? Didn't we go through all this with Aaron Swartz and one or two other high profile hackers?
    - onion2k 10y ago
      Do you think it's OK for violating the T&Cs of an app to be illegal? I don't think determining legality and harm should be a boolean operation. There are layers of subtly and nuance in most things, and the law is one of them. I don't think posting the F word on a forum where the owner doesn't want you to post it should be treated as an equal violation of the law as deliberately abusing your competition as a billion dollar business. The amount of damage, and perhaps potential damage should be considered. When I swear a reasonable person would think the harm is minimal. When I try to sabotage another company where the damage could result in billions of dollars of lost investment and thousands of jobs vanishing a reasonable person would think that's pretty bad. They're technically the same 'crime', but they're obviously not the same in scale.
freeplatform 10y ago
Are user location credentials often accidentally exposed in other app's APIs? This isn't something I have much knowledge in and am just wondering how often this is a security issue.
guelo 10y ago
Trying to think through how Hell must have worked, Uber must have decoded Lyft's encrypted Rest APIs and were able to hit an endpoint that returned the 8 nearest available rides given a user and geolocation. Given a large metro area such as LA, you would probably need to make hundreds of requests with fake geolocations to be able to map out the whole area. You would probably only need to do it maybe every 5-10 minutes to get decent resolution for a semi-live map. Depending on Lyft's rate limiting you might get by with in the order of dozens of fake accounts. Given Lyft's scale this would probably be small undetectable noise in their analytics and wouldn't really degrade their systems. I would say it's only semi-shady, probably doesn't rise to the level of civil or criminal lawsuits.
- vostrocity 10y ago
  Uber could just run Android or iOS emulators running Lyft with fake user accounts and fake geolocation.
  - huac 10y ago
    The article claims that's how it worked
blazespin 10y ago
I love how "There has been some recent tension between her and Kalanick, with some investors blaming bad press for Uber’s woes (wrong!), although sources said that was expected given all the controversies at the company of late." becomes "Uber’s head of communications Rachel Whetstone recently quit, reportedly because of conflicts with Kalanick."
Apocryphon 10y ago
So is Uber just getting its dirty laundry wikileaked more than American intelligence services are now or what
pjc50 10y ago
Please note that the whole "illegal access to a computer system" business is what Aaron Scwartz was being prosecuted for. I don't think we want to promote a restrictive idea about what constitutes authorised use of a system, just so we can have a go at an unpopular taxi service.
- pluma 10y ago
  The two situations are very different. As technology goes, Aaron merely accessed what was already accessible to every user. Uber accessed information a single user wouldn't have had access to. As ethics go, Aaron downloaded information that represented publicly funded research and would be available to the public if academic publishing wasn't so horribly defunct. Uber extracted operative business information that was only meant to be exposed a fraction at a time to provide specific services. As motives go, Aaron tried to make information publicly available for free. Uber tried to poach Lyft's drivers and sabotage Lyft's operational model for financial gain. The only value of Aaron's case in this discussion is as an example in the form of "If what Aaron did was grounds for criminal prosecution, how is what Uber did not a federal crime?". Even if you disagree with the ethical aspects, Aaron exfiltrated information available to any normal user (just at a larger scale than intended) whereas Uber intentionally exploited a design flaw to access information not available to any individual user. If both crimes could be described as "doing X, and then doing the same thing again a lot more times" for Aaron X was "downloading a file intentionally made available to all users" whereas for Uber X was "downloading information only intended to be available to a single other user".
throwawayosiu1 10y ago
I would really like to know what is unethical (or even illegal) about this (just so I can understand this correctly). Uber * created multiple fake accounts on lyft to know about it's drivers * figured out that it's drivers were assigned numerical ids * used said ids, to track lyft drivers. imho, this is just figuring out your competition (say by signing up to the service) and then using this knowledge to improve your service (by incising drivers on both platforms to ditch one). This is one of those "do things that don't scale" mean (or my interpretation of it). I say this because, one multi-billion $ "startup" is doing this to another multi-billion $ "startup". Also, I'm sure this would never be an issue if Uber was not in the press for other crappy stuff they did.
mifeng 10y ago
>If there were several Uber drivers near an Uber rider but one of those drivers was also frequently available on the Lyft network, as seen by the Hell program, Uber’s ride-dispatch team was supposed to “tip” that ride request to the driver who was “dual apping,” or typically looking for riders through both the Lyft and Uber apps, sometimes by using two different smartphones at the same time. The person involved in the program called it “privileged dispatch” and said Uber aimed to use that to squeeze Lyft’s supply of drivers. [from the original article on The Information] I think this should be the most controversial part of the program. Essentially, Uber favored its drivers who used both Uber and Lyft at the expense of its drivers who were strictly loyal to Uber.
decker 10y ago
I always wondered why Uber showed fake cars on their map. I remember them citing "technical" issues which seemed suspicious given that it's not a hard problem, and Lyft actually shows car locations. I wouldn't be surprised if the fake cars came about as a result of the Hell program when they realized car locations could be used against them.
RoyTyrell 10y ago
What is wrong with Uber's management? I don't think I've ever read anything positive about the company. From their numerous gender bias and sexual harassment claims, to their CEO acting like a bratty spoiled 15yr old and bitching out a driver, to trying to skirt public safety laws by refusing to register their self-driving cars after being catered and begged to do so by government regulators simply because they don't give a fuck, to this whole Waymo lawsuit, to this. I think this shitty company needs a complete change of upper management.
yesiamyourdad 10y ago
I drove for both Lyft and Uber last year, and I could swear that Uber was tracking Lyft. I'd get a call for an Uber and while fumbling around with the phone getting to the Lyft app to drop driver mode, I'd get a Lyft call in. Totally anecdotal, but it happened enough that I noticed. Eventually I quit trying to double dip, it was just too stressful. I'd make a call on which to use based on the incentives being offered, basically, or if things were slow on one I'd switch to the other.
waronsanity 10y ago
Is Uber the only tech company using unethical and immoral practices to take out the competition? or the only one to be caught? (Not asking as a defense for them, I'm just curious, and cynical, I believe they all do this, but thats an ignorant belief as I dont know)

179 points by petergatsby 10y ago

I really hope that Uber's shenanigans get studied in ethics classes in Computer Science and other technology degrees. When I was doing my CS degree, we had a mandatory ethics class (which I hated at the time but in hindsight think is a good thing). Ethical implications were something I hadn't previously thought of much, but in the field I've encountered them many times. Based on the news that has been coming out from Uber, I think it's time for our industry to re-focus on the ethics of what we do. Being technologically cool, doesn't make something good.

DaiPlusPlus 10y ago
Mine focused on Therac-25... not quite the same problem-space. It's possible Uber's devs were misled about the nature of the software they were writing - for example I read their other secret system, "Greyball", was written under the guise of protecting Uber drivers from being physically assaulted by militant Taxi drivers - a common sight in certain parts of the world - nothing to do with the dual-use of shadow-banning public officials and journalists.
- rosstex 10y ago
  Are you from Berkeley?
  - alpha_squared 10y ago
    Mine also focused on Therac-25, but I'm not from Berkeley. It's likely that it was used throughout several campuses. Though I feel that's not so much about ethics as it was appropriate safeguards/testing given the problem space.
    - jrockway 10y ago
      I think it's a pretty common ethics case study. Therac-25 almost seems like a meme to me these days: "What are the ethical implications in the field of software engineering?" "Therac-25." I don't think we've gotten any better, either. I'm surprised there aren't thousands of Therac-25s killing people every day, actually. I guess the hardware engineers got better at turning off software, because I don't think software engineers got better at software engineering.
      - Gibbon1 10y ago
        > I guess the hardware engineers got better at turning off software, because I don't think software engineers got better at software engineering. Years ago (like 25 years) I read an author discussing safety critical system. He flat out said, safety must be a primary system level design goal. Attempts to band aid it in will fail. Properly designed systems have safeties, interlocks, and monitoring subsystems to prevent software bugs from propagating to the point where people are harmed. People designing safety critical systems tend to completely distrust software.
      - bipson 10y ago
        Huh, I think I never heard of the Therac-25. We instead talked about flight Lufthansa 2904 [1] (Airbus A320-211 Warsaw accident), also as a case of overconfident engineers (although Wikipedia mostly blames the weather report). [1] https://en.wikipedia.org/wiki/Lufthansa_Flight_2904 https://en.wikipedia.org/wiki/Lufthansa_Flight_2904
    - noir_lord 10y ago
      Therac-25 featured on our syllabus here in the north of England. Its a pretty infamous case.
    - DaiPlusPlus 10y ago
      The "ethics" aspect came from the conduct of the engineers behind Therac that did not take the reports of malfunctions seriously, including a fatality - they were too overconfident and arrogant - as a result it took 2 more people to die, and many more seriously injured, before the problem was identified and fixed. We also covered other ethics-related case-studies that covered project-mismanagement leading to massive cost-overruns, especially of public-service projects - particularly when those overruns are caused by malfeasance instead of incompetence or ever-changing client requirements (e.g. embezzlement, fraudulent conduct, etc). Another one was the ethics of personal data collection.
stass 10y ago
What's unethical about this? They were doing market research. It's not much different from stalking your competitor on google and going after the users they advertise to.
- jsmthrowaway 10y ago
  It's completely different, so far different as to be antonyms, opposites, completely diametrically opposed ends, because you just described a passive, orthogonal, ethical activity while Uber actively fooled with Lyft's systems to get the intel they wanted (emphasis mine): > Hell originated after Uber created fake rider accounts on Lyft and used software to trick Lyft’s system into thinking those riders were in certain locations. This allowed Uber to see the eight closest available Lyft drivers to each fake rider. You literally just typed the equivalent of "what's wrong with using an ad unit to deliver a zero day exploit? It's not much different from advertising."
  - JustSomeNobody 10y ago
    All of which /u/stass would have know had there been an ethics class for them to take. ;)
    - stass 10y ago
      There isn't the one and only standard for ethics. Perhaps a class would teach a certain version of ethics, but not a universally applicable one. As a somewhat relevant example, a lot of ethical norms in USSR (prosecution of successful individuals, outlawing free speech, destroying dissent, banning "unethical" literature and works of art) would be considered completely unethical in the Western society and vise versa, although the admiration of former became fashionable in tech circles lately.
  - _jezell_ 10y ago
    Creating fake accounts is pretty common for spiders... standard search engine tactics.
  - viraptor 10y ago
watwut 10y ago
I don't think it is lack of ethical knowledge that makes people act unethical. It is that being consistently ethical costs and may have bad impact on your career. It is also that company like Uber would punish overly ethical people too much and would pish them out. Ethical class won't solve that.
- m_t 10y ago
  Ethical class might help a young developer understand why working at a company like that is a bad idea. Understanding that a company punishing you for being ethical is a big glowing red flag is important.
  - thewhitetulip 10y ago
    Yes, but the problem is that Uber pays well and it has a lot of interesting problems to solve, and as usual in our society, morality becomes the later priority than interesting work/pay
    - spcelzrd 10y ago
      It's not a problem limited to our society. Ethics, regulations, and consumer pressure can all help to keep corporations in check. The thing to remember is that a corporation can never have a moral compass, so we have to give it to them.
    - cjrp 10y ago
      But if there was the potential for future prosecution because of your actions, maybe that would alter the risk/reward profile enough for some people? Especially if you've taken an ethics course, and thus can't really argue plausible deniability.
    - wfo 10y ago
      If developers had a professional organization and working for Uber (or some company that does things which are banned by that organization) was a black mark on your resume that would ensure you never get a good job again, then we'd be in business. That's how it works for doctors and lawyers.
astrodust 10y ago
Since we all learned so much from Enron and ethical problems like that never cropped up again, stands to reason Uber's going to be the last of its kind.
- asdfologist 10y ago
  Sorry I can't tell whether this is sarcastic.
woodruffw 10y ago
I've been designing a CS ethics class for the past few months, mostly as a personal challenge. I proposed it to a few professors in my department yesterday. The responses I got were mostly variants of "not until they make us," which is exactly the kind of attitude that results in our present state of affairs (thinking of the BMW emissions controversy, Uber, &c). I don't want another major teachable scandal to come out of the tech world, but that may be what it takes.
- toss1 10y ago
  It was VOLKSWAGEN --NOT BMW-- that created the emissions scandal by programming their cars to change the engine running parameters when the detected the conditions of the emissions test. first article found of 641000 http://www.bbc.com/news/business-34324772 http://www.bbc.com/news/business-34324772 BMW is actually doing it right http://www.bmwblog.com/2016/02/16/top-five-current-diesel-bmws/ http://www.bmwblog.com/2016/02/16/top-five-current-diesel-bm... sheesh (edit: add BMW story link)
  - neoeldex 10y ago
    That's not true, All car manufacturers were pulling tricks in order to save adBlue. The BMW story is on a bmw blog... Here you can see other emissions, in a Guardian article, where it's clearly to be seen that BMW does not comply to the EURO 6 norms. https://www.theguardian.com/business/2016/apr/21/all-top-selling-cars-break-emissions-limits-in-real-world-tests https://www.theguardian.com/business/2016/apr/21/all-top-sel...
    - toss1 10y ago
      Perhaps the Guardian story is true and everyone is playing around the margins on the European tests, but that's trying to obscure the forest with one tree. In the actual context of the comment, which is the the USA "emissions controversy" with the massively fraudulent code, it was VOLKSWAGEN that was the main player, BMW was not involved. (also IMO, Diesels are a pretty bad way to burn fuel in any case; I don't think BMW should pursue it at all, and although I like my petrol-powered model, I wouldn't buy one of their diesels)

perfmode 10y ago

It's only because Uber's view of its own drivers is known as heaven/god view. edit: discussed in article. Call me a pessimist, but I am betting that, despite the long and rocky road ahead, Uber is eventually going to succeed. And we're going to see the emergence of a new corporate template.

unlmtd 10y ago
Uber is going to be rendered obsolete by an open platform based on blockchain identity.

dnautics 10y ago

I strongly prefer lyft's side, haven't used uber in years and the last year I drove for ridesharing I exclusively drove for lyft and not uber, but I really don't have a problem with this. OF COURSE you should collect intelligence on your competitor's activities - if they expose information publically (e.g. showing the cars on the app / API) and cross-correlating with the uber drivers that still are logged on - what is the objection to this? Mind you, some of the other things uber has done, like hail a lyft and repeatedly cancel, are totally not ok.

fapjacks 10y ago
Agreed. I think Uber is terrible, but I also think this is just no-brainer competitor research.
- pyrale 10y ago
  There is a strong dichotomy in the minds of many american people, between large private companies and public offices. This is an instance of it: Uber has shown in the past that they can wield considerable powers, and are prone to misuse it. Therefore, them collecting data about drivers, a population that is vulnerable towards Uber (and a subset of which we know is shared between the two platforms), is dangerous. If you approach this dichotomy from the other side, can you imagine the NSA being described as doing no-brainer customer research ?
  - fapjacks 10y ago
    If Uber had been circuit-bending the Lyft app or Lyft's API or rider/driver devices, I would think it unacceptable. But this information is being provided by Lyft inside their app. Uber was just aggregating this information and storing and analysing the data. Also the NSA is doing a lot worse things and we know this for certain. I find it distressing how many people seemingly have forgotten about that. If the NSA were only going this far, I'd be pretty happy.
    - pluma 10y ago

sillysaurus3 10y ago

Lyft said “We are in a competitive industry. However, if true, these allegations are very concerning.” Notice the careful non-statement by Lyft. It's hard to believe Lyft isn't doing exactly the same thing. It's not questionable behavior to track what your competitor is doing. That's the first step toward beating them. And yes, Uber is trying to beat Lyft, just like Lyft is trying to beat Uber. That happy balance is a good thing for consumers. It's pretty strange that I have to second-guess whether to post this comment since it could be interpreted as a defense of Uber. But the PR spin is getting to be a feeding frenzy. Is all tracking now unethical? Under what circumstances should you be allowed to track other people? Google knows more about you than your significant other. Should they be allowed to do this? Is this ethically questionable? What is the categorical difference between Google and Uber? These are questions which have no clear and easy answer, but it's painted as if it's so clear-cut.

rodorgas 10y ago
Agree. Google not only tracked Bing but also set up fake results to catch them copying. There's an app that compares the price from Uber, Lyft and others services. These two examples are using data from computer systems in a way companies didn't intend. Have you guys ever thought that search engines scraping your site is opt-out? We are just repelling this because Uber has a bad reputation.
- stordoff 10y ago
  > Google not only tracked Bing but also set up fake results to catch them copying. I'm not sure I see the similarity. Google never sent false queries to Bing - Google sent synthetic queries to their own infrastructure, and observed how Microsoft's software (search engine, toolbar etc.) responded to that. There's That seems closer to if Uber had just hired a team of people to use Lyft and record their observations (which is still problematic, as one of the results is tracking people without their knowledge, but for different reasons than falsifying queries to scrape this data).
eridius 10y ago
> It's hard to believe Lyft isn't doing exactly the same thing. No, it's actually really easy to believe that Lyft isn't tricking Uber's computer systems into giving Lyft real-time info on Uber's drivers and fare prices. Please stop trying to make excuses for Uber's shitty behavior.

mtgx 10y ago

That's appropriate, considering Uber itself seem to have been born in Hell.

JumpCrisscross 10y ago

> [Uber] used software to trick Lyft’s system into thinking those riders were in certain locations Could this be a CFAA violation? Are there any prosecutorial jurisdictions with lots of Lyfts and few or no Uber?

pluma 10y ago
I'd be surprised if this couldn't be spun into a federal crime if there's any interest in taking this to court and involving the authorities.

Buge 10y ago

Interesting how they didn't punish drivers who also drove for Lyft, they actually rewarded drivers who also drove for Lyft with better Uber offers.

perfmode 10y ago
always have a counter-offer.
yesiamyourdad 10y ago
Uber & Lyft need a large pool of drivers readily available. The quick pickup is a key part of the experience that makes them superior to taxis. Especially drivers who are rated well. I'd be kind of surprised if a driver's rating didn't factor into their entire incentive program. I carried a 4.9 Uber rating by the time I quit driving and they were issuing some really attractive incentives by the end.

_jezell_ 10y ago

Doesn't seem much different than Google indexing the web. They were just crawling Lyft.

pluma 10y ago
They created fake accounts with fake geolocation to extract information, then they exploited a design flaw in Lyft's software to perform an enumeration attack that allowed them to extract full information about all drivers in real time in order to exploit that information financially. Google crawls public websites while respecting counter-measures like the `robots.txt` protocol. They also don't create fake accounts. They most certainly don't perform enumeration attacks to find more content to index. This is nothing like what Google does. If Google did this, they'd be called out the same way. Heck, if anything, this is similar to what Aaron Swartz did, except Aaron did it to make the information public rather than profit from it for financial gain -- and the data he did it with was neither sensitive nor private.

free2rhyme214 10y ago

At this point, what hasn't Uber done?

Razengan 10y ago
At this point, is anyone else feeling like there's might be some vendetta-driven campaign directed against them?
- douche 10y ago
  Somebody very much wants them to fail. It's starting to feel like the campaign to pump up all the Russophobia
  - pluma 10y ago
    Except there's more evidence of Uber's failings than for the accusations levied against Russia.
- RoyTyrell 10y ago
  If there is, they don't have to do much other than to make Uber's shitty practices more public.
noway421 10y ago
became a viable stable enterprise?
bbcbasic 10y ago
Trafficking
ClassyJacket 10y ago
Used chemical weapons?

pkkim 10y ago

If I were Lyft, I might try to detect what traffic is coming from suspect clients and present an inaccurate view to them to maximize inefficient spending on Uber's part. This seems like it should be easy to do without harming someone in case you inaccurately label someone as illegitimate.

pluma 10y ago
It is interesting that Lyft didn't detect this malicious behaviour and this raises some questions. Did Uber try to obscure what they were doing by spreading the requests over various IPs to cover their tracks? This would indicate that they knew they were doing something malicious (which could affect sentencing if this is considered a federal crime under US law which it actually might be -- though IANAL). If this really was "realtime", why didn't Lyft notice the unusual request volume? What could they have done to detect this as suspicious and investigate? Are there some specific lessons other companies could learn from this?
- kyrra 10y ago
  Detecting these kinds of behaviors is hard without generating false positives. GPS on phones arent always the most reliable thing, especially if the user is opening and closing the app. An app that did try to stop this type of behavior was Pokémon Go. It took them a while to do even halfway well.

JustSomeNobody 10y ago

>Hell originated after Uber created fake rider accounts on Lyft and used software to trick Lyft’s system into thinking those riders were in certain locations. This allowed Uber to see the eight closest available Lyft drivers to each fake rider. This is not ethical. It's not.

sebleon 10y ago

I don't see how this is nefarious, Uber is scraping data that Lyft is sharing publicly. And based on Lyft's response, my hunch is that they do the same thing. If anything, this story distracts us from legit nasty business practices - like repeatedly cancelling on Lyft drivers to waste their time and lower their earnings.

onion2k 10y ago
Uber is scraping data that Lyft is sharing publicly. Except they're really not. They accessed data from an API that is only available to the Lyft app by creating some fake profiles. That means their profiles couldn't legally have agreed to the app's terms and conditions, so it wasn't legally permissible for them to access the API. So no, they weren't just accessing information that Lyft were "sharing publicly".
- averagewall 10y ago
  Do you think it's OK for violating the T&Cs of an app to be illegal? Isn't that the same as using the F word on a forum when you agreed not to? Didn't we go through all this with Aaron Swartz and one or two other high profile hackers?
  - onion2k 10y ago
    Do you think it's OK for violating the T&Cs of an app to be illegal? I don't think determining legality and harm should be a boolean operation. There are layers of subtly and nuance in most things, and the law is one of them. I don't think posting the F word on a forum where the owner doesn't want you to post it should be treated as an equal violation of the law as deliberately abusing your competition as a billion dollar business. The amount of damage, and perhaps potential damage should be considered. When I swear a reasonable person would think the harm is minimal. When I try to sabotage another company where the damage could result in billions of dollars of lost investment and thousands of jobs vanishing a reasonable person would think that's pretty bad. They're technically the same 'crime', but they're obviously not the same in scale.

freeplatform 10y ago

Are user location credentials often accidentally exposed in other app's APIs? This isn't something I have much knowledge in and am just wondering how often this is a security issue.

guelo 10y ago

Trying to think through how Hell must have worked, Uber must have decoded Lyft's encrypted Rest APIs and were able to hit an endpoint that returned the 8 nearest available rides given a user and geolocation. Given a large metro area such as LA, you would probably need to make hundreds of requests with fake geolocations to be able to map out the whole area. You would probably only need to do it maybe every 5-10 minutes to get decent resolution for a semi-live map. Depending on Lyft's rate limiting you might get by with in the order of dozens of fake accounts. Given Lyft's scale this would probably be small undetectable noise in their analytics and wouldn't really degrade their systems. I would say it's only semi-shady, probably doesn't rise to the level of civil or criminal lawsuits.

vostrocity 10y ago
Uber could just run Android or iOS emulators running Lyft with fake user accounts and fake geolocation.
- huac 10y ago
  The article claims that's how it worked

blazespin 10y ago

I love how "There has been some recent tension between her and Kalanick, with some investors blaming bad press for Uber’s woes (wrong!), although sources said that was expected given all the controversies at the company of late." becomes "Uber’s head of communications Rachel Whetstone recently quit, reportedly because of conflicts with Kalanick."

Apocryphon 10y ago

So is Uber just getting its dirty laundry wikileaked more than American intelligence services are now or what

pjc50 10y ago

Please note that the whole "illegal access to a computer system" business is what Aaron Scwartz was being prosecuted for. I don't think we want to promote a restrictive idea about what constitutes authorised use of a system, just so we can have a go at an unpopular taxi service.

pluma 10y ago
The two situations are very different. As technology goes, Aaron merely accessed what was already accessible to every user. Uber accessed information a single user wouldn't have had access to. As ethics go, Aaron downloaded information that represented publicly funded research and would be available to the public if academic publishing wasn't so horribly defunct. Uber extracted operative business information that was only meant to be exposed a fraction at a time to provide specific services. As motives go, Aaron tried to make information publicly available for free. Uber tried to poach Lyft's drivers and sabotage Lyft's operational model for financial gain. The only value of Aaron's case in this discussion is as an example in the form of "If what Aaron did was grounds for criminal prosecution, how is what Uber did not a federal crime?". Even if you disagree with the ethical aspects, Aaron exfiltrated information available to any normal user (just at a larger scale than intended) whereas Uber intentionally exploited a design flaw to access information not available to any individual user. If both crimes could be described as "doing X, and then doing the same thing again a lot more times" for Aaron X was "downloading a file intentionally made available to all users" whereas for Uber X was "downloading information only intended to be available to a single other user".

throwawayosiu1 10y ago

I would really like to know what is unethical (or even illegal) about this (just so I can understand this correctly). Uber * created multiple fake accounts on lyft to know about it's drivers * figured out that it's drivers were assigned numerical ids * used said ids, to track lyft drivers. imho, this is just figuring out your competition (say by signing up to the service) and then using this knowledge to improve your service (by incising drivers on both platforms to ditch one). This is one of those "do things that don't scale" mean (or my interpretation of it). I say this because, one multi-billion $ "startup" is doing this to another multi-billion $ "startup". Also, I'm sure this would never be an issue if Uber was not in the press for other crappy stuff they did.

mifeng 10y ago

>If there were several Uber drivers near an Uber rider but one of those drivers was also frequently available on the Lyft network, as seen by the Hell program, Uber’s ride-dispatch team was supposed to “tip” that ride request to the driver who was “dual apping,” or typically looking for riders through both the Lyft and Uber apps, sometimes by using two different smartphones at the same time. The person involved in the program called it “privileged dispatch” and said Uber aimed to use that to squeeze Lyft’s supply of drivers. [from the original article on The Information] I think this should be the most controversial part of the program. Essentially, Uber favored its drivers who used both Uber and Lyft at the expense of its drivers who were strictly loyal to Uber.

decker 10y ago

I always wondered why Uber showed fake cars on their map. I remember them citing "technical" issues which seemed suspicious given that it's not a hard problem, and Lyft actually shows car locations. I wouldn't be surprised if the fake cars came about as a result of the Hell program when they realized car locations could be used against them.

RoyTyrell 10y ago

What is wrong with Uber's management? I don't think I've ever read anything positive about the company. From their numerous gender bias and sexual harassment claims, to their CEO acting like a bratty spoiled 15yr old and bitching out a driver, to trying to skirt public safety laws by refusing to register their self-driving cars after being catered and begged to do so by government regulators simply because they don't give a fuck, to this whole Waymo lawsuit, to this. I think this shitty company needs a complete change of upper management.

yesiamyourdad 10y ago

I drove for both Lyft and Uber last year, and I could swear that Uber was tracking Lyft. I'd get a call for an Uber and while fumbling around with the phone getting to the Lyft app to drop driver mode, I'd get a Lyft call in. Totally anecdotal, but it happened enough that I noticed. Eventually I quit trying to double dip, it was just too stressful. I'd make a call on which to use based on the incentives being offered, basically, or if things were slow on one I'd switch to the other.

waronsanity 10y ago

Is Uber the only tech company using unethical and immoral practices to take out the competition? or the only one to be caught? (Not asking as a defense for them, I'm just curious, and cynical, I believe they all do this, but thats an ignorant belief as I dont know)