6 ms·

Are New York’s Free LinkNYC Internet Kiosks Tracking Your Movements?

98 points by rfreytag 8y ago

allthenews 8y ago
As someone who leans libertarian, I tend to shy away from rigid legislative solutions to social problems and corporate overreach. However, articles like this make me wonder if it isn't time for the government to step in and implement privacy regulations of some sort. I did not consent to have my movements tracked and ads sold to me by privately owned kiosks all over my city of residence. OTOH, I don't know if I would trust the current government to implement such protections in a way that isn't self serving and possibly counterproductive. Shitshow all around.
- berbec 8y ago
  I could see the current government implementing strong privacy controls to protect your personal data from bad actors who doesn't donate enough to reelection campaigns. Not a right or left thing either; I believe both sides sell themselves shamelessly.
- matklnz 8y ago
  I always read these like "as someone who leans libertarian, I'm starting to realise libertarianism is a bad idea"
  - allthenews 8y ago
    Perhaps I accept that there are more than 2-5 dimensions in the sphere of politics, and that occasionally one must compromise because no singular philosophy is perfect in all circumstances. That doesn't mean that an entire political ideology is at fault. The modern political system would be far better off without this kind of (engineered?) rigid thinking.
  - bduerst 8y ago
    I think most ex-libertarians eventually realized that (most of the time) a smaller government just means a power vacuum that gets filled by other organizations that have the means but not the peoples' interests.
  - njarboe 8y ago
    Taleb has an interesting take on why a person might state their position this way. He states he is: Libertarian at the global and national level. Republican at the state level. Democrat at the city level. Socialist at the club/neighborhood level. Communist at the family level. Makes quite a bit of sense to me. And if one does not realize one has this hierarchy of beliefs, it is hard to talk about ones politics. What do you call yourself if you hold such beliefs?
    - Spooky23 8y ago
      It was interesting in an earlier time. Today, that's just fancy clothes on a reactionary/right-wing philosophy, a really cynical worldview that creates nasty outcomes. Translation: - "Communist at the family level": I like total control. - "Socialist at the club level.": I like my religious denomination/tribe - "Democrat at the city level.": Bread and circus for the plebes, but no money or power. - "Republican at the state level.": Make sure my friends can make money. - "Libertarian at the national level": Keep government out of our lives, except when I want it in your life. - "Libertarian at the global level": These barbarians won't subscribe to our ideals of liberty. But, we have tanks to help deliver liberty to them. <enter fascism>
      - jerf 8y ago
        Yes, if you rewrite the meaning of every single word that someone uses, you can completely rewrite their original statement. That's not a terribly meaningful outcome. Are you sure you want to go with calling someone "reactionary", which generally labels you as fairly far left, but then just agreeing that "communism" is "total control"? I can imagine a person who can make all the statements you made and be self-consistent, but it's an awfully narrow window with a complicated shape.
    - beager 8y ago
      That "hierarchy" of beliefs just sounds selfish, with an interest in disproportionately consolidating resources in your proximity, but then demanding permissive access to them once they're at arms length. Of course, policies must be crafted differently to create a benefit at different levels, but that doesn't mean you can't have consistent philosophies.
- scarface74 8y ago
  There are solutions. If you have an iOS device running iOS 8 or later, it implements MAC address randomization by default. It’s also coming to Android. https://www.androidpolice.com/2018/03/08/android-p-feature-spotlight-per-network-mac-address-randomization-added-experimental-feature/ https://www.androidpolice.com/2018/03/08/android-p-feature-s...
- snissn 8y ago
  These Free LinkNYC kiosks are being installed by the nyc gov't... Am i missing something in your comment?
CodeSheikh 8y ago
"...code collects the user’s longitude and latitude, as well as the user’s browser type, operating system, device type, device identifiers, and full URL clickstreams (including date and time) and aggregates this information into a database." Aren't all mobile phones browsers collect this data any way? If your location privacy is enabled to be shared by the browser. I am not sure what this student found beyond this which is worth raising brows. Also, 3 cameras system in each kiosk is indeed creepy.
- kevin_thibedeau 8y ago
  Firefox mobile asks first and you can disable the nags in about:config.
- Spooky23 8y ago
  The difference is that rather than a telco in the case of cellular devices, the system is owned and operated by the municipal government directly. In the context of NYC in particular, it's more immediately concerning than usual because NYPD actually has a significant, funded intelligence division with the resources to use the data.
  - AdamM12 8y ago
    Wait so do they need a search warrant?
    - freeone3000 8y ago
      You don't need a search warrant for information freely given.
sevensor 8y ago
I presume that's what they're for, just like the thing Comcast routers do, where they provide public access points whether you want them to or not.
- givinguflac 8y ago
  Not defending Comcast, but you can disable the public hotspot feature. You cannot however disable the hidden Comcast home security network broadcasting whether you have that service or not
sanityvampire 8y ago
Ubiquitous WiFi kiosks with inbuilt cameras, huh? Ostensibly, they're not allowed to track individual user locations, but the combination of functions present in the devices means it would be trivial to start connecting independent databases and building profiles on users. If you were a malicious actor, how would you go about it? The PoCs on tracking individuals with MAC addresses are old news (and, in fairness, newer iOS devices use random MAC addresses for WiFi probe requests), let alone the user fingerprinting you could do on browsers when people actually use these things. So you've got a database of devices, and then on top of that you start doing facial recognition and gait analysis to collect another set of individual data points. Then you connect devices to people, and you have a pretty nice system for tracking individuals moving through the city, even those with location services and such disabled. Paranoia? Maybe, but it wouldn't take much for say, Amazon, to start doing this. And Bezos wouldn't be bound by city regulations on citizen privacy.
- alexandercrohde 8y ago
  I wouldn't be surprised. I interviewed with a NYC company that bought a bunch of old phonebooths and was looking into installing cameras on them and recording video to sell to whoever they could. They had this idea that they could do style recognition on clothing and sell that.
  - deleted 8y ago
    [deleted]
- chimeracoder 8y ago
  > The PoCs on tracking individuals with MAC addresses are old news (and, in fairness, newer iOS devices use random MAC addresses for WiFi probe requests) MAC address tracking is obsolete. All phones (including iOS devices) broadcast a full list of SSIDs that they have previously connected to when attempting to connect to wireless networks. That alone is enough to uniquely identify most people.
  - JBReefer 8y ago
walterbell 8y ago
(repost) NYCLU and Columbia University have a 2016 video (starts at 2:50) about the corporate origins and privacy policy of Google's LinkNYC surveillance kiosks in Manhattan: https://livestream.com/internetsociety/hopeconf/videos/130816888 https://livestream.com/internetsociety/hopeconf/videos/13081... Village Voice covered the topic, https://www.villagevoice.com/2016/07/06/google-is-transforming-nycs-payphones-into-a-personalized-propaganda-engine/ https://www.villagevoice.com/2016/07/06/google-is-transformi... > This freedom to opt out entirely is also the last argument that spokespeople for LinkNYC and the city itself fall back upon when challenged with privacy concerns: If you don’t like it, you’re welcome not to use it. It’s a disheartening place to land, especially when discussing infrastructure that’s supposed to be serving people who aren’t served otherwise. To Moglen, it’s simply an unacceptable conclusion. “That’s what they want us to believe, that we have a choice between isolation and monitored connecting,” he says. “Those are not adequate choices in a 21st-century world: We are designing the net to track you — if you don’t like it, don’t use it. The human race is shifting to a fully surveilled and monitored superorganism — if you don’t like that, stop being human. That’s a poor outcome. The United States is a society that was based around the idea that human beings can have liberty. So give us liberty! And don’t tell us that otherwise we can have the death of the net."
- freehunter 8y ago
  This is one of the best provisions in GDPR, in my opinion. If someone opts out of data collection, you still have to provide them the service unless the data collection is absolutely necessary to providing the service. It's not an all-or-nothing like most EULAs tend to be, you can opt out of non-essential parts of the agreement.
  - mtgx 8y ago
    Which unfortunately many companies don't comply with. See: http://gdprhallofshame.com/ http://gdprhallofshame.com/ Hopefully we'll start seeing a wave of enforcement actions against these companies soon, too.
    - pmalynin 8y ago
nine_k 8y ago
As life becomes more connected, privacy that was not enforced but just existed due to technical limitations keeps eroding. We should remember this, anticipate this, maybe sometimes legislate around this, but most of all, build explicit technical counter-measures. Also, all of this may and sometimes will fail, so we need to learn to live in an inevitably more and more transparent world.
uptown 8y ago
Almost certainly. And if you're driving, your EZPass tag will track you: https://www.youtube.com/watch?v=HQTdpFAo7eQ https://www.youtube.com/watch?v=HQTdpFAo7eQ
- overcast 8y ago
  Simply stowing it away in a glove box like most people do prevents any reader from getting at it. I don't know anyone who physically displays their tag on the windshield all the time.
  - 24gttghh 8y ago
    How about everyone who sticks it to their windshield with the velcro the ez-pass comes with?
    - overcast 8y ago
      "I don't know anyone who physically displays their tag on the windshield all the time." If you do, then stow it in your glovebox if concerned about privacy.
      - givinguflac 8y ago
        You should get out more, I’ve never met anyone who doesn’t :)
      - post_break 8y ago
        Houston has bluetooth trackers for traffic. If you have a phone with bluetooth you're looped in there as well. Just turn bluetooth off while driving while hiding your ez tag in your glove box right? What about the plate readers.
        cimmanom 8y ago
        And then people wonder why anyone would want the iOS control center to turn bluetooth OFF instead of just disconnecting current connections...
codedokode 8y ago
These kiosks can collect WiFi and Bluetooth MAC addresses of devices people carry. If those are Android devices, then Google probably knows their MACs and can identify users passing by.
dublinben 8y ago
More info: https://cryptome.org/2016/06/linknyc-spy-kiosks-installation-videos.htm https://cryptome.org/2016/06/linknyc-spy-kiosks-installation...
qubax 8y ago
How's the saying go? If you aren't paying for it, then you are the product? Nothing is free. You are paying one way or another. Even if they aren't actively tracking your movements, they are collecting data on you and passively tracking your movements since they can use the data to retroactively see where you were.
fatjokes 8y ago
The only people I've seen use those things are hobos and near-hobos.
Nasrudith 8y ago
My first thought before clicking the article was 'of course - it is NYC and the government there prides itself on being paranoid authoritarians'. This is the same city which brought us stop and frisk, which has a police department that likes to wander broadly out of jurisdiction into foreign countries, and given reports about unmarked X-Ray Vans that they have gotten special pleading okays to block any information from the courts. Their government will almost certainly kill more innocent people in /New York City/ than terrorists ever will which is impressive feat given both 9-11 and earlier historic attacks.

98 points by rfreytag 8y ago

As someone who leans libertarian, I tend to shy away from rigid legislative solutions to social problems and corporate overreach. However, articles like this make me wonder if it isn't time for the government to step in and implement privacy regulations of some sort. I did not consent to have my movements tracked and ads sold to me by privately owned kiosks all over my city of residence. OTOH, I don't know if I would trust the current government to implement such protections in a way that isn't self serving and possibly counterproductive. Shitshow all around.

berbec 8y ago
I could see the current government implementing strong privacy controls to protect your personal data from bad actors who doesn't donate enough to reelection campaigns. Not a right or left thing either; I believe both sides sell themselves shamelessly.
matklnz 8y ago
I always read these like "as someone who leans libertarian, I'm starting to realise libertarianism is a bad idea"
- allthenews 8y ago
  Perhaps I accept that there are more than 2-5 dimensions in the sphere of politics, and that occasionally one must compromise because no singular philosophy is perfect in all circumstances. That doesn't mean that an entire political ideology is at fault. The modern political system would be far better off without this kind of (engineered?) rigid thinking.
- bduerst 8y ago
  I think most ex-libertarians eventually realized that (most of the time) a smaller government just means a power vacuum that gets filled by other organizations that have the means but not the peoples' interests.
- njarboe 8y ago
  Taleb has an interesting take on why a person might state their position this way. He states he is: Libertarian at the global and national level. Republican at the state level. Democrat at the city level. Socialist at the club/neighborhood level. Communist at the family level. Makes quite a bit of sense to me. And if one does not realize one has this hierarchy of beliefs, it is hard to talk about ones politics. What do you call yourself if you hold such beliefs?
  - Spooky23 8y ago
    It was interesting in an earlier time. Today, that's just fancy clothes on a reactionary/right-wing philosophy, a really cynical worldview that creates nasty outcomes. Translation: - "Communist at the family level": I like total control. - "Socialist at the club level.": I like my religious denomination/tribe - "Democrat at the city level.": Bread and circus for the plebes, but no money or power. - "Republican at the state level.": Make sure my friends can make money. - "Libertarian at the national level": Keep government out of our lives, except when I want it in your life. - "Libertarian at the global level": These barbarians won't subscribe to our ideals of liberty. But, we have tanks to help deliver liberty to them. <enter fascism>
    - jerf 8y ago
      Yes, if you rewrite the meaning of every single word that someone uses, you can completely rewrite their original statement. That's not a terribly meaningful outcome. Are you sure you want to go with calling someone "reactionary", which generally labels you as fairly far left, but then just agreeing that "communism" is "total control"? I can imagine a person who can make all the statements you made and be self-consistent, but it's an awfully narrow window with a complicated shape.
  - beager 8y ago
    That "hierarchy" of beliefs just sounds selfish, with an interest in disproportionately consolidating resources in your proximity, but then demanding permissive access to them once they're at arms length. Of course, policies must be crafted differently to create a benefit at different levels, but that doesn't mean you can't have consistent philosophies.
scarface74 8y ago
There are solutions. If you have an iOS device running iOS 8 or later, it implements MAC address randomization by default. It’s also coming to Android. https://www.androidpolice.com/2018/03/08/android-p-feature-spotlight-per-network-mac-address-randomization-added-experimental-feature/ https://www.androidpolice.com/2018/03/08/android-p-feature-s...
snissn 8y ago
These Free LinkNYC kiosks are being installed by the nyc gov't... Am i missing something in your comment?

CodeSheikh 8y ago

"...code collects the user’s longitude and latitude, as well as the user’s browser type, operating system, device type, device identifiers, and full URL clickstreams (including date and time) and aggregates this information into a database." Aren't all mobile phones browsers collect this data any way? If your location privacy is enabled to be shared by the browser. I am not sure what this student found beyond this which is worth raising brows. Also, 3 cameras system in each kiosk is indeed creepy.

kevin_thibedeau 8y ago
Firefox mobile asks first and you can disable the nags in about:config.
Spooky23 8y ago
The difference is that rather than a telco in the case of cellular devices, the system is owned and operated by the municipal government directly. In the context of NYC in particular, it's more immediately concerning than usual because NYPD actually has a significant, funded intelligence division with the resources to use the data.
- AdamM12 8y ago
  Wait so do they need a search warrant?
  - freeone3000 8y ago
    You don't need a search warrant for information freely given.

sevensor 8y ago

I presume that's what they're for, just like the thing Comcast routers do, where they provide public access points whether you want them to or not.

givinguflac 8y ago
Not defending Comcast, but you can disable the public hotspot feature. You cannot however disable the hidden Comcast home security network broadcasting whether you have that service or not

sanityvampire 8y ago

Ubiquitous WiFi kiosks with inbuilt cameras, huh? Ostensibly, they're not allowed to track individual user locations, but the combination of functions present in the devices means it would be trivial to start connecting independent databases and building profiles on users. If you were a malicious actor, how would you go about it? The PoCs on tracking individuals with MAC addresses are old news (and, in fairness, newer iOS devices use random MAC addresses for WiFi probe requests), let alone the user fingerprinting you could do on browsers when people actually use these things. So you've got a database of devices, and then on top of that you start doing facial recognition and gait analysis to collect another set of individual data points. Then you connect devices to people, and you have a pretty nice system for tracking individuals moving through the city, even those with location services and such disabled. Paranoia? Maybe, but it wouldn't take much for say, Amazon, to start doing this. And Bezos wouldn't be bound by city regulations on citizen privacy.

alexandercrohde 8y ago
I wouldn't be surprised. I interviewed with a NYC company that bought a bunch of old phonebooths and was looking into installing cameras on them and recording video to sell to whoever they could. They had this idea that they could do style recognition on clothing and sell that.
- deleted 8y ago
  [deleted]
chimeracoder 8y ago
> The PoCs on tracking individuals with MAC addresses are old news (and, in fairness, newer iOS devices use random MAC addresses for WiFi probe requests) MAC address tracking is obsolete. All phones (including iOS devices) broadcast a full list of SSIDs that they have previously connected to when attempting to connect to wireless networks. That alone is enough to uniquely identify most people.
- JBReefer 8y ago

walterbell 8y ago

(repost) NYCLU and Columbia University have a 2016 video (starts at 2:50) about the corporate origins and privacy policy of Google's LinkNYC surveillance kiosks in Manhattan: https://livestream.com/internetsociety/hopeconf/videos/130816888 https://livestream.com/internetsociety/hopeconf/videos/13081... Village Voice covered the topic, https://www.villagevoice.com/2016/07/06/google-is-transforming-nycs-payphones-into-a-personalized-propaganda-engine/ https://www.villagevoice.com/2016/07/06/google-is-transformi... > This freedom to opt out entirely is also the last argument that spokespeople for LinkNYC and the city itself fall back upon when challenged with privacy concerns: If you don’t like it, you’re welcome not to use it. It’s a disheartening place to land, especially when discussing infrastructure that’s supposed to be serving people who aren’t served otherwise. To Moglen, it’s simply an unacceptable conclusion. “That’s what they want us to believe, that we have a choice between isolation and monitored connecting,” he says. “Those are not adequate choices in a 21st-century world: We are designing the net to track you — if you don’t like it, don’t use it. The human race is shifting to a fully surveilled and monitored superorganism — if you don’t like that, stop being human. That’s a poor outcome. The United States is a society that was based around the idea that human beings can have liberty. So give us liberty! And don’t tell us that otherwise we can have the death of the net."

freehunter 8y ago
This is one of the best provisions in GDPR, in my opinion. If someone opts out of data collection, you still have to provide them the service unless the data collection is absolutely necessary to providing the service. It's not an all-or-nothing like most EULAs tend to be, you can opt out of non-essential parts of the agreement.
- mtgx 8y ago
  Which unfortunately many companies don't comply with. See: http://gdprhallofshame.com/ http://gdprhallofshame.com/ Hopefully we'll start seeing a wave of enforcement actions against these companies soon, too.
  - pmalynin 8y ago

nine_k 8y ago

As life becomes more connected, privacy that was not enforced but just existed due to technical limitations keeps eroding. We should remember this, anticipate this, maybe sometimes legislate around this, but most of all, build explicit technical counter-measures. Also, all of this may and sometimes will fail, so we need to learn to live in an inevitably more and more transparent world.

uptown 8y ago

Almost certainly. And if you're driving, your EZPass tag will track you: https://www.youtube.com/watch?v=HQTdpFAo7eQ https://www.youtube.com/watch?v=HQTdpFAo7eQ

overcast 8y ago
Simply stowing it away in a glove box like most people do prevents any reader from getting at it. I don't know anyone who physically displays their tag on the windshield all the time.
- 24gttghh 8y ago
  How about everyone who sticks it to their windshield with the velcro the ez-pass comes with?
  - overcast 8y ago
    "I don't know anyone who physically displays their tag on the windshield all the time." If you do, then stow it in your glovebox if concerned about privacy.
    - givinguflac 8y ago
      You should get out more, I’ve never met anyone who doesn’t :)
    - post_break 8y ago
      Houston has bluetooth trackers for traffic. If you have a phone with bluetooth you're looped in there as well. Just turn bluetooth off while driving while hiding your ez tag in your glove box right? What about the plate readers.
      - cimmanom 8y ago
        And then people wonder why anyone would want the iOS control center to turn bluetooth OFF instead of just disconnecting current connections...

codedokode 8y ago

These kiosks can collect WiFi and Bluetooth MAC addresses of devices people carry. If those are Android devices, then Google probably knows their MACs and can identify users passing by.

dublinben 8y ago

More info: https://cryptome.org/2016/06/linknyc-spy-kiosks-installation-videos.htm https://cryptome.org/2016/06/linknyc-spy-kiosks-installation...

qubax 8y ago

How's the saying go? If you aren't paying for it, then you are the product? Nothing is free. You are paying one way or another. Even if they aren't actively tracking your movements, they are collecting data on you and passively tracking your movements since they can use the data to retroactively see where you were.

fatjokes 8y ago

The only people I've seen use those things are hobos and near-hobos.

Nasrudith 8y ago

My first thought before clicking the article was 'of course - it is NYC and the government there prides itself on being paranoid authoritarians'. This is the same city which brought us stop and frisk, which has a police department that likes to wander broadly out of jurisdiction into foreign countries, and given reports about unmarked X-Ray Vans that they have gotten special pleading okays to block any information from the courts. Their government will almost certainly kill more innocent people in /New York City/ than terrorists ever will which is impressive feat given both 9-11 and earlier historic attacks.