7 ms·

We Can't Trust Uber

318 points by applecore 12y ago

mehwoot 12y ago
according to The Washington Post, the company was so lax about such sensitive data that it even allowed a job applicant to view people’s rides, including those of a family member of a prominent politician. worries me a lot more than a 2012 post on the company’s blog that boasted of how Uber had tracked the rides of users who went somewhere other than home on Friday or Saturday nights, and left from the same address the next morning. Obviously Uber has this sort of data, and it can use it in various aggregated ways. What's more important than demonstrations of what information they could pull out of this is how serious they are about protecting it from access, either from people who want to buy that information or employees simply snooping around. I don't care if someone uses my data in an aggregate way to do something (e.g. facebook) as long as I am not personally identified.
- robbrown451 12y ago
  Those two things are very related. Knowledge of people having sexual indiscretions can be very powerful leverage to manipulate politicians (and others) with.
- tzmudzin 12y ago
  Why would you believe the data was aggregated, and not available in individualized form in the latter case?
  - nemothekid 12y ago
    Because the blog post was publicly posted (and had been available for 2 years before Uber's recent PR trouble), and the data that was presented was on an aggregate level. If you are asking if the blog poster had access to the individualized data, I imagine he did as he was a data scientist at Uber - but I don't see how that is something to be alarmed about.
    - tzmudzin 12y ago
      They _published_ the data in an aggregated form, but they have _profiled_ the customers on individual basis. Now contrast this e.g. to the principles of data protection that Germany has imposed...(http://en.wikipedia.org/wiki/Bundesdatenschutzgesetz http://en.wikipedia.org/wiki/Bundesdatenschutzgesetz)
      - nemothekid 12y ago
        I'm not sure I quite get what you mean. How do you produce an aggregate without profiling customers on an individual basis? Secondly, I don't see how a company like Uber can use their data to power something like surge pricing while following the exact letter of the BDSG.
        tzmudzin 12y ago
        ...so maybe they should keep their hands off the aggregates as well? For the surge pricing, I'm a bit at a loss, because you don't need personally identifiable data for it, just a request counter per area ID, right? Maybe I don't understand it right though... Also, the reasoning should be the other way around: if I cannot provide a service respecting the basic privacy of my users, I should not be providing a service.
        claudius 12y ago
        > I'm not sure I quite get what you mean. How do you produce an aggregate without profiling customers on an individual basis? You can easily calculate the average of a set without keeping every individual member of the set by updating the running average each time a new data point comes in. You still collect individual data, but destroy it as soon as possible. > Secondly, I don't see how a company like Uber can use their data to power something like surge pricing while following the exact letter of the BDSG. Then Uber should be banned and its employees and shareholders punished appropriately. I don’t see how “this business model can’t work with this law” could possibly be an excuse to ignore the law. Protection rackets don’t really work with the exact letter of the law, either.
  - roymurdock 12y ago
    Here's the link: https://web.archive.org/web/20140827195715/http://blog.uber.com/ridesofglory https://web.archive.org/web/20140827195715/http://blog.uber.... The problem that most people have with the article is the creepy tone ("I know which of you are fooling around and where") rather than an actual leak of information on individual users.
    - tzmudzin 12y ago
      The problem many people with Uber is that they leak information, rather than that they actually do creepy stuff... Whether they brag about it or not, whether they make active use of it or not -- they did invest their time & effort into this type of profiling. Was this altruistic goofing around, with no bad intent? I'd prefer to believe that, but there are no checks in place to ensure this. And I believe most of their customers would be enraged to be subject to such a profiling, even just for the goofing...
sillysaurus3 12y ago
Uber argues that it’s doing only what other technology companies regularly do. That may be true but it only underlines why we need oversight mechanisms that cover all of them. Such as? If you're giving your data freely to companies, I don't understand what kind of oversight mechanism could or should protect you. Imagine a hypothetical oversight mechanism, then imagine the consequences to tech companies. Imagine the consequences to startups. Not Uber; I'm talking about tiny, early-stage startups. Airbnb and Dropbox have enriched my life. I'd hate for regulatory burden to prevent such startups from forming in the first place. This isn't a hypothetical concern. The finance industry is so regulated that you can't easily form a finance startup without having a lot of connections or a lot of money. Same for the healthcare sector, as far as I've heard.
- rurounijones 12y ago
  > If you're giving your data freely to companies You are assuming people understand this and the implications. The fact it is buried in a legalese ToS somewhere doesn't mean people know what information is sent and how it will be used.
  - sillysaurus3 12y ago
    This is dodging the question. Again: What oversight mechanism can possibly protect users from themselves? They're sending this data, whether they understand it or not. People keep advocating that drug use should be an educational / health issue, not a legal issue. It's ironic that in this situation, people are calling for the opposite: For the government to step in and protect them, when it's unclear how the government can help without causing all kinds of unintended consequences. This should be an educational issue, not a legal issue. We should educate users about the ramifications of uploading this data. Remember, if we enforce regulation, users will still upload sensitive data, and the government will still be free to take advantage of it. Whereas if users are educated about what data they upload, then the data won't exist to begin with.
    - lemming 12y ago
yafujifide 12y ago
Although I largely agree with the premise, the author assumes that the only way to solve this problem is with government regulation. I think a better way to solve this problem is with decentralization. The problem Uber solves is one of coordination. This does not require a central intermediary like Uber. It could be solved in a decentralized manner with p2p networks. With a decentralized Uber, only you and the driver would know where you started from and where you went. Privacy would be improved.
- brador 12y ago
  Serious question, how would a decentralised system have dealt with the recent uber driver rape case?
  - pavanred 12y ago
    To provide some context, an Uber driver was arrested on rape charges in Delhi today. Uber allegedly hired a repeat sex-offender driver without a mandatory police background verification. [1] And, I agree that a decentralized system without any regulation or oversight could probably improve privacy but is definitely not the solution. [1] http://www.firstpost.com/living/cab-driver-a-repeat-offender-uber-should-take-moral-responsibility-for-delhi-rape-1838175.html http://www.firstpost.com/living/cab-driver-a-repeat-offender...
brohoolio 12y ago
I'm not going to use the service. Everything that keeps coming out about Uber has been super shady. I'm not the only one. Big Uber proponents who I know have stopped using their service. It's not going to stop the masses, but if stories like this keep coming out without policy fixes they are going to lose their edge. All they are is a dispatch service.
- jsprogrammer 12y ago
  It seems like Uber could be easily replaced with an open solution. Anyone working on it?
  - logn 12y ago
    I've been noticing that comments advocating P2P replacements of sharing economy apps all get downvotes, and no comments explaining why. I'll assume these downvoters are NSA puppets for now.
  - jsprogrammer 12y ago
    @logn Not sure the NSA would bother itself with such trivialities. An Uber exec or paid social media expert is the most likely culprit. Or just your common troll (not that there's much of a difference).
    - logn 12y ago
      I saw this on a TaskRabbit thread too. Edit: and they do concern themselves with shaping opinion via social media. I imagine they very much enjoy mining ride sharing data. But yeah maybe they don't care about HN comments. Relevant links: http://www.theguardian.com/technology/2011/mar/17/us-spy-operation-social-networks http://www.theguardian.com/technology/2011/mar/17/us-spy-ope... https://www.techdirt.com/articles/20110318/02153313534/us-military-kicks-off-plan-to-fill-social-networks-with-fake-sock-puppet-accounts.shtml https://www.techdirt.com/articles/20110318/02153313534/us-mi...
  - free2rhyme214 12y ago
    Yes DuckDuckDrive will be out soon lol kidding
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
neilarmslow 12y ago
I'm amazed that in all this news coverage, this story hasn't risen to the top. It's far more relevant than the company in question here. "Buying news coverage and crying misogyny in the ride-sharing industry" https://medium.com/@PersonofAwesome/buying-news-coverage-and-crying-misogyny-in-the-ride-sharing-industry-dedeec300ae9 https://medium.com/@PersonofAwesome/buying-news-coverage-and...
- FeeTinesAMady 12y ago
  That article raises some good points, but the problem here is that Uber is really, genuinely awful, and the ones in power there are terrible people. See their fraudent calls to Lyft, the way they lie to drivers about how much money they'll make, etc.
marcus_holmes 12y ago
As the article says, this has got almost nothing to do with Uber, and everything to do with a regulatory regime that allows companies to do anything they like with data they collect. Maybe the USA should start looking at the Data Protection / Privacy laws implemented by Europe and the rest of the world, instead of just dismissing them as socialist welfare-state hippy-dippy bullshit regulation getting in the way of business.
- jsprogrammer 12y ago
  Better yet, skip all the business and political bullshit and just build the open solution with the appropriate security baked in. Don't trust businesses, don't trust politicians, trust the code and the process that runs it.
  - anigbrowl 12y ago
    Technology can and will be gamed. So can laws and policies, but but I' think it's naive to assume that social technology that has evolved over thousands of years can be replaced overnight with computer code.
    - jsprogrammer 12y ago
      Probably not overnight, but possibly years and decades. There's no need to eliminate social behavior, that's arguably the entire 'point'. What we likely can do is, identify places where code is more appropriate and use it.
DigitalSea 12y ago
Quite a sensationalist headline. Basically what this article is saying is that Uber have all of this info on where you came from, where you are going and that we should not trust them because they do not have processes in place to ensure users information on trips taken is kept private. While I do not disagree with the amount of data that Uber have, a company like Facebook and Google arguably know more about us than we do ourselves. Why should we distrust Uber more than any other company? However, I STRONGLY believe that companies with data like Uber should be held accountable to very high standards and any breach of privacy of said data would result in severe penalties. This is not just an Uber problem, this is a big data problem and one many companies have. I recently quit using Uber in favour of other services like Lyft because I do not believe in Uber's lack of ethics and the way they do business. However, I don't think it is fair they are being targeted as much by the media as they currently are. As much as I dislike Uber, I don't think it is fair to single them out as some lone wolf operating in the wild big data wilderness. We need to be reasonable and stick to the facts, not speculation. This article really tells us nothing, gives us no true reason other than a single incident (as far as I am aware of) of a privacy breach of a journalists trip to the Uber offices for an interview. There have been other reported incidents of data breaches, but without conclusive evidence, it could just be hearsay. I am not saying that there is not an issue with companies like Uber and improper practices with data. I am also not denying that Uber have not had incidents where data has been viewed by employees or other reasons, however I am saying there is a lot of false reporting going on at the moment. We need to remain reasonable and non-objective, let the truth and facts speak for themselves. Lets not hate on a company just because everyone else is. As this article points out, this is not specifically an Uber problem, and as such, I think the title is an inaccurate and deliberate click-bait attempt to get more viewers.
- ccvannorman 12y ago
  > I do not believe in Uber's lack of ethics and the way they do business THIS. They've done so much bullshit that I flat out refuse to use them. Is there a compiled list of all their wrongdoings somewhere? I'd love to refer my friends to it..
- smacktoward 12y ago
  > While I do not disagree with the amount of data that Uber have, a company like Facebook and Google arguably know more about us than we do ourselves. Why should we distrust Uber more than any other company? I believe the point of the article was that we should not distrust Uber more than any other company; we should distrust them all equally, i.e. assume they are all misusing or failing to secure our personal data until an audit by a trusted third party (an "information fiduciary") can prove otherwise. > However, I do believe that companies with data like Uber should be held accountable to very high standards and any breach of privacy of said data would result in severe penalties. This is not just an Uber problem, this is a big data problem and one many companies have. The problem is that there is no incentive for the companies to treat customer data responsibly, while there are substantial commercial incentives for them to misuse it, or at best to reduce the amount they spend on securing it to the absolute minimum possible that they can get away with. And since users are poorly informed and have little power, these incentives will continue to be misaligned until third parties exist with the market or legal muscle to create negative incentives around misusing information strong enough to outweigh the positive ones.
discardorama 12y ago
Email companies (I won't name names here) have _much_ more sensitive data than Uber does. How come the same scrutiny isn't brought to bear on them? We do know that some of the leading ones will mine your emails for targeting. I remember once I was having a little tiff with the GF, and the ads I saw were for marriage counselors and therapists. That was creepy.
- CamperBob2 12y ago
  How come the same scrutiny isn't brought to bear on them? As long as they have a stated privacy policy and abide by it, what's the problem?
- Hoffmannnn 12y ago
  They must abide by numerous data privacy, security, and internal access laws, here and abroad. It just so happens that most of the laws are abroad.
Thrymr 12y ago
Previous HN discussion on the (now deleted) "Rides of Glory" post: https://news.ycombinator.com/item?id=8644080 https://news.ycombinator.com/item?id=8644080 They also seem to have deleted other blog posts that people have criticized, e.g. "Uberdata: How prostitution and alcohol make Uber better" [2]. Internet Archive links: [1] https://web.archive.org/web/20140827195715/http://blog.uber.com/ridesofglory https://web.archive.org/web/20140827195715/http://blog.uber.... [2] https://web.archive.org/web/20120524052917/http://blog.uber.com/2011/09/13/uberdata-how-prostitution-and-alcohol-make-uber-better/ https://web.archive.org/web/20120524052917/http://blog.uber....
- gwintrob 12y ago
  That part of the article stuck out for me. The authors then draw a comparison to OKCupid "experiment[ing] on its users", but Uber is writing blog posts with anonymized data. I do agree that Uber should be extremely careful with securing its data, but I'd be interested to read more data analysis.
ams6110 12y ago
Opportunity for an Uber-like service that destroys your ride data after you have reached your destination (why do they need it after that, anyway?)
- raldi 12y ago
  To investigate complaints that the driver took you on a grossly indirect route, for one.
- cddotdotslash 12y ago
  "It's like Snapchat but for ride sharing"
smhinsey 12y ago
They don't seem to care much about their users. I had an account I hadn't used in years, long enough that the credit card associated with it was expired. This resulted in my account being locked in a way that required me to contact their helpdesk. After telling me to do the equivalent of power cycling my machine by going through their password reset screens, which I'd already tried, they told me that to restore my account I'd need to email them a picture of my driver's license. This leads me to believe that their support database is probably a goldmine for identity thieves and generally those databases are not exactly Fort Knox.
suprgeek 12y ago
Every single recent (and not so recent) item about Uber screams ethically & morally bankrupt scumbags who would soon as throw you under a bus (or an Uber) if it meant making a fast buck. 1) In the New Delhi Uber rape case -they failed to verify the driver who was a repeat offender, they had no call number and no way to access drive logs from India. 2) As others have pointed out - the concept of privacy at Uber is tragically laughable (Rides-of-glory, God Mode, Using riders info for non-ride purposes etc etc) 3) Playing dirty with competitors is encouraged 4) The VP who boasted of hiring a hit team to dig up dirt on Journalists families is still working at Uber after saying this in a very public forum. And this is just the recent stuff. Why anyone would patronize this scummy company is really beyond comprehension. [1] http://indianexpress.com/article/india/india-others/after-victim-went-to-police-dcp-had-to-download-app-and-book-a-cab-to-find-office/ http://indianexpress.com/article/india/india-others/after-vi...
- philwelch 12y ago
  > The VP who boasted of hiring a hit team to dig up dirt on Journalists families is still working at Uber after saying this in a very public forum. This point has obviously been through a few rounds of "telephone". "boasted of hiring a hit team"--he suggested it as a hypothetical idea, he didn't "boast" of already doing it, nor is there any indication he did "in a very public forum"--he said it at a private dinner party where comments were understood to be off the record, but someone brought a +1 and didn't read him into this so he ran with it.
  - onedev 12y ago
    He was just drunk and made an offhanded joke. Come on people, we make offensive jokes all the time. The difference is that people laugh our jokes off and for him, a reporter picked it up and ran with it. I'm not trying to defend Uber with any of the other stuff, I just think that one particular thing was blown up a little bit more than was necessary. I prefer Lyft anyway.
    - shangxiao 12y ago
      lol when will people learn not to drink & make stupid jokes in public ;)
zaidf 12y ago
It's hysterical reading the drama about Uber because it misses the biggest reason why someone shouldn't use Uber: it's almost always more expensive than Lyft, at least using Line in San Francisco. This morning I got a lyft ride from downtown SF to SFO for $18. The Uber quote was $25-32.
TheM00se 12y ago
Uber is scum, I hope they get shutdown soon, very soon.
- mcv 12y ago
  This is getting increasingly clear. A year ago I was pretty positive about Uber, but not anymore. They play dirty. They play dirty wherever they get the chance. I don't trust them not to use their data to blackmail.
downandout 12y ago
"The problem wasn’t just that a representative of a powerful corporation was contemplating opposition research on reporters..." The Uber corporation did no such thing, and the executive involved wasn't "contemplating" anything. This individual executive made a colossally stupid, hypothetical statement during a rant at a party about what he would like to do to a self-declared enemy of the company that happened to be a member of the media (a term I use loosely in this case). This rant was reported to Sarah Lacy (the target of the hypothetical), who, smelling opportunity, then wrote a blog post about how Uber had hitmen hunting her children while they slept in their pajamas (seriously, she actually talked about the danger they were in while they slept in their pajamas). Of course, when interviewed about it on Bloomberg West, Sarah Lacy was certain that this was a "plan" and not a hypothetical, but could produce no evidence of any actions taken or pinpoint any harm that befell her or her sleeping children. NYT is a little late on this one, but given the nice revenue pop that Sarah Lacy's wild exaggeration of the story must have brought, I can see why they are trying to beat this dead horse. Sadly, this story has about as much significance as the original.
- Borogravia 12y ago
  Actually, Uber already did exactly what the article was talking about, to a Buzzfeed reporter. You should probably read more carefully.
  - downandout 12y ago
    They fed negative stories about the personal lives of reporters and their families to the media? If you have proof, I'd love to see it. Because that's what the "threat" and the corresponding publicity were all about. It had nothing to do with being able to show someone where they've been, which is common and should be expected with any app that you authorize your phone to give location data to. Perhaps you should take your own advice about reading more carefully.
skybrian 12y ago
This article mixes up a couple different issues. First, internal controls: what can employees do when they access the user database? Beginning startups probably don't have a lot of formal policies and you're relying on good judgement of the founders and first employees. As a company grows, they need to guard user data with access restrictions, restrict root to a few trusted sysadmins, and put in place clear rules about what what employees with legitimate access to the database are allowed to do. (And of course if your database gets owned it's all for nothing, so you can't protect privacy without good security.) It sounds like Uber might be behind on this, relative to their scale. Second, what can you do with aggregate reports generated from user data? Facebook and OkCupid and Uber posted research articles to their blob summarizing some of their users' overall characteristics. When it's okay to do this sort of research is debatable, but it's a different issue from invading the privacy of individual users. Unfortunately taking a regular taxi may not help [1]. That was screwup rather than intentionally revealing user data, but by now everyone should know that publishing anonymized records is really hard and probably shouldn't be done at all. [1] http://research.neustar.biz/2014/09/15/riding-with-the-stars-passenger-privacy-in-the-nyc-taxicab-dataset/ http://research.neustar.biz/2014/09/15/riding-with-the-stars...
zeeshanm 12y ago
Articles like this one remind me of Baudrillard who once famously said the only way out of this is to unplug and in this "post-modern" society we are the ones unplugged by these apps. I mean why in the world you can't walk 5 blocks and have to "hail" uber or lyft or sidecar or hailo or what have you. I know there are other specific use cases of these apps, too.
goodgoblin 12y ago
The article does well by pointing out that Uber isn't the only company to do these kinds of things, and in fact almost every corporation engages in some variation of these tactics. Everyone knows that corporations have the same psychological profile as sociopaths, but what is fascinating about the recent Uber revelations is how clumsily they play their part. Sociopaths do not understand why society is organized the way it is, yet they do understand that it is important to appear to understand it, to appear to be a good law abiding citizen. Sociopaths and corporations both take great pains to hide their true anti-social and parasitic intentions. Once spotted by the herd the sociopath must restart the painstaking process of making friends, pretending to care about things real people care about, ingratiating themselves with a community and building up trust for the sole purpose of betraying that trust in secret later. For many reasons, the media is generally content to let the dirty tricks companies engage in pass by without examination, leaving the machinations of the sociopathic corporate spiders mostly in the dark. The media earns it's keep by convincing society that their version of the truth is the best approximation money can buy. The mistake Uber made was in threatening a reporter, an action which triggered a very personal response, the kind of response that humanizes the parties involved and clearly demonstrates the difference in the kinds of things Uber is willing to do to advance their goal (blackmail a reporter so they can replace more cab rides with Ubers) v.s. the kinds of goals people have (to enjoy Friday night, get home from the airport). Though it likely won't last long, there is a window of time where incensed reporters may ply their trade without the usual over-riding concern for their own career, and benefit society in the process. Their rate of expansion potentially at risk, Uber will likely respond with a bill of rider's rights and a corporate pledge to uphold the highest ethical standards. In time people will be trained to think of Uber and high moral standards as closely correlated, and all the while the corporate spiders in the shadows have been watching and learning from Uber's mistake. Eventually Uber's case will be used in business schools to teach the dos and don'ts of important subjects like Media Relations (1. never clumsily proclaim your intent to blackmail reporters. 2. always restore a tarnished reputation through a combination of both marketing and policy). Boutique marketing firms will specialize in helping corporations write privacy policies that are made to be marketed, crafted to neutralize negative impressions long enough to lull the sheep back to complacency.
- deleted 12y ago
general_failure 12y ago
The title should read 'we cannot trust uber either'. Other companies like fb, google, do the very same thing except they are more secretive about it
unixpunx 12y ago
Uber should make a social media website, that way nobody would care. All kind of shady business or lack of ethics are completely forgotten, as long as people get to post selfies and show off their socioeconomic status to other losers lile them.
swiftydev 12y ago
We Can't Trust Nytimes

318 points by applecore 12y ago

according to The Washington Post, the company was so lax about such sensitive data that it even allowed a job applicant to view people’s rides, including those of a family member of a prominent politician. worries me a lot more than a 2012 post on the company’s blog that boasted of how Uber had tracked the rides of users who went somewhere other than home on Friday or Saturday nights, and left from the same address the next morning. Obviously Uber has this sort of data, and it can use it in various aggregated ways. What's more important than demonstrations of what information they could pull out of this is how serious they are about protecting it from access, either from people who want to buy that information or employees simply snooping around. I don't care if someone uses my data in an aggregate way to do something (e.g. facebook) as long as I am not personally identified.

robbrown451 12y ago
Those two things are very related. Knowledge of people having sexual indiscretions can be very powerful leverage to manipulate politicians (and others) with.
tzmudzin 12y ago
Why would you believe the data was aggregated, and not available in individualized form in the latter case?
- nemothekid 12y ago
  Because the blog post was publicly posted (and had been available for 2 years before Uber's recent PR trouble), and the data that was presented was on an aggregate level. If you are asking if the blog poster had access to the individualized data, I imagine he did as he was a data scientist at Uber - but I don't see how that is something to be alarmed about.
  - tzmudzin 12y ago
    They _published_ the data in an aggregated form, but they have _profiled_ the customers on individual basis. Now contrast this e.g. to the principles of data protection that Germany has imposed...(http://en.wikipedia.org/wiki/Bundesdatenschutzgesetz http://en.wikipedia.org/wiki/Bundesdatenschutzgesetz)
    - nemothekid 12y ago
      I'm not sure I quite get what you mean. How do you produce an aggregate without profiling customers on an individual basis? Secondly, I don't see how a company like Uber can use their data to power something like surge pricing while following the exact letter of the BDSG.
      - tzmudzin 12y ago
        ...so maybe they should keep their hands off the aggregates as well? For the surge pricing, I'm a bit at a loss, because you don't need personally identifiable data for it, just a request counter per area ID, right? Maybe I don't understand it right though... Also, the reasoning should be the other way around: if I cannot provide a service respecting the basic privacy of my users, I should not be providing a service.
      - claudius 12y ago
        > I'm not sure I quite get what you mean. How do you produce an aggregate without profiling customers on an individual basis? You can easily calculate the average of a set without keeping every individual member of the set by updating the running average each time a new data point comes in. You still collect individual data, but destroy it as soon as possible. > Secondly, I don't see how a company like Uber can use their data to power something like surge pricing while following the exact letter of the BDSG. Then Uber should be banned and its employees and shareholders punished appropriately. I don’t see how “this business model can’t work with this law” could possibly be an excuse to ignore the law. Protection rackets don’t really work with the exact letter of the law, either.
- roymurdock 12y ago
  Here's the link: https://web.archive.org/web/20140827195715/http://blog.uber.com/ridesofglory https://web.archive.org/web/20140827195715/http://blog.uber.... The problem that most people have with the article is the creepy tone ("I know which of you are fooling around and where") rather than an actual leak of information on individual users.
  - tzmudzin 12y ago
    The problem many people with Uber is that they leak information, rather than that they actually do creepy stuff... Whether they brag about it or not, whether they make active use of it or not -- they did invest their time & effort into this type of profiling. Was this altruistic goofing around, with no bad intent? I'd prefer to believe that, but there are no checks in place to ensure this. And I believe most of their customers would be enraged to be subject to such a profiling, even just for the goofing...

sillysaurus3 12y ago

Uber argues that it’s doing only what other technology companies regularly do. That may be true but it only underlines why we need oversight mechanisms that cover all of them. Such as? If you're giving your data freely to companies, I don't understand what kind of oversight mechanism could or should protect you. Imagine a hypothetical oversight mechanism, then imagine the consequences to tech companies. Imagine the consequences to startups. Not Uber; I'm talking about tiny, early-stage startups. Airbnb and Dropbox have enriched my life. I'd hate for regulatory burden to prevent such startups from forming in the first place. This isn't a hypothetical concern. The finance industry is so regulated that you can't easily form a finance startup without having a lot of connections or a lot of money. Same for the healthcare sector, as far as I've heard.

rurounijones 12y ago
> If you're giving your data freely to companies You are assuming people understand this and the implications. The fact it is buried in a legalese ToS somewhere doesn't mean people know what information is sent and how it will be used.
- sillysaurus3 12y ago
  This is dodging the question. Again: What oversight mechanism can possibly protect users from themselves? They're sending this data, whether they understand it or not. People keep advocating that drug use should be an educational / health issue, not a legal issue. It's ironic that in this situation, people are calling for the opposite: For the government to step in and protect them, when it's unclear how the government can help without causing all kinds of unintended consequences. This should be an educational issue, not a legal issue. We should educate users about the ramifications of uploading this data. Remember, if we enforce regulation, users will still upload sensitive data, and the government will still be free to take advantage of it. Whereas if users are educated about what data they upload, then the data won't exist to begin with.
  - lemming 12y ago

yafujifide 12y ago

Although I largely agree with the premise, the author assumes that the only way to solve this problem is with government regulation. I think a better way to solve this problem is with decentralization. The problem Uber solves is one of coordination. This does not require a central intermediary like Uber. It could be solved in a decentralized manner with p2p networks. With a decentralized Uber, only you and the driver would know where you started from and where you went. Privacy would be improved.

brador 12y ago
Serious question, how would a decentralised system have dealt with the recent uber driver rape case?
- pavanred 12y ago
  To provide some context, an Uber driver was arrested on rape charges in Delhi today. Uber allegedly hired a repeat sex-offender driver without a mandatory police background verification. [1] And, I agree that a decentralized system without any regulation or oversight could probably improve privacy but is definitely not the solution. [1] http://www.firstpost.com/living/cab-driver-a-repeat-offender-uber-should-take-moral-responsibility-for-delhi-rape-1838175.html http://www.firstpost.com/living/cab-driver-a-repeat-offender...

brohoolio 12y ago

I'm not going to use the service. Everything that keeps coming out about Uber has been super shady. I'm not the only one. Big Uber proponents who I know have stopped using their service. It's not going to stop the masses, but if stories like this keep coming out without policy fixes they are going to lose their edge. All they are is a dispatch service.

jsprogrammer 12y ago
It seems like Uber could be easily replaced with an open solution. Anyone working on it?
- logn 12y ago
  I've been noticing that comments advocating P2P replacements of sharing economy apps all get downvotes, and no comments explaining why. I'll assume these downvoters are NSA puppets for now.
- jsprogrammer 12y ago
  @logn Not sure the NSA would bother itself with such trivialities. An Uber exec or paid social media expert is the most likely culprit. Or just your common troll (not that there's much of a difference).
  - logn 12y ago
    I saw this on a TaskRabbit thread too. Edit: and they do concern themselves with shaping opinion via social media. I imagine they very much enjoy mining ride sharing data. But yeah maybe they don't care about HN comments. Relevant links: http://www.theguardian.com/technology/2011/mar/17/us-spy-operation-social-networks http://www.theguardian.com/technology/2011/mar/17/us-spy-ope... https://www.techdirt.com/articles/20110318/02153313534/us-military-kicks-off-plan-to-fill-social-networks-with-fake-sock-puppet-accounts.shtml https://www.techdirt.com/articles/20110318/02153313534/us-mi...
- free2rhyme214 12y ago
  Yes DuckDuckDrive will be out soon lol kidding

deleted 12y ago

[deleted]

deleted 12y ago

[deleted]

neilarmslow 12y ago

I'm amazed that in all this news coverage, this story hasn't risen to the top. It's far more relevant than the company in question here. "Buying news coverage and crying misogyny in the ride-sharing industry" https://medium.com/@PersonofAwesome/buying-news-coverage-and-crying-misogyny-in-the-ride-sharing-industry-dedeec300ae9 https://medium.com/@PersonofAwesome/buying-news-coverage-and...

FeeTinesAMady 12y ago
That article raises some good points, but the problem here is that Uber is really, genuinely awful, and the ones in power there are terrible people. See their fraudent calls to Lyft, the way they lie to drivers about how much money they'll make, etc.

marcus_holmes 12y ago

As the article says, this has got almost nothing to do with Uber, and everything to do with a regulatory regime that allows companies to do anything they like with data they collect. Maybe the USA should start looking at the Data Protection / Privacy laws implemented by Europe and the rest of the world, instead of just dismissing them as socialist welfare-state hippy-dippy bullshit regulation getting in the way of business.

jsprogrammer 12y ago
Better yet, skip all the business and political bullshit and just build the open solution with the appropriate security baked in. Don't trust businesses, don't trust politicians, trust the code and the process that runs it.
- anigbrowl 12y ago
  Technology can and will be gamed. So can laws and policies, but but I' think it's naive to assume that social technology that has evolved over thousands of years can be replaced overnight with computer code.
  - jsprogrammer 12y ago
    Probably not overnight, but possibly years and decades. There's no need to eliminate social behavior, that's arguably the entire 'point'. What we likely can do is, identify places where code is more appropriate and use it.

DigitalSea 12y ago

Quite a sensationalist headline. Basically what this article is saying is that Uber have all of this info on where you came from, where you are going and that we should not trust them because they do not have processes in place to ensure users information on trips taken is kept private. While I do not disagree with the amount of data that Uber have, a company like Facebook and Google arguably know more about us than we do ourselves. Why should we distrust Uber more than any other company? However, I STRONGLY believe that companies with data like Uber should be held accountable to very high standards and any breach of privacy of said data would result in severe penalties. This is not just an Uber problem, this is a big data problem and one many companies have. I recently quit using Uber in favour of other services like Lyft because I do not believe in Uber's lack of ethics and the way they do business. However, I don't think it is fair they are being targeted as much by the media as they currently are. As much as I dislike Uber, I don't think it is fair to single them out as some lone wolf operating in the wild big data wilderness. We need to be reasonable and stick to the facts, not speculation. This article really tells us nothing, gives us no true reason other than a single incident (as far as I am aware of) of a privacy breach of a journalists trip to the Uber offices for an interview. There have been other reported incidents of data breaches, but without conclusive evidence, it could just be hearsay. I am not saying that there is not an issue with companies like Uber and improper practices with data. I am also not denying that Uber have not had incidents where data has been viewed by employees or other reasons, however I am saying there is a lot of false reporting going on at the moment. We need to remain reasonable and non-objective, let the truth and facts speak for themselves. Lets not hate on a company just because everyone else is. As this article points out, this is not specifically an Uber problem, and as such, I think the title is an inaccurate and deliberate click-bait attempt to get more viewers.

ccvannorman 12y ago
> I do not believe in Uber's lack of ethics and the way they do business THIS. They've done so much bullshit that I flat out refuse to use them. Is there a compiled list of all their wrongdoings somewhere? I'd love to refer my friends to it..
smacktoward 12y ago
> While I do not disagree with the amount of data that Uber have, a company like Facebook and Google arguably know more about us than we do ourselves. Why should we distrust Uber more than any other company? I believe the point of the article was that we should not distrust Uber more than any other company; we should distrust them all equally, i.e. assume they are all misusing or failing to secure our personal data until an audit by a trusted third party (an "information fiduciary") can prove otherwise. > However, I do believe that companies with data like Uber should be held accountable to very high standards and any breach of privacy of said data would result in severe penalties. This is not just an Uber problem, this is a big data problem and one many companies have. The problem is that there is no incentive for the companies to treat customer data responsibly, while there are substantial commercial incentives for them to misuse it, or at best to reduce the amount they spend on securing it to the absolute minimum possible that they can get away with. And since users are poorly informed and have little power, these incentives will continue to be misaligned until third parties exist with the market or legal muscle to create negative incentives around misusing information strong enough to outweigh the positive ones.

discardorama 12y ago

Email companies (I won't name names here) have _much_ more sensitive data than Uber does. How come the same scrutiny isn't brought to bear on them? We do know that some of the leading ones will mine your emails for targeting. I remember once I was having a little tiff with the GF, and the ads I saw were for marriage counselors and therapists. That was creepy.

CamperBob2 12y ago
How come the same scrutiny isn't brought to bear on them? As long as they have a stated privacy policy and abide by it, what's the problem?
Hoffmannnn 12y ago
They must abide by numerous data privacy, security, and internal access laws, here and abroad. It just so happens that most of the laws are abroad.

Thrymr 12y ago

Previous HN discussion on the (now deleted) "Rides of Glory" post: https://news.ycombinator.com/item?id=8644080 https://news.ycombinator.com/item?id=8644080 They also seem to have deleted other blog posts that people have criticized, e.g. "Uberdata: How prostitution and alcohol make Uber better" [2]. Internet Archive links: [1] https://web.archive.org/web/20140827195715/http://blog.uber.com/ridesofglory https://web.archive.org/web/20140827195715/http://blog.uber.... [2] https://web.archive.org/web/20120524052917/http://blog.uber.com/2011/09/13/uberdata-how-prostitution-and-alcohol-make-uber-better/ https://web.archive.org/web/20120524052917/http://blog.uber....

gwintrob 12y ago
That part of the article stuck out for me. The authors then draw a comparison to OKCupid "experiment[ing] on its users", but Uber is writing blog posts with anonymized data. I do agree that Uber should be extremely careful with securing its data, but I'd be interested to read more data analysis.

ams6110 12y ago

Opportunity for an Uber-like service that destroys your ride data after you have reached your destination (why do they need it after that, anyway?)

raldi 12y ago
To investigate complaints that the driver took you on a grossly indirect route, for one.
cddotdotslash 12y ago
"It's like Snapchat but for ride sharing"

smhinsey 12y ago

They don't seem to care much about their users. I had an account I hadn't used in years, long enough that the credit card associated with it was expired. This resulted in my account being locked in a way that required me to contact their helpdesk. After telling me to do the equivalent of power cycling my machine by going through their password reset screens, which I'd already tried, they told me that to restore my account I'd need to email them a picture of my driver's license. This leads me to believe that their support database is probably a goldmine for identity thieves and generally those databases are not exactly Fort Knox.

suprgeek 12y ago

Every single recent (and not so recent) item about Uber screams ethically & morally bankrupt scumbags who would soon as throw you under a bus (or an Uber) if it meant making a fast buck. 1) In the New Delhi Uber rape case -they failed to verify the driver who was a repeat offender, they had no call number and no way to access drive logs from India. 2) As others have pointed out - the concept of privacy at Uber is tragically laughable (Rides-of-glory, God Mode, Using riders info for non-ride purposes etc etc) 3) Playing dirty with competitors is encouraged 4) The VP who boasted of hiring a hit team to dig up dirt on Journalists families is still working at Uber after saying this in a very public forum. And this is just the recent stuff. Why anyone would patronize this scummy company is really beyond comprehension. [1] http://indianexpress.com/article/india/india-others/after-victim-went-to-police-dcp-had-to-download-app-and-book-a-cab-to-find-office/ http://indianexpress.com/article/india/india-others/after-vi...

philwelch 12y ago
> The VP who boasted of hiring a hit team to dig up dirt on Journalists families is still working at Uber after saying this in a very public forum. This point has obviously been through a few rounds of "telephone". "boasted of hiring a hit team"--he suggested it as a hypothetical idea, he didn't "boast" of already doing it, nor is there any indication he did "in a very public forum"--he said it at a private dinner party where comments were understood to be off the record, but someone brought a +1 and didn't read him into this so he ran with it.
- onedev 12y ago
  He was just drunk and made an offhanded joke. Come on people, we make offensive jokes all the time. The difference is that people laugh our jokes off and for him, a reporter picked it up and ran with it. I'm not trying to defend Uber with any of the other stuff, I just think that one particular thing was blown up a little bit more than was necessary. I prefer Lyft anyway.
  - shangxiao 12y ago
    lol when will people learn not to drink & make stupid jokes in public ;)

zaidf 12y ago

It's hysterical reading the drama about Uber because it misses the biggest reason why someone shouldn't use Uber: it's almost always more expensive than Lyft, at least using Line in San Francisco. This morning I got a lyft ride from downtown SF to SFO for $18. The Uber quote was $25-32.

TheM00se 12y ago

Uber is scum, I hope they get shutdown soon, very soon.

mcv 12y ago
This is getting increasingly clear. A year ago I was pretty positive about Uber, but not anymore. They play dirty. They play dirty wherever they get the chance. I don't trust them not to use their data to blackmail.

downandout 12y ago

"The problem wasn’t just that a representative of a powerful corporation was contemplating opposition research on reporters..." The Uber corporation did no such thing, and the executive involved wasn't "contemplating" anything. This individual executive made a colossally stupid, hypothetical statement during a rant at a party about what he would like to do to a self-declared enemy of the company that happened to be a member of the media (a term I use loosely in this case). This rant was reported to Sarah Lacy (the target of the hypothetical), who, smelling opportunity, then wrote a blog post about how Uber had hitmen hunting her children while they slept in their pajamas (seriously, she actually talked about the danger they were in while they slept in their pajamas). Of course, when interviewed about it on Bloomberg West, Sarah Lacy was certain that this was a "plan" and not a hypothetical, but could produce no evidence of any actions taken or pinpoint any harm that befell her or her sleeping children. NYT is a little late on this one, but given the nice revenue pop that Sarah Lacy's wild exaggeration of the story must have brought, I can see why they are trying to beat this dead horse. Sadly, this story has about as much significance as the original.

Borogravia 12y ago
Actually, Uber already did exactly what the article was talking about, to a Buzzfeed reporter. You should probably read more carefully.
- downandout 12y ago
  They fed negative stories about the personal lives of reporters and their families to the media? If you have proof, I'd love to see it. Because that's what the "threat" and the corresponding publicity were all about. It had nothing to do with being able to show someone where they've been, which is common and should be expected with any app that you authorize your phone to give location data to. Perhaps you should take your own advice about reading more carefully.

skybrian 12y ago

This article mixes up a couple different issues. First, internal controls: what can employees do when they access the user database? Beginning startups probably don't have a lot of formal policies and you're relying on good judgement of the founders and first employees. As a company grows, they need to guard user data with access restrictions, restrict root to a few trusted sysadmins, and put in place clear rules about what what employees with legitimate access to the database are allowed to do. (And of course if your database gets owned it's all for nothing, so you can't protect privacy without good security.) It sounds like Uber might be behind on this, relative to their scale. Second, what can you do with aggregate reports generated from user data? Facebook and OkCupid and Uber posted research articles to their blob summarizing some of their users' overall characteristics. When it's okay to do this sort of research is debatable, but it's a different issue from invading the privacy of individual users. Unfortunately taking a regular taxi may not help [1]. That was screwup rather than intentionally revealing user data, but by now everyone should know that publishing anonymized records is really hard and probably shouldn't be done at all. [1] http://research.neustar.biz/2014/09/15/riding-with-the-stars-passenger-privacy-in-the-nyc-taxicab-dataset/ http://research.neustar.biz/2014/09/15/riding-with-the-stars...

zeeshanm 12y ago

Articles like this one remind me of Baudrillard who once famously said the only way out of this is to unplug and in this "post-modern" society we are the ones unplugged by these apps. I mean why in the world you can't walk 5 blocks and have to "hail" uber or lyft or sidecar or hailo or what have you. I know there are other specific use cases of these apps, too.

goodgoblin 12y ago

The article does well by pointing out that Uber isn't the only company to do these kinds of things, and in fact almost every corporation engages in some variation of these tactics. Everyone knows that corporations have the same psychological profile as sociopaths, but what is fascinating about the recent Uber revelations is how clumsily they play their part. Sociopaths do not understand why society is organized the way it is, yet they do understand that it is important to appear to understand it, to appear to be a good law abiding citizen. Sociopaths and corporations both take great pains to hide their true anti-social and parasitic intentions. Once spotted by the herd the sociopath must restart the painstaking process of making friends, pretending to care about things real people care about, ingratiating themselves with a community and building up trust for the sole purpose of betraying that trust in secret later. For many reasons, the media is generally content to let the dirty tricks companies engage in pass by without examination, leaving the machinations of the sociopathic corporate spiders mostly in the dark. The media earns it's keep by convincing society that their version of the truth is the best approximation money can buy. The mistake Uber made was in threatening a reporter, an action which triggered a very personal response, the kind of response that humanizes the parties involved and clearly demonstrates the difference in the kinds of things Uber is willing to do to advance their goal (blackmail a reporter so they can replace more cab rides with Ubers) v.s. the kinds of goals people have (to enjoy Friday night, get home from the airport). Though it likely won't last long, there is a window of time where incensed reporters may ply their trade without the usual over-riding concern for their own career, and benefit society in the process. Their rate of expansion potentially at risk, Uber will likely respond with a bill of rider's rights and a corporate pledge to uphold the highest ethical standards. In time people will be trained to think of Uber and high moral standards as closely correlated, and all the while the corporate spiders in the shadows have been watching and learning from Uber's mistake. Eventually Uber's case will be used in business schools to teach the dos and don'ts of important subjects like Media Relations (1. never clumsily proclaim your intent to blackmail reporters. 2. always restore a tarnished reputation through a combination of both marketing and policy). Boutique marketing firms will specialize in helping corporations write privacy policies that are made to be marketed, crafted to neutralize negative impressions long enough to lull the sheep back to complacency.

deleted 12y ago

general_failure 12y ago

The title should read 'we cannot trust uber either'. Other companies like fb, google, do the very same thing except they are more secretive about it

unixpunx 12y ago

Uber should make a social media website, that way nobody would care. All kind of shady business or lack of ethics are completely forgotten, as long as people get to post selfies and show off their socioeconomic status to other losers lile them.

swiftydev 12y ago

We Can't Trust Nytimes