Sophos Cloud Optix
The City of London has told a bin company to keep its nose out of people’s business.
The rubbish and recycling bins, from the company Renew, were set up to identify and remember people’s smartphones, and thereby the movements and habits of their owners, as they walked by – kind of like how web pages monitor site traffic.
The online magazine Quartz was the first to report on the tracking technology, which, it says, was installed in a dozen bins around London’s Square Mile.
Set up in the Cheapside area of central London, the bins recorded phones’ media access control (MAC) addresses – unique identification numbers that act like a device’s digital fingerprint.
If you walk around with WiFi enabled on your phone then it will broadcast its MAC address indiscriminately and, unlike an IP address which changes over time or when you switch networks, a MAC address is constant for the lifetime of a device. (OK, they aren’t quite unique and they can be changed but they are reliable enough).
The tracking was designed to enable advertisers to target messages at people whom the bins recognized.
Prior to the 2012 Olympics, Renew installed 100 recycling bins with digital screens around London.
Advertisers were able to buy space on the internet-connected bins, with the city getting 5% of the airtime to display public information.
According to Quartz, it was only recently that Renew rigged the bins with gadgets to sniff passing smartphones.
Quartz’s coverage sparked public alarm, including, according to the BBC, concerns raised by the UK privacy group Big Brother Watch.
The City of London on Monday said in a statement that it’s asked Renew to quit the data collection and has taken the issue up with the Information Commissioner’s Office:
"We have already asked the firm concerned to stop this data collection immediately and we have also taken the issue to the Information Commissioner’s Office. Irrespective of what’s technically possible, anything that happens like this on the streets needs to be done carefully, with the backing of an informed public."
Renew chief executive Kaveh Memari said in a statement that this has all been blown out of proportion, that the data being collected in initial trials – since concluded – is anonymized, and that the company is no longer counting devices that pass by:
"During our initial trials, which we are no longer conducting, a limited number of pods had been testing and collecting annonymised and aggregated MAC addresses from the street and sending one report every three minutes concerning total footfall data from the sites.
"A lot of what had been extrapolated is capabilities that could be developed and none of which are workable right now. For now, we no longer continue to count devices and are able to distinguish uniques versus repeats. However, the process is very much like a website, you can tell how many hits you have had and how many repeat visitors, but we cannot tell who, or anything personal about any of the visitors on the website. So we couldn’t tell, for example, whether we had seen devices or not as we never gathered any personal details."
Memari told the BBC that the current technology was just being used to monitor local footfall and that while more capabilities could be developed in the future, the public would be made aware of any changes.
According to the BBC, the collection of anonymous data through MAC addresses is legal in the UK, though it exists in a grey area.
That’s because the UK and the EU have strict laws about mining personal data using cookies – small bits of data sent from a website that can be used to uniquely identify people and then monitor their behaviour across different websites.
Under UK and EU law companies that want to use cookies to track us in the virtual world must gain our consent to do so but no such consent is required to track us in the real world using our devices’ MAC addresses.
Nick Pickles, director of Big Brother Watch, told the BBC that the City of London’s spying-bin shutdown is welcome, but it’s a bit concerning that this “blatant attack on people’s privacy” was allowed in the first place:
"Systems like this highlight how technology has made tracking us much easier, and in the rush to generate data and revenue there is not enough of a deterrent for people to stop and ensure that people are asked to give their consent before any data is collected."
How much of a threat to privacy does sniffing our MAC addresses entail?
In this case Renew says the collected data was anonymized and encrypted, describing the bins as little more than “glorified people counters”.
But the fact is that this was just an initial trial by a marketing firm.
An array of MAC address detectors in a busy town or street could easily be used to harvest useful real world information about an individual and their commuting and shopping habits. Information that marketing companies would love to get their hands on.
Simply knowing where somebody is and how long they spend there might be used to infer where they work, what shops they visit, where they eat lunch and all manner of other useful things that could be used for individually targeted advertising.
In other words, these snooping bins sound like the tip of a privacy iceberg.
I’m glad to hear the City of London is on the case and that the ICO isn’t far behind.
Given the ICO’s track record with, for example, Google’s privacy transgressions, let’s hope we can look forward to the office once again putting a lid on (heh, heh) privacy trespassing.
Image of bin courtesy of Renew.
So they could probably tell, or at least get a good idea of who, was talking up to spy bins and setting them on fire? Will bear that one in mind.
This sort of thing is going to become part of everyday life eventually. One day you will be tracked from birth to death, every single movement you make will be recorded somewhere on a database or other information log.
So glad it won't happen in my lifetime, but I fear for my grandchildren and their children.
It is going to happen.
I can't imagine what use physical proximity of a MAC address to an outdoor rubbish bin would be to advertisers. You don't know if the MAC belongs to someone young or old, male or female, or anything other than they were in this location for some reason. If you used the fact that this MAC address was in a red-light district after midnight as an excuse to show seedy ads, you might offend other passers-by. Maybe if they were near a car dealer you could show car ads, but car ads pop up everywhere anyway. It would seem this would only be useful if you could also associate the MAC address with other personal characteristics.
It probably depends how isolated they are. In a typical British town there are one or two tightly packed streets with shops and restaurants and a number of bins.
If each bin had a MAC address detector and the addresses were stored and shared you could potentially discover where somebody was in space, what direction they are moving in, how long they spend in proximity to something, how often they visit those streets or particular locations on those streets etc.
From those patterns you might easily imply what shops and restaurants they visit and from those you could easily target your advertising more tightly. Just knowing what shops somebody visits can reveal demographic information like age and spending power. Where do you shop? Big and Tall (large, male)? Top Shop (female, probably 25 years of younger)? Saga holidays (over 65). And that's one shop on one day – Big Data is all about the information that emerges from collections of individually innocuous data points.
Remember you don't have to be really good at targeting to see a benefit, you only have to be better than if you do no targeting at all.
And that's before you associate that MAC address with some useful personally identifiable information.
Considering how inconspicuous the sniffers are, how is a ban on such devices going to be enforced? The moral is — disable wifi unless you are actively using it.
Banning them at least means you can prosecute people who set them up. That might be enough to deter some (not all) businesses. And sniffers usually have to reveal that they exist to make the technology function, so you could equip someone like a parking attendant with a sniffer sniffer to root them out. And anyway, it's partly about the public getting to put their foot down and say they will not be harassed and bullied by business.
Seems funny they claim they can't use any of the information when they say "are able to distinguish uniques versus repeats" how else but via something like a MAC address. It's always interesting to hear people say "what good is data from a trash can", you would be amazed at what a good analyst can figure out from limited data. The more data the more precise. Weather forecasts are much better because of the size of the data sets they can access. No different from peoples movements and probably less complex.
Jack
"Quartz's coverage sparked public alarm, including, according to the BBC, concerns raised by the UK privacy group Big Brother Watch."
What's the big deal? Why are people upset? They walk around all day long broadcasting this information with their smartphones and then they get upset when somebody "tunes in" to the information.
People today need to treat ALL of their electronic communication equipment just as they would a CB radio. Expect NO privacy and only keep data on it that you would not mind posting on a billboard.
I think the difference is that CB radios give you a choice about when you're speaking and let you easily not broadcast. Our phones and such have become CB radios we're forced to leave on all the time. That's the real issue here. And yes, you can turn WiFi off, but a lot of phone manufacturers don't make that easy or convenient.
At this point the data is anonynous, but what will happen when they ally with the phone/cell companies who do know the mac address owner's data?
This is a crime infect and should be considered seriously as these kind of things can lead to the serious crime. Storing information within the bins is quite ridiculous.
George Orwells 1984 comes to mind Big Brother is watching you a serious invasion of privacy here and should be banned
rubbish.
Switch your device off when you are walking through town. My generation grew up without mobiles and tablets, I’m sure todays generation can get used to it. If anything it will make people more aware of their surroundings if they are not being distracted by ringing/vibrating/ shrieking mobile phones, and they’ll be watching where they are walking instead of tappity-tappity-tappity BEEEEP (oops nearly got run over then!). In any case don’t forget these bins can only detect what your device is broadcasting, I’m afraid calling this snooping is much the same as complaining that someone is listening into your conversation when you are shouting at your mate down the street. If you don’t want your device to be overheard, switch it off!