
Are New York’s Free LinkNYC Internet Kiosks Tracking Your Movements? - rfreytag
https://theintercept.com/2018/09/08/linknyc-free-wifi-kiosks/
======
walterbell
(repost)

NYCLU and Columbia University have a 2016 video (starts at 2:50) about the
corporate origins and privacy policy of Google's LinkNYC surveillance kiosks
in Manhattan:
[https://livestream.com/internetsociety/hopeconf/videos/13081...](https://livestream.com/internetsociety/hopeconf/videos/130816888)

Village Voice covered the topic,
[https://www.villagevoice.com/2016/07/06/google-is-
transformi...](https://www.villagevoice.com/2016/07/06/google-is-transforming-
nycs-payphones-into-a-personalized-propaganda-engine/)

 _> This freedom to opt out entirely is also the last argument that
spokespeople for LinkNYC and the city itself fall back upon when challenged
with privacy concerns: If you don’t like it, you’re welcome not to use it.
It’s a disheartening place to land, especially when discussing infrastructure
that’s supposed to be serving people who aren’t served otherwise. To Moglen,
it’s simply an unacceptable conclusion. “That’s what they want us to believe,
that we have a choice between isolation and monitored connecting,” he says.
“Those are not adequate choices in a 21st-century world: We are designing the
net to track you — if you don’t like it, don’t use it. The human race is
shifting to a fully surveilled and monitored superorganism — if you don’t like
that, stop being human. That’s a poor outcome. The United States is a society
that was based around the idea that human beings can have liberty. So give us
liberty! And don’t tell us that otherwise we can have the death of the net."_

~~~
freehunter
This is one of the best provisions in GDPR, in my opinion. If someone opts out
of data collection, you still have to provide them the service unless the data
collection is absolutely necessary to providing the service. It's not an all-
or-nothing like most EULAs tend to be, you can opt out of non-essential parts
of the agreement.

~~~
mtgx
Which unfortunately many companies don't comply with. See:
[http://gdprhallofshame.com/](http://gdprhallofshame.com/)

Hopefully we'll start seeing a wave of enforcement actions against these
companies soon, too.

~~~
pmalynin
Unless EU (with the help of GDPR) starts enforcing DNS nodes with ENDS0 Client
Subnet extensions (as many endpoints send the subnet of /32 for IPv4 or /128
for IPv6 enabling unprecedented amount of tracking), the whole thing is simply
a selective enforcement tool that will be used to punish those the EU does not
agree with.

~~~
colejohnson66
Every law is subject to selective enforcement. Should we stop making laws at
all?

~~~
jMyles
...yes?

I mean, I've certainly heard worse ideas than "stop making laws."

------
sanityvampire
Ubiquitous WiFi kiosks with inbuilt cameras, huh? Ostensibly, they're not
allowed to track individual user locations, but the combination of functions
present in the devices means it would be trivial to start connecting
independent databases and building profiles on users. If you were a malicious
actor, how would you go about it?

The PoCs on tracking individuals with MAC addresses are old news (and, in
fairness, newer iOS devices use random MAC addresses for WiFi probe requests),
let alone the user fingerprinting you could do on browsers when people
actually use these things. So you've got a database of devices, and then on
top of that you start doing facial recognition and gait analysis to collect
another set of individual data points. Then you connect devices to people, and
you have a pretty nice system for tracking individuals moving through the
city, even those with location services and such disabled.

Paranoia? Maybe, but it wouldn't take much for say, Amazon, to start doing
this. And Bezos wouldn't be bound by city regulations on citizen privacy.

~~~
chimeracoder
> The PoCs on tracking individuals with MAC addresses are old news (and, in
> fairness, newer iOS devices use random MAC addresses for WiFi probe
> requests)

MAC address tracking is obsolete. All phones (including iOS devices) broadcast
a full list of SSIDs that they have previously connected to when attempting to
connect to wireless networks. That alone is enough to uniquely identify most
people.

~~~
JBReefer
I thought iOS doesn't do that anymore?

~~~
chimeracoder
> I thought iOS doesn't do that anymore?

Last I checked, they did because it's part of the actual spec, though if
anyone has definitive evidence to the contrary (either for iOS or flagship
Android phones), I'd be curious to see it.

~~~
sanityvampire
You know, I totally forgot this was a thing. I'm sure modern phones do it.
Last time I was on an airplane, couple months ago, I was messing around with
airmon-ng, and I was amazed at the amount of personally identifiable
information that people's WiFi drivers were just spewing into the ether.

------
nine_k
As life becomes more connected, privacy that was not enforced but just existed
due to technical limitations keeps eroding.

We should remember this, anticipate this, maybe sometimes legislate around
this, but most of all, build explicit technical counter-measures. Also, all of
this may and sometimes will fail, so we need to learn to live in an inevitably
more and more transparent world.

------
uptown
Almost certainly. And if you're driving, your EZPass tag will track you:

[https://www.youtube.com/watch?v=HQTdpFAo7eQ](https://www.youtube.com/watch?v=HQTdpFAo7eQ)

~~~
overcast
Simply stowing it away in a glove box like most people do prevents any reader
from getting at it. I don't know anyone who physically displays their tag on
the windshield all the time.

~~~
24gttghh
How about everyone who sticks it to their windshield with the velcro the ez-
pass comes with?

~~~
overcast
"I don't know anyone who physically displays their tag on the windshield all
the time." If you do, then stow it in your glovebox if concerned about
privacy.

~~~
post_break
Houston has bluetooth trackers for traffic. If you have a phone with bluetooth
you're looped in there as well. Just turn bluetooth off while driving while
hiding your ez tag in your glove box right? What about the plate readers.

~~~
reaperducer
Doesn't stop them from tracking you by the transmitters in your tires.

~~~
severine
^ This is not sarcasm: [https://en.wikipedia.org/wiki/Tire-
pressure_monitoring_syste...](https://en.wikipedia.org/wiki/Tire-
pressure_monitoring_system#Privacy_concerns_with_direct_TPMS)

~~~
mrguyorama
>Because each tire transmits a unique identifier

Suddenly glad my car uses the old style, tire rotational speed based system.
Sure it's not as accurate and feature rich, but my tires can't be picked out
of a blind lineup

------
CodeSheikh
"...code collects the user’s longitude and latitude, as well as the user’s
browser type, operating system, device type, device identifiers, and full URL
clickstreams (including date and time) and aggregates this information into a
database."

Aren't all mobile phones browsers collect this data any way? If your location
privacy is enabled to be shared by the browser. I am not sure what this
student found beyond this which is worth raising brows.

Also, 3 cameras system in each kiosk is indeed creepy.

~~~
Spooky23
The difference is that rather than a telco in the case of cellular devices,
the system is owned and operated by the municipal government directly.

In the context of NYC in particular, it's more immediately concerning than
usual because NYPD actually has a significant, funded intelligence division
with the resources to use the data.

~~~
AdamM12
Wait so do they need a search warrant?

~~~
freeone3000
You don't need a search warrant for information freely given.

------
allthenews
As someone who leans libertarian, I tend to shy away from rigid legislative
solutions to social problems and corporate overreach.

However, articles like this make me wonder if it isn't time for the government
to step in and implement privacy regulations of some sort. I did not consent
to have my movements tracked and ads sold to me by privately owned kiosks all
over my city of residence.

OTOH, I don't know if I would trust the current government to implement such
protections in a way that isn't self serving and possibly counterproductive.
Shitshow all around.

~~~
matklnz
I always read these like "as someone who leans libertarian, I'm starting to
realise libertarianism is a bad idea"

~~~
njarboe
Taleb has an interesting take on why a person might state their position this
way. He states he is:

Libertarian at the global and national level. Republican at the state level.
Democrat at the city level. Socialist at the club/neighborhood level.
Communist at the family level.

Makes quite a bit of sense to me. And if one does not realize one has this
hierarchy of beliefs, it is hard to talk about ones politics. What do you call
yourself if you hold such beliefs?

~~~
beager
That "hierarchy" of beliefs just sounds selfish, with an interest in
disproportionately consolidating resources in your proximity, but then
demanding permissive access to them once they're at arms length.

Of course, _policies_ must be crafted differently to create a benefit at
different levels, but that doesn't mean you can't have consistent
philosophies.

~~~
pdkl95
> that doesn't mean you can't have consistent philosophies

Social structures and politics are _not_ philosophically or logically
consistent! Philosophies are, at best, a useful set of guide, but it isn't
hard to find pathological examples for any philosophy.

------
sevensor
I presume that's what they're for, just like the thing Comcast routers do,
where they provide public access points whether you want them to or not.

~~~
givinguflac
Not defending Comcast, but you can disable the public hotspot feature. You
cannot however disable the hidden Comcast home security network broadcasting
whether you have that service or not

------
dublinben
More info: [https://cryptome.org/2016/06/linknyc-spy-kiosks-
installation...](https://cryptome.org/2016/06/linknyc-spy-kiosks-installation-
videos.htm)

------
codedokode
These kiosks can collect WiFi and Bluetooth MAC addresses of devices people
carry. If those are Android devices, then Google probably knows their MACs and
can identify users passing by.

------
Nasrudith
My first thought before clicking the article was 'of course - it is NYC and
the government there prides itself on being paranoid authoritarians'. This is
the same city which brought us stop and frisk, which has a police department
that likes to wander broadly out of jurisdiction into foreign countries, and
given reports about unmarked X-Ray Vans that they have gotten special pleading
okays to block any information from the courts. Their government will almost
certainly kill more innocent people in /New York City/ than terrorists ever
will which is impressive feat given both 9-11 and earlier historic attacks.

------
fatjokes
The only people I've seen use those things are hobos and near-hobos.

------
qubax
How's the saying go? If you aren't paying for it, then you are the product?
Nothing is free. You are paying one way or another.

Even if they aren't actively tracking your movements, they are collecting data
on you and passively tracking your movements since they can use the data to
retroactively see where you were.

