Forgot your password?
typodupeerror
United Kingdom Privacy Transportation

London's Public Bike Data Can Tell Everyone Where You've Been 41

Posted by timothy
from the away-from-flat-call-in-the-burglary-lorry dept.
An anonymous reader writes "I recently posted this article with a few vizualizations and a bit of analysis about the risks associated with open data sets. Thought it might be of interest of Slashdot readers: 'This article is about a publicly available dataset of bicycle journey data that contains enough information to track the movements of individual cyclists across London, for a six month period just over a year ago.'"
This discussion has been archived. No new comments can be posted.

London's Public Bike Data Can Tell Everyone Where You've Been

Comments Filter:
  • Contradiction (Score:4, Informative)

    by jklovanc (1603149) on Thursday April 10, 2014 @04:02PM (#46718741)

    From the article;

    and with a little effort, it's possible to find the actual people who have made the journeys.

    because (thankfully) it requires a fair bit of effort to actually identify individuals from the data

    Is it "a little effort" or " a fair bit of effort"? The never go into what would need to be done to get the identity information.

  • Apparently England is fine letting everyone know where you have been.

    Look at it from the perspective of a stalker.

    Note, that stalker may be a wife, ex-wife, husband, ex-husband, etc.

    The stalker can pretty easily find out where you live and work, if they don't already know. Then easily use this website to get all of your other visits.

    Your ex-husband, who you left because he hit you one time, can now track you down. Oh, and he now knows the rough location of where you new boyfriend lives.

    Clear violatio

    • by jklovanc (1603149)

      Only if the stalker can link the map to a person. The article says it is possible but not how to do it. The maps are called up but a user id not a name.

      • From point A (your house) to point B (your work) there are only a handful of individuals (or only one)... so filtering with some other information (such as trips from point A to C, close to his/her parents) it can be linked to a single individual quite easy.

        • Re: (Score:3, Informative)

          by Dazza (2865)

          It's not that simple.

          You can't track from 'your house' to 'your work'. The tracking data is for London's bike hire scheme. These are picked up from specific 'docking points' around the city, and are returned to any docking point.

          So you can only get 'station to station' data.

          • by rjstanford (69735)

            And if you already know the start- and end-points of the bike ride to refine the data, its not actually all that hard to predict the route, or useful to confirm it.

          • It *is* relatively simple. Just look in other publicly-available data sets for other events occurring in the same timeframes/patterns as the bike for hire events. Eventually you'll get to a small set of individuals and links to things that contain personally identifiable information.
      • by JeffAtl (1737988)

        The author mentioned cross-referencing the time/location data points with social media posts.

        If person already knew a particular time/location for the biker, that could be used to figure out the customer id.

      • by gurps_npc (621217)
        It is only difficult to do it the other way around. That is, if you have a user ID it is hard to figure out which person it applies to.

        But finding out the user ID of a person whose travel schedule you know is ridiculously easy. If you know four facts - 1) the person uses the bike program, 2) where they work, 3) where they live, and 4) what time they have to be in work, then you can easily figure out their userID

      • Re: (Score:3, Interesting)

        by TheCarp (96830)

        Except said stalker has a different problem set than the article's author. The author is looking at the data, and picking out an individual. It is a whole different problem to take an individual, that you have some information about, and pick them out.

        So maybe the stalker is looking at an employee of some establishment. He watches when that employee comes in for a few days. Lots of people use the same bike terminal, but how many individuals checked in at 8 am today, 8:03 yesterday, 7:58 the day before?

        Befor

        • Frankly, it is actually putting people in danger in a way that is especially enormously terrible since it would be so easy to avoid. Why would you EVER publish unique identifiers that map to people like that? I can understand this was probably an oversight, but it really is indefensible as an intentional disclosure.

          I consider this publication beneficial. If the data was restricted to government employees only, then only a small portion of the population would be in danger and the monitoring continues unchallenged. When everyone has to share the same danger, monitoring people becomes an issue.

          I hate when people are so naive as to believe that collecting data on people is fine as long as only the government has access to that data. If it is not acceptable to make the data available to everyone, then it is not accepta

    • If I want to stalk you why don't I just get your new address from your car registration?

      Or, since I'm stalking my ex-wife I know all her person details. I can just call up her insurance company or bank, give them her details (and put on a girly voice I guess?) and "confirm my details" with them.

    • https://bayareabikeshare.com/d... [bayareabikeshare.com] and http://divvybikes.com/datachal... [divvybikes.com] Nothing new here folks.
    • Congratulations, YOU are the community bicycle.

    • Those who use the bicycle hire scheme in London, which is a subset of all people. But I agree with you, it's very interesting that the data's public. It might not be a violation of privacy if you've agreed to it when you hire the bike though? Never hired one of those bikes myself so I am not sure what you've agreed to when you click on "ok".

  • by Anonymous Coward

    It's easy enough to identify someone if you are determined - all you need to do is be present at the bike station at the set time and follow the user home. You may get a few false positives but once you identify the correct person, you can track their movements forever in the future. So it is not difficult.

    However, providing customer level data has lot more benefits - from road/bike route planning to planning where to put my shop that sells bike parts or on the go coffees in a special non spill cup, tailore

  • Spying on the citizens and visitors of London by using public bike data... For SHAME you guys....

    Oh... wait...

  • Incorrect (Score:4, Insightful)

    by rjstanford (69735) on Thursday April 10, 2014 @04:53PM (#46719377) Homepage Journal

    This article is about a publicly available dataset of bicycle journey data that contains enough information to track the movements of individual cyclists across London

    From TFA: "What may surprise you is that this record includes unique customer identifiers, as well as the location and date/time for the start and end of each journey."

    The unique ID? Yeah, maybe that's a problem, likely not that big a deal but also easy enough to get rid of (although if we do that, we lose the ability to track joined journeys, identify frequent vs. infrequent users, &c. But that's not the point here.

    Identifying which bike stations you check a bike out from and return a bike to is very different from identifying your movements across London. Very different indeed. I'd argue that you do have an expectation of privacy when you stop along the way to get a cup of coffee, a bit of nookie, or a gyro. As a public transportation user, though, your checkin and checkout actions are totally different than your route.

    In fact, it'd be damned useful to be able to see and show that you did - or did not - retrieve or return a bike at a particular place and time. Its also useful to be able to tell where that bike went in the future.

    Think about library books. Even in the "olden days," it was frequently possible to see who checked out a book, when they got it, and when they returned it. You couldn't, however, tell whether or not they liked it, if they read it in the bathtub, or if they let their SO read a page or two along the way.

    Same here, just with bikes. Sorry guys, no news.

    • by Anonymous Coward

      My God! I may have to admit to going to the places that I actually go to. And here i thought promoting lies was what the world is all about.

  • Is it any surprise they are tracking you at this point? Wouldn't you be more surprised if they were not?

    Why shouldn't they? There are no consequences.

  • Asa an avid bicycle I don't understand how people can rent those things. You have to adjust those things each time you get a new one or risk serious physical damage. I never see people riding them either.

    • by Anonymous Coward

      Asa an avid bicycle I don't understand how people can rent those things.

      Avid cyclists aren't their target market. I know it sounds crazy but you are not the center of the universe.

    • To get around the city they are superb! You can combine it with other modes of transportation (e.g., a thunderstorm comes, just return it and catch a bus). Adjust? Release the saddle quick-release, move saddle, close the quick-release, ride.

      Yes, they suck in terms of riding for enjoyment/sport/speed. I have my own bikes for that.
    • That's the typical geek attitude that I see everywhere - "It doesn't meet my needs, therefore I can't see how it can meet anyone else's needs either."

      I see plenty of people riding these around London. Whilst I'm not a bicycle rider (avid or otherwise), I can understand the convenience of just being able to walk up to a bike stand and rent one for a short journey.

  • Um, what? (Score:2, Informative)

    by Anonymous Coward

    The dataset contains a Bike ID, not a customer ID. You can get the dataset yourself and look.

    http://www.tfl.gov.uk/info-for/open-data-users/our-feeds#on-this-page-4

      And one of the suggestions they have is to map the bike journeys.

    There is a similar set for the underground.

    • Have you actually registered and looked at live data?

      The author himself states, in response to a comment making the same point as you, that:

      The actual bike data that you download from the TFL website contains customer record numbers

Put your Nose to the Grindstone! -- Amalgamated Plastic Surgeons and Toolmakers, Ltd.

Working...