London’s Tube Network to Switch on Wi-Fi Tracking by Default in July

https://techcrunch.com/2019/05/22/mind-the-privacy-gap/

by dmmalam • 7 years ago

78 76 7 years ago

techcrunch.com

markive• 7 years ago

So typical of the UK these days..

sys_64738• 7 years ago

All part of the Snoopers Charter.

forthispurpose• 7 years ago

Is it just an impression or is UK indeed the most enthusiastic of all Western countries when it comes to performing mass surveillance on its citizens?

Seems like it runs way deeper and broader than in US

dvno42• 7 years ago

Opinion but I'm getting that impression, I was visiting Britain earlier this year and to gain entry to a sit down restaurant (Denny's type place), I was required to produce my passport or ID so that a copy could be scanned and saved before being granted entry (this was the norm for locals as well).

voldacar• 7 years ago

Christ that's unsettling

andrewingram• 7 years ago

Wait what? I’ve never come across this.

dTal• 7 years ago

That is not even remotely normal anywhere in the UK. Where was this?

twic• 7 years ago

That's certainly not normal.

I wouldn't be entirely surprised if you had to do this to get into a restaurant somewhere slightly sensitive, such as at the top of a skyscraper. And i have been asked for ID - and patted down! - going to the bowling lanes in a slightly gangy part of town.

But nobody's going to give you the third degree to get into a Nando's.

tialaramex• 7 years ago

Sounds like somebody pranked you.

Most older Brits don't carry any sort of ID at all. Young people often need ID to buy booze, but when you're old enough that nobody could mistake you for under 25 they never bother you. Source: I've never carried ID, in my 40s this ceased ever causing any hassle because now nobody ever even asks.

Silhouette2• 7 years ago

FYI, that's not even slightly normal for eating out in the UK. In my entire life, I have never been required to produce ID when eating out (other than perhaps a few times when I was younger and ordering alcohol, to prove that I was of legal age).

In fact, such a policy would probably be catastrophic, because there was a big fight over whether we would all be required to carry compulsory ID cards here a few years ago, and for once the civil liberties side won after a big campaign.

viraptor3• 7 years ago

You've possibly been scammed in some way. Watch out for weird things happening in your name. This is not normal and most likely not legal.

stordoff• 7 years ago

This absolutely _isn't_ normal. I don't routinely carry ID, and never have done. The only place I can think of that did this was one nightclub near my university, but the upshot was we just didn't go to that nightclub often.

Tsiklon• 7 years ago

Plenty of bars in my local area of London have this set up unfortunately, usually they only turn them on after a certain point in the evening. I understand it's a requirement of their license. Most larger nightclubs in London will also do the same, I was very concerned when I first saw it.

detritus• 7 years ago

This is the second time I've read of this on HN and I've literally no idea what any of it is about.

I can perhaps imagine this happening in some [crappy centre-town, tourist-trap] nightclubs, but literally not in a ‘Denny's type’ cafe restaurant.

I can't even begin to imagine why, short of some scam or bored locals teasing tourists.

zhte415• 7 years ago

Given that almost nobody in the UK has any form of ID on them at any given time, and certainly nothing a restaurant can verify, it seems this as an entrance policy may be hurting the restaurant's business. Where was it? I've never been asked this. Did you consider reporting them to the police? If not, why not?

jrockway2• 7 years ago

I think TfL just wants money. People won't pay for public transportation with increased taxes and whine loudly whenever fares are increased to cover the cost of the ride, so instead they track your movements with WiFi.

Y_Y2• 7 years ago

But the Tube is already foolishly expensive, even by London standards. If you compare it with e.g. the BCN Metro the fares are typically about five times higher. The only thing to be said for TfL is that the passengers are generally very well behaved and never look at each other.

kevin_thibedeau• 7 years ago

There's a whole book giving them an instruction manual.

Carpetsmoker• 7 years ago

My comment from yesterday applies here as well: https://news.ycombinator.com/item?id=19978973

Specifically, I found the "distrustful of everyone to the point of paranoia"-part is really pervasive. I'm not trying to upset anyone here, but it's one of those things that's hard to notice unless you have a different perspective (e.g. you're a foreigners, have lived abroad, etc.)

A lot of the British seem pretty okay with it shrug

ownagefool• 7 years ago

The further north you get, the friendlier people are, and the more distrust for Government there is. This however does also include cultural and sectarian divides, so the split isn't as simple as north/south.

With that said, I'm Scottish and living near London and find this distasteful. But it's easier to configure a VPN then whine about it, so maybe we're just lazy?

londons_explore4• 7 years ago

This is passive listening to unencrypted data. Anyone could do it.

I actually commend them for announcing it. Most businesses just hire an 'analytics' company and end up getting all the same data from their customers without asking.

saagarjha• 7 years ago

secure, privacy-protected data collection

This is frequently an oxymoron in practice…

walterbell7• 7 years ago

Note that iOS "grey" color for WiFi does NOT mean disabled - you can still be tracked. A diagonal line across the WiFi symbol = off.

Use "Settings" to turn WiFi completely off, or disable WiFi via Control Center before turning off Airplane Mode.

This stateful & confusing button behavior was added in recent iOS releases. If Apple cares about privacy, they can enable the original iOS behavior via permanent opt-in setting and MDM policy.

lathiat2• 7 years ago

Though iOS also randomizes and regularly rotates the MAC address used for WiFi probing and only uses your real MAC once you connect.

So in disconnected mode, or, if you've never actually connected to that wifi network, you'd think that wouldn't really work?

walterbell7• 7 years ago

When WiFi is enabled, iOS devices broadcast a list of known SSIDs and possibly the MAC addresses of some known routers. Has that changed?

https://arstechnica.com/gadgets/2012/03/anatomy-of-an-iphone...

https://lists.immunityinc.com/pipermail/dailydave/2012-March...

dontbenebby3• 7 years ago

Note that iOS "grey" color for WiFi does NOT mean disabled - you can still be tracked. A diagonal line across the WiFi symbol = off. Use "Settings" to turn WiFi completely off, or disable WiFi via Control Center before turning off Airplane Mode.

Are you sure about that? It's my understanding turning it off in airplane mode turns it off completely.

I just tested - connected to wifi + cell, went into airplane mode, then disabled wifi, and I see a diagonal line through the wifi symbol.

walterbell7• 7 years ago

Yes, airplane mode turns off WiFi.

But if you turn on WiFi without airplane mode, even once, you can never again turn off WiFi (only) via Control Center. You can only "Disconnect".

And if you enter Airplane Mode while disconnected, then exit Airplane Mode, WiFi will not be disconnected, but fully enabled (blue). The only way to keep cellular service and disable WiFi at that point is via settings.

nmstoker• 7 years ago

Wondering if these changes will finally make the data service more robust for users.

The main issue seems to be that it's so hit and miss about correctly recognising you, failing with messages about being logged in in too many other locations, so you get blocked from about half the stations as you travel across the network on a typical commute

Silhouette2• 7 years ago

As a curious data point, when I bought a new phone and then signed up for a new SIM-only plan with a UK provider not so long ago, they made a big deal about how I now had access to free WiFi on the Underground. This was not mentioned at all during the sign-up process and not something I requested or opted into.

TfL do say they won't identify individuals, but for the purposes of data protection law anything that could be used to identify a specific individual is in scope, so these kinds of systems (and similar ones that have been used in places like shopping centres for a while) might be skating on thin ice if there are also, for example, sufficient CCTV cameras around and recording for an individual to be identified from those and then matched against their phone.

It looks like TfL have been cagey about exactly what precautions are being taken here, and they certainly have other mechanisms that could potentially be used to identify individuals such as CCTV and data from payments and entry/exit barriers, so given the scale of the Underground network and the number of people likely to be affected, it wouldn't surprise me if these kinds of stealthy phone-tracking systems started to come under greater regulatory scrutiny before long.

softgrow• 7 years ago

It's not just the UK. Prospect Council in Adelaide Australia have "Prospect Fast WiFi" https://networkprospect.com.au/prospect-fast-wifi/. It costs a little to provide, but they get back actionable metrics for assessing how much foot traffic there is and then evaluate policy effectiveness for their main street. A much richer data source for next to nothing compared to other methods of tracking visitors to the area. Still I'm surprised that TfL wants that level of detail as they already log people in and out of the (transport) system, so can easily measure how well things work (or not).

frosted-flakes• 7 years ago

I remember reading about this when they were still piloting it a while back. Entry and exit info is valuable, but doesn't help when there are multiple routes between those stations that you want to compare. Also, it can identify seemingly rounadabout routes that people take for whatever reason (quieter, fewer transfers, more transfer but more likely to get a seat, want to avoid taking the same train as Mad Mary from the office, etc.), but I don't know what they do with that information.

xfitm32• 7 years ago

I don't believe its purely for advertising. Wifi tracking and IMSI catching are already done at airports, makes sense its expanding to other travel locations. It's sad that London is becoming a total surveillance state and everyone seems to be ok with it.

shereadsthenews• 7 years ago

I'd like to know how any educated and rational person ever formed the belief that they were going to go about in public, on the tube, with a radio transmitter in their pants, and nobody is allowed to notice. It's a very public and very not private activity.

jaabe• 7 years ago

I wonder how this is legal. I work for a Danish municipality and we once used WiFi tracking to help us build a better inner city. The data were wiped of any identifying features, because we really didn’t care who went were, we just wanted to track the flow of citizens in general.

It was still deemed illegal under the government adapted GDPR laws because we didn’t have consent. So how on earth is London getting away with this, and I guess you could say the same about their CCTV footage?

hkai• 7 years ago

For someone living in Asia, it's crazy that people in Western countries have to always fiddle with their phone to search and connect to Wi-Fi, because their plans are expensive or the tunnels don't have coverage.

kzrdude• 7 years ago

I'm thinking the same thing. Living in Sweden.

But - WiFi is very good when you are travelling outside of your data plans coverage area.

retrac982• 7 years ago

Coverage is an issue underground, but plans are cheap now, at least in the UK.

I think my phone plan costs me something like £12 per month and I get more data than I ever use from my phone (30GB), and unlimited minutes/texts.

hutattedonmyarm• 7 years ago

Counterpoint: I pay 10€/mo for 2GB and no minutes/texts included in Germany

heavenlyblue• 7 years ago

Which network is it?

jsmith99• 7 years ago

4G will be available across the tube by 2021, even in tunnels. They need an interesting type of antenna [0], basically a long wire running along the tunnel that 'leaks' radio signals, because 4G won't propagate down tunnels. The mayor is trying to take credit for it but it's actually supporting the new Emergency Services Network: an over ambitious plan to replace all police and emergency radios with 4G devices.

[0] https://eandt.theiet.org/content/articles/2019/01/online-und...

KaiserPro• 7 years ago

from what I remember of the pilot, they actually did a good job of anonymising the data.

Basically every mac address/SSID group was md5'd with a salt that was rotated daily. I _think_ that each station had a different salt too. But this was to track user movement though one station, not across the network.

There is of course, no guarantee that they will do this again

shpx• 7 years ago

There's 2^48 MAC addresses. You can crack 2^48 MD5 hashes in 3 hours using a single Nvidia GTX 1080 Founders Edition

https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...

https://www.wolframalpha.com/input/?i=2%5E48+hashes+%2F+25+b...

severine• 7 years ago

I use the aptly named Wi-Fi Privacy Police, from F-Droid:

Prevents your smartphone or tablet from leaking privacy sensitive information via Wi-Fi networks. It does this in two ways:

It prevents your smartphone from sending out the names of Wi-Fi networks it wants to connect to over the air. This makes sure that other people in your surroundings can not see the networks you’ve connecte to, and the places you’ve visited.

If your smartphone encounters an unknown access point with a known name (for example, a malicious access point pretending to be your home network), it asks whether you trust this access point before connecting. This makes sure that other people are not able to steal your data.

Link: https://f-droid.org/es/packages/be.uhasselt.privacypolice/

Does it work? Am I being naive?

edit: Formatting, grammar

dharma1• 7 years ago

Having actual WiFi coverage in the tunnels would be a good start. Now it only works at the stations, maybe for 15 seconds at a time, on each stop. It's awful

londons_explore4• 7 years ago

Can they please get on with switching on 3G?

4G has come out, and 5G is about to come out, all in the time they've spent delaying.

magwa101• 7 years ago

Didn't Bostrom say the only way for us to survive was through massive surveillance, sounds about right.

London’s Tube Network to Switch on Wi-Fi Tracking by Default in July

Related Stories