UK's MI5 Wants Oyster Card Travel Data

Boiled Frog from a Nation of Suspects writes "The Oyster card, an RFID single-swipe card (which was recently cracked), was introduced to London's public transport users purportedly to make their lives easier. Now, British Intelligence services want some of the benefits by trawling through the travel data amassed by the card to spy on the 17 million Britons who use it. The article notes, "Currently the security services can demand the Oyster records of specific individuals under investigation to establish where they have been, but cannot trawl the whole database. But supporters of calls for more sharing of data argue that apparently trivial snippets — like the journeys an individual makes around the capital — could become important pieces of the jigsaw when fitted into a pattern of other publicly held information on an individual's movements, habits, education and other personal details. That could lead, they argue, to the unmasking of otherwise undetected suspects."

Acid Test

They should make records like this for all MPs and their families pubically available, updated daily and hosted on the interweb.

After 6 months, they can decide if they *REALLY* want the intelligence services (and anyone who picks an MI5 laptop up on a train) to have the same.

That's not good enough.

People in power really don't have as much to hide. Political dissidents, on the other hand, have to watch out for reprisals. Would you risk having anything to do with an opposition group if you knew your affiliation would be noted? Symmetry of information is not always the same as symmetry of power.

The best way to oppose this is to note that there's no real law enforcement benefit.

Re:That's not good enough.

People in power really don't have as much to hide? I know of a certain New York governor that is evidence to the contrary, and I don't really believe he's a one of a kind.

Re:That's not good enough.

People in power really don't have as much to hide.

Wow, that is the most naive statement I've heard in well... as long as I can remember!

Everyone is a suspect then.

What the honest hope to unmask is criminals by considering everyone a suspect.

What they will do is discover and harass political opposition. Dark times for the UK.

Re:Everyone is a suspect then.

I'm with you on the spying/freedom thing. Gas prices on the other hand:
its good that we pay so much tax on the damn stuff, gas should be expensive.
The fact that gas is so expensive means we have vaguely working public
transport and fuel efficient vehicles. You're paying $4 a gallon.. good,
you should be paying at least that, its just a shame you haven't been
paying that much for decades. If you had your infrastructure would have
developed in saner ways and you might be in a better position
to face peak oil. As it is, so many people live > 20 miles from where
they need to work, and food/goods distribution is so energy intensive
its really going to get ugly.

*sigh*

"That could lead, they argue, to the unmasking of otherwise undetected suspects."

Translated: We want to be able to spy on you. We are not sure why yet.

I predict a new business coming

Here is my pass, and an additional 100 pounds Sterling. Now, just travel around London for the next 7 days, sightseeing or whatever you like. When you are done, mail it back to me. Wow, now that is a really good tourism plan. What? Why am I being arrested at the airport? No, I did not rob a bank. No, I am not muslim. Oh, that's why? hmmmm

Or better, stick it inside someone else's bag and you look like you were traveling with them. The downfall of all of this is that there is no physical link between the tag and any human being. This is just stupid. Tracking people will not work, and will ONLY inconvenience the stupid criminals and honest people. When will governments learn?

Re:I predict a new business coming

The downfall of all of this is that there is no physical link between the tag and any human being. This is just stupid. Tracking people will not work, and will ONLY inconvenience the stupid criminals and honest people. When will governments learn?

So do the obvious thing and require that everyone in the UK (including those changing planes at Heathrow) get an RFID implant. Problem solved, identity theft a thing of the past [1]

[1] At least as long as the Forces of Evil don't figure out how to remove/transplant the suckers. Don't worry, they're not smart enough to figure that out.

The lab called

Your sarcasmometer is overdue for recalibration.

Re:I predict a new business coming

The downfall of all of this is that there is no physical link between the tag and any human being.

Shhhh don't give them any ideas! Next thing you know they are going to implant chips for you to travel, or go work, or get your chocolate ration for the week. I hear it's up to 20 grams!

Re:I predict a new business coming

Your idea of a criminal appears to be someone who has already committed a crime. To the government, a criminal is someone who might commit a crime, also known as a citizen.

Pervasive surveillance

Spying on everyone, and having everyone spy on *each other*, is a fabulous way to run a civilization. As we all know, the former Soviet Union and China are the closest we've come to paradise-on-earth.

What the fuck is wrong with England? I mean, Orwell *showed* them in "1984" how bad it could be, but they keep moving towards it. It's very strange.

Re:Pervasive surveillance

As we all know, the former Soviet Union and China are the closest we've come to paradise-on-earth.

I believe that the DDR (former East Germany) holds the record with something like 30% of the population keeping tabs on the rest. Their status as a workers' paradise is left to the reader to judge.

Re:Pervasive surveillance

What the fuck is wrong with England? I mean, Orwell *showed* them in "1984" how bad it could be, but they keep moving towards it. It's very strange.

It's only strange if you believe that government exists to serve the people.

 

Re:Pervasive surveillance

I mean, Orwell *showed* them in "1984" how bad it could be, but they keep moving towards it. It's very strange.

Not at all. The people in power are generally immune to any consequences, which is why they can do this and not care. The United States Congress was originally structured in such a way that the lawmakers would serve their term of office (a civic responsibility, much like jury duty) and then return to their previous lives to live under the very laws they instituted. That very powerful negative feedback loop was opened (to our detriment) when the idea of "career politician" was born. Now, I don't know enough about England's governmental structures to know if there were any similar controls that have also since lapsed into uselessness. If so, it would explain a lot.

Pay as you go variant.

... and I have to say that stories like this are exactly the reason why I opted out of using the original Oyster where you have to register and hand over personal details. I use the anonymous pay as you go version. Though, thinking about it, I'm sure with a little effort they could associate the card id with the debit card payments used to top it up.

Why link it to the individual at all?

Shanghai metro for one has an oyster type card that is anonymous. To top it up you pay cash at the ticket office.

There are logs, and you can check them yourself by inserting the card into a reader; same for your wife who took your card to see where you've been. It is anonymous in that your personal details are not tied to the card ID, so no fishing expeditions by the authorities.

Feature creep

And this is why you should be wary of ANY data collection scheme...just like it used to be that any application would eventually evolve to a point where it incluided a webbrowser/IRC client/email reader, data collections like thses evolve until the government wants it.

And what happens when the database gets hacked (this is INEVITABLE) and your personal data is online, never to go away? Jack shit is what. The government won't reimburse you, the data will never dissappear (like they say, real men don't do backups, they archive to the internet!) and identity theives (including, you guessed it, terrorists) will have a field day with easily used personal data which can't be 'taken back'.

This is one of those cases where the certain (not potential, this shit is ionevitable) consequences are much worse than any 'problem' you are trying to solve.

Personal data will hit the net, identity thieves will have fun and you actually make tracing terrorists MORE DIFFICULT.

God, people are dumb sometimes.

Shock!

Oh man, I never saw this coming! Did you? Such a surprise. And here I thought they'd stop at the public cameras! Ha ha ha, boy is my face red.

Oh well. I'm sure this time they'll be satisfied with their new powers.

The TERROR!

From TFA:

The fear of cyber-warfare has climbed Whitehall's agenda since last year's attack on the Baltic nation of Estonia, in which Russian hackers swamped state servers with millions of electronic messages until they collapsed. The Estonian defence and foreign ministries and major banks were paralysed,

Except that these were done by some Estonian script kiddies [theregister.co.uk], so it wasn't "CYBERWARFARE!!!11@@!"

Rich.

data trawling is ineffective

Unless you are already tracking a suspect, data trawling is ineffective. The bigger the database, the less effective it is as more and more false positives occur and have to be investigated. This wastes huge amounts of time and resources and starves real investigations that could well turn up real suspects.

Two problems with that

First, apparently what they are asking for is not "anonymized" data. Second, as was very clearly demonstrated by the AOL data-release scandal, it is sometimes possible to get an awful lot of personal data on people by putting enough "anonymous" data together.

Re:D Filter error: You can type more than that for

It's already anonymous if you want it to be. You can buy an Oyster card over the counter for cash without giving any personal details. You can optionally register the card, so you can top up the pre-pay online and so on, in which case it ceases to be anonymous, but the default is anonymous.

Of course, if you really have something to hide, you buy individual tickets, which would only be traceable with a lot of work correlating the CCTV images (no change from the present). Ok, it's £4 per Zone 1 journey instead of £1.50, but I bet the terrorists can afford it. In other word, this isn't a measure against the terrorists -- it's too easily circumvented: it's just more monitoring of the ordinary reasonably law-abiding citizen.

Re:D Filter error: You can type more than that for

There are two versions of the Oyster Card. The kind most commuters have is tied to a credit card. Whenever it becomes empty, it is automatically topped up. The other kind (which I have) can be bought for cash (technically I think it's a deposit and can be returned if you give the card back) and topped up for cash. When it is empty it stops working until you put more credit on it (by credit card or cash). If you ever top it up with a credit card then they can presumably tie your name to the card.

It's a silly thing to ask for, since any terrorist who isn't a complete idiot is likely to use the anonymous version. Of course, anyone willing to blow themselves up is probably some kind of idiot to start with...