Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
Australia Government Privacy The Almighty Buck Transportation Technology

'How I Went Dark In Australia's Surveillance State For 2 Years' (cnet.com) 235

schwit1 shares a report from CNET, written by Claire Reilly: In 2015, during the transition from paper to Opal [contactless public transit cards], Australia passed sweeping new data retention laws. These laws required all Australian internet service providers and telecommunications carriers to retain customers' phone and internet metadata for two years -- details like the phone number a person calls, the timestamps on text messages or the cell tower a phone pings when it makes a call. Suddenly, Australians were fighting for the right to stay anonymous in a digital world. On one side of the fence: safety-conscious civilians. They argued that this metadata was a powerful tool and that the ability to track a person's movements through phone pings or call times was vital for law enforcement. On the other side of the fence: digital civil libertarians. They argued that the data retention scheme was invasive and that this metadata could be used to build up an incredibly detailed picture of someone's life. And sitting in a barn two paddocks away from that fence: me, switching out burner phones and researching VPNs. When it emerged that police had the power to search Opal card data, track people's movements and match this to individual users, it was the last straw. August 2016 rolled around, paperless tickets were phased out and I hatched my plan. The Black Opal. The concept of the Black Opal is simple. Buy your transport card. Pay cash. Top up with cash (preferably in a new location each time). Never register it. Never link it to your credit or debit card. Live off the grid. Stay away from The Man.

[Reilly discusses the problems she faced:] All the top-up machines at train stations, light rail stops and ferry terminals were card-only affairs. One tap on that baby and you were back in the system. So, if I was busing downtown for a work meeting, I'd have to factor in extra time to get to an ATM, get cash out and then find somewhere to top up my card. Running for the train with friends, I was the one who had to divert three blocks, change jackets, burn off my fingerprints and find a nondescript corner store to top up. Here's what I learned. No one likes the paranoid one. [...] I finally came undone last week. Racing for a flight, I forgot about my Black Opal. I'd had an unusually busy week on public transport, and my balance was low. On the train to the airport terminal, it hit me. Did I have enough money on my card to pay the AU$17.76 tap-off fee that they use to gouge tourists at the airport? As I rode up the escalators and the exit turnstiles came into view, my heart sank. No ATM. No cash in my wallet. Just a row of bright green Opal readers and a top-up machine. Card only. With one trip, my years of off-grid living were undone. I slumped against the top-up machine and swiped my debit card. I was just 9 cents short, but it cost me so much more than that. My Black Opal was dead.

This discussion has been archived. No new comments can be posted.

'How I Went Dark In Australia's Surveillance State For 2 Years'

Comments Filter:
  • by Type44Q ( 1233630 ) on Sunday March 25, 2018 @05:44PM (#56324755)
    I only read the headline (mea culpa) but talk about the best way to raise a red flag... you want to blend in...
    • Re:Jesus H. (Score:5, Insightful)

      by fahrbot-bot ( 874524 ) on Sunday March 25, 2018 @08:51PM (#56325455)

      I only read the headline (mea culpa) but...

      Don't be too hard on yourself; that probably saved you some brain cells. TFA is either a joke, or the woman is literally an idiot.

      Here's an excerpt (really):

      My email address (that is, my real email address, not my burner address) doesn't use my birth name. I am no fun at birthday parties, but you'd never know it... mostly because I won't reveal my actual birthday.

      But I'm not alone. For someone who was mostly educated through the received wisdom of Hollywood movies, I learned a lot about what The State could do to me. I watched "The Net" as if it were a documentary. I didn't brush my hair for weeks after watching "Gattaca." I spent months walking around my house, narrating my life after watching "The Truman Show," just to give Ed Harris more material to edit.

      I wish these stories weren't true. But in the grim near future of "Demolition Man" I know I would be the one hiding in the bathroom, away from the countless surveillance cameras, trying to stop people stealing my eyeballs.

      • Thanks for that. I was briefly tempted to RTFA but your comment definitely killed that urge.

      • You are a literal idiot or targeted troll to call someone an idiot for pointing out we are in the surveillance state we always feared. I notice this always happens when someone screams "fire". I suspect that people are employed to troll the big sites to psyop-out people who say something is terribly wrong.
        We are IN something worse than 1984. Benign today is not benign twenty, thirty years from now. We have the framework in place for a hellish, and eternal, series of authoritian hells. How the hell can it be

        • You are a literal idiot or targeted troll to call someone an idiot for pointing out we are in the surveillance state we always feared.

          I don't doubt/deny that we're in the surveillance state you talk about, but the examples she listed are ridiculous -- and you know that. So... either the intent of the article was humor, or she's an idiot who actually believes that stuff can happen like in the movies. Furthermore, she claimed to be "off the grid" and the subtitle of TFA was "They called me the nameless one, the ghost who commutes, the silent passenger who refused to get an Opal transport card." She actually *had* an Opal card, she just pa

  • Link to article (Score:3, Informative)

    by carlhaagen ( 1021273 ) on Sunday March 25, 2018 @05:44PM (#56324757)
  • Now what?

  • What if you tapped in with a card bought for cash, then "lost the card on the train?" Could you buy another card in the final station to "tap out", thus preserving the sanctity of the "Black" Opal card?
    • by Nonesuch ( 90847 )
      That's how all the "tap out" systems I've known work -- if you don't have a readable card at the exit point, you pay the highest possible fare, but it's not like they are going to hold you prisoner in the train station for lack of a transit card.
      • Re: (Score:3, Informative)

        by b0s0z0ku ( 752509 )
        Sure they do -- if they're in Boston :) https://www.youtube.com/watch?... [youtube.com]
      • by Zaelath ( 2588189 ) on Sunday March 25, 2018 @06:05PM (#56324847)

        Yeah, no. In Australia (even if you have registered your card, bought a monthly card that only needs to tap on for statistics purposes, and have a clear pattern of travelling from Stop A to Stop B and vice versa every day) what happens if you forget to tap on at the start, or lose your card on the journey, is they fine you $200-238.

        To stress that, this is even when you've already paid but just forgot to tap on.

        Arseholes.

        • I'm confused: if you don't tap on at the start, the fare gates don't open, right? How do you board the train without tapping on or jumping the gates?

          Also, $200 might be worth if to keep the anonymity of your "cash" card.

          • In Korea it is the opposite way. The gates going inside are open, when you tab and its ok, they stay open, if you don't tab, you can simply pass. If you tab and your card is not ok, the gates close.
            That is to speed up people passing into the train stations, I guess.

          • Many of the suburban stations don't have gates, they just have a post that can register your tap on. All the CBD stations have gates though, and often 4-5 people with nothing else to do than hand out $200 fines to absent-minded commuters.

          • Some stations don't have gates. Most stations in fact.

    • by omnichad ( 1198475 ) on Sunday March 25, 2018 @06:47PM (#56325035) Homepage

      The original card's entire history was tied to a real person with one single card transaction. That's the big loss.

      • No, I was talking about "losing" the cash card, then using whatever mechanism they have, so people who dropped their card on the train can still get out.
        • For one time use and then throw it away, sure. But it would be the max fare for the route.

        • There's no need, You just tap off. The card balance goes negative but it doesn't stop you from leaving.

          If you are feeling charitable you can then top up the card at your leisure. If you have better use for your money than the government then you just throw the card in the bin and get a new one for free (well for $X with a $X balance).

          Article writer was just an idiot apparently.

      • The original card's entire history was tied to a real person

        A real person but not necessarily *the* real person. The only conclusion you can gather here is that someone put money on the card. With a single transaction that could have been anyone. I have been stuck in exactly this scenario before (no debit card, no credit card accepted, no cash accepted) and I paid someone 20eur to top up my card with 20eur. Bam! My card now tied to someone else's bank details.

        You can only really tie it together if the same card is used repeatedly.

        • Sure. The cameras also know that the person getting around with the card wasn't the person who used a debit card there.

          • You're now going to a lot of effort to connect someone based on a completely pointless hunch. Pro tip: if this person is actually of interest, just follow them. No need for wildly expensive big data conspiracies.

            • In this day and age, pulling information about digital transactions around a given time stamp and then pulling the related information is as simple as asking a data technician who is attached to this ID XXXXX that badged on a train at one terminal and off at another. The search space includes "where was card XXXXX sold?" and "at what time was card XXXXX sold?", followed by "pull the CCTV footage from the blue light police camera on that street" and "pick out any of these 3 POI at the destination." It's pr
  • by Anonymous Coward

    Instead just enough money on your card for one trip you should have put $40 or $50 at a time on it. Then you wouldn't be constantly running around trying to add more. Moron.

  • this is not enough. (Score:5, Interesting)

    by Anonymous Coward on Sunday March 25, 2018 @05:51PM (#56324793)

    The "black opal" idea is fairly ridiculous. Home IP + work IP is enough to uniquely identify someone. Simply tapping out at the airport might be enough to de-anonymize the card: passenger manifests are probably efficiently searchable by shrink-wrap surveillance software like Palantir's, and the small set of people departing the airport within a four-hour window plus some other weak bit of information is probably enough to uniquely identify you and thus all your past and future trips on that card. "Co-presence," this kind of correlation, is not exotic. It's the typical goal of these whole-take surveillance systems, so I would expect the attacks possible with it to be in use.

    In London I think you can turn in your Oyster card and get a refund in cash, which you can then use to get a new Oyster card a couple hours later with a different serial number, but of course nobody does that so it might be like wearing a kick-me sign to attempt evasion that way. I don't know.

    • by b0s0z0ku ( 752509 ) on Sunday March 25, 2018 @06:02PM (#56324835)
      Australia doesn't actually require ID to fly domestically in all cases so manifests may or may not be accurate. Also, there are plenty of non-flyers going to the airport on any given day. Contractors, interviewees, people meeting friends/dropping them off, etc.
      • by Kjella ( 173770 )

        Australia doesn't actually require ID to fly domestically in all cases so manifests may or may not be accurate. Also, there are plenty of non-flyers going to the airport on any given day. Contractors, interviewees, people meeting friends/dropping them off, etc.

        On any given day, but rarely on the same combination of days and departure/arrival times if you keep using the same card. Most of the non-flyers can probably be trivially be dismissed as contractors probably work there regularly and people meeting arrivals will depart again much quicker than those departing for a round trip. I checked my local airport, it has ~4 million passengers per year so ~2 million departures or 5500/day. If you give it a 4-hour window it's maybe 2000 in the rush hour.

        Being away for mo

      • The US is going the opposite way; you either need a "RealID enabled ID" or a passport now to fly. My state kept pushing ReadID off (because of Obama), so now they got denied another extension on it all. They finally caved, but right now are at the 2-4 year mark on actual implementation.
  • by pz ( 113803 ) on Sunday March 25, 2018 @05:52PM (#56324799) Journal

    This is exactly why you have TWO cards. One that you use only occasionally that is traceable and used only for emergencies, and one that you use mostly, which you top up with loads of cash (and cash only), and keep frelling topped up. If you're really paranoid, you cycle the cash-only one every month or two for a new one, and don't frelling worry about the last dollar-and-a-half when you ditch it.

    Basic engineering: make allowances for cockups.

    • Yeah, that doesn't help if they tapped on with the wrong (low balance) card. The system is designed to allow you entry regardless, then deny you exit and hoover up that lovely penalty cash. Ka-ching, ka-ching!

      • The DC metro will allow you out (if you beg the human attendant), but the card will have a negative balance after. Since the system only allows entry with at least the minimum fare, the highest amount of negative the card can go is $max fare-$minimum fare, a number which totals $4. A new card costs $5, which means there is always incentive to restore your card to a positive value rather than chuck it and get a new one.

        • by b0s0z0ku ( 752509 ) on Sunday March 25, 2018 @06:28PM (#56324951)
          Practically, a new card costs $1 with $4 of "hidden" credit. If you think of them as having $4 hidden credit, you should always use the negative credit if (say) you're a tourist who isn't planning on returning, Then leave the card lying around so someone can pick it up and not have to pay for a new card. Pay it forward.
        • But then how are you going to pay $85-100k+ for your ticket inspectors, who also get 7 weeks off a year and free public transport?

          http://yarratrams.com.au/about... [yarratrams.com.au]

          • While touristing there, I saw the Melbourne inspectors drag a couple of annoying teenagers off for not having tapped in, something like $250 fine. When they protested, the inspector loudly stated "all these people have properly paid, and you haven't. Is that fair?" Gotta say I wish we enforced fare evasion over here as rigorously...

    • by Anonymous Coward

      This is exactly why you have TWO cards.

      I keep more than two, just in case one broke down, I still have redundancy on my side

      Not just cards, but also burner phones

      Call me a paranoid, but I am still 'not visible' to the man, and I've been 'on the system' since before the net

    • Or, you know, don't live in Sydney: or if you must , don't catch public transport? Seems like an over complicated approach to solving a simple problem.
      • If you think not catching public transport in some cities is easily worked around then you've obviously never driven in Sydney, or any city in Europe for that matter.

    • I agree two cards is a better idea so you can use a trackable one in a pinch....

      But I really shouldn't understand the philosophy of keeping the card with around $20 of credit. If I were trying what he did I would have $100 of credit or so if possible, refilling any time it dropped below $50... being able to take several trips without an immediate refill.

      However there is a giant hole in his plan. He was always using ATMS pretty much right before filling, so I'm almost certain they were matching cameras fro

      • by Cederic ( 9623 )

        I'm almost certain they were matching cameras from the ATM and the cameras on the transit refill and they knew exactly who it was

        Paranoia much? No, that would require them to notice that there was a card being used cash only, care, trace where it was being topped up then correlate that to ATM usage. If they wanted to use camera footage to confirm that's a whole additional load of hassle.

        Sure, it's possible, but unless use of that card was tied to serious crime they're just not going to bother.

        • The whole scheme is paranoid to begin with, the parent poster is just explaining that it isn't paranoid enough to succeed at the goal of remaining anonymous. If you're filling up the card at an ATM you've already linked it to fully trackable data about you.
    • by _merlin ( 160982 )

      Two? I have half a dozen Opan, myki and Octopus cards used for different types of trips.

    • by tlhIngan ( 30335 )

      The system Vancouver (BC) uses allows for perfectly anonymous usage, with prepaid cards, as well as convenience modes where you can tie that card to a ID.

      You buy a card from a retailer (there are several) for $6. From there, you can head to a fare machine and put money on it, or buy a pass. You can pay by cash, credit card or debit card, but the former is preferable if you wish to remain anonymous.

      If you want convenience, you can create an account, and tie that card to yourself. Which means you can have the

  • by Nonesuch ( 90847 ) on Sunday March 25, 2018 @06:00PM (#56324825) Homepage Journal

    Why did she hold onto one single card for so long and keep topping it up?

    You'd think somebody who was truly paranoid would have multiple cards, and routinely discard older cards and acquire new cards through unorthodox means. For example, if you hang out at the airport outside the "tap off" exit from the train, you can find a lot of tourists who are flying out and just want to discard their old transit card. Or put just enough to "tap on" (there's usually a minimum balance to enter the train station) on your old cards, and then find homeless people who have a near-zero-value card and trade with them-- they get into the station, you get a new anonymous card with some random travel history on it.

    • by Anonymous Coward

      Why did she hold onto one single card for so long and keep topping it up?

      You'd think somebody who was truly paranoid would have multiple cards, and routinely discard older cards and acquire new cards through unorthodox means. For example, if you hang out at the airport outside the "tap off" exit from the train, you can find a lot of tourists who are flying out and just want to discard their old transit card. Or put just enough to "tap on" (there's usually a minimum balance to enter the train station) on your old cards, and then find homeless people who have a near-zero-value card and trade with them-- they get into the station, you get a new anonymous card with some random travel history on it.

      I do all you described, and one more --- I dumpster dive, a trick I learned back in the 80's and 90's

    • Re: (Score:1, Flamebait)

      by fahrbot-bot ( 874524 )

      Why did she hold onto one single card for so long and keep topping it up?

      Because she's an idiot, who thinks she's James Bond, who wanted to write a seemingly clever story.

      To digress a bit... It's like this chick, Hephzibah Anderson, and her book Chastened [amazon.com] about her voluntary year of chastity. Turns out she just stopped having penetration - gave up the “last base” (her words). Still went on dates, still kissed, still fondled, but she drew the line at that – kiss, kiss, no bang, bang. How she must have suffered. So she writes a book about it and gets fam

      • That's still following the letter of the definition, if not the spirit. Chastity just means the abstainment of sexual intercourse. I.E. no penile penetration of her genitalia since she was female.

    • Being truly paranoid, is a rare skill in our times.

    • Why did she hold onto one single card for so long and keep topping it up?

      Because she's the type who is paranoid without any reason to be. You expect rational thought here with a brain that is incapable of exhibiting it. She's not a terrorist or a spy, she's just a crazy person.

  • by Anonymous Coward

    We have the perfect opening crawl for the next Star Wars film. It's better than reading about trade disputes....

  • Tap-off loophole (Score:5, Informative)

    by ben_kelley ( 234423 ) on Sunday March 25, 2018 @06:10PM (#56324875)
    A little known loophole: Your Opal card can go into negative balance. So long as you have enough balance to tap on, you can always tap-off. Tap on with $2.50 credit, tap off for $17.76, throw the card away and get another one. Simples! (You have been living off the grid for 2 years but you didn't know this? Hmm...)
    • You have been living off the grid for 2 years but you didn't know this?

      She only *thinks* she's been living off the grid. The reality is the government is probably watching only her and ignoring all the other normal people out there.

  • by fahrbot-bot ( 874524 ) on Sunday March 25, 2018 @06:14PM (#56324891)

    Buy your transport card. Pay cash. Top up with cash (preferably in a new location each time). Never register it. Never link it to your credit or debit card. Live off the grid. Stay away from The Man.

    Ya, because acting like that isn't suspicious. "The Man" knows someone is paying for that unregistered, un-linked card w/cash, at different locations. They know the card number, they know where and when it was reloaded and used. They have CCTV cameras. They have a picture of you from somewhere you used it and, if you have any official ID -- driver license, passport, etc... -- they can match them up. They know who you are, what you're doing and where you're doing it. They have devices to identify the mobile phone(s) you're carrying and can track them if they want to.

    Either they've been tracking you all this time or determined that you're an idiot and have been ignoring you all this time.

    Why do you think businesses and governments encourage, and make it easy to use, electronic payment systems over cash? Identification and tracking.

    • by Anonymous Coward on Sunday March 25, 2018 @07:19PM (#56325129)

      "Suspicious pattern of camouflaged activity" only causes scrutiny when the pattern's components are (somehow) assembled to a single name.

      99% of the system ("The Man") isn't a man. Half your post describes systems that require a human operator, which only happens AFTER a motivating cause for them. Automated logging costs effectively nothing.

      > they have been ignoring you all this time.
      Computers don't "ignore" logs, they just dump hoover dump dragnet dump scoop dump. Even if the data isn't useful. Same goes for every commercial industry, particularly anything in mobile OSs. "Logging costs nothing. Keep everything, maybe we'll contract an interpreter later to figure out this shit."

      Logging != monitoring, only the most concerning PoIs get the latter. Resisting mass dragnets is an exercise against algorithms, not people. And results aren't a binary outcome, they're a spectrum. This really should be more obvious.

  • This is a serious question. Whenever a US data privacy debate pops up online, Australians seem to weigh in with Europeans in calling privacy a paranoid American concern. When the government told them to turn in their guns, they did so in concern for the greater good. Why not agree to have their movements tracked and their telephony metadata archived? It's for the greater good too, isn't it?

  • This has been the law in Europe for some time now. The data retention time can be up to 2 years, the laws are different between countries.

  • ... the solution is really a social one.
    Lighten up Claire (pun intended ;-)
    What the man dreads is critical mass. The man is just the point-1 percent, rmember? That critical mass will come, in fact it's already there, and my bet is that that smartphone you're going to get will be more of a help than a hinder when the time comes. It may even be a prerequisite.
  • Okay, no. (Score:5, Insightful)

    by fahrbot-bot ( 874524 ) on Sunday March 25, 2018 @06:33PM (#56324989)
    The TFA subtitle:

    They called me the nameless one, the ghost who commutes, the silent passenger who refused to get an Opal transport card.

    I doubt "they" called you any of those things -- especially since you actually *had* an Opal transport card (that you simply paid for w/cash).

    I'm going to call you "pretentious".

  • Firstly Opal cards typically let you tap off with a negative balance. In fact itâ(TM)s been a relatively well known exploit for getting a cheaper fare to the airport. There are plenty of articles out there on the loophole, but none as far as I can see on it being closed. Iâ(TM)m pretty sure my balance has gone negative recently, but I suppose it is possible they have put different restrictions in at the the airport. Secondly, anyone paranoid about privacy would discard their Opal card (they are f
  • As the legend would have it:

    At first, Sue finds Dundee less "legendary" than she had been led to believe, being unimpressed by his pleasant-mannered but uncouth behaviour and clumsy advances towards her; however, she is later amazed, when in the Outback, she witnesses "Mick" subduing a water buffalo, taking part in an aboriginal tribal dance ceremony, killing a snake with his bare hands, and scaring away the kangaroo shooters from the pub from their cruel sport.

    The next morning, offended by Mick's assertion

  • A rose is a rose is a rose. She was never dark. One of her many aliases was the number of the card. Its every move was tracked. Even the cash refills.

    If they've got distributed database search capabilities, I bet they could peg her name with a query alone - something like which individual used their card to get cash at the nearest ATM to this card's refills within 10 minutes of a refill the greatest number of times.

    I'd also bet they periodically run a query to list all cards that have never been linked to a

  • GIven you can just have the balance go negative when you tap off the entire article makes no sense at all.

    Last time I was in Oz the opal card went in the bin when I got to the airport since it was at about $-10, and who would pay $10 to get the balance to 0 when you can just pay $10 for a new $10 balance card...

  • Bellingham (Whatcom Transit) accepts cash (20.00) for the monthly pass.

    Pass is swiped on machine at entry to bus. There is no swipe upon exit from bus. All bus routes both in and out of downtown are handled the same way.

    There is no deduct done on swipe as pass is fixed $20.00 per calendar month.

    System knows when each card is swiped to board the bus. System does not know when you get off the bus. Swipe is via mag stripe, not presence. In fact, if you want to use credit card, you have to go to the windo

  • She could have just buy a new opal and top it up with her credit card and use it for that trip only, and then destroy it and use her black card again once she has access to atm somewhere else.
  • It's a good story in the press but this person is hardly unique.

    I only fill up my transit cards with cash (whenever I can) and recycle them every so often, but I don't have breathless stories in the press about how amazingly black my Oyster, OV, etc cards are.

    I just like making total surveillance more difficult.

  • It was until that moment "Card number $whatever", just not linked to a certain person. That and how this card traveled was still recorded. Should it have raised some flags with someone, e.g. that this card was suspiciously close to some interesting events frequently, rest assured that they would have spent the time and money to find out who holds that card.

    Now those 2 years of going out of your way are rendered moot, retroactively. The card is now not only for all future uses "yours", but the profile collec

  • Is this a real story from a real person trying to protect and preserve her privacy, or is it a propaganda story made up by the Australian government to try to convince people how futile it is to try to protect and preserve their privacy anymore?

    One day, here in the U.S., the average people are going to wake up and realize what's been taken from them. On that day I will laugh sardonically at them all for having been so damned dumb.
  • by MooseTick ( 895855 ) on Monday March 26, 2018 @01:11PM (#56328635) Homepage

    Couldn't she have just bought a NEW card list a tourist would and then ditch it? At best, the "man" could determine she visited the airport once in her life. She could have also called a cab, had them take her to an ATM, and then paid cash. Or, she could have walked. Or, she could have called a friend/family.

A morsel of genuine history is a thing so rare as to be always valuable. -- Thomas Jefferson

Working...