Government Agencies Love Expanding E-ZPass Coverage; Handling Data Responsibly, Not So Much

from the no-roadblocks-for-mission-creep dept

Traffic management may be the goal, but watch out for the mission creep. New York's E-ZPass system started out as an efficient way to keep traffic on toll roads running without interruption, but has expanded its coverage to areas where no tolls apply. A couple of years ago, a New York driver rigged up his E-ZPass transponder to light up every time it detected an E-ZPass signal. It lit up a lot.


E-ZPass swears the information collected by its system away from toll roads is only harvested "in aggregate" and "anonymized," and solely for the purpose of delivering data on traffic patterns. All well and good, but it's still the same technology it uses on actual toll roads, where vehicles are tracked individually and specifically. This information is turned over in response to court orders (both civil and criminal) as well as to a variety of government agencies, including the New York City's tax collectors and the Department of Homeland Security. It wouldn't take much to flip a switch and have E-ZPass track drivers all the way through the city, far from any toll roads.


New York's ACLU is concerned about this potential for abuse, as well as the system's use in general. It requested documents related to E-ZPass from a handful of New York government agencies and, somewhat surprisingly, received quite a bit of information in response. But among all the documents it secured, information pertaining to privacy policies and disposal of generated data was definitely in the minority.
The New York State Department of Transportation and the New York State Thruway Authority, for example, produced privacy policies that are vague and barebones. Those agencies report that the E-ZPass readers they use at non-toll locations work differently from those at toll locations. Part of a system called TRANSMIT, the readers electronically scramble identifying information about EZ-Pass accounts, assign an anonymous ID to each vehicle that passes through the system and dump the anonymous IDs every few hours…

The New York City Department of Transportation, more troublingly, appears to have never considered the impact of its study on New Yorkers’ privacy rights. In response to the NYCLU’s FOIL (request number 6), the city Department of Transportation responded that it has no policies or training materials on storage, retention, destruction and use of information generated by or collected from E-ZPass readers.
The NY DOT's response said this specifically:
...[no] responsive documents were found with respect to items 4, 6, 7, and 8 of your request.
These are the items the DOT claims it has no responsive documents for.
4. Documents, including but not limited to privacy policies and marketing materials, that describe the types of data that can be collected by E-ZPass Readers, when it will be collected, and how it will be used.

6. Policies and training materials describing the storage, retention, destruction, and use of information generated by or collected from E-ZPass Readers.

7. Policies and training materials describing when and how NYCDOT shares information and/or data gathered from E-ZPass Readers with other entities, including but not limited to the New York City Police Department, the Federal Bureau of Investigation, and the Drug Enforcement Administration.

8. All documents, redacted as necessary and permitted under law, describing or containing law enforcement requests to NYCDOT for information gathered from E-ZPass Readers in New York City since January 1, 2012, including the response to the requests.
Not exactly comforting, considering there's been no effort on the part of any of the involved agencies to inform the public that E-ZPass is scanning their devices in areas far removed from toll roads. While E-ZPass may only harvest aggregate, anonymous data currently, that could change at any time and its silence on its expanded coverage area doesn't exactly give hope that it will be forthcoming should an outside agency (like the surveillance-happy NYPD or the DHS) start requiring it to track drivers throughout New York City.

What is collected about each specific vehicle from scanners on toll roads isn't being handled responsibly either. While the policies make it pretty clear that this data won't be handed out to everyone who comes asking (like commercial third parties), it is certainly willing to provide info when hit with a subpoena from a government agency. As we've seen in the past, government entities who have direct access to E-ZPass data have abused it for political reasons. The harvesting of data is the necessary byproduct of assessing toll fees, but running the system for years with nothing in the way of disposal policies only increases the potential for abuse.

Finally, no Freedom of Information story is complete without some sort of ridiculous redaction being pointed out. The NY Thruway Authority returned this 9-panel abstract art piece to the NYCLU under the tile "ITS Manual." ("ITS" presumably stands for "Intelligent Transportation Shaping," and copies of other ITS manuals can be found scattered around the internet -- wholly unredacted.)









Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: ez-pass, surveillance, tracking


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • icon
    Andrew "K`Tetch" Norton (profile), 29 Apr 2015 @ 1:52pm

    It's one reason I've avoided getting a 'Peach Pass'. You now need one of these to travel on the HOV lane of I85 north of Atlanta, because it was made into a toll lane 2-3 years back. Now, instead of getting into the HOV lane if you've got 2+ people (as you would on the I75/85 connector through downtown Atlanta) you have to get out of the lane on the north side if you don't have a transponder. Oh, and they upped the requirements to 3 people, and you'd better remember to set the account to 'carpool' online, else you're paying, and set it off carpool if you're not, else you're fined. All for 10 miles of lane with variable pricing (and which is often set at 1-2 cents per section, or about 14c for the whole length). And they're looking to expand this to I75N.

    hmm, maybe I should get one and see how it goes off....

    link to this | view in chronology ]

    • icon
      John Fenderson (profile), 29 Apr 2015 @ 2:25pm

      Re:

      "It's one reason I've avoided getting a 'Peach Pass'"

      I remain continually amazed (and saddened) that anyone willingly uses these transponders at all.

      link to this | view in chronology ]

      • icon
        Andrew "K`Tetch" Norton (profile), 29 Apr 2015 @ 2:44pm

        Re: Re:

        Again, if you want to use the HOV lanes on I85 in Atlanta, you HAVE to have one.

        I'm not sure if it also worked on GA-400 (our only toll road) as I've never traveled the toll area (which stopped being a tolled road a year ago).

        I don't go to the NE corner of greater Atlanta much, but the roads can be pretty bad (as can Atlanta traffic in general - last month it took me 4.5 hours to drive the 80-odd miles along I75 from near Macon to downtown atlanta, was a 'typical saturday'.

        link to this | view in chronology ]

        • icon
          John Fenderson (profile), 29 Apr 2015 @ 3:01pm

          Re: Re: Re:

          "if you want to use the HOV lanes on I85 in Atlanta, you HAVE to have one."

          Yes, I understand. That doesn't diminish my astonishment and disappointment, though.

          link to this | view in chronology ]

  • icon
    Spaceman Spiff (profile), 29 Apr 2015 @ 2:32pm

    Simple solution

    There is a simple solution for this. When you aren't on toll roads, place your transponder in one of those metallic bags that shield it from scanning, or two if you are really paranoid. It will block the scan and let you stay anonymous!

    link to this | view in chronology ]

    • icon
      Derek Kerton (profile), 30 Apr 2015 @ 11:15am

      Re: Simple solution

      Well, as anonymous as you can be with security cams, gov't cams, traffic light cams, and license plate recognition.

      Oh. And cell phone tracking. And connected cars, and "Black box" functionality in some cars. And credit card receipts when you transact at your destination.

      And probably much more.

      link to this | view in chronology ]

  • identicon
    Anonymous Coward, 29 Apr 2015 @ 2:35pm

    if it is out there beyond what it was represented as, then there is no potential abuse. It is actively being abused and has been ever since they decided to expand it beyond what they said it would be

    link to this | view in chronology ]

  • identicon
    pukingmonkey, 29 Apr 2015 @ 2:39pm

    slides as to where the tag data goes, and how the little review of the "scramble" (transmitted in the clear, simple xor)

    http://cryptovillage.org/archives/dc22/ezpass.pdf

    link to this | view in chronology ]

  • identicon
    KRA, 29 Apr 2015 @ 3:02pm

    Electronic tolls

    In CT they legislature is fighting hard against the will of the people to bring back tolls. These tolls will be overhead electronic tolls--no toll booths. If you don't have an EZPass or its equivalent, the "toll" photographs your license plate and sends you a bill. The federal government has offered to help CT pay for this horror.

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 29 Apr 2015 @ 3:37pm

      Re: Electronic tolls

      ...The federal government has offered to help CT pay for this...

      Anything involving an interstate or US designate highway will have federal money involved.

      Try getting any state to pay 100% of any bill on an interstate or US highway.

      link to this | view in chronology ]

      • identicon
        Pragmatic, 30 Apr 2015 @ 5:12am

        Re: Re: Electronic tolls

        Bu-b-but TAXES! These things have to be paid for, by taxes or tolls. Choose.

        This is why it's so damn hard to get any state to pay the bills for interstate and US highways.

        link to this | view in chronology ]

        • icon
          John Fenderson (profile), 30 Apr 2015 @ 7:54am

          Re: Re: Re: Electronic tolls

          "These things have to be paid for, by taxes or tolls."

          Tolls are taxes.

          link to this | view in chronology ]

    • identicon
      Anonymous Coward, 30 Apr 2015 @ 2:56am

      Re: Electronic tolls

      We have those overhead photo tolls on the M50 in Ireland. I'm thinking of putting some UV led's around my plates just for the craic.

      link to this | view in chronology ]

  • icon
    Derek Kerton (profile), 30 Apr 2015 @ 11:13am

    Tripod

    Man. If I went to all the trouble to hack my transponder so that I could film a video to demonstrate gov't over-reach...I'd go the extra mile and "hack" a tripod or phone holder.

    link to this | view in chronology ]

  • identicon
    Anonymous Coward, 30 Apr 2015 @ 12:46pm

    Transponders aren't even necessary

    My EZ-Pass transponder actually stopped working and I didn't even know it. My only clue was that I occasionally got the yellow "Call EZ-Pass" light instead of the "GO" light when going through tolls (but everything billed correctly).

    When I did call, they told me that if there's no communication with the transponder, it uses the license plate photo.

    I've tested this successfully in my fiancee's car (her plate is registered on the account, but she doesn't have a transponder). YMMV.

    link to this | view in chronology ]


Follow Techdirt
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Discord

The latest chatter on the Techdirt Insider Discord channel...

Loading...
Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it
Close

Email This

This feature is only available to registered users. Register or sign in to use it.