Chris Christie, Port Authority Official Abused E-ZPass Data For Their Own Ends

from the just-some-harmless-toll-data,-right? dept

What data is harmless in the hands of the government? Apparently, not much. Case in point: the data collected by E-ZPass transponders. While the system helps alleviate traffic congestion, it also tracks drivers' movements. If you thought it just triggered toll payments, you're drastically underestimating the government's desire for data.

Back in 2013, Mike covered one NYC driver's experience with his E-ZPass device, finding it was triggered all over the city -- not just on toll roads. The company claimed the signal was scrambled and travel data collected in aggregate. Whether or not that remains true is open for debate, but even the data collected where drivers are expecting data collection can be revealing. E-ZPass data has been used in divorce cases to prove a spouse's whereabouts as well as against a city official, who falsified time sheets.

It's also been used in political fights to disparage opponents. The IBTimes reports that two New Jersey government officials obtained Senator Frank Lautenberg's EZPass records and used them as political fodder in a battle over toll increases.

"Respectfully, Senator, you only started paying tolls recently," [Port Authority Deputy Chief Bill] Baroni said, according to a transcript of the exchange. "In fact, I have a copy of your free E-ZPass," he continued, holding up a physical copy of the toll pass Lautenberg had received as a benefit from his tenure as a Port Authority commissioner. "You took 284 trips for free in the last 2 years you had a pass."

Governor Chris Christie himself disclosed further information about Lautenberg's driving habits.

At a press conference, he alleged that the senator didn't "pay for parking at Port Authority facilities" and said Lautenberg went "through the tunnel to New York three or four times a week in 2005 and 2006."

I find it interesting, too, by the way, in 2005 and 2006, that he went over the Hudson River 284 times. Where was he going?... I think he needs to answer that. 'Cause he's supposed to be the senator from New Jersey. So what's he doing going over the bridge or through the tunnel to New York three or four times a week for 2005 and 2006?... Did he ever spend any time in New Jersey?

Obviously, this is an abuse of government-collected data. Bill Baroni admitted during the 2013 Bridgegate scandal investigation that he possessed driving data on those interrogating him. To add insult to injury, the governor's office claimed it had no records on Lautenberg's driving habits in response to IBTimes' 2012 open records request -- the same records he used to criticize Lautenberg in an earlier press conference.

The ACLU points out that not only is this a misuse of private records, but this sort of situation is completely avoidable.

EZ Pass and other electronic toll booth systems should have the option for anonymous use, where money on the devices is treated like cash, for users who prefer privacy to the convenience of having named accounts. A driver, in other words, should be able to buy a transponder for cash, and use cash to store and re-load value on it. The Washington DC Metro system, for example, offers this option for users of its contactless transit passes.

Obviously, whatever protections the state of New Jersey affords these data are inadequate. Sure, driving in public isn't necessarily private, but the use of travel data to attack political opponents is still an abuse of state-collected data. Supposedly, the data is exempt from public record laws, which locks citizens out of acquiring the data without a subpoena. But nothing's stopping the Port Authority from using it for its own political ends and passing it on to the governor to do the same.

Driving on public roads may not be private, but there's a lot that can be ascertained about a person simply by looking at this data -- information that could only otherwise be acquired by nonstop physical "tailing." When collected and stored, it runs the risk of being abused. The Port Authority already grants police open access to the records (limited only to "purposes of discharging their duties," whatever that actually means in practice) and has shown its willingness to puts its self-interest ahead of state law when it comes to disseminating this information. Better policies and practices are in order, and Governor Chris Christie should be waist deep in investigators (a belated call for a DOJ investigation of Christie and Baroni has been issued by NJ Congressman Frank Palone) rather than considering a 2016 presidential run.

Filed Under: bill baroni, chris christie, e-zpass, frank lautenberg, new jersey, politics, privacy, spying

NYC Tracking E-ZPass Tags All Over The City, Without Telling Drivers

from the big-brother-is-watching dept

New York, and many states in the northeast and midwest, use an RFID toll-paying solution called E-ZPass (the system works in multiple states -- but not all, which is why, for example, you can't use the E-ZPass on California's Fastrak system). Ever since E-ZPass came into existence, some have expressed concerns that the tags would be used for tracking, rather than just for more convenient and efficient toll-paying. And, in fact, the toll-paying records have been used in a variety of legal cases, from catching an official who falsified time sheets to being used as evidence in divorce cases. But all of those still involved using the records at the actual tolls, where everyone knows the tags are being read.

However, it turns out that New York City has had an ongoing program to surreptitiously scan the tags in a variety of places supposedly for monitoring traffic. Indeed, you could see how that sort of traffic information might be useful, though these days with many other forms of traffic monitoring systems out there, it's probably a lot less necessary than before. But this was only discovered because a hacker going by the name Puking Monkey (one assumes this was not his given name) got suspicious and hacked up an E-ZPass to light up and make a sound whenever it was read. Then he drove around Manhattan, and voila, the tag kept going off: As Kash Hill's article at Forbes notes, this has been going on for years, though, the various agencies involved have been rather quiet about it, and (perhaps most importantly) this type of usage does not appear to be disclosed in the terms and conditions for the E-ZPass. Oops.

The technology company that makes the devices insists that it's not being used for any surveillance:

“The tag ID is scrambled to make it anonymous. The scrambled ID is held in dynamic memory for several minutes to compare with other sightings from other readers strategically placed for the purpose of measuring travel times which are then averaged to develop an understanding of traffic conditions,” says TransCore spokesperson Barbara Catlin by email. “Travel times are used to estimate average speeds for general traveler information and performance metrics. Tag sightings (reads) age off the system after several minutes or after they are paired and are not stored because they are of no value. Hence the system cannot identify the tag user and does not keep any record of the tag sightings.”

Of course, even if that is true today, that doesn't mean it will always be true. We're already well aware of how the NYPD is known for the extreme lengths it will go in terms of surveillance, including the fact that it's set up its own intelligence division that many say rivals the intelligence operations of entire nations. Since the folks behind E-ZPass didn't seem to think it was necessary to tell people that their devices would be used for traffic monitoring, how likely is it that anyone would be told if it was used for surveillance as well?

Filed Under: e-zpass, nyc, rfid, tolls, tracking, traffic