Surveillance

Yes, Toll Booth Scan Devices Can Be and Are Scanned Elsewhere

The New York Civil Liberties Union Maps All the Other Places Your Tool Booth Pass is Being Read.

|

Way back in 2003, in a more innocent time, I wrote a long cover feature for Reason which spitballs a bit about the dangers of a fully electronically surveilled society, in the context of tech millionaire John Gilmore's by now oh-so-quaint failed fight to be able to get on a plane without showing ID because of government demand. The next year, Declan McCullagh wrote a famous cover story called "Database Nation" taking a measured look at the advantages of a world where all sorts of data was collated and saved about us in all sorts of places.

Flickr/VA DOT

It's always nice, though, to at least know where and when we are having data on us collected via the magic devices of the world of tomorrow, today!

A recent report from the New York Civil Liberties Union reveals some things about the use of E-ZPass toll scanners in that state that most people probably didn't know, even if they might have darkly suspected.

How the NYCLU found out:

In late 2013, NYCLU staff went on a car ride with a privacy activist who designed a cow-shaped device that mooed every time it detected signals on the same frequency that E-ZPass readers use. We listened as the cow mooed its way through Midtown and Lower Manhattan — though we weren't at any toll plazas, something was reading the E-ZPass tag in our car.

This prompted us to file New York Freedom of Information Law (FOIL) requests to find out why E-ZPass readers had been installed far from any toll booths for some purpose unrelated to their intended use, and what privacy protections, if any, were in place. Earlier this week, the NYCLUreleased the result of that investigation (part of a new webpage that hosts records obtained through FOIL requests on how government agencies are collect information on New Yorkers).

The full article will tell you, with a map, all the non-toll-booth places your E-ZPass is being read in the Big Apple.

So, what's going on?

….both city and state transportation agencies have set up E-ZPass readers around the state as part of technology-based traffic management programs. Under a program called Midtown in Motion, for example, the city Department of Transportation initially installed 100 microwave sensors, 32 traffic video cameras and E-ZPass readers at 23 intersections to measure traffic volumes and congestion. By July 2014, that program had expanded to 149 E-ZPass readers around the city.

Outside of New York City, the State Department of Transportation in partnership with other entities has set up a similar traffic management program that scans E-ZPass tags on major transportation corridors, away from toll plazas.

The NYCLU would prefer public privacy policies in place to make sure this "traffic" data remains anonymous, and perhaps allows for opting out. But "the New York City Department of Transportation stated in response to the FOIL that it had no policies or training materials on storage, retention, destruction or use of the information collected from its E-ZPass readers."

In the NYCLU's perspective:

Toll booth transponders such as E-ZPass were created for one specific purpose: smoothing the flow of traffic at toll booths. We've already seen the technology abused for political purposes. The fact that they're now being repurposed to track cars around the streets of New York without adequate public notice is exactly the kind of mission creep that we always warn against with powerful tracking technologies.

I emailed yesterday with a private investigator pal about this, Emmanuelle Richard (who is also the wife of Reason editor-in-chief Matt Welch). While she didn't know anything about how and where this particular E-Zpass data was used, she was aware that some states do use such data for other purposes, or sell it to commercial database companies. License Plate Recognition is another source of state surveillance whose information does trickle out to the commercial markets for repo men and private eyes, as well as law enforcement of course.

Richard told me of areas where citizens might like a more intelligent use of license plate info with law enforcement where it could help the citizen, but where alas it does not. She points out that the cops have "tons of photos of our car to be able to fine us if it was parked illegaly, but when the car was stolen last year, the police took two weeks to report that the thieves had crossed several bridges to New Jersey and back. Of course, the thieves were never stopped, even though our license plate was scanned again and again! The police called me only when they found the carcass of the car…"

It is true, she says, that the government does "share and make money off our data without disclosing it and without giving us the option of opting out, but I guess that they assume that when driving, we have no expectation of privacy. From a professional perspective [as a private investigator], I find this data very useful to locate people and determine their activities." 

For those of us who might ever worry we'll be on the other side of a private investigation, or a public one, that's not super encouraging. But it is the world we live in: the electronic tracking of us is ubiquitous, and in many ways oh-so-convenient. People seem to love their tool booth reader thingamabobs. But as the NYCLU has discovered for us, they can be used for more than we bargained for when we put them in our car.

NEXT: Bernie Sanders is Running for President

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  1. The NYCLU would prefer public privacy policies in place to make sure this “traffic” data remains anonymous, and perhaps allows for opting out. But “the New York City Department of Transportation stated in response to the FOIL that it had no policies or training materials on storage, retention, destruction or use of the information collected from its E-ZPass readers.”

    I’m not sure what the answer is here.

    I think we’re kind of past the technological tipping point where all of these abilities exist, and we can’t expect the state to not use them.

    Creating byzantine laws, rules or policies for each new technology introduced demanding that this or that collection method remain anonymous or is non-retained is probably a non-starter.

    Your data is going to get into the system. It’s a seive. You can’t plug the holes– it’s going to drip through either intentionally or unintentionally.

    I think that a larger, more blanket rule needs to be put in place. Perhaps one that demands that government agencies show how and where they got your data- perhaps its source or collection point(s). Then we the public can decide (possibly through FOI requests) on a case-by-case whether the use is legitimate. This would accomplish two things. It would serve as a massive tie-their-hands approach to using the data against us. Also, it would force them to shine a light on every way data is collected about the public.

    1. Since we’re automating all this when can we start laying off cops by the hundreds?

      1. Don’t be ridiculous. If anything, we need to add cops to the roster. Look at all the new data they have to shift through. Think of all the crimes to punish.

    2. The problem is, Paul, is that they’ll just circumvent your blanket rule just like they do now (remember, they’re often already ignoring supposed rules and assurances about the data use even now). You’re very right that the info is going to get collected regardless, and attempting to make all kinds of byzantine and draconian rules about the use of it will result in another HIPAA situation.

      The only actual solution is vastly smaller government, one that doesn’t have the money or the resources to do this shit. But that horse left the barn ages ago. So the best next solution is technology that tries to provide privacy as best as possible.

      It’s a constant battle against the government. Just like we’re always battling bacteria that evolves to get around the latest antibiotics, we have to do the same with the government. Constantly.

      1. So the best next solution is technology that tries to provide privacy as best as possible.

        If this rule could be put in place and enforce, my hope would be that we could see every way data is collected, then protect ourselves against it. Realize that your EZ-pass or Good 2 Go pass gets scanned at every streetcorner? Dump it and pay cash at the toll bridge.

        I know it wouldn’t be perfect- and sure, as a law it would get broken like every other law the government breaks, but I think it might be a start.

        1. Except there is no toll booth, at least in Washington State. You pay the toll via Good to Go at std rates or they photograph your license plate and you pay by mail – and pay an additional 40% more in tolls since they want you to use Good to Go and let the State hold your cash in their bank accounts.

          1. I created a Good2Go account (with the minimum settings for them holding my money) because they’re going to film my license plate one way or the other. At least with the account I save a significant amount when I go over the 520 bridge.

            I mean, it’s obnoxious the way they do it, but there’s not device in your car that can track it. Other than the one the NSA plants in all of our buttocks while we sleep.

          2. Yeah, there’s a tollbooth on the narrows bridge. Go through it a couple times a month.

        2. I keep my transponder in one of those static bags that comes with every disk drive. As far as I know, it can’t be read until I pull it out just before I go through the toll booth.

        3. Good luck there Paul. Problem is that you would also need to dump your cellphone (or turn off bluetooth). In addition to the toll tag readers, cities also commonly install bluetooth readers. This is becoming more common because, currently, most vehicles tend to have a bluetooth device turned on. Some cities use a combination of the two. It is an effective way to determine average speed and travel time between different places. That info is then posted to the roadside signs.

          The systems don’t save identifying info (toll or bluetooth). But, if Big Brother decided to get creepier, they definitely could be made to save that info.

    3. I say make all such government-collected data public. Yes, let everyone see it. The biggest howls would be from Trump, Bloomberg, and especially people like the energy executives who met with Cheney lo so many years ago — remember that little embroglio?

      I’d really rather not have the government collecting it at all, but that genie’s aout of the bottle. The only alternative is to make it all public.

      Then anyone could track their stolen car, and more to the point, everyone would know it, instead of being able to cover their eyes like kids hiding under blankets from monsters.

    4. Perhaps one that demands that government agencies show how and where they got your data- perhaps its source or collection point(s).

      We’ve already seen examples of the government lying about where it gets data in criminal courts with the DEA using info from illegal searches to form parallel construction.

      This is one of the most troubling things highlighted by the Snowden documents, and the media/citizens barely noticed or cared.

  2. I emailed yesterday with a private investigator pal about this, Emmanuelle Richard (who is also the wife of Reason editor-in-chief Matt Welch).

    .

    Emmanuelle……sexy name….or sexiest name?

    1. She’s Emanuelle, baby! Emanuelle!

    2. “Manny”

    3. We need some pics.

    4. I’ll just leave this here.

      SFW, skip ahead to 3:00 if you are pressed for time.

  3. She points out that the cops have “tons of photos of our car to be able to fine us if it was parked illegaly, but when the car was stolen last year, the police took two weeks to report that the thieves had crossed several bridges to New Jersey and back.

    Governments respond to the same incentives the rest of us do.

    Busting you for parking illegally via a photograph is a revenue center. We’re absolutely going to be on top of that.

    Finding your stolen car is a cost center. We’ll get to it when we get to it.

    1. Stripped and burned-out hulks of cars are a nuisance. Car thieves? Dunno. We’ll let you know when we find one.

  4. This is precisely the reason I never bothered to get an EZPass. I knew they were doing this, and I was right. Because of course they do. How could anyone sane expect them not to?

  5. Obviously the solution is to require every, um, public official to continually post its precise location.

  6. Folks, how do you think self-driving cars are going to find their way to some destination? Do you think the state won’t bother keeping the data on where you traveled on X date?

  7. Privacy is a mere thing of the past. Both government and private entities are spying and watching everything.

    E-ZPass, for example offers convenience for you data.

    One can always stand on the long long long cash line if they don’t want big-brother watching you on E-ZPass. But still, they’ll take a photo of your plate.

    1. And here’s Alice to prove once more that ignorance is a specialty of the left:

      Alice Bowie|4.28.15 @ 8:29PM|#
      “Privacy is a mere thing of the past. Both government and private entities are spying and watching everything.”

      Alice, companies want info on me to offer to sell me something.
      Governments, OTOH, can SHOOT YOUR SORRY ASS over that data.
      Do you now see how stupid your false equivalence is, Alice?

      1. With the exception of you and other purist libertarians that will defend commerce as it were god, most people, regardless of the purpose of the data, want their privacy.

        And remember, government is owned and controlled by commerce. Commerce will use the government to “SHOOT OUR SORRY ASS over that data”.

        No difference.

        1. Huh, so you really are retarded.

  8. FYI, it’s pretty easy to make a Faraday cage, or even a simple metal box that will block access to the ez-pass scanner when you don’t want it being used.

    1. The ezpass actually comes in an antistatic bag which should be effective at blocking the signal when not in use. I can try to test that later this week actually.

  9. But tolls is how we gets the roadz!

  10. It appears the data is used collectively to promote traffic flow (bridge/tunnel lane openings, traffic lights, etc.) and not individually run against a database (hence stolen vehicle not noted). So, all in all, a good usage? Seems to be, if it works. And presumably they have analyzed whether it would be…

    1. So, all in all, a good usage?

      Maybe, for now…

      Seems to be, if it works. And presumably they have analyzed whether it would be…

      You have far, far more faith in government than I do.

    2. The information is primarily used for determining travel times. Your vehicle’s tag is detected at one location and then it is detected at another location a little later. The system divides distance by time to get your average speed from point A to point B. Does the same for lots of cars. Averages these and uses that info to post messages to roadway signs telling you that the average time from point a to point b is x minutes. It is very effective if the traffic through that area has a significant number of toll tags.

      In the applications that I am familiar with, it is not run against a database. The traffic system that does the speed/traveltime math doesn’t actually get identifying info about the tag. In other words, it doesn’t see that Serial Number 123456789 was detected. The detector generates a temporary token number (like 1234) which is sent to the traffic system. That token number will then be recycled and assigned to some other vehicle in a day or two.

      It is possible that the detector could store the data on cars that passed by. Generally, contracts require the collectors to flush that data after a few days.

  11. I always keep my EZ pass in an anti-static bag unless I am at the toll booth. I thought this prevented it from being scanned. Or am I just kidding myself?

Please to post comments

Comments are closed.