Articles: Go card privacy ..

[ozbob]

From the Brisbanetimes click here!

Police watching where you Go

Police watching where you Go
SEAN BAUMGART
July 29, 2010 - 3:00AM

Police are tracking commuters' movements on Brisbane public transport using their Go Card records.

Officers are using the technology to not only pinpoint the movements of criminal suspects but also potential witnesses.

One woman has told brisbanetimes.com.au she was contacted last month as part of a murder probe after police tracked her down via her Go Card, which is registered with her details by TransLink.

Police confirmed Go Card records had been used as part of an investigation into a New Farm murder last month.

The woman, who wished to remain anonymous, said she felt rattled when called by a detective seeking information on a bus trip she'd taken in New Farm three weeks earlier.

Her unease grew when the officer also revealed the name of her partner.

"He was saying, 'You were travelling on a certain bus on a certain day at a certain time'," she said.

"And I said, 'That could be my partner [using my Go Card]. And he said, 'Would that be ...', and then gave his name. And I thought, 'Oh sh%t'."

The woman said she had little recollection of the trip and genuinely couldn't help the officer.

Police and TransLink have both confirmed the practice but remain tight-lipped about the frequency and circumstances of such requests.

A TransLink spokesman said police sought Go Card records "less than a handful of times a week" under an exemption to the Information Privacy Act 2009 (Chapter 29).

"Requests must be made in writing and the information provided can be used in court," a Translink spokesman said in a statement.

"This is the same procedure that police and other law enforcement agencies follow to gain credit card or banking information, driver's licence data or any other detail which may help confirm a person's identity or movements."

The records often relate to missing persons or stolen cards and a warrant is needed if the record is to be used in court.

But the practice of tracking people's movements without their consent has raised the ire of civil libertarians.

The pre-paid Go Cards have been in use on Brisbane trains, buses and ferries since February 2008 and allow faster access to the transit system, with commuters touching the cards on a pad as they enter and exit the service.

While it is not necessary to register the cards, many commuters choose to in case the card is lost or stolen.

Australian Council for Civil Liberties president Terry O'Gorman said he was not surprised to find police were accessing Go Card records as part of investigations.

"We warned when the Go Cards were introduced that the electronic records could be used for various forms of surveillance and we were pooh-poohed and told that we were being unnecessarily concerned," he said.

"This shows that our concerns are justified.

"In the light of this I'd urge people who are concerned about their privacy to take the de-identification route so that agents of the state can't willy-nilly access information on their travel patterns."

Mr O'Gorman said he had a Go Card but was unsure if it was registered to his name.

"My wife got it, but I'll soon be de-identifying it now," he said.

Investigators have long used bank and phone records to track people's movements and Bond University criminology expert Professor Paul Wilson said police were quick to exploit new avenues of investigation.

"I think they are very quick to use new technology as a detection tool," he said. "That can be seen by them being able to trace mobile phone signals easily to where people are at particular times and that's been used for years.

"This is just another variation of the use of digital technology like Go Cards. I suppose it does raise the big question of how far society is prepared to go to allow authorities to follow them in the interest of solving crime or public security.

"I suppose the answer to that is, they are allowed to go very far."

The Queensland Police Service said it adheres to strict legal requirements when accessing information from organisations like Translink.

"Strict regulations, including legislative requirements, memorandums of understanding and operating guidelines are in place, both within the QPS and within external agencies, to monitor and regulate these processes," they said in a statement.

But Professor Wilson said current regulations could give individuals limited protection and as technology evolved, privacy would deteriorate further.

"I think the trend is disturbing," he said. "I don't think people realise with not only cell phone and technology that tracks things like Go Cards, but also CCTV, how little privacy is respected in modern society and I think that's a great pity."

Mr O'Gorman said Go Cards made life easier for users, but many didn't realise at what cost.

"I don't think people knowingly trade privacy for convenience," he said.

"The increased convenience of mobile phones, the increased convenience of Go Cards, the increased convenience of iPad use - people focus almost exclusively on the convenience and don't give a moment's thought to how the electronic track provides a ready bank of electronic information that the police can readily access."

[ozbob]

From the Brisbanetimes click here!

How I became a passenger of interest

How I became a passenger of interest
SEAN BAUMGART
July 29, 2010 - 5:13AM

When Kathy's phone rang last month, she had no idea she was about to become involved in a murder investigation.

As alarming as that was, what struck home for ''Kathy'' (not her real name) was how police came to find her in the first place.

About three weeks earlier, she had caught a bus in New Farm. As usual, she used her Go Card to pay the fare and in doing so unwittingly left an electronic trail.

It was a trail detectives probing a New Farm murder picked up when they obtained Go Card records from TransLink in the hope someone on the bus could help their investigation.

"He pretty much opened with 'was it OK to talk at the moment' and I said, 'I'm on a bus' and he said, 'That's a coincidence because that's why I'm calling'," Kathy told brisbanetimes.com.au.

"He said, 'I'm investigating a murder. Do you remember anything about your bus trip on [date and time]?'"

The woman said she remembered little of the trip and was unable to assist the detective.

Australian Council for Civil Liberties president Terry O'Gorman recommended people concerned about their privacy make sure their names are not registered to their Go Cards.

He said he would ensure his details were not attached to his own card.

However, Kathy said she saw no need to remove her details from her card.

"I'm not going to be committing any untoward acts," she said.

"I don't necessarily mind, I just thought it was an interesting experience and one that hasn't been properly discussed.

"I never considered that my behaviour might be attractive to police."

While shocked at the ability of the police to track her movements, she conceded Go Card records helped police do their jobs.

"It's part of an increasing problem where the information we have is collected by so many different sources and the use of that is unregulated.

"It could have been quite helpful had we recalled something about the incident, and I can see the public benefit of that, but, you know, I'm sitting on a bus, I'm not taking in the world, I'm just going by.

"That is part of the double-edged sword of the Privacy Act. It can be both a hindrance and a help."

Kathy said she was mindful of the erosion of people's right to privacy across the community.

"I also oppose the idea of e-tracking for medical records because I regard my body to be private property," she said.

"I appreciate the need to disclose pertinent information to practitioners in context. I don't expect my history to potentially prejudice the way that I am treated. I do have some particularly strong views about it."

[ozbob]

Earlier thread on these issues --> http://railbotforum.org/mbs/index.php?topic=3267.0

[Derwan]

Given that this is a murder investigation, I think it's fair enough.  I wouldn't mind being contacted by police if there was any chance that I could assist in putting a murderer behind bars.

It's not as if police are tracking everyone's movements.  They would have made a specific enquiry about buses departing a certain bus stop during a particular time period to see if anyone waiting at the bus stop may have seen or heard anything.  They probably didn't even have the destination of the traveller!

Once they have a name and address, it wouldn't be hard to check licence records to see who else lives at that address, which is why they knew the name of the lady's partner.

People appear to have this false expectation of "privacy".  If you want privacy, go live on a deserted island.

[ozbob]

Police tracking Go Card movement

612 ABC Brisbane Spencer Howson Interview with TransLink's Andrew Berkman

Click here!

[ozbob]

If someone is overly concerned they can chose not to register their go card (and miss out on the benefits).  They had also better stop using mobile phones, stop driving a car if they do, don't do any electronic banking tools and probably would be wise to give the internet the flick as well.  Walking around the CBD, travelling on public transport and visiting major shopping centres is also out.

The reality is we are constantly monitored, not directly generally but indirectly so that should there be a reason  such as a missing person investigation, serious crimes and the like, time might be saved in sorting an urgent issue and investigations might be facilitated.

I don't have any concerns, but others might. But they have their choices.

[ozbob]

From the Courier Mail click here!

Privacy worries as police confirm they track commuters via their Go Card use

Privacy worries as police confirm they track commuters via their Go Card use

    * James O'Loan
    * From: The Courier-Mail
    * July 29, 2010 9:14AM

The issue has raised privacy concerns from the Queensland Council of Civil Liberties, which has claimed Queenslanders are "sleepwalking into a surveillance society".

But the flip side is that authorities are solving crimes by accessing the records - even Translink staff.

Indooroopilly father Bill Gemmell said his $5000 Macbook Pro notebook was saved at Roma St train station when thieves came unstuck using his wife's Go Card.

"They were heading back to the Gold Coast with out loot," he said.

"The guys there (working at Roma St station) knew straight away the guy using my wife's card wasn't my wife."

"I got my Macbook back."

Queensland Police do not have to go to court to access registered Go Card user information.

They can access it through an exemption of the Privacy Act 2009 (clause 29).

There are currently over 1 million Go Cards in circulation across southeast Queensland.

"We believe about 750,000 of these are active," said Mr Berkman.

Despite privacy concerns, Mr Berkman encouraged users to register their Go Cards so the balance remains intact if the card is stolen.

He said police were granted access to records via the act for the same reasons they were granted access to bank details and mobile phone records.

Police have confirmed the use of Go Card trip information for criminal investigations.

"The Queensland Police Service (uses) a variety of investigative strategies and tools when investigating offences,'' police said in a statement.

"Some of these can include liaison and cooperation with external agencies and bodies, including the collection of personal information.

"Strict regulations, including legislative requirements ... are in place ... to monitor and regulate these processes.''

[ozbob]

612 ABC Brisbane Interview with Madonna King and Chief Superintendent Mike Condon and civil libertarian Terry O'Gorman

Is your Go card being used to track your movements?

Click here!

Is your Go card being used to track your movements?

29 July 2010 , 11:27 AM by Amanda Dell

Police are requesting the details of Go card usage from Translink in order to investigate crimes.

Madonna spoke to Chief Superintendent Mike Condon and civil libertarian Terry O'Gorman.

[ozbob]

Brisbanetimes --> Police defend access to Go Card data

[p858snake]

If someone is overly concerned they can chose not to register their go card (and miss out on the benefits).  They had also better stop using mobile phones, stop driving a car if they do, don't do any electronic banking tools and probably would be wise to give the internet the flick as well.  Walking around the CBD, travelling on public transport and visiting major shopping centres is also out.

I think i should point out that they need to subpoena those records where as with a gocard they don't, which is why people are are considered, They just need to submit a written letter to Translink, Although they are not required to hand them over there is nothing stopping the police from pressuring them.

[Derwan]

I think i should point out that they need to subpoena those records where as with a gocard they don't.

Say what?  Don't you mean a court order?  What exactly DO they need a court order for and what can they apply for as part of investigations?

I think you'll find court orders are only required for things like phone tapping.  I believe phone records, bank account details and CCTV would all fall into the same category as Go Cards information.  But I'm no legal expert.

[Derwan]

They had a TransLink spokesperson on the news tonight indicating that the information on the website and application stuff informed people that details could be released to law enforcement officers.  So I had a look at their Privacy Statement.

They have some standard details used in many privacy policies such as:

Personal information collected by TransLink generally comprises name, address, date of birth, gender, contact details (such as phone, fax and email), certain financial information (such as credit card details or bank account details) and information relevant to concession fares (such as student or pension details).

and

Disclosure of personal information

In order to perform our functions and activities, we may be required to disclose your personal information to third parties, such as:

...
    * Other organisations such as law enforcement agencies which we may be required to disclose information to as required by law.

What they don't specifically indicate is that trip information is also part of the personal information that is collected with every day use of the Go Card and that it may be used by law enforcement officers.  Perhaps it would be prudent to add this level of specificity.

I dare say that it'd be the same for any kind of electronic card:

• Murder in a Library:  Who used their library card around that time?
• Murder in a secure building:  Who used their building access card around that time?

Police will use any means possible to solve a crime - and so they should.  I think what worries people about Go Card trips is the idea of their movements being tracked - which of course is not happening.  But there's no convincing some people.

[p858snake]

I think i should point out that they need to subpoena those records where as with a gocard they don't.

Say what?  Don't you mean a court order?  What exactly DO they need a court order for and what can they apply for as part of investigations?

I think you'll find court orders are only required for things like phone tapping.  I believe phone records, bank account details and CCTV would all fall into the same category as Go Cards information.  But I'm no legal expert.

Anything that isn't exempt under the privacy act (theres a link to it in the brisbane times article) or that the owner/holder of the data refuses to turn over on the voluntary basis (that doesn't break the required privacy laws) needs to go via the court system, If they don't and get it illegally the information can be suppressed and found inadmissible (can't be used against the person) in the court proceedings.

[Derwan]

Anything that isn't exempt under the privacy act

The exemption referred to is the fact that the police and other law enforcement agencies have an exemption to the act (i.e. they're allowed to obtain personal details stored by organisations).

[somebody]

Never knew that police could request such info without a court order!  Is it the same in other states?  I would say that the owner of the data should be the person who the data is on.  TL are just the custodians.

[Golliwog]

I disagree slightly Derwan. Their movements ARE being tracked, but there's no one sitting there watching everyone going "ooohhhhhh, Joe Blow just caught a train to Bowen Hill! Lets see what he does next!" But yes perhaps it may be prudent to mention somewhere that trip information is collected, but not used (by Translink anyway) on a individual basis, just to get travel patterns of the population as a whole.

somebody: Translink may just be the custodians, but p858snake said owner OR holder so I think that means its acceptable.

[ozbob]

Media Release 30 July 2010

SEQ:  The great go card beat up

RAIL Back On Track (http://backontrack.org) a web based community support group for rail and public transport and an advocate for public transport commuters has said the over top reaction to an old issue, the fact that a go card travel history can be accessed by law enforcement agencies is a non event.

Robert Dow, Spokesman for RAIL Back On Track said:

"Conditions of use of the go card clearly indicate that TransLink may be required to disclose personal information to third parties, such as such as law enforcement agencies (1)."

"The hysterical reaction to an old issue just highlights why people need to assume some responsibility for their actions and before they commit to anything actually be informed and take the time to note the conditions of use, not only for a go card but any financial transaction."

"To further highlight the absurd nature of the beat up, go card users do have a rather simple choice to register or not register the card.  A non registered go card can not be associated with an individual. If someone is overly concerned they can chose not to register their go card.  They had also better stop using mobile phones, stop driving a car if they do, don't use any electronic banking tools and probably would be wise to give the internet the flick as well.  Walking around the CBD, travelling on public transport and visiting major shopping centres and sporting venues is also out."

"The reality is as a community we are constantly monitored, not directly generally but indirectly so that should there be a reason such as a missing person investigation, serious crimes and the like, time might be saved in sorting an urgent issue and investigations might be facilitated."

"To clarify any doubt in users' minds the TransLink privacy policy should be updated to spell out personal information includes a travel history."

Reference:

1.  http://www.translink.com.au/privacy.php

Contact:

Robert Dow
Administration
admin@backontrack.org

[ozbob]

Brisbanetimes --> TransLink 'should promote anonymous option'

[ozbob]

Brisbanetimes --> Privacy Commissioner launches Go Card review

... "TransLink welcomes the chance to meet with the privacy commissioner and provide her all the information she needs," he said in a statement.

"TransLink has always and will continue to comply with the relevant privacy laws and looks forward to working with the Office of the Information Commissioner to ensure the highest standards of customer privacy needs are maintained." ...

[Golliwog]

Ughhh. Really? I mean, REALLY?

[Derwan]

Watch out.  The media has got a taste of blood now:  Police catch up with thieves on motorways

Police request images from cameras on the Gateway and Logan motorways up to 200 times a year, according to Queensland Motorways.

I don't know if this report is a good or bad thing.  It points out that obtaining details from various systems is normal -  but it may only serve to make the paranoid people worse!

[Golliwog]

I don't get it. Yeah I get that MAYBE all these cameras and tracking go cards COULD be used incorrectly by the police but the amount of data and stuff they would have to trawl and the number of people and organisations they would have to deal with would set off some red flags with those people.

A slight side point, we have nowhere near as many cameras as they have in London. You can seriously make an easy game out of seeing who can spot the most cameras first. I stopped after going a block and had seem roughly a dozen, and there weren't even any shop fronts on that block.

[#Metro]

I think it is un-necessary to record conversations with the TransLink journey planner computer.
Why does it need to record every conversation? Why does it waste so much time on the privacy notice at the start when you could have "privacy notice press 1" or if you don't want to be recorded press 2.

Ring 13 12 30 if you don't know what I'm talking about.

[Golliwog]

so they can analyse the service and try and fix things if they go wrong. Also, same as a lot of call centers, so they can prove what was said if the customer later complains that they were given incorrect information etc.

[#Metro]

so they can analyse the service and try and fix things if they go wrong. Also, same as a lot of call centers, so they can prove what was said if the customer later complains that they were given incorrect information etc.

What, conversations between a customer and the automatic journey planner computer? Why do they need this?
Does it record your phone number too, even if it is silent?

The TL website does not record each individual click and destinations to from (or does it?) so I don't really see why the conversation needs to be recorded, with the exception being GoCard accounts.

[Golliwog]

To make sure that its giving you the correct information and it's understanding the voices of whoever is using it. And again, so that if someone catches the wrong bus and whatever and they ring to complain to Translink demanding compensation saying that their journey planner directed them to catch the wrong bus/train/whatever then Translink can check up on that. Its unlikely to actually be needed but it could happen.

As for phone number, it would record it, but theres no way to record the number if you have you're number set to private.

[#Metro]

To make sure that its giving you the correct information and it's understanding the voices of whoever is using it. And again, so that if someone catches the wrong bus and whatever and they ring to complain to Translink demanding compensation saying that their journey planner directed them to catch the wrong bus/train/whatever then Translink can check up on that.

So someone is listening to these voice recordings with the computer? I'm sure the call centre gets thousands of calls per day, if I ring up and say "The TL journey planner lied to me, bring up my voice recording" how would they know and would they even bother?

TL never gives compensation, not even for late trains.

[longboi]

How can people not know these things 

They aren't out to get your average commuter so whats the issue?

[WTN]

I think it is the fear that police will do something nasty to the average commuter that scares people. With the bad reputation police sometimes get these days (whether from the media or word of mouth), its no wonder why people are scared of information misuse.

The possibility that you could be told that you were on a bus/train with a violent criminal would scare a few too, like the Brisbane Times example.

Contrast this with the huge volumes of confidential information held by government. The public doesn't go paranoid over this because public officials aren't known for information misuse. It does happen, but it is rare.

[Golliwog]

To make sure that its giving you the correct information and it's understanding the voices of whoever is using it. And again, so that if someone catches the wrong bus and whatever and they ring to complain to Translink demanding compensation saying that their journey planner directed them to catch the wrong bus/train/whatever then Translink can check up on that.

So someone is listening to these voice recordings with the computer? I'm sure the call centre gets thousands of calls per day, if I ring up and say "The TL journey planner lied to me, bring up my voice recording" how would they know and would they even bother?

TL never gives compensation, not even for late trains.

I don't know about how many they listen to or even if they actually do, but it leaves the oportunity open so that if need be they can. And if you called up like that they would ask what phone number you called from and they can get a list of when that number has called. If you called from a private number I'm not sure but you would probably be asked what time you called and they MAY be able to track you down with that, depends on how serious the complaint is as to how much effort they put it. They may not give compensation but I can guarantee they would at least want to check if the complaint was true or not and if it is stop it from happening in future.

It's the same with pretty much any call centre, and not just the government ones either.

[longboi]

I think it is the fear that police will do something nasty to the average commuter that scares people. With the bad reputation police sometimes get these days (whether from the media or word of mouth), its no wonder why people are scared of information misuse.

Yes because Police are out to get everyone aren't they 

[WTN]

Bad cops that give police a bad name might do that. Good cops won't. Targeting the innocent speaks volumes.

[longboi]

Bad cops that give police a bad name might do that. Good cops won't. Targeting the innocent speaks volumes.

Crooked cops (assuming there is some) don't stalk random people via their go card usage data, they have much more lucrative criminal activitives to be involved with.

[WTN]

Bad cops that give police a bad name might do that. Good cops won't. Targeting the innocent speaks volumes.

Crooked cops (assuming there is some) don't stalk random people via their go card usage data, they have much more lucrative criminal activitives to be involved with.

Good point.

[ozbob]

Brisbanetimes --> Don't cut us out: top cop

[YoYo]

I like the fact that discussion has occurred about goCard privacy in recent times. If someone chooses to register their card, then they should be told *exactly* what their data is used for, and have the option to have an unregistered card instead. If they choose to not register their card, then there should be no personal details kept about the card (except in aggregate means for Transport planning).

While I agree with many points made on the topic (including from ozbob) - Especially things like other tracking methods available (ATM/Credit Card transactions, Mobile phone records, cameras on the street, toll records etc), and the lack of disclosure/privacy there, I still think that goCard privacy is important.

So, why is it that Translink requires you to provide a name and phone number when you report an incorrect "penalty fare" transaction on an unregistered goCard and request it to be fixed? Their privacy policy has nothing in it that indicates that they should be requiring this information - and knowing how things work, it is kept long term in their records (as a help desk type call record).

[ozbob]

Welcome YoYo, thanks for your comments.  Yes, perhaps it would have been best if the type of confidential information that can be released (not only for go card but anything else is spelt out).  We said this in a media release on the 24th '"To clarify any doubt in users' minds the TransLink privacy policy should be updated to spell out personal information includes a travel history."

As I have said elsewhere, the issue may well dissuade users from registering their go cards, and so limiting the utility.  I think this is not a good outcome.

Re

So, why is it that Translink requires you to provide a name and phone number when you report an incorrect "penalty fare" transaction on an unregistered goCard and request it to be fixed?

Will ask TransLink why at the next opportunity, but my guess is for audit purposes.  All government funds need to be auditable?

[Derwan]

I would've thought it'd be so they can contact you for further information or if the refund request was unsuccessful.

[YoYo]

I would've thought it'd be so they can contact you for further information or if the refund request was unsuccessful.

While I understand that, their privacy policy does not state that. Besides, this information is likely to be held long term in a help desk program or similar call logging system. This from what I understand is NOT spelt out in their privacy policy as they claim to not retain any identifying information (bar credit/debit card financial records) from unregistered goCards.

A person logging an issue should have the ability to not provide details if they wish.

I'm tempted to do a claim using an unregistered card, and then do a Right-To-Information request to prove my point... Translink are not exempt from following their privacy policy, and if it's not spelt out in the privacy policy, then what else are they missing?

[ozbob]

From the Brisbanetimes click here!

Go Card privacy probe due

Go Card privacy probe due
Daniel Hurst
November 23, 2010 - 5:40AM

Police are set to face changes to the way they access commuter travel records following an investigation by the Privacy Commissioner.

Privacy Commissioner Linda Matthews will today hand the parliamentary speaker a report outlining her findings on the use of Go Card journey data in criminal investigations.

The probe was triggered by a brisbanetimes.com.au report in July revealing police were using Go Cards to pinpoint the movements of not only suspects but also potential witnesses.

Police can apply to Translink for information about the passenger journeys of Go Cards whose owners have registered their details, under an exemption to privacy laws.

In July, police confirmed 46 such applications had been made but sought to allay public concerns over privacy.

Police yesterday were unable to say if any more applications had been made since then.

The Privacy Commissioner's report, understood to contain recommendations to improve the application procedures, is expected to be tabled in the Legislative Assembly today.

Opposition transport spokeswoman Fiona Simpson said last night everyone understood the need to catch criminals, but privacy concerns also existed.

Ms Simpson said authorities should be upfront with commuters about the potential use of their Go Card data.

"It may help police with enquiries but there need to be checks and balances so it's not abused," she said.

Before launching her investigation, Ms Matthews told brisbanetimes.com.au she believed in "maximum disclosure".

At the time, she said commuters should be clearly told about how they could remain anonymous by not registering their smartcards.

The Go Card review was conducted under section 135 of the Information Privacy Act 2009, which allows the findings to be reported to the Queensland Parliament.

It was expected to examine whether Translink and the Queensland Police Service acted in accordance with legal requirements on each of the 46 reported occasions Go Card data was sought.

Both the Queensland Police Service and Translink promised to co-operate with the investigation.

But Police Commissioner Bob Atkinson said the service would argue its case for continued access to commuter records, saying the use of data was in the public interest as it helped with criminal investigations.

Translink's newly redesigned website, at the top of its page on Go Card registration, says that the public transport body "works with the Information Commissioner to ensure we meet the highest standards of customer privacy".