This three-part post hilights two (new) technologies that may have an invisible impact on (y)our privacy. The first part is about Wifi and Bluetooth tracking on railway stations in The Netherlands. The second part shows a new technique to perform (concert) ticket registration using ultrasonic sound. In the final part, I will give my insights on these techniques, potential impact on personal privacy, and measures to prevent or minimise that impact.

Wifi tracking on railway stations

In June 2017, the Dutch news outlet RTL Nieuws reported[RTLN] that the Dutch Railway (Nederlandse Spoorwegen, or NS in short)) tracks people on their stations with Wifi and Bluetooth trackers. The Dutch Railway published[NSnl] a news article stating they use Wifi and Bluetooth sensors, next to ‘counting sensors’ in the form of stereo camera’s, to gain insight in the movement of travellers on their railway stations. This data can be viewed in realtime by employees on the station. Those employees, then, can be instructed to help travellers on the platform. These metrics are also used for improving reachability and passenger throughput on railway stations (NS provides three examples on [NSnl]). Unfortunately, a background article[OVmag] on the methods used and their results this is only available through a paid subscription.

According to RTL Nieuws, NS collects the unique addresses of smartphones (MAC address) and saves them in an irreversible format (a hash; a mathematical operation such that given an output of that operation, one cannot feasibly determine its input). Next to that, NS makes sure that they cannot see whether you visited a train station on an earlier date. These hashes are saved for five (5) years and analyses (such as: “so many people walked from the train station to the city”) are saved indefinitely.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) has announced[APNS] they are going to “ask questions” about this method. As of now, AP has not yet published any results on their website.

Radar is another Dutch organisation that monitors consumers’ interests (in various aspects). They published a video item[RDR] on Wifi tracking in October 2017 that explains how Wifi tracking works and what data is collected.

In the next post, we will see a way to perform ticket registration with ultrasonic audio.

References