[00:01.120 --> 00:03.000]  Hi, good morning.
[00:03.560 --> 00:04.860]  So I'm Mariko Hirose.
[00:05.100 --> 00:16.160]  I'm a senior staff attorney at the New York Civil Liberties Union where I work on free speech, privacy, surveillance issues as well as criminal justice and other civil rights issues.
[00:16.560 --> 00:20.980]  So I am not Deborah or John, as we just established.
[00:21.700 --> 00:27.040]  And trust me, I am as disappointed as all of you are that I am not one of those people.
[00:27.960 --> 00:37.700]  I was really, initially, very excited to see this topic on the panel list for this conference.
[00:38.320 --> 00:56.640]  Our involvement in this issue has been when we, around the time we started seeing these Link NYC kiosks go up around the city, and we saw some news coverage of how exciting this is, I looked at the privacy policies that were up.
[00:57.040 --> 01:04.440]  and read them, and the privacy policy and the franchise agreement, and had some concerns.
[01:04.780 --> 01:11.000]  So I sent a letter to the city outlining our concerns and recommending changes.
[01:11.860 --> 01:20.980]  And our, you know, overall view was that it's great that the city is working on providing free Internet access to people.
[01:20.980 --> 01:24.400]  Internet access is a very valuable resource.
[01:24.680 --> 01:28.840]  There are too many people in this city who do not have access to that resource.
[01:29.180 --> 01:33.180]  And so we support the goal of providing free municipal Wi-Fi access.
[01:33.480 --> 01:37.240]  But the privacy policy has some problems.
[01:37.640 --> 01:43.280]  So I sent that letter, I believe it was in April or so, to the city.
[01:43.840 --> 01:55.480]  A couple of weeks ago, there was a great Village Voice article on this issue, where there was an anonymous city government official quoted saying that, I will not be receiving a response to that letter.
[01:55.720 --> 01:58.860]  So I guess that's, you know, that's where that went.
[02:00.920 --> 02:07.460]  But even though I was somewhat disappointed, because I thought I would learn a lot from this panel with the initial panelists.
[02:07.820 --> 02:10.780]  And I was disappointed when they asked me to be on it.
[02:10.900 --> 02:13.220]  And I was like, okay, I guess I'm not going to learn much more.
[02:13.220 --> 02:23.420]  But we're actually really lucky, because my co-panelist, Benjamin Dean, from Columbia, has been following this issue very closely.
[02:23.760 --> 02:32.220]  And he has prepared a really interesting, engaging discussion for us.
[02:32.320 --> 02:40.980]  And I think it will, you know, give us all a view of how LinkNYC came to be and what some of our concerns are.
[02:40.980 --> 02:43.340]  So I will turn it over to Benjamin now.
[02:51.700 --> 02:53.240]  Thank you very much, Mary Cohn.
[02:54.220 --> 02:58.560]  So I've retitled the talk today, not out of disrespect to John and Deborah.
[02:58.680 --> 03:01.100]  I, too, was very disappointed that they wouldn't be speaking.
[03:01.740 --> 03:21.220]  But ever since I started exploring the LinkNYC project, and it caught my attention maybe two years ago, it became apparent to me immediately that for what's billed as a public and free Wi-Fi service, it's striking because, as we know, when you're not paying,
[03:21.420 --> 03:23.780]  you're not the customer, you're the product.
[03:24.280 --> 03:28.220]  But also that this project has been largely privatized.
[03:28.520 --> 03:37.160]  So this free public Wi-Fi that isn't free or public is anomalous and interesting to explore just for that very reason.
[03:38.180 --> 03:43.440]  Just to introduce myself very quickly, I'm a fellow at Columbia University.
[03:43.440 --> 03:46.000]  I do research on the economics of information.
[03:46.360 --> 03:54.340]  I also have my own consulting company where I help my clients monitor waves of technological change and understand their consequences.
[03:55.320 --> 03:58.820]  So this project very early on caught my attention.
[03:58.820 --> 04:15.880]  And today I'm very much looking forward to taking you through what has been a journey for me in understanding the intricacies of city government and the way in which the next ten years, what's in corporate speak called smart cities, if we don't make changes now,
[04:16.280 --> 04:18.220]  is likely to proceed.
[04:19.540 --> 04:24.780]  So with some background, I imagine there are some of us from out of town or who have come internationally.
[04:24.780 --> 04:28.360]  I'll give you some quick background on the history of this project.
[04:28.880 --> 04:36.220]  In 2012, the city decided that it wanted to upgrade or replace its aging system of payphones.
[04:36.720 --> 04:42.900]  At the same time, the administration decided they wanted to provide Internet access to those who could not afford it.
[04:43.520 --> 04:50.100]  A request for information was put out in 2012 and subsequently a series of...
[04:51.240 --> 04:54.100]  well, a request for proposals is then put out.
[04:54.340 --> 04:56.400]  A series of design challenges are held.
[04:57.980 --> 05:03.320]  And from what I remember, it was dozens and dozens and dozens of proposals came in.
[05:03.960 --> 05:13.800]  Two years later though, the de Blasio administration announced that the winner of this competition were the two very companies that had the franchise over the payphone system previously.
[05:15.320 --> 05:18.520]  They had formed a consortium called City Bridge.
[05:18.900 --> 05:22.340]  City Bridge is kind of an amorphous entity, as you'll see.
[05:22.600 --> 05:23.880]  It's like a chameleon.
[05:24.420 --> 05:33.600]  At the time of the awarding, Titan and Control Group, the two companies that had the previous payphone franchise, were the two leads.
[05:33.920 --> 05:41.860]  And a company called Comark, which I believe manufactures the kiosks, and Qualcomm, which concerns itself with the wireless Internet access.
[05:42.720 --> 05:43.780]  They won this bid.
[05:46.480 --> 05:47.180]  Fair enough.
[05:47.500 --> 05:50.200]  There were some questions around the selection process.
[05:50.420 --> 05:53.980]  I'm not going to go into that today, but it's posted all over the Internet for those who are curious.
[05:54.480 --> 06:06.320]  The interesting part for me, and this is where my ears pricked up, was when Google announced something called Sidewalk Labs, and they named the former deputy mayor of New York City as the head of that company.
[06:06.320 --> 06:19.380]  Or anybody who's looked closely enough at public-private partnerships over the last few decades, will know that this is a classic play, bringing in city officials to lead projects that will be done on a public-private partnership basis.
[06:21.200 --> 06:29.280]  At the time, the question mark in my mind was, alright, that's very nice, Google, but what exactly are you going to do with this company?
[06:29.560 --> 06:37.040]  It wasn't apparent to me at the time what the business model might be, until the very first acquisition was LinkNYC.
[06:38.940 --> 06:47.000]  Sidewalk Labs purchased Titan and Control Group, which you might recall are the two companies that previously had the franchise for the phones.
[06:47.240 --> 06:50.560]  They merged them into a company called Intersection.
[06:51.420 --> 06:54.200]  Intersection is owned by Sidewalk Labs.
[06:54.500 --> 06:57.340]  Sidewalk Labs is owned by Google slash Alphabet.
[06:57.880 --> 07:04.180]  I feel a little bit like doing like the Panama Papers here, trying to trace all the corporate ownership and entities.
[07:05.220 --> 07:08.060]  So, Titan Group and Control Group are now Intersection.
[07:08.560 --> 07:10.400]  Comarch spins out their company.
[07:11.060 --> 07:13.500]  And so we end up with a new city bridge.
[07:15.400 --> 07:19.380]  Intersection, Civic Smartscapes, which is the spun-out company from Comarch.
[07:19.380 --> 07:22.440]  And Qualcomm is the only one who has not changed its face.
[07:23.340 --> 07:28.320]  The LinkNYC system, in short, is 10,000 links.
[07:28.600 --> 07:31.940]  These obelisks that you see sprouting up all across the city.
[07:32.400 --> 07:34.800]  Each one has three cameras built into it.
[07:35.020 --> 07:35.860]  Thirty sensors.
[07:36.320 --> 07:38.720]  And they run two Wi-Fi networks.
[07:38.940 --> 07:40.380]  One is called the public network.
[07:41.200 --> 07:43.160]  The other is called the private network.
[07:43.540 --> 07:46.640]  The private network has additional security features built into it.
[07:46.640 --> 07:53.480]  But as of right now, we're only available to those running iOS 7 or greater devices.
[07:54.940 --> 08:02.240]  Five hundred million dollars is expected to be generated in revenue, ad revenue, over the next 12 years.
[08:02.560 --> 08:13.840]  And the deal is that City Bridge is going to split this 50-50 with the city of New York.
[08:13.840 --> 08:16.520]  So, that's 250 million dollars.
[08:16.760 --> 08:18.080]  And this is...
[08:18.640 --> 08:26.360]  When they say, well, we got this for free, they don't like to play up that they're getting paid 250 million dollars to have allowed the project.
[08:26.680 --> 08:33.740]  But this is an important point in this entire deal that, towards the end of my talk, I'll go into greater detail on.
[08:34.660 --> 08:36.860]  So, here are the links, the obelisks.
[08:36.860 --> 08:39.580]  On the left is one in its domesticated one.
[08:39.660 --> 08:40.900]  On the right is one in the wild.
[08:41.660 --> 08:44.260]  This one sprouted up near where I live the other day.
[08:44.820 --> 08:47.900]  And there have been three more that have sprouted up over the last week.
[08:48.040 --> 08:49.700]  So, they're multiplying like rabbits.
[08:51.620 --> 08:55.340]  Let's delve into the data collection and privacy issues here.
[08:55.540 --> 09:00.320]  Now, I know that nobody reads the privacy policies on anything that they click I agree to.
[09:00.320 --> 09:12.900]  But, if you actually do click on them and you read it, you find out a remarkable amount of information about the potential privacy concerns that systems like this raise.
[09:15.020 --> 09:24.260]  So, the passive visitor who drops by and clicks on the security and privacy link on the NYC website will be confronted with this.
[09:24.260 --> 09:30.000]  In very simple language, we have created a user first privacy policy.
[09:30.380 --> 09:33.560]  And we will not sell any personal information.
[09:34.260 --> 09:35.980]  That seems to check out, right?
[09:36.280 --> 09:38.280]  No need to read the privacy policy now.
[09:38.680 --> 09:41.160]  You can just go and start using our free Wi-Fi.
[09:43.100 --> 09:47.520]  So, if you actually do click on the privacy policy, you're confronted with something.
[09:47.840 --> 09:50.640]  If this is user first, I don't know what user last is.
[09:50.640 --> 09:53.080]  But, there are two privacy policies.
[09:53.320 --> 09:55.420]  And it's very important that we differentiate them.
[09:55.580 --> 10:00.300]  Because only until very recently, even I was confused as to which one applies to the network.
[10:01.400 --> 10:12.720]  The one on the left, the LinkNYC franchise agreement, the CityBridge agreement, is the one between CityBridge and the city for the operation of the LinkNYC network.
[10:12.720 --> 10:21.860]  If you go to the LinkNYC website and you scroll to the bottom and click on privacy policy, you will end up with this one, effective of October 27.
[10:22.300 --> 10:24.920]  That applies to the LinkNYC website only.
[10:28.020 --> 10:29.200]  User first.
[10:30.880 --> 10:37.120]  So, today we're going to dissect the CityBridge privacy policy for the LinkNYC franchise.
[10:37.120 --> 10:42.480]  A lot of the language is very similar, given that it's so vague.
[10:42.780 --> 10:47.560]  But there are some additional items that you'll find in the CityBridge agreement that will catch our attention.
[10:48.000 --> 10:49.260]  A caveat first.
[10:50.420 --> 11:00.160]  Throughout this entire process, you know, they say, don't ascribe to malice anything that can be explained through incompetence.
[11:01.820 --> 11:07.680]  Throughout this process, I keep pinching myself and asking, are they out to get us?
[11:07.920 --> 11:11.460]  Or do they just not know what they're doing and they make it up as they go along?
[11:11.980 --> 11:18.840]  And when you go back to the privacy policy in November 4th, this is before Google Sidewalk Labs acquired them, to be fair.
[11:19.860 --> 11:25.740]  What you find is that the privacy policy is posted online with drafting edits left in there.
[11:25.740 --> 11:36.440]  So, the level of oversight of these privacy policies clearly was not up to the level that one might expect from an organisation that intends on handling all of our personal data.
[11:38.660 --> 11:44.260]  As it's revised and you look at the drafting, what you find is that items are appended.
[11:44.260 --> 11:56.060]  And I assume that what happens is, when there's media outcry and people get upset about the potential, like here, for facial recognition technology, somebody knocks on the lawyer's door and says, we need you to add a bullet point.
[11:56.280 --> 11:58.040]  Tell them that we're not going to do that.
[11:58.620 --> 12:04.280]  Now, if they had been more specific in what they're going to do and what they're not going to do in the wording, this might not be necessary.
[12:04.280 --> 12:09.360]  But unfortunately, all throughout this agreement, what you find is vague wording.
[12:09.360 --> 12:12.360]  So, what data may be collected?
[12:12.620 --> 12:14.140]  It's the operative word, may.
[12:15.060 --> 12:18.000]  I've highlighted some in red that might catch your attention.
[12:18.400 --> 12:21.820]  The MAC address and IP address, fairly self-explanatory.
[12:22.220 --> 12:36.380]  But then we start going to information about visits to websites we provide, including the full URL clickstream, URL requests, pages you viewed or searched for, page interaction information.
[12:36.960 --> 12:39.620]  This is all information that may be collected.
[12:40.000 --> 12:43.060]  It would be very nice to know what information is collected.
[12:43.580 --> 12:53.720]  Now, in anecdotal talks that I've had with people who are somewhat keyed into this process, they tell me that as of now, much of this information is not being collected.
[12:55.880 --> 13:02.080]  Well, if it's not being collected now, I would like to know when it will be collected and what it will be used for.
[13:03.060 --> 13:11.720]  You can't just write these... What I find amazing here is that somebody in the mayor's office has ticked off on this as they've gone along and said, nothing to see here.
[13:11.800 --> 13:13.260]  This privacy policy looks great.
[13:13.460 --> 13:20.200]  I mean, they're only going to look at the clickstream of people's activity and they're only going to look at the pages they viewed or searched for.
[13:20.420 --> 13:22.300]  There's nothing that could possibly go wrong there.
[13:22.300 --> 13:33.900]  So, at this point, just to make the point, there's a lot of sensitive information that may be collected here, at least within the terms that are provided.
[13:34.220 --> 13:36.720]  This should raise a lot of privacy alarm bells.
[13:37.540 --> 13:38.720]  Can I add something?
[13:39.040 --> 13:39.340]  Please.
[13:39.840 --> 13:40.040]  Hello?
[13:40.240 --> 13:40.780]  Is this working?
[13:41.640 --> 13:42.500]  Does this work?
[13:42.800 --> 13:43.000]  Okay.
[13:43.000 --> 13:57.920]  So, yeah, just to add to that point, so what the company has said is that currently they're only collecting all of these information from the people who are using the tablets that are on the kiosks.
[13:58.160 --> 14:04.160]  Currently, they're not collecting this if you're using your own device to connect to the network.
[14:04.460 --> 14:06.480]  And therefore, there is nothing to worry about.
[14:06.480 --> 14:16.520]  And, of course, it's that last piece that's concerning because, as Benjamin said, if that's not what they're doing, that's what the privacy policy should say.
[14:16.760 --> 14:24.640]  And it's really the privacy policy that obligates them to legally, as a legal matter, to follow what they're saying.
[14:24.640 --> 14:30.780]  They're not legally obligated to tell me or any of us the truth when they're responding to the media, right?
[14:30.780 --> 14:39.320]  And they're not legally obligated to tell us when their practices change if the privacy policy doesn't reflect what they're currently doing.
[14:42.300 --> 14:46.500]  So, given this data that may be collected, what might it be used for?
[14:47.700 --> 14:48.860]  CityBridge is quite clear.
[14:48.860 --> 14:51.840]  They're not going to sell personally identifiable information.
[14:52.360 --> 14:53.600]  This is a good thing.
[14:53.800 --> 14:56.900]  It's a very explicit term within the privacy policy.
[14:57.080 --> 14:59.940]  It tells us what they, in a binary, what they will or will not do.
[14:59.940 --> 15:05.600]  The term sell is the operative word, though, because they may share your information.
[15:07.140 --> 15:12.260]  And they may share it with a whole lot of people who might not like the information shared with.
[15:12.860 --> 15:14.880]  I've highlighted a couple of them here.
[15:15.440 --> 15:25.680]  Any third-party that acquires CityBridge, with anybody that's watched LinkedIn just be acquired by Microsoft, I left the network immediately because I don't want Microsoft taking that.
[15:27.000 --> 15:31.600]  This, in the future, will be very interesting because I don't see any terms in here around data retention.
[15:32.660 --> 15:40.100]  And I would be very concerned if somebody came along and bought this company and managed to take all the information that had been accrued over a decade plus.
[15:42.540 --> 15:43.180]  What is this?
[15:43.220 --> 15:47.260]  The third bullet point is around a third-party whom we must legally share information about you.
[15:47.260 --> 15:49.400]  We know who that's going to be.
[15:50.320 --> 16:04.200]  I would like somebody... I didn't highlight this, but you, upon your request, I urge you all to ask CityBridge for your information, because the weight of the room here might be a bit more successful than just us two continuing to pester them.
[16:04.840 --> 16:09.340]  Let's zoom in a little bit on this question around legally obligated.
[16:09.340 --> 16:10.700]  Go ahead.
[16:10.940 --> 16:13.180]  Jump in on the retention period point.
[16:13.880 --> 16:16.640]  So that was one of the concerns that we had raised.
[16:17.140 --> 16:27.740]  There is a sentence in there somewhere in the privacy policy that says, we will make reasonable efforts to delete your information 12 months after your last login.
[16:28.700 --> 16:36.640]  So if you think about that, if you actually use BlinkNYC and use it on a daily basis, that's essentially an indefinite retention policy.
[16:38.780 --> 16:42.200]  So looking at the governmental entities, we should all know now.
[16:42.520 --> 16:48.440]  I mean, after Snowden told us that large centralized repositories of data are...
[16:49.000 --> 16:52.440]  Government agencies go like moths to a light when those exist.
[16:52.980 --> 17:05.560]  Here, we've got any request from a governmental entity that will provide the personally identifiable information, and they'll take reasonable attempts to notify you of such a request, assuming that there's no gag orders put in place.
[17:05.560 --> 17:11.480]  But as we know with national security letters and various other legal devices, this is not guaranteed.
[17:14.100 --> 17:30.040]  They also may share non-personally identifiable information, and often that definition is vague, but apparently it will be with analytics or search engines, and I can't for the life of me work out which search engine might want this kind of information or have access to it.
[17:30.040 --> 17:34.460]  But interestingly, it's to advertisers and advertising networks as well.
[17:34.780 --> 17:40.880]  Now, a consistent line from CityBridge has been, we are not going to use any of the data we collect to target ads.
[17:41.860 --> 17:49.020]  Yet, if you read the policy, this is perfectly allowable within the terms that have been agreed between the city and the consortium.
[17:51.020 --> 17:53.420]  How are the data actually used?
[17:54.760 --> 18:02.520]  So we've got here around serving advertisements on websites, measuring or understanding the advertising.
[18:02.820 --> 18:07.560]  So again, it's well within their purview to start targeting ads towards people.
[18:07.560 --> 18:10.000]  I think this is a very interesting one.
[18:10.240 --> 18:21.880]  Because this talks about an opt-in or consent model, where they would be able to start collecting personally identifiable information to begin targeting information about goods or services that may interest you.
[18:22.700 --> 18:23.260]  Advertising.
[18:25.380 --> 18:27.220]  If you go into the...
[18:28.300 --> 18:34.280]  If you go back in the history, what you find is from the very beginning, Titan had this in their sites.
[18:35.720 --> 18:44.400]  They wrote in their original request for information, that as smart phone technology is refined and becomes available, we are going to have great opportunities to generate revenue from mobile commerce.
[18:45.060 --> 18:47.900]  Now, they mention a couple of ways in which they might do it.
[18:48.460 --> 18:49.840]  This was four years ago.
[18:50.080 --> 18:56.420]  So the technology has moved on a bit from NFC chips and geofencing and whatnot.
[18:56.700 --> 18:58.060]  But we have to keep this in mind.
[18:58.180 --> 19:01.060]  This has always been an intention of the system.
[19:01.540 --> 19:06.060]  And I've seen nothing so far to suggest to me that it is not the intention in the future.
[19:07.920 --> 19:12.000]  I mentioned briefly that there are cameras, sensors and beacons built into these.
[19:12.140 --> 19:14.440]  Here's the Cryptome take on it.
[19:14.680 --> 19:16.100]  And I think they're spot on.
[19:16.460 --> 19:20.940]  If you go and have a close look at these obelisks, what you find is there are three cameras.
[19:21.380 --> 19:29.720]  They're positioned above the two advertising panels, and then just in front of the little screen that you would use to make calls or whatnot.
[19:30.540 --> 19:46.680]  The big picture is that as this system spreads to other cities within the United States and internationally, if you take the number of obelisks built and you multiply it by three, and then you multiply it out across the cities, at least given these plans,
[19:46.900 --> 19:49.740]  1.7 million cameras are going to be installed.
[19:50.060 --> 19:52.720]  And the data feeds from them are going to be centralised.
[19:53.260 --> 19:55.080]  I would be very, very concerned.
[19:55.340 --> 19:58.500]  I'm already concerned at the amount of surveillance that occurs in this city.
[19:58.760 --> 20:03.540]  The fact that a lot of it is not centralised, it allows me to sleep a little bit at night.
[20:03.540 --> 20:08.000]  The idea that we're going to centralise all of this in the future worries me immensely.
[20:09.940 --> 20:11.860]  Information collected by sensors and cameras.
[20:12.540 --> 20:21.880]  So, there is going to be video footage taken, but we're not going to use it to anybody other than the city or governmental law enforcement.
[20:23.440 --> 20:34.000]  We're not going to use facial recognition technology, which is good to know, and I would like to see more definite phrasing like this, in terms of what they're going to do and what they're not going to do, in the future.
[20:35.100 --> 20:39.640]  The one that's on my mind is, instead of the video footage, it's the location data.
[20:39.940 --> 20:42.880]  Because any time you'll use a Wi-Fi network, it's going to ping your device.
[20:43.240 --> 20:47.400]  And they make it very clear that they do not collect information about your precise location.
[20:48.680 --> 20:52.360]  Yet, when you use the services, they can determine your general location.
[20:52.780 --> 21:00.360]  I'm not sure what the difference between those two are, but I would have thought if I'm within a one block radius of somewhere, that's close enough to concern me.
[21:00.920 --> 21:03.440]  There's another element that's not mentioned here, though.
[21:04.140 --> 21:05.840]  It's not mentioned in the privacy policy.
[21:06.040 --> 21:08.660]  But what it is mentioned in is the marketing material.
[21:09.040 --> 21:14.200]  And it's that each of these obelisks has got beacon technology built into it.
[21:14.680 --> 21:20.540]  The idea is going to be to ping your devices through Bluetooth beacon to provide advertising in the future.
[21:20.800 --> 21:22.600]  It will be based on location.
[21:23.420 --> 21:28.420]  I would think that given the third parties who might want to use this, it will be quite a precise location.
[21:29.340 --> 21:32.420]  I.e., if you're walking past a store and they would like to send you a deal.
[21:33.040 --> 21:38.420]  The reason I bring this up is simply to say, this is not covered precisely within the privacy agreement.
[21:38.620 --> 21:42.840]  So people are not able to make an informed decision about whether they want to use this or not.
[21:43.500 --> 21:45.640]  This is going to be a public Wi-Fi scheme.
[21:45.640 --> 21:50.900]  In the true sense of the word, need to inform the public about what this use implies.
[21:51.580 --> 21:54.220]  For the moment, I have not seen anything along those lines.
[21:55.360 --> 22:01.660]  Now, as someone with a background in economics and accounting, I start following the money when I want to know what's going on here.
[22:01.940 --> 22:15.560]  Because as far as I can see from the way in which this has been developed, at least the LinkNYC system is configured, there's an awful lot of data collection that apparently is not going to be used but has been put into the terms regardless.
[22:16.180 --> 22:22.660]  And I'd like to know why we went with a system, a public Wi-Fi system that involves so much data collection and tracking.
[22:23.520 --> 22:40.880]  I did some research on this earlier in the year and some back of the envelope math will tell you that if we have $500 million in total ad revenue, across 10,000 Links, 8 million people and 12 years, what you find is the monthly revenue per person is fractions of a cent.
[22:41.640 --> 22:42.920]  Why is this important?
[22:42.920 --> 22:53.280]  Well, if you want Wi-Fi across the city and you want to provide it to people who don't have Wi-Fi access, it would cost us pennies each to do so.
[22:54.160 --> 23:06.640]  Why have we gone with a system that involves so much tracking and involves putting up 10,000, 20,000 billboards across the city when it would cost so little for us to provide those very services publicly?
[23:07.660 --> 23:14.840]  You start digging into the business model, what you find is it's configured in a way that encourages governments to adopt the ad business model.
[23:15.240 --> 23:16.940]  This one is without ads.
[23:17.160 --> 23:23.580]  So if a city does not want ads, and I assume tracking, though I cannot be certain of that, they'll get the kiosks for free.
[23:23.760 --> 23:33.200]  But it will cost them $12,900 to install the obelisks, connect the optical fiber, you can double it, and then there's a fund for maintenance put on the side.
[23:33.200 --> 23:37.760]  On top of that, the city has to cover the annual operating costs.
[23:38.120 --> 23:43.000]  So one link will cost the city $45,000 per year under this business model.
[23:43.300 --> 23:46.160]  It's not something that cash-strapped governments want to do.
[23:46.340 --> 23:48.600]  So they go with the ad business model.
[23:48.940 --> 23:55.160]  That involves the kiosk being installed for free effectively and financed by CityBridge.
[23:55.500 --> 23:59.200]  I've listed sidewalk here, but we should probably broaden out a bit.
[23:59.200 --> 24:03.060]  And I'm not sure who covers the running costs under this business model.
[24:03.780 --> 24:13.540]  But the bottom line is that instead of spending $45,000 a year per link, the city gets revenue of $30,000 per year.
[24:13.760 --> 24:19.020]  So you can see why we've been sold this system that is so data-hungry.
[24:19.160 --> 24:22.000]  It's because the city wants to make some revenue on the side.
[24:22.880 --> 24:27.020]  So under this business model, CityBridge is picking up the bill.
[24:27.020 --> 24:28.980]  How much are they going to spend on this?
[24:29.640 --> 24:35.320]  Well, in Nick Pinto's excellent piece in The Village Voice, he gets the two excellent quotes.
[24:35.460 --> 24:36.160]  And here's one of them.
[24:36.800 --> 24:42.880]  The CityBridge spokesperson says that they're going to spend $30 million building and installing these Link NYC terminals.
[24:43.200 --> 24:43.400]  300.
[24:43.740 --> 24:43.940]  300, yes.
[24:44.540 --> 24:44.660]  Sorry.
[24:45.120 --> 24:45.440]  300.
[24:47.000 --> 24:50.340]  Doctorov, running the company, still expects to make a lot of money from this.
[24:50.980 --> 25:04.220]  Well, all you need is a napkin and a pen, because if you take the $500 million in revenue, you take out the CityBridge cut, $250 million, compare it with the upfront cost of installation, and they're making a $50 million loss.
[25:04.880 --> 25:07.920]  So there must be another revenue stream here.
[25:08.340 --> 25:17.500]  On face value, if Doctorov is going to make a lot of money, he surely must be going to make more revenues than he's spending simply on the installation of these things.
[25:18.200 --> 25:21.700]  And that brings me to the last quote in the end of my presentation.
[25:22.160 --> 25:29.780]  It's amazing to see the difference between what's put out through PR departments and what people actually say when they're in semi-private audiences.
[25:30.100 --> 25:32.160]  This is a quote from Nick Pinto's piece.
[25:32.840 --> 25:34.520]  And this is the bottom line.
[25:35.760 --> 25:49.820]  Doctorov says that by having access to all the browsing history of people using the Wi-Fi, anonymized and aggregated, we know how effective anonymization can be, over time they'll track them and provide ads through beacons and location services.
[25:50.420 --> 25:54.400]  What we're doing is replicating the digital experience in physical space.
[25:54.400 --> 26:09.600]  Now, we all know the repercussions over the last decade of the ad-based business model on the Internet, the effects that's had on privacy, and the effective capacity that's created for surveillance worldwide.
[26:10.920 --> 26:15.820]  The end game here is to expand that business model into meet space.
[26:16.220 --> 26:27.420]  The idea is to replicate it in the physical space to generate data, collect it, analyze it, package it, and sell it, or for a profit.
[26:28.500 --> 26:31.020]  I find this immensely concerning.
[26:31.220 --> 26:37.300]  I find it concerning that the city government is not looking out for the privacy interests of its citizens.
[26:37.560 --> 26:46.140]  It might be a quaint notion to think that elected officials might look out for the interests of their citizens, but it looks like they're more interested in getting the revenue.
[26:46.360 --> 26:48.580]  I'd also like to know where the revenue is going to go.
[26:49.840 --> 27:01.460]  I'm also immensely concerned about the expansion of this business model, which is a surveillance business model in practice, from where it's been already tested on the Internet, and we've seen the consequences of that.
[27:01.700 --> 27:05.340]  It is now being expanded to physical space in New York City right now.
[27:05.560 --> 27:10.060]  The next step is to take it to Barcelona or other cities in the United States.
[27:10.060 --> 27:13.960]  This is the next 10 years of what's called smart cities.
[27:14.220 --> 27:25.420]  If we don't make the right decisions now, we're going to have very grave consequences to face in 10 years, just as we're faced after 10 years of the surveillance business model on the Internet.
[27:26.080 --> 27:28.080]  I look very much forward to the discussion.
[27:28.360 --> 27:29.160]  Thank you for listening.
[27:43.580 --> 27:45.240]  So I will...
[27:45.240 --> 27:46.400]  Oh, I'm...
[27:46.400 --> 27:47.440]  I think...
[27:47.920 --> 27:48.620]  Go ahead.
[27:48.900 --> 27:49.180]  Okay.
[27:49.260 --> 27:57.620]  I'm going to talk a little bit about our letter and the concerns that we raised, and then we can take questions at the end and happy to have a discussion.
[27:58.400 --> 28:08.420]  So I mentioned at the beginning that the New York Civil Liberties Union sent a letter to the city when we first looked at the privacy policy.
[28:08.720 --> 28:12.340]  And there were three concerns that we raised in that letter.
[28:12.660 --> 28:16.960]  If you want to see the letter itself, it's on our website, nyclu.org.
[28:18.560 --> 28:24.860]  One was the collection and retention piece, which Benjamin talked about in detail.
[28:24.860 --> 28:34.180]  The privacy policy essentially allows the companies to collect everything and retain everything for an indefinite period of time.
[28:34.180 --> 28:38.020]  And we said that that needs to be... that language needs to be revised.
[28:38.020 --> 28:40.880]  It needs to be tied to operational needs.
[28:41.000 --> 28:49.120]  And the retention policy needs to have a specific date and a specific commitment to delete in certain circumstances.
[28:49.840 --> 28:57.340]  The second piece that we raised was the government access, the possibility of government access.
[28:58.040 --> 29:02.340]  So the privacy policy is itself...
[29:03.540 --> 29:09.040]  It says that it will respond to a government request for information when necessary.
[29:09.300 --> 29:32.900]  There's actually a separate franchise agreement that does say that it will be, you know, at least a subpoena, but that still raises a lot of questions about will it be a subpoena, will it be a warrant, what kind of order is required before government agencies can get access to the data that these companies are collecting.
[29:33.880 --> 29:44.060]  And then there's a question about whether the users will get notice when a government entity requests information from these companies.
[29:44.400 --> 29:51.520]  And that becomes really important because it's the notice piece that give users the right to stand up for their own rights.
[29:51.520 --> 30:01.920]  If they don't get notice that a government has requested this information, they'll never know, they won't be able to go into court to move to quash a subpoena or a warrant.
[30:02.880 --> 30:19.920]  So on that piece, on the notice piece, the privacy policy says, we will make reasonable efforts to notify you of government requests for information, if we can, essentially, if it's possible, to the extent it's possible.
[30:20.160 --> 30:32.680]  So we ask that that kind of vague language be revised, and to actually make a commitment to notify users whenever they can.
[30:32.680 --> 30:40.560]  notify users unless they are prohibited from doing so under a judicial order.
[30:41.260 --> 30:44.280]  So that's generally the framework in which it works.
[30:44.700 --> 30:58.360]  Law enforcement entities are not allowed to gag service providers from notifying their users of requests for information unless they've gotten an order from the judge saying that it's necessary to do so for a short period of time.
[30:58.360 --> 31:06.740]  So our recommendation was that you make a commitment to notify your users whenever you are allowed to do so.
[31:07.140 --> 31:12.640]  And the third piece that we had questions about was the cameras and the environmental sensors.
[31:13.320 --> 31:24.540]  So as you saw in the privacy policy, the policy currently says that those fees from the cameras can be shared with law enforcement and with the city.
[31:24.540 --> 31:26.640]  No restrictions on that.
[31:26.840 --> 31:34.000]  So we wanted to know if those fees were going to be aggregated into the domain awareness system.
[31:34.360 --> 31:43.780]  Which is the system that the NYPD has set up in place that aggregates fees from NYPD surveillance cameras, automatic license plate readers.
[31:44.800 --> 31:49.480]  They've now added shot spotter data, which is gun detection data.
[31:50.180 --> 32:00.720]  And we were concerned that all of these cameras that are going up are going to end up feeding into that system as well.
[32:01.500 --> 32:09.920]  And also the policy said that with the written permission of the city, we can share the camera feeds with any entity.
[32:09.920 --> 32:21.320]  So we said, well, you know, there should be a mechanism for the public to know when this company has gotten written permission from the city to share it with a third-party company.
[32:22.300 --> 32:27.920]  The response, as I mentioned, the city is not going to be responding to our letter apparently.
[32:27.920 --> 32:31.600]  But the company has responded in public statements.
[32:32.140 --> 32:37.220]  As I mentioned, on the collection and retention piece, they said, we're not doing this right now.
[32:38.120 --> 32:42.680]  And also on the cameras piece, they said, well, the cameras are not currently on.
[32:43.540 --> 32:48.480]  But of course, that really begs the question of when will they be turned on?
[32:48.480 --> 32:52.880]  Will we learn about it when it's turned on?
[32:53.080 --> 33:00.100]  And what will we learn about how those cameras, how all of this data is going to be used?
[33:00.300 --> 33:10.780]  And that goes back to the need to have a very much more specific privacy policy that actually reflects the reality of what they are doing.
[33:10.780 --> 33:16.020]  Because that binds them to be doing those things, right?
[33:16.140 --> 33:22.860]  It doesn't...they essentially have a privacy policy that says we can collect anything and do anything.
[33:23.620 --> 33:28.180]  And so that sets the outer boundary, legal boundaries of what they can do.
[33:28.380 --> 33:30.300]  And this is a very big problem.
[33:31.660 --> 33:35.280]  I just have one question.
[33:36.560 --> 33:41.880]  I'm very interested in the NYCLU's view on how...sorry, I'll start again.
[33:42.100 --> 34:02.780]  I'm very interested in the NYCLU's view on how, if this is a system that's designed to give those who do not have or cannot afford access to the Internet, access to the Internet, nominally for free, I'm very interested then in how that interplays with who is unequally impacted by surveillance in society.
[34:02.780 --> 34:07.320]  Yes, and that's exactly one of the points that we raised in the letter.
[34:07.700 --> 34:09.440]  That this is a great initiative.
[34:09.840 --> 34:14.720]  But it's even more important to have really good privacy policies in place.
[34:14.920 --> 34:21.020]  Because there are people who are going to be relying on this technology in order to access the Internet.
[34:22.060 --> 34:28.660]  And those are the people who are already subject to increased police surveillance.
[34:28.660 --> 34:36.820]  And so we need to have the policies in place to ensure that they can feel comfortable and confident using this service.
[34:37.360 --> 34:43.400]  And knowing that not all of their browsing data is going to be collected and retained indefinitely.
[34:43.740 --> 34:54.760]  And we can certainly imagine, if they are collecting and retaining all of this information, that there will be government requests for information from the NYPD or from any other entity.
[34:56.000 --> 34:59.720]  There's another element to this around security of the system.
[35:00.080 --> 35:07.760]  I don't have to tell this crowd that the perils of connecting yourself to public Wi-Fi, certainly if you don't use a VPN.
[35:08.420 --> 35:20.420]  To the credit of CityBridge, they have developed what is nominally a private Wi-Fi network, which is unfortunately only available to those who have iOS devices, iOS 7 or above.
[35:22.800 --> 35:31.740]  There are security concerns created by such a network, precisely for those who are most unlikely to have iOS devices.
[35:32.640 --> 35:37.300]  Now, this is kind of... this will evolve over time.
[35:37.620 --> 35:44.700]  And from what I've seen, the measures to prevent things like malware, the solution is to monitor the network at all times.
[35:47.480 --> 35:55.580]  The option is to suggest that people use VPNs whenever they use the public Wi-Fi network, because you can sniff the traffic.
[35:56.700 --> 36:03.060]  There's the chance that somebody might set up... or spoof the network and set up a fake one.
[36:03.260 --> 36:05.940]  I haven't seen any workable solutions around that.
[36:06.680 --> 36:10.320]  There are limits to what they can do, but free Wi-Fi is not all that great.
[36:10.320 --> 36:16.440]  It comes with security concerns and security costs that are not borne by the providers of the service.
[36:16.660 --> 36:18.520]  And it says that in the terms of service as with all.
[36:18.720 --> 36:19.720]  We have no liability.
[36:19.720 --> 36:22.160]  It's your own problem if bad things happen to you.
[36:22.720 --> 36:24.680]  But we need to remember that as well.
[36:24.900 --> 36:26.540]  The free Wi-Fi comes with a cost.
[36:26.720 --> 36:29.060]  And that cost is in terms of security very often.
[36:30.820 --> 36:37.660]  I want to go back to the point you made at the end of your presentation about other smart city initiatives.
[36:37.660 --> 36:41.620]  And I think that's an important point of discussion for the future.
[36:41.900 --> 36:49.580]  We've seen a lot of different things proposed in recent years under the umbrella of smart city initiatives.
[36:51.620 --> 36:57.520]  And I do think that there are lots of benefits to some of these initiatives.
[36:57.520 --> 37:04.840]  We should be looking at using technology in ways that would improve our daily experiences.
[37:05.560 --> 37:14.060]  But often there isn't enough of a conversation about the privacy risks or privacy concerns of these initiatives.
[37:14.560 --> 37:24.420]  And many of these things can end up creating structures for surveillance that may not initially be used for that.
[37:24.620 --> 37:25.440]  But it's there.
[37:25.860 --> 37:29.660]  And there's going to be questions about mission creep.
[37:29.660 --> 37:40.460]  So when is something that's set up for a traffic study going to be used for some other purpose to monitor the people on the streets?
[37:41.300 --> 37:47.560]  And so having strong privacy policy protects against that kind of mission creep.
[37:47.560 --> 38:00.340]  But I think generally, we need to be having more conversations in our communities before these initiatives are accepted about what the privacy implications of each of the projects will be.
[38:01.220 --> 38:07.880]  To build on that, in this whole smart cities landscape, there's another element to this.
[38:07.980 --> 38:10.900]  And it's around the way in which we're going to roll out these initiatives.
[38:10.900 --> 38:17.380]  This is nominally a public Wi-Fi system that is owned and operated by a private consortium.
[38:17.940 --> 38:24.920]  The data that is collected through such a system effectively privatises data collected from public spaces.
[38:25.420 --> 38:41.220]  Now, if you watch very carefully what's happening right now online and now off, the great promise of the information and Internet age was we were going to create all this wonderful data at almost zero marginal cost and we were going to create all kinds of prosperity through it.
[38:41.440 --> 38:46.120]  Well, what's actually happening is a lot of the data is being privatised and controlled.
[38:46.520 --> 39:01.780]  And if we're going to start having private entities designing and implementing systems just like this, and we put terms in there that allow them to not... they'll say they won't sell it, but they'll control and share it within their own corporate entities.
[39:01.780 --> 39:05.680]  And as I've shown you, it's like a Russian doll set of entities.
[39:05.940 --> 39:12.440]  We should be very concerned that the great potential of the information age is suddenly going to be privatised and closed up.
[39:13.660 --> 39:16.020]  But I see that we've got eight minutes left.
[39:16.180 --> 39:21.600]  It might be a good time for the Q&A because I saw one very keen person to start with.
[39:23.100 --> 39:23.540]  Hello.
[39:23.820 --> 39:24.060]  Hi.
[39:25.120 --> 39:34.340]  I actually kind of like these NYCs a little bit, but I'm a little bit concerned about anything that's given away for free that's owned by Google or any other consortium like that.
[39:34.800 --> 39:42.760]  One of the things you didn't touch on was the free telephone service they're offering through Skype... I'm sorry, Microsoft, at LinkNYC things as well.
[39:43.260 --> 39:56.940]  And I'm also interested in, with all these wonderful sensors, 30 of them, if you are not a LinkNYC user, I never connected and I never ticked the box that says I agree to their terms, are they still tracking me somehow?
[39:56.940 --> 39:59.820]  They probably are, at least with their videos.
[40:00.100 --> 40:01.600]  And what are the implications of that?
[40:01.940 --> 40:02.220]  Thank you.
[40:04.840 --> 40:05.320]  Sure.
[40:06.020 --> 40:06.480]  Indeed.
[40:06.780 --> 40:08.840]  Free telephone service is excellent.
[40:09.260 --> 40:10.040]  And I mean free...
[40:10.040 --> 40:12.900]  Internet that's available to people at no cost is excellent.
[40:13.080 --> 40:17.940]  But we should just be kind of cognizant of the costs that are associated with it, that might be hidden over time.
[40:17.940 --> 40:21.820]  The 30 sensors are interesting.
[40:22.140 --> 40:23.740]  They're there for a variety of reasons.
[40:24.380 --> 40:26.320]  To kind of passively collect information.
[40:26.560 --> 40:30.140]  They say to solve complex problems in the city.
[40:31.040 --> 40:37.160]  This is things like tracking traffic flow and air pollution and whatnot.
[40:37.680 --> 40:40.100]  Now we already have a pretty good meteorological service.
[40:40.640 --> 40:44.060]  And Google owns Waze, which does a pretty good job of tracking the traffic.
[40:44.860 --> 40:49.240]  So I wonder myself what the utility of these 30 sensors are.
[40:49.960 --> 40:54.240]  And I mean they will passively be collecting information on people as they pass.
[40:54.400 --> 40:55.580]  It will not identify them.
[40:55.880 --> 40:59.060]  But that does not mean that it's necessarily desirable.
[40:59.440 --> 41:02.120]  I'm more concerned with the fact that it's privatized information.
[41:02.680 --> 41:08.560]  I mean for the last century the meteorological service provided information on the public dime that was accessible to all.
[41:08.980 --> 41:13.760]  And here we're going to start collecting information and lock it up in a big box so nobody can use it.
[41:13.760 --> 41:15.240]  Which is a great concern to me.
[41:15.820 --> 41:24.700]  And just to add, yeah, so the sensors and the cameras will be capturing data from people regardless of whether you've ever signed up and agreed to use this service.
[41:25.500 --> 41:32.580]  And the traffic study part, you know, we're really seeing a lot of smart city proposals that have to do with traffic studies.
[41:32.900 --> 41:38.460]  And I just wonder if at some point we've had enough traffic studies in certain locations.
[41:39.820 --> 41:40.460]  Thank you.
[41:41.680 --> 41:47.680]  Yes, could you speak a bit about the USB connectors that are available for charging for people who aren't even on the Wi-Fi?
[41:47.880 --> 41:49.000]  And the dangers of those?
[41:49.140 --> 41:51.740]  And what is about it in the terms, in the privacy?
[41:51.960 --> 41:52.460]  We'll see.
[41:52.760 --> 41:55.840]  So there's no mention of it in the privacy policy.
[41:56.360 --> 42:00.260]  From what I've read, the USB adapters don't exchange data.
[42:00.260 --> 42:02.980]  They simply exchange power in one direction.
[42:03.340 --> 42:07.640]  But I'm open to anybody who would like to correct me.
[42:07.780 --> 42:10.100]  It simply isn't covered in the privacy policy.
[42:10.200 --> 42:12.780]  Make sure you use a cable that will only pass power.
[42:15.500 --> 42:18.020]  Yeah, I preach abstinence.
[42:18.160 --> 42:19.860]  Don't use the free Wi-Fi.
[42:20.080 --> 42:23.100]  And if you must, use a VPN for God's sake.
[42:26.740 --> 42:30.260]  So you mentioned that they were collecting lots of video.
[42:30.260 --> 42:35.960]  And their policy says they aren't going to do face tracking, but they'll give it to other people.
[42:35.960 --> 42:42.800]  Is there anything stopping those other people from just running their own face tracking software on all of those videos?
[42:44.420 --> 42:44.900]  Nope.
[42:45.200 --> 42:45.620]  Nope.
[42:46.520 --> 42:48.960]  They're not using the cameras right now, but...
[42:48.960 --> 42:49.720]  And that's the key.
[42:50.140 --> 42:50.840]  That's the key.
[42:50.980 --> 42:53.660]  It's like we'll share it with people who we won't tell you about.
[42:54.080 --> 42:55.100]  But we don't know.
[42:55.240 --> 42:56.660]  We can't tell you what they're going to do.
[42:57.140 --> 43:00.420]  So correctly pointed out there, there's kind of second order problems here.
[43:01.960 --> 43:04.180]  Another follow-up question to the sensors.
[43:04.180 --> 43:08.200]  You just mentioned that there is a Bluetooth beacon in each of the obelisks.
[43:08.420 --> 43:08.540]  Yeah.
[43:09.180 --> 43:10.680]  And you said it was going to be picking out.
[43:11.000 --> 43:25.680]  What's to stop them from eventually figuring out, okay, this person has this MAC address on their phone for their Bluetooth, to be able to track them regardless if you're using the system or not?
[43:26.260 --> 43:31.760]  Is there anything in the terms that allocates for Bluetooth at all?
[43:32.200 --> 43:32.240]  No.
[43:32.240 --> 43:32.980]  No.
[43:33.280 --> 43:35.120]  No, the beacons are not mentioned in there.
[43:35.260 --> 43:38.260]  Which I find curious considering that they're mentioned in the marketing material.
[43:39.660 --> 43:48.580]  Again, the vague terms set these parameters that are so large that one does not know what will and could be done.
[43:49.560 --> 43:51.800]  So, you mentioned the public dime.
[43:51.800 --> 43:59.720]  Was there a proposal at any point slash discussion to fund this through taxpayer money instead of through advertising revenue?
[44:00.020 --> 44:00.300]  Yeah.
[44:02.060 --> 44:03.360]  So, there was a lot...
[44:03.360 --> 44:05.720]  I was trying to trace back the discussion.
[44:05.720 --> 44:12.820]  There were public forums held, and yet Control Group and Titan prevailed with the contract.
[44:14.200 --> 44:23.400]  There were motions filed after that to say that this was not a competitive process, that you're effectively monopolizing access or Internet services in the city.
[44:26.820 --> 44:30.700]  I have not gone through all the dozens of proposals.
[44:30.720 --> 44:33.380]  I would not be surprised if there was one in there.
[44:33.380 --> 44:40.800]  And considering the cost per year, it's probably within the remit of the world city, New York.
[44:42.060 --> 44:45.740]  Much more this city than any other, I would say, in the United States.
[44:46.000 --> 44:46.520]  Thank you.
[44:47.960 --> 44:55.840]  So, I've heard a lot about, you know, about the data that these companies are collecting and stuff like that.
[44:56.080 --> 44:59.820]  And how we can stop these companies from doing certain things with this data.
[45:00.040 --> 45:02.840]  But it occurs to me that these companies are collecting huge amounts of data.
[45:03.000 --> 45:03.940]  And they're just collecting it.
[45:04.040 --> 45:08.400]  I mean, at the very beginning, the goal is just collect.
[45:10.300 --> 45:15.820]  So, for people like us who have a mindset of, well, how can we f*ck with this?
[45:15.820 --> 45:19.020]  How can we, you know, feed them bogus data?
[45:19.720 --> 45:22.220]  Or, you know...
[45:22.220 --> 45:23.160]  Actually, that's a good example.
[45:23.260 --> 45:23.960]  Feed them bogus data.
[45:24.180 --> 45:25.360]  You know, clone MAC addresses.
[45:27.680 --> 45:31.280]  Useless data that sucked into the system because right now all they're doing is consuming.
[45:32.480 --> 45:39.820]  And you can take it a step further and say that, well, a sufficiently powerful laser pointer burns out a photoreceptor on a camera.
[45:39.980 --> 45:43.420]  So, why not go around and stick a laser in every camera you see?
[45:44.180 --> 45:46.540]  And, you know, make it even harder for them to collect.
[45:46.680 --> 45:50.880]  Like, I've heard, you know, all of these arguments are about, yes, they're collecting.
[45:50.880 --> 45:52.780]  And we're not doing anything to actually stop it.
[45:52.880 --> 45:57.860]  We're just saying, well, we should have these companies treat our data with more respect.
[46:00.020 --> 46:02.300]  Why not take a more offensive side to it?
[46:03.200 --> 46:04.600]  And I'd like your opinions on that.
[46:06.860 --> 46:13.280]  Well, I guess on the bogus data point, I will note that...
[46:13.280 --> 46:17.880]  So, when you first sign into LinkNYC, it asks for your email address.
[46:18.200 --> 46:20.280]  And, of course, there's no verification, right?
[46:20.360 --> 46:25.660]  So, there's nothing really requiring you to give your real email address.
[46:27.080 --> 46:30.380]  And, you know, I think that's for everyone to know.
[46:31.120 --> 46:32.920]  Yeah, there are ways of doing that.
[46:33.080 --> 46:38.380]  I would not encourage, you know, illegal ways of doing that, like vandalizing the kiosk.
[46:39.260 --> 46:41.600]  But, yeah, I think there are ways that you can...
[46:42.220 --> 46:46.120]  Steps that you can take to protect yourself, right?
[46:46.360 --> 46:48.680]  And I'd encourage that everybody...
[46:48.680 --> 46:48.940]  Black tape.
[46:49.480 --> 46:49.820]  Black tape.
[46:50.020 --> 46:50.260]  Yeah.
[46:50.640 --> 46:52.020]  Well, I just wanted to add...
[46:53.000 --> 46:57.280]  All this collection, you know, it may be technically legal under the law because they futzed with it.
[46:57.720 --> 47:07.480]  But, agreeing with the fact that all this collection with, you know, consent that we clicked to agree, that's legal, yes, but it's not okay.
[47:07.900 --> 47:16.640]  So, I mean, while there's reason to not do things to damage their systems, they're damaging the system that we live in now.
[47:16.640 --> 47:24.960]  So, one has to ask yourself if you actually... if it's actually worth going a little farther and saying, hey, you're screwing with our lives, we're going to screw with yours.
[47:26.820 --> 47:27.380]  Go ahead.
[47:29.420 --> 47:29.980]  Thank you.
[47:32.120 --> 47:43.920]  I just wanted to ask, is there a function with this, for instance, if you don't have your Bluetooth on your phone, if you walk by, can they be connecting...
[47:43.920 --> 47:48.820]  ...from you, as they were trying to do with that bank system with your credit card, if you're walking through a store?
[47:49.060 --> 47:50.500]  Is it similar to that?
[47:51.420 --> 47:56.320]  And the other comment I'd just like to make is that it's about connecting the dots in this.
[47:56.520 --> 48:03.800]  If you look at the really big picture of the Trans-Pacific Partnership Agreement, the agreement in Europe, this is all about control.
[48:04.280 --> 48:06.040]  And the cameras are there for what?
[48:06.620 --> 48:08.100]  I mean, why do you need cameras?
[48:10.560 --> 48:12.440]  You know, there's a big picture here.
[48:12.860 --> 48:16.180]  And it's a brave new world transitioning into 1984.
[48:19.040 --> 48:21.360]  On both of those comments, I mean, it's...
[48:21.880 --> 48:25.860]  I wouldn't... I encourage civil disobedience, not vandalism.
[48:25.980 --> 48:31.100]  In fact, 30 of the censors there, you've got to realize that a lot of them are there to make sure people don't vandalize the things.
[48:32.460 --> 48:34.020]  We're told that the malware...
[48:34.020 --> 48:34.400]  That's what we're told.
[48:34.420 --> 48:37.840]  That they're monitoring the network so that malware can't, you know, infect any of the machines.
[48:38.060 --> 48:41.520]  I would never condone in a hacker conference for anyone to test that claim.
[48:41.680 --> 48:47.980]  But I'll be very interested to see what happens in the future because there's so many unintended consequences.
[48:48.380 --> 48:54.780]  I don't think anyone's thinking about the complex big picture on many levels in line with your comment.
[48:55.560 --> 48:58.360]  Hey, this will be the last question because we've only got a minute left, but please.
[48:58.360 --> 49:05.660]  Is there anything built into the contract or into the privacy policy or in law that specifies the repercussions?
[49:05.820 --> 49:11.000]  I mean, what happens if you have a perfect privacy policy and then they just take the data and do what they want?
[49:11.420 --> 49:12.520]  What happens then?
[49:14.580 --> 49:16.540]  The privacy policy...
[49:17.230 --> 49:24.280]  Well, so there's very little legal protection here, but they're not allowed to be misleading in their privacy policy.
[49:24.280 --> 49:31.800]  And so if they say in their privacy they're doing one thing and they're actually doing another, they would be violating the law.
[49:32.260 --> 49:39.640]  Now, of course, that gets the problem of the current privacy policy because the current privacy policy allows them to do a lot of things.
[49:39.640 --> 49:43.060]  If they're doing those things, it wouldn't be misleading.
[49:43.940 --> 49:48.200]  And I mean, again, I mentioned the liability, you know, any damage that occurs to people.
[49:48.400 --> 49:52.220]  I mean, if you're using it, you're agreeing essentially to say, well, I'll take that risk on.
[49:52.740 --> 49:54.620]  So again, privatizing the risk.
[49:54.780 --> 49:57.140]  This is a trend that's been going on for a while.
[49:57.760 --> 50:07.220]  The corporations that provide these services don't want to take on any of the risks and the complex risks that might occur due to use of their very products and services.
[50:07.220 --> 50:16.520]  Now, in the 1950s and 60s, when cars were killing people, Ralph Nader came along and we had liability placed on car manufacturers.
[50:16.780 --> 50:20.040]  I'm wondering when that's going to happen with systems such as these.
[50:21.820 --> 50:24.000]  But what kind of penalties?
[50:24.000 --> 50:32.840]  I hope the NYCLU is on that because I don't know who else will be if not.
[50:33.700 --> 50:34.660]  Thank you.
[50:34.900 --> 50:35.660]  Thank you.
[50:35.740 --> 50:36.700]  Thank you very much.