Grant Patten kicked off the day with a screening of video diary #5, which was well-received. Jennette Weber then presented her ID overlays, explaining the many iterative phases involved in the design.

Brenda McPhail then facilitated an entertaining, tongue-in-cheek demo of Alex Tichine’s Prop-ID digital wallet smartphone app. In the demo, students demonstrated how the Prop-ID app would work when an underager tries to purchase alcohol.

Our session concluded with comments from expert discussants, including Raf Eskenazi, Director of the Freedom of Information and Protection of Privacy Office at U of T.

The Smart Private Eyes research project, another of professor Andrew Clement’s initiatives, was also discussed. This project’s website is viewable here.

A recording of the morning and afternoon sessions can be viewed here.
Morning session
Afternoon session

the information stored in the barcode and magnetic stripe is for use by law enforcement personnel to confirm the information that is displayed on the front of the card.”

That may indeed be the purpose that the magstripe and barcode were originally designed for, but function creep has extended the use of the driver’s licence far beyond law enforcement. Card readers and barcode scanners are used at many establishments throughout Ontario. Recently, the “We Expect ID” program has enabled convenience stores throughout the province to swipe a customer’s ID if they look under 25. Owners may claim that they are swiping ID for law enforcement purposes. But what other latent purposes might be lying under the surface of this practice? What is to stop the owner of one of these private stores from realizing the potential value of the personal information that he has collected on his customers? What is to stop him from then selling this coveted information to third-parties, e.g. marketers?

Our point is not that card swiping and barcode scanning should never be practiced. Rather, our point is that if the public is at least made aware of the personal information that is being transmitted whenever a magstripe or barcode is used, perhaps more people will begin to insist on privacy protective principles. For example, when a card is swiped through a reader, all of the information on that card is usually captured. Why should a convenience store need to capture your name, height and driver’s licence number? The store should only need to capture the date of birth, and even that should not be held in the database longer than necessary.

The letter continues:

to maintain the integrity and security of the driver’s licence card, the Ministry of Transportation does not disclose to the public the specific content or formatting of the information stored in the magnetic stripe and barcode.”

But we here on the Prop-ID project do not subscribe to security through obscurity, which is essentially what the MTO is promoting with this response. Feel free to read the many convincing arguments against the “security through obscurity” approach here. If there are in fact security vulnerabilities in the Ontario driver’s licence, then they should be dealt with by design, not by obfuscation. Obfuscation is not only a poor approach to security, it also unnecessarily deprives the public of full knowledge about the ID documents carrying their personal information. Surely, in a democratic country, citizens should be entitled to fully understand any and all ID documents that carry their personal information. With this principle in mind, then, we would like to share with you what we have thus far been able to learn about the Ontario driver’s licence magstripe and barcode:

1) the driver’s licence information can be captured using a three-track magstripe reader and 2D barcode reader.

2) the larger barcode on the bottom of the backside of the licence contains the same information that is printed on the face of the licence. The barcode is PDF417 format.

3) the smaller barcode just above the larger one on the backside of the licence contains only the driver’s licence number. It is a 1D Code 39 format barcode.

We hope that this information will be of assistance to future researchers. It was disappointing but not entirely surprising that finding out even this little bit of information took quite a bit of effort. More questions certainly need to be asked of these government agencies, e.g. why? Why is there a separate barcode that holds only the driver’s licence number? Answers to these questions should be made available to the public. We are simply asking questions about documents that hold our personal information, not confidential diplomatic cables. And any argument coming from a government agency that sounds like security through obscurity should be treated with immense skepticism by the public.

Read the full response from the MTO here.

What happens when stores swipe your driver’s license? This interesting question is explored in the video. It also provides an introduction to our card overlays and Android prototype. Enjoy:

A number of web articles have already been sufficiently critical about Google Wallet, including Huffington Post’s Google Wallet: Tech Giant Doesn’t Want Your Money, Just Your Data and Washington Post’s How much do you trust Google? Anna Hervas describes the concerns well:

But will I use Google Wallet? No way. I clearly trust them with a lot of my information, but this is where I draw the line. And I’m not alone. / Sometimes [Google] innovates first and thinks of privacy later. So when it comes to giving it access to my bank account, I’m a little hesitant.” (2011)

Research has shown (Morawczynski and Miscione, 2008) that the establishment of trust is the crucial element for the widespread acceptance of a mobile payment system. The Google Wallet ecosystem is fairly circumscribed at the moment. Only one phone (the Sprint Nexus S) is compatible with the system and plenty of major retailers have yet to even consider supporting the Wallet. But, more importantly, consumers are going to be very hesitant about embracing such a technology. Technical concerns, such as what does one do when the phone’s battery dies, are important. But the crucial consideration here, and one that will affect society at large, is privacy. And this is where the Prop-ID project can contribute.

We are not interested in vilifying Google and announcing to the public that they must reject the Wallet because of the highly questionable things Google and other third-parties might do with one’s data. We do think those concerns are legitimate. However, rather than rejecting the technology, we want to help industry players like Google to understand how a win-win situation can be created here for customers and businesses by building privacy protective technology into digital wallet developments. By marketing one’s mobile payment system with an application such as the Proportionate ID Digital Wallet, a company will be showing the public that it takes privacy seriously and is not interested in being reckless with consumers’ personal information.

This perception of a hidden agenda with regard to the use of consumers’ personal information is the main hindrance facing Google right now. Informed consumers are highly skeptical about Google’s privacy policies, and rightfully so. The Google Buzz controversy and Android location tracking practices provide specific examples of why consumers should be concerned.

But we do not think that the Google Wallet necessarily has to be a privacy invasive technology. Digital wallets, at least, do not necessarily have to be privacy invasive. By openly championing privacy-enhancing technologies such as the Prop-ID Digital Wallet application, industry will stand a much better chance of getting consumers to embrace mobile payments on a substantial scale.

Here at Prop-ID we’ve been busy researching all these digital wallet developments and have officially started our own little digital-wallet-reservoir, cleanly designed and diligently referenced. We don’t claim that this is an exhaustive list but we think it’s a mighty good start.

Check it out at: http://propid.ischool.utoronto.ca/digiwallet_overview.

As of February 2011, however, Best Buy in Canada changed their return and exchange policy to make providing government-issued ID mandatory. Even if you have the receipt and the original purchase was paid in cash, this new policy requires that your ID (such as driver’s licence) is to be electronically swiped for any product to be returned.

By swiping a personal ID, Best Buy is able to track the return and exchange rate of each individual, allowing them to crack down on the “1% of abused returners.” Yet 1% of returners is a pretty small number — what else is so valuable to swipe ID cards for the other 99% of returners?

Turns out Best Buy is not alone in this practice of swiping IDs to return products. Especially in the US, there are a growing number of retail stores that are contracting a third-party data collector, called The Retail Equation (TRE). By swiping ID cards to return products, TRE is able to use the unique identifying number (such as the driver’s licence number) to collect personal information (such as gender, age and address) and continuously keep track of a person’s returns and exchanges across a variety of retailers. Combined with any financial trails the stores have (e.g. credit card information), an individual’s shopping behaviour can be tracked extensively, including where they shop, what they buy and what they return. This behavioural tracking presents very valuable information for a store’s promotional targeting, and is potentially more profitable than stopping return abusers.

Part of the Prop-ID project is to try to have stores be open about what information they are collecting and what they are doing with it. While return abuse might be a legitimate concern for retailers, the current practice of recording a person’s ID card and using that information for a variety of secondary purposes without the consent of the individual is a violation of the openness and transparency principles in Canada’s privacy laws.

The paper explains some of the most common ways in which the crime is committed. It reveals the techniques employed by thieves in obtaining personal information. Data from a driver’s licence, a health card, a credit card or practically any form of ID can facilitate identity theft. The notion that a corrupt employee in a bank or even a government agency might sell your personal information to an identity thief is not something that anyone wants to think about. Alas, it is a reality. Not even the most well-established institution should be trusted unreservedly with your personal information.

The wide-scale adoption of privacy protective concepts championed by the Prop-ID project, such as minimal/selective disclosure and minimum/maximum retention periods, would certainly make the commission of identity theft a lot less easy. And every citizen who uses ID in any form would benefit from the knowledge conveyed in this paper.

On Friday and Saturday, we had a Prop-ID booth set up at the University of Toronto Art Centre. There, we introduced our project to conference attendees. But our main involvement in the conference came on Saturday, May 14, when professor Andrew Clement formally presented the Prop-ID project at the Munk School. You may view professor Clement’s slides for this presentation here.

The discussant for Clement’s presentation was Gus Hosein, Policy Director at Privacy International. Hosein commented that he thinks our ethnographic methodology – in which we test out our ideas in real-life situations – is appropriate and a welcome change in approach from most privacy-related research projects. He also offered some constructive criticism by pointing out that he’s very cynical and pessimistic about ID-focused research projects that promote concepts like selective disclosure. He cited the recent shutdown of CardSpace and the departure of Kim Cameron from Microsoft – written about in our April 24 blog post – as a reason why these ideas simply don’t work in practice. Hosein suggested that if companies such as Microsoft can’t get privacy-protective ID schemes implemented, then nobody will.

Clement responded to this by stating that the Prop-ID project isn’t about commercial implementation. Rather, this project should ideally be seen as an “awareness raiser.” We think that the first step toward successful implementation is creating greater public and institutional awareness of the value of privacy-protective concepts such as selective disclosure, informed consent and data minimization.

Very rarely are data brokers and the advertising companies they serve interested exclusively in data from one particular source, e.g. location tracking. Rather, they are interested in an aggregated view of all the different types of data they can possibly gather about people. It is based on this combination of data sources that consumer profiling is conducted. (CIPPIC, 2006)

The data brokers, then, routinely combine information about one’s in-person transactions with location tracking data to make interpretations about that individual. The individual would then be grouped into a category and marketed to in a particular way. This imposed classification is often not in the person’s best interests.

We are interested in ensuring that only the essential amount of ID card data is provided in any given transaction scenario. Clearly, there would also be value in ensuring that only the essential amount of location data is captured whilst using a mobile phone. Important questions for the US lawmakers to answer, then, will be: what is, on average, the essential amount of location data for smartphone operations? Is Apple or Google storing more data on these devices than is absolutely necessary?

The fact that Apple has released a software patch to amend these location tracking concerns on the iPhone seems to be an admittance that it was storing more than the essential amount of data. (Chosun, 2011) It is certainly a positive development that these mobile privacy issues are finally being discussed at the congressional level in the US. Hopefully the upcoming congressional hearings (Melvin, 2011) will help bring these concerns to the attention of the average consumer.

An International Workshop, 12-15 May 2011

Location: Campbell Conference Facility, Room 1545, Munk School for Global Affairs, University of Toronto, 1 Devonshire Place (@Hoskin Ave).

Prop-ID’s involvement in this upcoming workshop will begin on Friday, May 13, where professor Andrew Clement will be giving a welcoming address at 8:45am.

On Saturday, May 14, from 2-3:30pm, we will be holding a breakout session to discuss the Prop-ID project (rm. 1545).

All are welcome to attend and it promises to be an extremely interesting conference, so please come check it out!