Are Philly’s New Wi-Fi Kiosks Going to Spy on You?

A Philly hacker is worried about the city's just-approved "Link" kiosks.


kiosks, intersection, link,

A LinkNYC kiosk via Intersection

Last month, we told you Philly sidewalks could soon feature 100 new kiosks — equipped with fancy features like free Wi-Fi, phone charging ports, public service announcements and info on local events, arts and culture.

Sounds good, right? We thought so, though some worry the kiosks, called “Links,” might be eyesores that will “damage the city’s historic brand,” while others fear they’ll distract bikers and drivers. And others have even deeper concerns surrounding privacy and surveillance — which were major issues when Intersection, the tech and media company behind the kiosks, installed its Links all over New York city last year.

LinkPHL has been approved — the kiosks are officially coming to Philly. They’ll stand 9.5 feet tall and feature 55-inch LED display panels on each side, plus two USB ports and a 911 button. About 80 will go in Center City and University City, and 20 others will be placed in other neighborhoods. They’re expected to be up and running by 2019.

In a statement, Mayor Jim Kenney said the kiosks are “an investment in Philadelphia’s future” that will “provide the sorts of modern services that our residents and visitors need as they work and play in the city — at no cost to taxpayers.”

Indeed, the kiosks will be installed and paid for by Intersection. Philly has partnered with the company since 2015, when Intersection agreed to make a multi-million dollar investment in the city in the form of new transportation infrastructure, including 600 amenity-packed SEPTA bus shelters, in hopes of generating significant advertising revenue over the next 20 years. The recent LinkPHL deal is part of that investment.

kiosks

A LinkNYC kiosk via Epicgenius/Wikimedia Commons

What’s in it for Philly, other than free Wi-Fi and gizmos? The city is expected to share 50 percent revenue with Intersection after the firm recoups its capital investment, resulting in a $450,000 minimum guarantee in annual funding for the city. The Office of Transportation and Infrastructure Systems, which helped bring the kiosks to the city, says that revenue will help fund public services.

In New York, where Intersection has already installed more than 1,300 kiosks since 2016 and plans to expand its network significantly more, Links have generated $37.3 million in advertising revenue, city officials told amNewYork in March. But the kiosks have encountered a few bumps, including several complaints that people were using them to blast music and watch pornography in the middle of Times Square. (Intersection no longer allows LinkNYC users to freely browse the internet; nor will that feature be available in Philly.)

The biggest issue of all — and not something to take lightly — has been privacy. That’s because Sidewalk Labs happens to be an investor of Intersection. And Sidewalk Labs is run by Alphabet — which is formerly known as Google. Stay with me here.

It’s no secret that Google tracks your data and uses it for ads. So when LinkNYC launched, a few concerned citizens and hackers, as well as the New York Civil Liberties Union and a Village Voice reporter, raised alarms about the fact that Google was now tied to a vast network of data-collecting hubs in NYC — and that Intersection’s privacy policy did little to settle qualms about what the company was doing with the data.

The NYCLU sent a letter to the city of New York in March, arguing that Intersection’s privacy policy was insufficient and needed to be updated with stronger language regarding data use, retention and sharing. Plus, many complained that through the kiosks, Intersection and the city had little-known access to built-in cameras, though the company says it did not turn those cameras on until March of 2017, when its privacy policy was updated.

Under that policy, the business claims it will not keep any footage captured by any camera for longer than seven days — unless that footage is necessary to investigate an incident, in which case the company could turn that footage over to law enforcement. Some have still taken issue with the cameras’ use.

https://twitter.com/frijole/status/895342831300169728

Is any of this an issue in Philly? According to Philly hacker Ed Cummings, it could be. Cummings said the Philly kiosks have the potential to be “Orwellian.”

As he points out, Intersection has since updated LinkNYC’s privacy policy (which the NYCLU applauded), but only after a significant public outcry. To be proactive, Cummings is calling on Intersection and Philly officials to establish a clear privacy policy — ahead of the kiosks’ implementation — stating “what information they’ll be allowed to collect and what they’ll be able to do with it.”

“Google isn’t this 501(c)(3) that wants to help everyone because they’re nice,” Cummings, who goes by “Bernie S.” in the hacker community, said. “They’re a multibillion company that made a fortune collecting information from the people that are using their search engines. … You should be cognizant to what can happen.”

City spokesman Mike Dunn said officials are “well aware of” privacy concerns, which “the city takes extremely seriously.”

Last year, Philly adopted New York’s Internet of Things guidelines, which works to ensure that so-called “smart city technologies,” like the Link kiosks, are used to maximize public benefit.

Dunn said the city is working with Intersection to develop a “strong privacy policy with user-first protections that will describe how Intersection will collect, use and share user information.”

That privacy policy will be released to public prior to the installation of the first kiosks, Dunn said. It will include information on the use of the kiosks’ cameras, he added.

Jen Hensley, the general manager of LinkNYC, said Intersection’s privacy policy for the Philly kiosks “will be based on the same principles that apply to our New York operation.”

Hensley said the policy will describe how Intersection will collect data and share user information. She added that the company will “never sell [user information] for the purpose of third parties.”

“We’re evaluating the ways we can develop the service in Philadelphia,” Hensley said. “It is our intention to maintain privacy … while still being able to operate our business.”