Nice Ride takes down public data over tracking concerns

niceridebikes.jpg
The Minneapolis Police Department has been taking heat for its license plate tracking records, but cars aren't the only way to get monitored around town.

About two weeks ago, Nice Ride published usage data for the 2012 season. Quickly, writers on the Minneapolis Bike Love forum and a local blogger realized that they could de-anonymize the information (read: link it to a specific person). After they voiced concerns, Nice Ride removed the database, and now is reassessing what it shares.

See Also:
- MPD's license plate data allows stalkers to track their victims using public data
- Nice Ride hits 500,000 trips
- Melissa Hill's new blog allows you to "Track the Police" using public data


Nice Ride's data dump ran down the start site, end site, dates and times of every trip this past year. The records contained the kind of information that people interested in how the system works love to analyze, and the kind of information that, in previous years, Nice Ride has been praised for making transparent.

But there was also another detail: a unique user ID. This is actually less information than Nice Ride has released in the past, when it's also included subscribers' date of birth, zip code and gender. As Bike Love Minneapolis demonstrated, though, it was still enough to be a tracking tool.

Imagine this scenario, which one Bike Love member posted on the forum:
"Let's say I take a bike out every morning near my house and ride it to work. My ex-wife knows I do this. She uses this information to figure out my subscriber ID because I am the only one who daily takes that bike from there and rides to the location near my work. Using my ID she looks at my other activity. She sees that I am riding places in the middle of the day. She sees that I am riding places when I told her I was out of town. She sees that I am riding around when I told her I was too sick to take the kids. She sees that I am riding to a place where I spent Saturday night and ride away the next morning. I just do not want her knowing that shit and I did not pay Nice Ride to tell her."
The blogger Anton Schieffer got more detailed with how to match up a person to a user ID. "If you're a user/consumer of social media, can you remember tweeting or updating your status when you rode on a Nice Ride?" he asked in a post.

"Simple observation" works too. Per Schieffer, "You saw that cute girl get on a Nice Ride at a certain date/place/time, and while you don't have her name, now Nice Ride has told you everywhere she has ridden a shared bike."

NiceRidedata.jpg
Screenshot via Minneapolis Bike Love
A sample from the now-removed data spreadsheet. Click to enlarge.
Schieffer also noticed another oversight, which Nice Ride confirmed to City Pages. The section of Nice Ride's user agreement that talks about confidential information doesn't mention any of this. All it says is, "We may share aggregated demographic information (data that cannot identify any individual person) with our partners and sponsors."

As Schieffer pointed out, Nice Ride was, in fact, sharing non-aggregated information, and sharing it with the public.

Schieffer got in touch with Mitch Vars, Nice Ride's IT director, about his concerns. In response, Vars tells City Pages, he let the database expire.

"We're kind of in the process of re-evaluating what exactly we want to release," Vars says. "Anton demonstrated that what we did to anonymize the information could be reversed in some cases and used to pinpoint an individual, and that's certainly something we want to prevent."

He explains that, when Nice Ride was starting out, this type of information wasn't available from other cities with similar programs, many of which were privately owned and viewed data sharing as a competitive disadvantage. "It was a hindrance to us," Vars says.

He had to guess about things like how many trips the average user takes on a bike, which was necessary to figure out how many bikes to get. As a result of that experience, "We've tried to be as transparent as possible."

Vars is now trying to make the data more anonymous, but says it may be tough to find a way that retains the same detail about how the system works. For instance, he could simply re-release the information without the subscriber IDs, but then, data would only show one leg of a trip.

"You couldn't say, they started at the university and went downtown, then they got another bike and went to Uptown," he says. "That really leaves a lot of information out, and it will fall short for those who are interested in how people use the system."
My Voice Nation Help
1 comments

Now Trending

From the Vault

 

Loading...