Can the Hong Kong police track you with your Octopus card? Not accurately, but thanks to the likes of Google and Facebook, they probably don’t have to.
As you might imagine, my newsfeed (and indeed much of my personal life) has been inundated with news about the massive protests in Hong Kong over the SAR government’s proposed amendments to its extradition law. As you might also imagine, I managed to find a technology angle, which is this: many of Hong Kong’s young people are sufficiently paranoid about the tracking capabilities of digital technology.
To explain:
Last week, Quartz writer Mary Hui reported the unusual spectacle of long queues at the ticket machines in the MTR (the city’s public train system) during the second protest on June 12. Usually there are no queues – most local people use “Octopus” contactless payment cards to ride the city’s trains and buses, because it’s faster and also cheaper than buying a single-trip ticket.
So why the sudden need to go to the trouble of buying a ticket? Because users of single-trip tickets can’t be tracked, Quartz reports:
… they were afraid of having their card data traced back to them and used as proof that they were at the protest, should the police decide to press charges — as they did against key protest leaders from the 2014 pro-democracy Umbrella Movement.
On a purely practical level, I think their fears are probably overblown, although I can see why people would worry about it – Octopus has a somewhat shaky track record when it comes to personal data. In 2010, it admitted selling personal data of 1.97 million customers to half a dozen companies in violation of local data privacy laws. Also, that same year, the police used Octopus data (along with lots of CCTV tapes) to track down a suspect in an acid-attack case.
However, since then, Octopus reportedly has been cleaning up its data act to collect only the bare minimum of data needed to complete a payment transaction: the user’s Octopus ID and transaction information (amount, date, time and reader ID). According to a ComputerWorld Hong Kong report in 2015, CEO Sunny Cheung said that the system doesn’t record things like what you purchased or where you get on or off the train. Assuming that’s still true, the protesters’ fears are unfounded.
Even if Octopus did collect and store that information, that alone wouldn’t be proof of anything. It could prove you exited a station near the protest site at the time the protest was happening, but it wouldn’t prove you actually went to the protest.
On a more practical note, the police aren’t likely to arrest people just for showing up to a protest, even an illegal one (which the June 12 protest technically was, as the protesters didn’t have a police permit for it), simply because of the scale. The crowd size of the June 12 protest was estimated at over 20,000 – it’s logistically impossible for the police to arrest that many people even after the fact. Just as with the 2014 Occupy Central protest, the police would likely go after the leaders of the protest, not everyone who attended.
Still, the decision by HK protesters to go off the grid shows an awareness (especially among young people) of the power of digital technology to track people. While Octopus might not keep detailed records of who went where and what they bought, technically it could do all of that and more.
We already know this because companies like Google, Facebook and Amazon already do it. They collect all kinds of personal data about everything we do online, compile it into richly detailed profiles and sell it to third parties who combine it with other data about us. Way back in 2013, Bruce Schneier described this as an “internet surveillance state”. He was right then, and he’s even more right today.
And that’s just the private sector. Imagine what a government could do with the same capabilities.
Actually, we don’t have to imagine it. China is already implementing it.
Ironically, all of that is another reason why those HK protesters queuing up at the MTR ticket machines were probably worrying over nothing – or rather, about the wrong thing. Many protesters were also posting pictures and videos to Facebook and Twitter. Who needs Octopus to track your every move when Facebook and Twitter can do it far more efficiently and accurately?
That said, some protesters are quite aware of this too. In addition to foregoing WhatsApp (Hong Kong’s default messaging app) in favor of the more secure Telegram, protesters implemented other ways to cover their digital tracks, according to the Hong Kong Free Press:
Many [protesters] said they turned off their location tracking on their phones and beefed up their digital privacy settings before joining protests, or deleted conversations and photos on social media and messaging apps after they left the demonstrations.
Be the first to comment