Forgot your password?
typodupeerror
Transportation Privacy

Metadata On How You Drive Also Reveals Where You Drive 81

Posted by Soulskill
from the turn-this-off-before-driving-through-a-mall-like-the-blues-brothers dept.
chicksdaddy writes "Pay-as-you-drive programs are all the rage in the auto insurance industry. The (voluntary) programs, like Progressive Insurance's Snapshot use onboard monitoring devices to track information like the speed of the automobile, sudden stops, distance traveled and so on. Safe and infrequent drivers might see their rates drop while customers who log thousands of miles behind the wheel and/or drive recklessly would see their insurance rates rise. GPS data isn't generally collected, and insurance companies promise customers that they're not tracking their movement. No matter. A study (PDF) by researchers at the University of Denver claims that the destination of a journey can be derived by combining knowledge of the trip's origin with the metrics collected by the 'pay-as-you-drive' device. The data points collected by these remote sensing devices are what the researchers call 'quasi-identifiers' – attributes that are 'non-identifying by themselves, but can be used to unique identify individuals when used in combination with other data.' In one example, researchers used a strategy they called 'stop-point matching,' to compare the pattern of vehicle stop points from a known origin with various route options. They found that in areas with irregular street layouts (i.e. 'not Manhattan'), the pattern will be more or less unique for any location. The study raises important data privacy questions for the (many) 'pay-as-you-drive' programs now being piloted, or offered to drivers – not to mention other programs that seek to match remote sensors and realtime monitoring with products and services."
This discussion has been archived. No new comments can be posted.

Metadata On How You Drive Also Reveals Where You Drive

Comments Filter:
  • Cue to the NSA wanting the information in 3.. 2..

  • by Anonymous Coward on Saturday September 28, 2013 @01:16PM (#44979873)

    The war for Internet privacy is over. We lost. There is no set of laws or regulations or RFCs that can get it back. Too much of the world's economy now depends on getting and analyzing and cross-referencing petabytes of information on consumers and their daily activities, phone calls, emails, television viewing, purchases and web surfing. And now, they all have the technology to do it in an economical fashion.

    As Scott McNealy said way back in 1998, "You have zero privacy now. Get over it."

    • The war for Internet privacy is over.

      Actually, not even Internet can compromise your OTP lines of communication. You can still have privacy when you need it most.

      • not even Internet can compromise your OTP lines of communication

        Even perfect encryption still allows traffic analysis. If the government can discover with whom you're communicating, when, where, and how much, it can discover much about your motives.

        • Traffic analysis only gives you an upper bound. That's why spy stations read numbers every day, even though they (likely) only rarely send messages.
      • Actually, not even Internet can compromise your OTP lines of communication.

        Yes it can. A OTP can protect the content of your communication, but it does not protect the meta-data. "They" can still see who you are talking to. Once they know who is involved, they can use the proverbial $5 wrench [xkcd.com] to retrieve the content.

        • Actually, they can't if you implement it properly. Given the nature of OTP, it's perfectly safe to use broadcast/multicast to transmit the messages. Or propagate them in a peer-to-peer graph of nodes. Or you can use a bulletin board-style system to connect a large number of people. Unless your system is actually compromised, there's no way to tell which recipients succeed in decoding which messages.
          • by Richy_T (111409)

            But you have to be sure it's getting to many unrelated ears. Posting it up on your blog because "anyone can read it" is not good. Something like Freenet or Usenet or in a popular torrent is probably better.

    • by AHuxley (892839)
      Thanks to Snowden the world now understands hardware, software, networking, brands and crypto been sold as "certified" to be useless junk.
      Air gaps, a return to one time pads or a deeper understanding of networking crypto will hopefully follow.
  • by kheldan (1460303) on Saturday September 28, 2013 @01:16PM (#44979877) Journal
    ..than allow any vehicle I own to have a tracking device installed on it. JUST SAY NO.
    • by Ichijo (607641)

      Does that include odometers? They track how far you drive.

      • by kheldan (1460303)

        odometers

        Sure but your odometer isn't connected to a radio transmitter that sends that data to some corporation or government agency somewhere. It also doesn't tell anyone where you've been driving or when.

  • Marketspeak for spooks...

  • by Anonymous Coward

    To foil the stop-point matching, just make random stops wherever you go. I'm sure my fellow motorists on the highways will understand.

    • by vjoel (945280)

      To foil the stop-point matching, just make random stops wherever you go. I'm sure my fellow motorists on the highways will understand.

      Also, no sandworms!

  • These sort of systems are outright ideal for people who a) don't drive, b) own a car, and c) live in a dense urban area. Chicago's streets are more regular than Manhattan's - we're on a strict North/South/East/West grid, which makes me one of the people this isn't really all that easy to track with.

    Besides, I just plain do not drive. BIke? Yeah, constantly. It's a 20 minute ride from my apartment on the lower west side to downtown, and it's actually *longer* if I drive (and a hell of a lot more expensive

  • by davebarnes (158106) on Saturday September 28, 2013 @01:27PM (#44979939) Homepage

    By 2060 it will be illegal for humans to drive a car/truck in the USA. Your robot driver will be ratting on you anyway.

    • by justthinkit (954982) <floyd@just-think-it.com> on Saturday September 28, 2013 @07:13PM (#44982057) Homepage Journal
      Implications of robot drivers:
      - no need for each person to own a car. A pool of robot "taxis" will be available to everyone at all times. Dispatched from one company there will be no turf wars, no gouging of passengers, no navigational incompetence. - no need for taxi drivers, truck drivers, ambulance drivers, etc.
      - no need for parking enforcement & traffic cops
      - no need for human-use gas stations
      - no need for Joe's Rip-Off garages
      - no need for Costco to sell motor oil
      - and best of all, a 95% reduction in TV advertisements!
      Unfortunately:
      - no more Geico ads [youtube.com])
  • by Anonymous Coward

    The character of Sherlock Holmes would be a villain today. Very little information exists in a vacuum. We once revered characters like Sherlock Holmes that could follow the threads that connected that information. Today we are horrified by that same feat. If there is anything to be afraid of it is that we have big data and not huge data. The false positives of big data are manifest in huge data, when supposedly unique results reutinely yield multiple, instead of only one false positive. 100 years ago we liv

    • Judging by all the police procedurals and the two Sherlock Holmes TV shows (one in the US, one in the UK), (and setting aside the generic steampunk movies they made instead of Iron Man 4 and 5), either most people don't see him that way, or Hollywood is really trying to portray that sort of thing as acceptable.

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      We once revered characters like Sherlock Holmes that could follow the threads that connected that information. Today we are horrified by that same feat.

      There's just a little bit of difference between ONE man who can, IF he's interested in the case, put the clues together- and a system where any cop (or corp) can press a button and pull up detailed records about pretty much anyone.

    • by sjames (1099)

      Actually, I am fine with Holmes. He uses his abilities to track down worthwhile criminals and bring them to justice. he doesn't waste his talent on harassing basically harmless low level offenders and he certainly doesn't waste it trying to get people to buy things they don't need and that are in many cases ultimately harmful to them.

      If only the corporate world had that level of moral restraint.

    • I had a severe adverse reaction to Sherlock Holmes as a child. Still do.

      It was soon obvious that the feats of deduction based on observation described in the books were explained to the reader post-seeum, that is, explained by Holmes himself and the reader was not even invited to participate. Or Doyle was too simply lazy to describe the surroundings, opting instead for some sort of empty exercise in hero-worship. If Tolkien or Auel had described a crime scene you'd be able to spot that broken twig.

      There is

  • by Iamthecheese (1264298) on Saturday September 28, 2013 @01:43PM (#44980013)
    Throughout history and especially in today's world anyone able to pay extra can get more privacy and anyone sufficiently poor has none. This is simply a continuation of that trend. The poorer you are the more forms you have to fill out with personal information to get what you need and the less likely those forms are to be jealously guarded. On the extreme end you have people filling out dozens of forms daily dealing with hospitals, charity organizations, food banks, and government assistance organizations just to survive. In this case if you're rich enough you can choose an insurance company that won't log every mile you travel. At the other extreme you have people with private airplanes they board with the surrounding areas screened for photographers; houses surrounded by tall walls and guards; every form filled out by someone else and when possible with inaccurate personal information; cars with dark tint on the back windows; and personal physicians bound to secrecy with highly restrictive privacy agreements.
  • insurance companies promise customers that they're not tracking their movement.

    Here's the easier way of finding out where someone's driven: get the government to go ask the insurance company for their records. Do you actually believe them when they say that they're not keeping track of your location?

  • Insurance risk (Score:5, Insightful)

    by Okian Warrior (537106) on Saturday September 28, 2013 @01:50PM (#44980059) Homepage Journal

    The reason for insurance is to spread the risk (and associated costs) over a large population.

    When insurance companies pick-and-choose their customers and rates, it invalidates this purpose.

    We've been seeing this with health insurance in past decades: ineligible if you have a pre-existing condition, or get dropped if you develop a condition, or get charged more for smoking or being older.

    This makes sense from a business perspective, so don't bother saying "what did you expect a business to do?" I'm saying that it makes progressively less sense from the customer's point of view. As these metrics get better, the companies will know exactly how much you will cost them as a customer, and charge the appropriate rates. Why bother with insurance if they know beforehand how much you will need it?

    Legally mandated insurance then becomes simple rent-seeking, with no benefit to the consumer.

    This particular trend - monitoring the driver's behaviour - is framed as a good idea. Everybody thinks they are a better-than-average driver, so the tradeoff seems like a good deal. You don't care about the big picture because hey! I just saved a bundle on my car insurance!

    Here's the big picture: there's no way to verify that the monitoring unit isn't broken, there's no way to verify that the monitoring report is accurate, or that what it's measuring is significant, or that the company isn't skewing the risk. There's no studies that link measured modes with accident risk, no way to tell whether the algorithm for detecting driving modes has flaws, no leeway for corner cases or exceptional conditions, and no way to appeal the decision.

    You have a promise from the insurance company that, if you're a safe driver, your rates will go down.

    The privacy implications are also important: your driving profile probably tells a great deal about your psychological makeup (how often you use the horn, how sharply you take corners). This would be of enormous benefit to advertisers, profilers, police, and national security agencies. The insurance company can make money by selling this information, but it's OK because it's not financial information.

    Ten years from now this will be a problem: insurance companies siphoning money from customers for no benefit.

    Perhaps we should be forward-looking this time and prevent useless suffering before it happens.

    • "You have a promise from the insurance company that, if you're a safe driver, your rates will go down."

      I hope you don't actually believe this. They said the same thing when airbags were invented. They said the same thing when daytime driving lights became mandatory, and the seat belt laws too. You would think my rates would be almost zero by now. Nope.

    • by Anonymous Coward

      "Legally mandated insurance then becomes simple rent-seeking, with no benefit to the consumer."

      Call it really what it is for fucks sakes: Feudalism.

      All the news outlets are going to say it's rent-seeking, you see they're owned by either AG Bertlesmann, Disney, Viacom or News Corp, and they have a vested interest in not being split up into a larger number of smaller papers, magazines, and electronic media outlets. Their sponsors have an interest too.

      They want to prance around the fact that once things get r

    • Re:Insurance risk (Score:5, Insightful)

      by Solandri (704621) on Saturday September 28, 2013 @03:08PM (#44980545)

      We've been seeing this with health insurance in past decades: ineligible if you have a pre-existing condition, or get dropped if you develop a condition, or get charged more for smoking or being older.

      This makes sense from a business perspective, so don't bother saying "what did you expect a business to do?" I'm saying that it makes progressively less sense from the customer's point of view. As these metrics get better, the companies will know exactly how much you will cost them as a customer, and charge the appropriate rates. Why bother with insurance if they know beforehand how much you will need it?

      You've gone completely to the opposite extreme from the one the insurance companies are trying to get to.

      There are two types factors at play here: Luck (randomness), and various behaviors under your control.

      Insurance is for distributing the cost of bad luck over the entire population. People agree that anyone could, randomly and through no fault of their own, get cancer or get hit by a drunk driver. And while the cost of dealing with the aftermath may be exorbitant for an individual, it's reasonable if a bunch of people get together and agree to cover the costs together for anyone in the group who happens to be unlucky.

      Insurance is not for distributing the cost of risky behaviors that an individual willingly engages in. In health insurance, it makes no sense to require non-smokers to cover the extra cost smokers incur due to the additional health risks caused by smoking. Likewise, if you choose to speed or make a lot of sharp turns, it makes no sense to force safer drivers to subsidize the cost of your risky behavior.

      The insurance industry would like to go to one extreme and drop coverage or deny claims for people suffering from bad luck. You want the other extreme where insurance covers everything including willingly partaking in risky behavior. The logical balance is to force insurance companies to cover bad luck cases, while allowing them to distinguish and assign different rates based on riskiness of behavior. (Note that this also "solves" the DNA profiling problem. You do not control your DNA, so any problems you're genetically predisposed to are due to bad luck, and should be covered.)

      Ten years from now this will be a problem: insurance companies siphoning money from customers for no benefit.

      In states which require auto insurance, there is usually a government insurance commission which limits the amount of profit the insurance companies can make. They cannot siphon off additional money. If they get into that situation, the state will force them to reduce rates to bring their profit margin back down.

      Or at least that's what's supposed to happen. If that's not happening in your state, you need to figure out why (usually it's due to corruption because politicians know they'll always be re-elected because the state always votes for one particular party), and do something to fix it. The mechanism for regulating insurance rates is already in place for most people, no need to complain as if we're completely at the insurance companies' mercy.

      • by Kjella (173770)

        The insurance industry would like to go to one extreme and drop coverage or deny claims for people suffering from bad luck. You want the other extreme where insurance covers everything including willingly partaking in risky behavior. The logical balance is to force insurance companies to cover bad luck cases, while allowing them to distinguish and assign different rates based on riskiness of behavior. (Note that this also "solves" the DNA profiling problem. You do not control your DNA, so any problems you're genetically predisposed to are due to bad luck, and should be covered.)

        There's a huge difference between risk factors you know in advance and having bad luck later. Would you let someone diagnosed with cancer take out a life insurance policy at the same rate as everyone else? No. Would you let someone who's been to a genetic review and found he has a 99% predisposition for developing cancer in the next five years take out a life insurance policy at the same rate as everyone else? Yes, it's bad luck. But he knows he has bad luck and can now hike his payout and pool his crap odd

    • by Livius (318358)

      The problem is that fundamentally insurance is not a good fit for the requirements of health care.

      Insurance for a business or consumer provides protection in the event of catastrophic but exceeding rare events, generally events so rare that the probabilities defeat the human imagination and most people are unable to make realistic judgements about them.

      Catastrophic events can happen in terms of someone's health, and insurance is a good solution for a surgery or other treatment resulting from an accident or

    • The reason for insurance is to spread the risk (and associated costs) over a large population.

      That's part of it - the Sesame Street version. The other part is to limit risk and costs to subscribed population. Then there's ensuring that sufficient reserve funds exist to cover expected contingencies, and... well, a whole lot of other things. Insurance is a complicated business even before you add in competition and profit.

      The problem with insurance today isn't insurers picking and choosing their cu

  • Parents have used devices to study teen drivers for quite some time as have suspicious wives and husbands. In a way that establishes precedent. Having already accepted the right of one person to track another without their knowledge or consent how could we say it is wrong for other parties to do exactly the same thing? Black boxes for crash studies have been in many cars for quite some time and have been very carefully kept out of court cases in which they could provide vital evidence as to who was

  • I saw a nice animation of a working system ~month ago. Cant find it now.
    It was basically a huge HMM problem.

    Video starts with IMU sensors reading of estimated car movement, somewhere else on the screen all the possible roads are listed and in time eliminated using HMM. Real position is snapped into road taken on the map after ~1 minute in a big city.

  • For the most part, this involves people driving a car on a public street. That is not a private act (despite what, e.g., speed camera opponents apparently want you to think). I don't see the problem, especially if drive in actual cities with real blocks, where this doesn't work as well, anyway (not that you need to drive, but I digress).

  • I wonder if you can gain privacy by adding noise in the system: if I exit a motorway just to re-enter it immediatly, if I stop at unexpected places, is it still possible to infer the destination?

  • >"The (voluntary) programs, like Progressive Insurance's Snapshot use onboard monitoring devices to track information like the speed of the automobile, sudden stops, distance traveled and so on. Safe and infrequent drivers might see their rates drop while customers who log thousands of miles behind the wheel and/or drive recklessly would see their insurance rates rise."

    Fast acceleration, itself, is not unsafe nor reckless.
    Hard braking, itself, is not unsafe nor reckless.
    Hard lateral G-force, itself, is n

  • It should be noted that while the insurance companies may not be tracking you, the data they receive is likely considered "business records" and that "metadata" can be handed over to the NSA who actually would use that info to track you.
  • I have progressive and I went ahead with their snapshot program. It's really neat because I would go on the web site every night and look at my driving record. The web site displays the time, driving speed, time and duration of each ride, along with number of "hard stops" made. It considers a velocity drop over 7mph/s to be a "hard stop". I hardly ever made hard stops.
    I had that device plugged in for six months. During those six months I made a round trip to Florida. Most of the trip I was going at least

Recursion is the root of computation since it trades description for time.

Working...