Bluetooth Big Brother
July 24, 2008

This week, The Guardian ran an article about the CityWare project which is a pretty sizable project out of the University of Bath. The project has several goals, around understanding how people interact and move through their urban environment, but also helping shed light on opportunities and threats associated with the wireless devices that people carry with them. With regard to the latter, it's a little ironic then that the project has come under fire from privacy advocates, with regard to the fact that cityware collects data about people's movements (or more pedantically, about the movements of their Bluetooth-enabled devices) without their knowledge.
In their defense, the Cityware people say that they don't actually collect personal data about people - they're just recording the Bluetooth address of the devices, plus the Bluetooth friendly name (like SOS W350 or Sean's Mobile) if there is one.
It's the latter in particular that I think is causing the problem, although of course, hard-core privacy people would also be concerned about the ability of someone to find out my Bluetooth address and then search the Cityware data (if that were possible) to pick up my "trails" in the system.
On balance, I'm with the Cityware people on this one. Here's why: I reckon I'm "tracked" in some fashion about (wild guess) 200-500 times per day: Credit Card usage, Surveillance cameras *everywhere*, my mobile phone (by the operator), car-tolls (EZPass), Bus passes, ATM usage, and so on, and so on. OK, I know some of these are different, and in theory, they're all in different databases. So argument number one is that Cityware doesn't really add an undue overhead to what's already going on. Plus, some of these are "non optional to me" - I can't ask the store owner to switch off the CCTV while I do my business. Not a great argument I know, but it brings me to my second point: control.
Argument number two is: if you want to not be tracked by Cityware, it's easy. Switch off Bluetooth entirely (safest if you're really concerned). If that's a pain, just ensure your friendly name is set to something innocuous, as opposed to say, your name, your address, and your PIN code :-)
Argument three is: eh, don't live in Bath. Ok just kidding on that one. In fact, the software has been used in other cities also, so even if you don't live in the lovel city of Bath, you may be "at risk".
I have a little bit of sympathy for Simon Davies, of Privacy International who said this:
"For Bath University to assert that there aren't privacy implications demonstrates an astonishing disregard for consumer rights. If the technology is as safe as they claim, then all the technical specifications should be published and people should be informed when they are being tracked."
I agree a little: there are some privacy implications, but in my opinion, they're just not radically different from the environment we're immersed in every day.
Where Simon completely loses my sympathy is when he says this:
"It would not take much adjustment to make this system a ubiquitous surveillance infrastructure over which we have no control."
This is just untrue, and gives the Privacy brigade a bad name. Somewhat hyperbolic to say the least. Dr Evil will have to install Bluetooth radios within 50-100 feet of every living person in every city in order to make this "ubiquitous", and it's a little unfair to say you have no control when you can , you know, just....turn.....Bluetooth......off.
Anyway - I think the project is way cool, and is genuinely interesting research. I also think that if they force people to opt in to the project (as in, alert people every time they're going to collect a bit of info) then the experiment is affected dramatically, and it alters the data. I think this is data worth analysing, not least because it may have clues for we might better manage how and where our identities are exposed by the electronic bag of tricks we carry around.


