After New York launches free public wifi, privacy advocates complain it's building 'massive database'

When New York started replacing its pay phones with wifi kiosks in January, the new free internet access was met with a great deal of excitement, particularly over the network’s speed. The beta launch included just a dozen wifi hubs, but the city plans to convert 7,500 phone booths over the next few years so that free wifi is as ubiquitous as the yellow taxi in New York. But now, concerns about privacy are beginning to emerge.

On Wednesday, the New York Civil Liberties Union (NYCLU) accused the city of using its new public wifi system, LinkNYC, to “build a massive database,” complaining that the company behind the program, CityBridge, can keep a vast amount of information about wifi users, per its privacy policy.

In order to register for LinkNYC, users must submit their e-mail addresses and agree to allow CityBridge to collect information about what websites they visit on their devices, where and how long they linger on certain information on a webpage, and what links they click on. CityBridge’s privacy policy only offers to make “reasonable efforts” to clear out this massive amount of personally identifiable user information, and even then, only if there have been 12 months of user inactivity. New Yorkers who use LinkNYC regularly will have their personally identifiable information stored for a lifetime and beyond.

The group sent a letter to Mayor Bill de Blasio’s office enumerating their concerns about the vagueness of the privacy policy. The letter, signed by NYCLU Staff Attorney Mariko Hirose and Advocacy Directory Johanna Miller, lists three main concerns: how long user data will be retained, unclear language about government requests for user data, and whether the “environmental sensors and cameras” that sit on the new wifi hubs will feed into the Domain Awareness System, a city-wide police surveillance network.

The Mayor and Citybridge responded quickly to the civil rights group’s letter. Natalie Grybauskas, a spokeswoman for the Mayor, said the “privacy policy is the best way to protect New Yorkers and LinkNYC users while they safely and securely enjoy free superfast Wi-Fi across the five boroughs.”

As to the Domain Awareness system, a spokeswoman for Mayor de Blasio told me via email that the “NYPD would have to subpoena to obtain any information from the Links [the wifi kiosks].” The same, she said, would be true for user information.

If a government request for a user’s information is received, a spokesperson for LinkedNYC said that “reasonable attempts” would be made to contact user via the email they provided to use the service.

The NYCLU’s Hirose said by the phone that the organization supports the effort to provide public wifi service but remains concerned about the indefinite retention of user data and the fact that these policy clarifications from the mayor’s office aren’t actually present in the LinkNYC privacy policy. When it comes to sharing the data from environmental sensors and cameras automatically with the city, she pointed out that “the language of the privacy policy is quite open to authorizing that.” Likewise, when it comes to how CityBridge will contact subjects of government information requests, the “the policy says something much more equivocal” than what I was told.

As of late 2013, 57 cities had municipal wireless systems of some sort, a number that has and will continue to grow. At the same time, especially when it comes to New York City, this is a relatively untested frontier. The NYCLU sees its job as ensuring strong privacy protections are built in, so that city wifi doesn’t become another kind of surveillance system, one whose cameras are trained on people’s internet activity.

As wireless internet is increasingly treated as a public utility (or public-privacy partnership utility, in this case), it will certainly be a place to which law enforcement turns for evidence of wrongdoing. The NYCLU is still pushing for the city to update its privacy policy to be more explicit, because as it stands, data about the internet activity of regular users could be kept indefinitely. Besides, let’s invert the argument so often made by members of the intelligence establishment: if LinkNYC and the city government has nothing to hide with regards to following their own stated policies, why fear putting it in writing?

Ethan Chiel is a reporter for Fusion, writing mostly about the internet and technology. You can (and should) email him at [email protected]