LinkNYC kiosks have become a familiar eyesore to New Yorkers. Over 1,600 of these towering, nine-and-a-half-foot monoliths — their double-sided screens festooned with ads and fun facts — have been installed across the city since early 2016. Mayor Bill de Blasio has celebrated their ability to provide “the fastest and largest municipal Wi-Fi network in the world” as “a critical step toward a more equal, open, and connected city for every New Yorker, in every borough.” Anyone can use the kiosks’ Android tablets to search for directions and services; they are also equipped with charging stations, 911 buttons, and phones for free domestic calls.
But even as the kiosks have provided important services to connect New Yorkers, they may also represent a troubling expansion of the city’s surveillance network, potentially connecting every borough to a new level of invasive monitoring. Each kiosk has three cameras, 30 sensors, and heightened sight lines for viewing above crowds.
Since plans for LinkNYC were first unveiled, journalists, residents, and civil liberties experts have raised concerns that the internet kiosks might be storing sensitive data about its users and possibly tracking their movements. For the last two years, the American Civil Liberties Union, Electronic Frontier Foundation, and a small but vocal group of activists — including ReThink LinkNYC, a grassroots anti-surveillance group, and the anonymous Stop LinkNYC coalition — have highlighted the kiosk’s potential to track locations, collect personal information, and fuel mass surveillance.
Now an undergraduate researcher has discovered indications in LinkNYC code — accidentally made public on the internet — that LinkNYC may be actively planning to track users’ locations.
You’re the Product
Plans to replace the city’s payphone booth network with Wi-Fi-enabled kiosks were first announced by de Blasio in 2014. Less than a year later, the city awarded a contract to a chameleon-like consortium of private companies known as CityBridge. It was an attractive deal: LinkNYC kiosks, at no cost to the city, would provide free internet coverage to anyone walking by. CityBridge, in turn, would be responsible for the installation, ownership, and construction of the devices, with plans to earn back its expenses through advertising. The twin 55-inch displays will eventually carry targeted ads derived from the information collected about kiosk users.
These terms raised alarms among internet researchers and privacy experts, who were quick to point out that nothing in life is truly free. “As we know,” Benjamin Dean, a technology policy analyst, told attendees at a New York hacking conference in 2016, “When you’re not paying, you’re not the customer — you’re the product.”
The key player in CityBridge is known as Intersection, and one of Intersection’s largest investors is Sidewalk Labs, with whom it also shares the same offices and staff. Sidewalk Labs CEO Daniel Doctoroff is the chair of Intersection’s board. Sidewalk Labs is owned by Google’s holding company, Alphabet Inc. In other words, the plan to blanket New York City with 7,500 camera-equipped obelisks has been largely underwritten by the company formerly known as Google — a corporation whose business model depends on selling your personal information to advertisers. As Doctoroff, who was also the city’s former deputy mayor of economic development, has said of the kiosks: “By having access to the browsing activity of people using the Wi-Fi — all anonymized and aggregated — we can actually then target ads to people in proximity and then obviously over time, track them through lots of different things, like beacons and location services, as well as their browsing activity. So in effect, what we’re doing is replicating the digital experience in physical space.”
In March 2016, the New York Civil Liberties Union raised multiple concerns with the mayor’s office about LinkNYC’s vast and indefinite data retention and the possibilities for unwarranted NYPD surveillance. The NYCLU asked whether environmental sensors and cameras would be hooked up to NYPD systems, including the Domain Awareness System (built by Microsoft). LinkNYC has since updated its policy to state that it will take reasonable efforts to notify users if their information is being shared with law enforcement.
In May of this year, Charles Meyers, an undergraduate at New York City College of Technology, came across folders in LinkNYC’s public library on GitHub, a platform for managing files and software, that appear to raise further questions about location tracking and the platform’s protection of its users’ data. Meyers made copies of the codebases in question — “LinkNYC Mobile Observation” and “RxLocation” — and shared both folders with The Intercept.