Big Brother is indeed watching you

Edition 28 June 2019, by Lorre Luther

A Volkskrant investigation conducted earlier this year revealed that at least 60 Dutch municipalities engage in Wi- Fi tracking. Amsterdam, Rotterdam, Hengelo, Leiden and Alkmaar regularly use this controversial technology to monitor the size of crowds and make public safety decisions, such as where to focus police resources. The precise number of local governments that participate in the practice remains unclear.

Wi-Fi tracking works by collecting the unique, unchangeable MAC addresses of networked electronic devices. When a cell phone or tablet’s Wi-Fi is turned on, it sends out a continuous signal with the device’s MAC address as the device looks for networks to join. By matching MAC address information to the location of the sensor picking up the signal, Wi-Fi tracking companies can determine a person’s precise location and even follow their movements over time. CityTraffic and Locatus are the two largest Wi-Fi tracking companies in the Netherlands. CityTraffic currently provides its services to 50 or 60 municipalities. Locatus works with approximately ten local government agencies. The technology has created a fair bit of controversy, mostly due to the privacy violation inherent in the procedure. Until two years ago, Tilburg regularly made Wi-Fi tracking data available to businesses. The municipality actually profited from selling the information — in 2017 a local business improvement organization paid €17,000 for the data. The city used part of that sum to underwrite its free Wi-Fi infrastructure — the very network it used to collect the location and MAC address data it later sold. The business improvement organization’s members used the information to glean details about foot traffic and the number of visitors frequenting downtown shopping areas. Stefan van Aarle, a representative of the group that made the purchase, described the importance of the granular visitor data provided by the tracking system. “You can use the information to measure whether or not your approach is working. Not only that, but you can also see patterns. For example, you can see when things tend to be busiest, so stores can adjust staffing or decide to stay open longer.”

Tilburg didn’t simply collect information about individuals who had logged on and accepted its free Wi-Fi network’s terms and conditions — it also gathered data from devices that were not logged onto the network and whose owners had not granted the city consent to track their movements. The free Wi-Fi system in Tilburg is now gone. It created so many privacy concerns that earlier this year the municipality decided to stop offering the service. The city determined it couldn’t guarantee the safety of the personal information gathered by the network. It also admitted that it had no real way to prevent the data from ending up in the wrong hands. In spite of these well-known privacy concerns, several municipalities continue to use similar data gathering techniques. Enschede still employs Wi-Fi tracking, but takes steps to anonymize the data. Amsterdam, which has prohibited commercial entities from using the technology, engages in Wi-Fi tracking for public safety reasons. It publishes sensor location details on a city website. Hengelo installed signs warning of nearby tracking device activity. In December 2018, the Dutch Data Protection Authority determined that Wi-Fi tracking violates European privacy regulations. “Digital tracking of people in public and semi-public places is an invasion of privacy that can only be used in exceptional situations. There are virtually no legitimate reasons to follow shoppers or travelers. Particularly when there are less invasive ways to reach the same goal without violating anyone’s privacy,” argues Aleid Wolfsen, head of the Data Protection Authority. Nijmegen, for example, doesn’t use Wi- Fi tracking technology for crowd control purposes. It relies instead on imageanonymizing cameras that translate traffic flow information to dots and lines.

Several companies have stopped providing Wi-Fi tracking services in cities, in response to the data protection ruling. According to Peter Nieland, the director of Locatus, the company still harvests Wi-Fi tracking information in 20 to 30 municipalities. It has, however, stopped making the information commercially available. The Expertise Center for Marketing Insights, Research and Analytics is currently working on a “Do Not Track” register that will permit people to opt out of Wi-Fi surveillance. The register was planned to be ready by the beginning of the summer, but the center hasn’t yet submitted a request to set up the system.