TfL WiFi Monitoring

If you’ve been using the London Underground recently then you may have seen one of these posters about WiFi data collection. They were on display at “54 Tube stations within Zones 1-4”¹, including at London Bridge.

The poster reads:

We are collecting WiFi data at this station to test how it can be used to improve our services, provide better travel information and help prioritise investment.

We will not identify individuals or monitor browsing activity.

We will collect data between Monday 21 November and Monday 19 December.

For more information visit: tfl.gov.uk/privacy

So the installation of all that Virgin kit at stations for the Olympics wasn’t just to provide internet to customers. It also allows passenger movements to be tracked.

Perhaps this is one of the reasons why future GB rail franchises need to include free WiFi? It would also allow tracking of how busy carriages are.

More information is available from TfL. There are also instructions on how to opt out:

If you do not want TfL to collect your MAC address, you can either turn off WiFi on your device or put the device into airplane mode whilst in one of the 54 London Underground stations included…

It would have been better if this information was on the poster (something short like “To opt out turn off WiFi.”). Yet then people may actually do that and the data would be slightly less accurate.

It’s a very good idea to turn off WiFi on you phone (when not in use) anyway, for many reasons. Not only will it prevent this sort of tracking, which is also performed in other places such as shopping centres. It will also extend your battery life and can stop your internet getting interrupted.

For example, the TfL WiFi is a captive portal (no internet until you log in) and is installed in stations where there is also phone signal. When some phones join the WiFi they will lose their internet access, even if they had a 3G/4G mobile data connection previously. Some new versions of iOS/Android address this issue and test connectivity before switching.

Also buried in the terms is this:

By understanding how customers move through and around stations we may be able increase [sic] revenue from companies who advertise on our poster sites…

So it looks like this is not just for helping with crowd flow but for measuring eyeballs on adverts too. Hopefully this will never be aggregated with the profile of what you view online?

This is reminiscent of the controversial spy bins from a few years ago. These were killed by the City of London when they found out through the press.

TfL provide some reassurance:

TfL will not collect any web browsing data, or data from website cookies…

However, don’t mistakenly believe that they lack the capability to do this. Unless you are using HTTPS everywhere or a VPN to encrypt your connection then what you view and do can be recorded.

It would be a good idea to encrypt your communications anyway, since the UK government recently gave themselves permission to tap everything (unless you’re an MP of course)! Although this is being challenged.

There’s a bit more detail and discussion on the TfL tech blog. As an aside, if you want to disable the annoying and browser-crippling WordPress Christmas snowstorm then press F12 to open the browser developer tools and paste this into the console.

snowStorm.stop()

Snowstorm can eat up a lot of CPU, even on modern computers, because of the number of elements being moved around the screen at once.

Oyster

All this new WiFi data extends the tracking already done with Oyster cards. Having this trail tied to your identity can be mitigated by never registering the card and only topping up with cash, however this is pretty inconvenient. National Rail paper Travelcards are often cheaper than oyster or contactless anyway and only hang around for a day.

I’m reminded of this piece of art I saw when Oyster first came out.

Photo by Chris Beckett.

I’ve regularly heard people claim:

You have nothing to fear if you have nothing to hide.

Yet they probably don’t realise that this quote is most commonly attributed to Joseph Goebbels in 1933. It’s not meant to be taken literally. It’s a warning.

Highly recommended further reading/watching includes this excellent talk on the perils of collecting too much data.