Big Brother WiST and the end of privacy?

Big Brother 2009 Italy

ITWeb contacted me and asked me for comment on a new technology called WiST which stands for “Wireless Intelligent Sensing Technology” (look out for the article tomorrow). On the face of it, this is an exciting technology. It is an alternative to RFID and promises an effective way to track assets and, more problematically, people:

Recent developments in miniaturized and low power integrated-circuit technology has allowed for the development of miniature and intelligent WiST™ sensors. Sensors provide a unique ID, sense movement, temperature, light, tilt, pressure and many more attributes. WiST sensors can also act as active RFID or NFC devices. This greatly enhances the use of WiST™ in a large variety of applications that vary from personal to business use.

Similarly GSM and microprocessor technology have become smaller, more power efficient and cost effective. The WiST™ sensor data transmits to predefined databases on the internet. The WiST™ applications then alert users and route data to business applications, control rooms, cell phones, and mobile devices according to predefined rules.

While the asset management applications are relatively benign (except where combined with people), the possible applications for people-based tracking are worrying, to the say the least. One of the possible applications mentioned on the WiST site is for “social networking identification”:

Why send countless hours updating your social networking profile while you can stay in touch and build new social networks with the help of a WiST™ sensor armband.

WiST™ armbands contain tamper proof sensors with on-board memory that enables the user to store personal information such as name, photograph emergency contact details, medical details and social network details. The system is programmable to allow for flexible distribution protocols.

As the user visits WiST™ enabled venues such as clubs, bars, restaurants etc. WiST™ cameras will identify the users and take photographs and/or videos of them in their social environment. The users can follow a few simple steps to post the material of their choice to their profiles.

This technology becomes problematic if it is used in such a way that consumers are unaware that it is being used or are not adequately informed about what the technology does. Tagging people in real-time and associating that with identities and location is a privacy minefield and WiST must navigate this very carefully. While the idea of enabling real-time tracking at events is an appealing one from an organiser’s perspective, people attending these events need to be clearly informed when or how –

  • the device or object they are wearing or carrying is such a tag;
  • they are being tracked and to what extent;
  • they can opt-out (they should be given a choice to opt-in in the first place);
  • they can access data about them held by whoever is holding or accessing that data as well as how they can control what is done with that data.

Sometimes consent isn’t enough. When children are involved the technology becomes incredibly problematic because of the limitations on collecting and processing children’s personal data (on the other hand, when the appropriate consents are given and safeguards put in place, this could be an invaluable technology to help track and protect children in trouble).

When it comes to the data collected, WiST must make sure that this data is secure and only disclosed to people who are required to have access to it and to parties the people being tracked have agreed may have access to the data. Using the data (including photos) for advertising must also be handled carefully. Ideally a release should be obtained and the party seeking to make use of those photos in the context of promotional competitions, for example, must comply with the Consumer Protection Act. Of course, when the Protection of Personal Information Bill is passed into law it will bring a host of very specific compliance requirements that will affect just about every aspect of WiST’s application to personal data.

This is a pretty complex set of issues which my comments only begin to unpack and this technology is not to be used to track people without making sure there is an adequate personal data protection mechanism in place to protect people’s privacy and explain the implications of the tags to them. The potential for abuse by reckless or uninformed providers is tremendous.

Consider this hypothetical scenario as an indication of the possible threats to consumers’ privacy:

A group of friends go to a concert and are given a bracelet containing a WiST tag. The tag tracks the friends’ movements in and out of the venue and trigger cameras at various locations in the venue. If the friends registered for the event in advance and associated their registration information with their Twitter and Facebook profiles, the photos are automatically uploaded (can your colleagues see these photos, do you know whether the photos are published publicly on Facebook or subject to your preferred privacy settings) and may even contain location data so someone downloading those photos can see where they were taken almost in real-time. As the friends visit concession stands their purchasing preferences are tracked and included in aggregated personal profiles, possibly to be made available to marketers later for more targeted marketing (not necessarily a bad thing but not everyone wants their preferences logged).

After the event the friends go their separate ways and, on the way home or to the next party, their tags track them using GPS functionality and transmit data about places they frequent, where they live and what their schedules are. If they happen to like the bracelet as a fashion item, they may wear the tags in the days that follow, adding a range of location-based information to their aggregated profiles and if they interact with other WiST enabled services, more specific transactional data may be thrown into the mix.

Where this becomes more problematic is if the friends were unaware that the bracelet was capable of tracking them and to what extent. If they didn’t consent to being tracked by the WiST tag (and this consent must be well informed, given the possible applications of this technology), they may not be aware of an option to opt-out meaningfully aside from removing and destroying the bracelet and the tag it contains (throwing it away at home isn’t really an option, it gives fraudsters with access to the data your home location and where your rubbish goes and a source for more of your data for possible identity theft efforts).

Other questions include who collects the data, who has access to it and who controls it? Can users obtain details of what personal information about them is being held under the Promotion of Access to Information Act? Is the data held in a central location or do event organisers and other WiST customers have their own databases? Are the holders of this data known to or discoverable by tagged consumers? Is the data securely held?

Something to bear in mind is that most of us carry a tag of a sorts already in the form of our mobile phones but we notionally have the option of disabling services on our phones that may track our locations, for example, or even turning the phones off altogether. Its not clear than consumers will be able to do this with WiST enabled devices or items.

WiST is a promising technology and could be legitimately and beneficially used in a variety of contexts to combat fraud and theft as well as simplify inventory control processes. It could help make a variety of industries more effective and efficient but when it comes to tagging people, the risks are considerable and require a well thought out and implemented privacy framework to avoid negating the right to privacy altogether. Much of this framework would come down to well-informed consent but there are a variety of legal compliance issues to cater for, both under current law and under future developments like the Protection of Personal Information Bill.

I’ve written about how important it is that consumers take an interest in how their personal data is collected and processed. WiST highlights how important this is and consumers will only have themselves to blame if they remain ignorant of the risks.

Image credits (in appearance order):

  1. Big Brother Italy 2009 by _mixer_, licensed CC BY SA 2.0
  2. WiST International, all rights reserved

Published by Paul Jacobson

Enthusiast, writer, Happiness Engineer at @automattic. I take photos too. Passionate about my wife, Gina and #proudDad.

%d bloggers like this: