Jul 9, 2020 7:00 AM

Uber Quietly Recruits Allies to Battle Cities Over User Data

Nonprofits and advocacy groups signed on to an organization called Communities Against Rider Surveillance—without knowing that the ride-hail giant was involved.

In February, the outreach director for an organization called Communities Against Rider Surveillance wrote to Evan Greer. CARS wanted to know if Fight for the Future, a nonprofit digital-rights advocacy group where Greer is the deputy director, would join, and allow itself to be listed as a member of the newly formed coalition.

“CARS is a new coalition working to raise awareness of a dangerous technology called Mobility Data Specification,” the email from outreach director Rich Dunn read. “In the wrong hands, the information collected by MDS poses grave privacy and safety risks.”

MDS is a technical specification created by Los Angeles’ Department of Transportation, now managed by a third-party foundation. The city, and more than 20 others, use it to track the movement of shared bikes and scooters. Operators of those services must hand over anonymized, close-to-real-time and daily data on vehicle trips; Los Angeles officials can also use MDS to send information back, telling companies to, say, avoid operating vehicles on a block with a water main break.

At Fight for the Future, Greer has concerns about MDS. She worries that the data could be abused by law enforcement or other government agencies. So in May, her group signed up to support CARS.

Here’s one thing the CARS email did not say: A main backer of CARS is Uber, which has been battling Los Angeles and other cities over their use of MDS. Uber is listed as a coalition member on the group’s website. In March, the publication Cities Today said Uber had been instrumental in forming the group, and it quoted an Uber executive voicing the company's concerns about MDS.

This week, after being contacted by WIRED about Uber’s involvement, Fight for the Future quit CARS. “It’s frustrating, because we share the coalition’s concerns,” says Greer. “But Uber’s involvement in the effort was not clearly disclosed to us when we joined. Companies that wish to engage in advocacy should do so transparently.” Greer says Fight for the Future has previously “faced off with corporate astroturf groups that intentionally obscure their connection to powerful industry lobbies. This practice undermines our democratic process. We refuse to enable it.”

The Algorithmic Justice League, an advocacy group focusing on bias in artificial intelligence, also left the coalition this week, after founder Joy Buolamwini said it learned of Uber’s involvement. “Given Uber’s track record on privacy and the lack of transparency about the extent of the company's involvement, we have officially pulled out of CARS,” she wrote in a statement.

CARS has 25 other members, mostly community groups in Los Angeles and Washington, DC, where the city government may soon require the use of MDS. When contacted, many said they were generally supportive of the organization’s mission, but declined to speak about it. “We want to make sure our communities do not get surveilled,” says Bamby Salcedo, president and founder of Los Angeles-based TransLatin@ Coalition, a CARS member. But Salcedo says her group is not involved in any organizing for the coalition.

An Uber spokesperson called CARS “a separate entity,” saying Uber is a member of the coalition and supports its agenda. The spokesperson did not respond to questions about how CARS is funded.

CARS also declined to disclose its funding. In a statement, CARS communications director Keeley Christensen said, “Our coalition is grateful to have support from a wide and diverse group of organizations that are rightfully concerned about city governments tracking people's personal movements. Uber is among the members who have been listed publicly on the coalition’s website since day one, as are many other groups that may not traditionally align but have come together to speak out against this uniquely dangerous threat.” Both Christensen and Dunn, the outreach director, are also employees of a Washington-area public relations and consulting firm.

Uber has opposed Los Angeles’ data-sharing requirements since the city began working on them in 2018. It’s concerned that cities could apply the data-sharing requirements to ride-hail services and potentially autonomous vehicles. The company says MDS would threaten the privacy of its users. It continues to oppose the specification after selling its scooter- and bike-share service, Jump, to onetime competitor Lime last month.

Applying MDS to ride-hail services could lead to more stringent regulation of Uber and other providers. Last fall, when Jump was still an Uber subsidiary, Los Angeles suspended the service from city streets for not complying with data rules. In March, Uber, as the then-owner of Jump, sued the city, arguing the data-sharing requirement violates constitutional protections against unreasonable search and seizure. Jump dropped the suit last month.

CARS says its main objective is to raise awareness of MDS with the media, government officials, and communities who might be affected by the data standard. Through social media accounts promoted by targeted ads, the group shares reports about government data security lapses and op-eds by coalition members. The Facebook Ad Library shows the group has paid almost $6,500 to run ads since February. “Renting a bike? Make room for big brother! DDOT wants to track DC bike riders—without their knowledge or input,” read one ad, targeted at Washington, DC, residents. Another called LA’s program a “1984-style surveillance program.”

The message of suspicion around government handling of data has resonated amid protests against the death of George Floyd, police brutality, and racial justice; the group has gained eight members since May. Some groups worry that government data, collected through mobile applications and “smart city” technology, might be used by law enforcement to identify people who’ve participated in protests. In an op-ed in the Los Angeles Sentinel published last month, pastor William Smart of the Southern Christian Leadership Conference of Southern California, a member of CARS, wrote that “with thousands of people in our city crying out for the foundational right to equal justice under law, city officials should commit to protecting us, like shepherds keeping the wolves at bay, and recognize that moving forward with MDS will place a stain on that commitment.” SCLC did not respond to requests for comment.

Uber has not always been a perfect steward of its own customers’ data. In 2018, the company paid a $148 million penalty to states’ attorneys’ general for failing to alert 57 million riders and drivers that their data had been affected by a 2016 breach. In March, Uber admitted it had inadvertently exposed Jump bike and scooter data that might have allowed someone to track a rider on her journey. Uber said the breach was the result of MDS-related data demands by the city of Miami.

Officials in cities like Chicago, New York, and San Francisco still speak with suspicion about Uber’s aims, a legacy of former CEO Travis Kalanick’s days at the helm when the ride-hail service launched services first and asked for permission later. They smart over programs like Greyball, which The New York Times in 2017 revealed as a software program used to evade regulators in cities across the globe. City officials cite Uber’s (and competitor Lyft’s) aggressive tactics for their cautious, more tightly regulated approach to bike- and scooter-share. “As ride-hail took off, it felt like there were a lot of things changing in the city that were invisible [to me] because companies’ information was opaque,” LADOT head Seleta Reynolds told Slate last year.

Others oppose the data standard for their own reasons. Last month, the American Civil Liberties Union and the Electronic Frontier Foundation filed a lawsuit against Los Angeles, arguing the data might be mishandled, and the government could use scooter data to track individuals to or from sensitive locations. Los Angeles officials have issued a set of “data protection principles,” in which they promise to de-identify and aggregate data, and only permit law enforcement access to data through a subpoena, just as the private companies do.