Thursday 28 January 2016

Some thoughts on what Uber/GrabTaxi/lyft can easily do with your data




“Exclusive: The ride-sharing company is conducting a trial in Texas using movement sensors in smartphones to track signs of erratic driving” http://www.theguardian.com/technology/2016/jan/26/Uber-monitoring-drivers-us-passenger-safety-houston
When I read the title of the article I wanted to laugh… It would be really dumb of Uber if this hasn’t been already happening for a while.

Imagine, as an Uber driver, you carry the Uber app in your phone; do you control what the app accesses? Your smart phone has in-built GPS (that’s what allows you to use the maps and other applications that give you directions, recommend stuff ‘near you’), gyroscope (that’s how you can play games that require you to move the phone itself rather than just use controls). 

Using these 2 pieces of equipment that most smart phones have in-built, it is very easy to know where you are, the speed and direction you are moving, and any sudden changes in direction. All you have to do is overlay a map that has data on the speed limits, and you will easily be able to tell whether speed limits are being exceeded, whether sudden lanes are changing are taking place…

So if this is an exclusive story, then I am really surprised. Uber can’t be that backward, afterall, remember the “rides of glory” where Uber classified the rides their customers took? (For example if you are picked up in an area with healthy nightlife in the wee hours of the morning and get dropped off at a new location, then depart from that location after a few hours later, it could be a one night stand…)

You cannot be doing this and not analysing what your drivers are up to, especially after the horror stories such as http://indianexpress.com/topic/delhi-Uber-rape-case/ . In fact, wouldn’t it be easy to simply track every Uber car, since you know the origin and destination of every trip a passenger takes, decide the most likely routes, and issue alerts when driver deviate from these routes, may be require driver and passenger to respond?

What is more even interesting is what is going to happen/happen to this data that Uber collects. 

Data is a resource, and a very useful one too, in the right hands.

MSIG recently announced it would be the first insurance company in Singapore to use telematics (http://www.asiainsurancereview.com/News/View-NewsLetter-Article?id=34686&Type=eDaily) . To be able to decide whether a driver is low or high risk, the insurer will have to collect the data on how that person drives. But for Uber drivers, Uber already has all this data.

Take a step further, think of passengers. 

When you fill up your application for insurance, you have to declare your habits, including the amount of alcohol you consume, and whether you enjoy sky-diving for example. It is up to you to inform the insurer if the response to any of the questions you answered in the past has changed. Else you could lose coverage at the most inopportune times (http://www.mcmha.org/never-lie-life-insurance-application/). What if your insurer knows you are often at a well-known nightspot until the wee hours? Did you declare alcohol consumption? This can impact your premium or seriously cut any pay-out from the insurance company. The insurance company would mostly likely gladly pay for information that would save them from large pay-outs.

What if your bank knew you often went to the vicinity of the casinos and add it to the fact that the bank knows that you do not spend on shopping there? How would that affect your credit rating and your ability to get loans at decent rates? The bank would also be most likely to be happy to buy data that ensures their risk is well covered (high-risk customers are charged ‘appropriately’ higher premiums).

What if the data on trips taken by Uber is sold in bulk? Nowadays with the proliferation of data, it takes less than 5 matches to be at least 90% sure of one’s identity and thus know who you are, where you were, and when. http://www.nature.com/articles/srep01376. Basically, all I’d need is 4 social media posts where you confirm your presence at certain locations at specific times that I can match with the Uber data (starting point or end point and time), and I can identify that all the Uber trips are made by you with 90% accuracy at least. 

Basically what I am trying to say is that there is a lot that can be done with data that Uber (or any other car ride company – I am just talking about Uber because the article that caused me to write this was talking about an ‘innovation’ by Uber), whether on its own to enhance Uber services (is the driver a safe driver? Is there a risk that the driver is up to no good?), or be used by third parties (is this driver safe and deserve a low premium or unsafe and merit a higher one to cover my insurance risks?) or merged with other data to reveal even more (is this customer a low risk customer or does he/she have less than prudent financial habits? Where does Mr XXX or Ms YYY go, where was he/she last Friday night, where does he/she visit often?)…

And this brings me back to my main concern; do we have any control over what happens to data we generate? Laws are required to force organisations that collect data that we generate to inform us of and get our permission for data collection and usage, and well as retention period and delete data upon request.