Know your data 41: collateral damage of data exhaust

In a previous post, I referred to a report that revealed Manhattan's congestion pricing program faced a toll evasion crisis right after launch - the non-compliant drivers didn't wait even one week.

What happened after the first week? New York Post (link) disclosed that law enforcement has already started issuing tickets. Toll evasion must have been quite rampant!

The journalist revealed that NYPD wrote over 100 tickets during a six-hour crackdown on toll evasion.

***

That's not the point of interest for this post. To me, the most informative line is this one:

In addition to the summonses, 10 vehicles were seized during the operation — eight of which had suspended registrations, and two that were impounded for other reasons. One individual was arrested at the scene, though authorities clarified the bust was for a warrant unrelated to congestion pricing.

I call this the collateral damage of data exhaust.

Because of this congestion pricing scheme, every single car entering lower Manhattan is identified. They have installed 1,400 cameras. These cameras can identify also every driver and passenger in every car - although I haven't heard whether that is being done.

This situation on the roads is wild wild West compared to what we face on the Web or on our phones. At least there we have some laws, albeit limited, concerning PII (Personally Identificable Information). This whole congestion pricing setup clearly involves PII but there doesn't seem to be any protection against abuse.

What those sentences tell us is that the PII is not just used for the tolling application for which data are being collected; the PII is then taken elsewhere, used to look people up in databases unrelated to congestion pricing, which leads to arrests and seizures of property. In the world of data science, such appropriation of data collected for one purpose to another is confusingly called "data exhaust".

In effect, every single camera is a cop who can identify someone without even asking for ID, and who has 24/7 access to all kinds of databases.