Is the MTA Tracking Your Every Move with its OMNY Tap-and-Go Fare System?

Is the MTA Tracking Your Every Move with its OMNY Tap-and-Go Fare System?

In May 2019, New York City’s MTA launched One Metro New York (“OMNY”), a new tap-and-go fare system created by Cubic Corporation.^[1] By 2023^[2] the MTA hopes to have OMNY replace Metrocards in all 472 subway stations and on many buses throughout five boroughs—affecting, on average, 5.5 million riders per day.^[3] As Americans become increasingly aware of the existence and widespread use of smartphone location tracking, questions are raised: will OMNY be tracking our every move around the city? Who gets access to that information? What can they do with it?

Data Privacy & Security Issues Surrounding OMNY

OMNY collects significant data from its users – not only tracking each and every subway station that a rider swipes into, but also credit card information and smartphone identifiers.^[4] This is information that most applications on your smartphone also gather. However, questions remain regarding OMNY’s storage of data and the city government’s access to that data.

Specifically, some argue that the fundamental problem is that the MTA’s Privacy Policy on OMNY is vague and “deficient.”^[5] For example, a report titled “OMNY Surveillance Oh My” written by the Surveillance Technology Oversight Project (“STOP”) elaborates on a number of these policy deficiencies.^[6] For one, the Policy is only available online and not readily accessible to all who use public transportation.^[7] The Policy goes on to use phrases like “may include” or “without limitation” when discussing the MTA’s ability to collect rider information.^[8] Further, by specifying no specific time period, the Policy allows collection and storage of user data for an indefinite period of time.^[9]

Finally, STOP notes that the Policy allows data to be shared with government agencies, such as the New York City Police Department and raises the concern that in particular, agencies like the NYPD have been known to use surveillance data that may target racial and ethnic minorities in the City.^[10] The Policy explicitly allows OMNY data to be turned over for government subpoenas – leading critics to wonder whether OMNY rider data could be subpoenaed to target citizens following events like political protests.^[11] Further, some note the risk that smartphone identifiers could be used by government agencies like ICE to track down undocumented immigrants who ride the subway.^[12] Without any limitation on data usage and storage, the OMNY platform faces the potential for abuse in varying areas.

Moreover, OMNY scanners even contain their own cameras and infrared illuminators.^[13] Steve Brunner, General Manager of Cubic Corporation, stated that the cameras and illuminators are not capable of facial recognition. Regardless, the mere existence of the cameras, coupled with the lack of transparency from the MTA, presents a major concern for critics of the OMNY system.^[14]

Are These Issues Really New to OMNY?

            Despite all the buzz about OMNY and its problems, surveillance in New York City’s subways is not a new concept for riders. For example, it is common knowledge that subway stations have surveillance cameras in place at entrances, and the MetroCard data currently stored by the MTA can be subpoenaed by the NYPD to track criminal suspects.^[15] If the MetroCard purchase was made with a debit or credit card, subpoenaed information can already be tied to that same credit or debit card information.^[16] Consequently, it is difficult to know whether OMNY privacy concerns present a genuine problem or whether these concerns come with the territory when implementing new technology.