Testimony Regarding Technology Oversight Hearing on LinkNYC

Testimony Regarding Technology Oversight Hearing on LinkNYC

The New York Civil Liberties Union respectfully submits the following testimony regarding oversight of LinkNYC, the public Wi-Fi network that was launched in New York City at the beginning of this year. We thank the Committee on Technology for this opportunity to discuss the need for better privacy protections around the collection and retention of data by LinkNYC.

The NYCLU, the New York state affiliate of the American Civil Liberties Union, is a not-for-profit, non-partisan organization with eight offices across the state, and over 50,000 members and supporters statewide. The NYCLU’s mission is to defend and promote the fundamental principles, rights and constitutional values embodied in the Bill of Rights of the U.S. Constitution and the Constitution of the State of New York.

To be clear, the NYCLU supports the City’s goal of providing free public Wi-Fi to New Yorkers and applaud the City for taking the first steps to make this a reality. But through this project the City has given a private company the power to build a mass surveillance system on the streets of New York City that is capable of collecting vast amounts of data, including sensitive browsing history that may reveal our political views, religious affiliations, medical or family problems, and more.

Such systems raise risks of abuse and misuse, and we are particularly concerned that the privacy policy that the City negotiated with the company, CityBridge, is inadequate to protect against threats of unwarranted government surveillance, whether by state, local, or federal agencies. The NYCLU has detailed our concerns with the privacy policy in previous communications with the City, a copy of which we attach here. Briefly, there are three areas of concern.

First, the privacy policy permits CityBridge to collect and retain, essentially indefinitely, an extensive range of private information about its users, including email addresses, what websites they visit on their devices, where and how long they linger on certain information on a webpage, and what links they click. Although we have been advised that CityBridge is not currently collecting and retaining data to the full extent of its authority, it could any day decide to do so under the current privacy policy. The privacy policy should commit to minimizing the collection and retention of any personally identifiable information to what is operationally necessary and set a destruction policy with a fixed retention period that is tied to operational needs.

Second, the privacy policy lacks robust language that commits to notifying users about government requests for information. Notice is crucial for providing users with the opportunity to argue against the reasonableness of such requests and for ensuring that courts are ultimately deciding the validity of government information requests, especially overbroad requests that infringe on the First Amendment right to anonymously view materials on the Internet.

The privacy policy should at minimum assure users that if there is a government request for information they will be provided notice through the email address that they provided during registration or through any other personally identifiable information in CityBridge’s possession, unless there is a lawful judicial order barring CityBridge from doing so. If there is such an order, the notice should be given as soon as the order is lifted.

Finally, the privacy policy allows for the unrestricted sharing of data collected by the environmental sensors and cameras on the LinkNYC kiosks with city and other governmental law enforcement agencies. It also allows for the sharing of that data with advanced, written permission from the City. The public should be notified of exactly who is getting access to this data and for what purpose, and communities should be given an opportunity to weigh in on whether such access and use are appropriate.

If this project succeeds according to the City’s vision, LinkNYC kiosks will soon be everywhere on the streets. People who cannot otherwise afford the Internet, as well as those who can, will be relying on them daily for accessing the Internet from the streets and even from their homes. It is imperative that City Council demand that policies governing LinkNYC adequately protect the privacy of all New Yorkers.