Great Taste, Less Privacy

A patron walks into a bar and orders a drink. The bartender asks to see some ID. Without asking permission, the barkeep swipes the driver's license through a card reader and the device flashes a green light approving the order. The bartender is just verifying the card isn't a fake, right? Yes, and perhaps more. Visitors to an art exhibit at the Pittsburgh Center for the Arts got more than their martinis when they ordered drinks at a bar inside the gallery's entrance. Instead of pretzels and peanuts, they were handed a receipt containing the personal data found on their license, plus all the information that could be gleaned from commercial data-mining services and voter registration databases like Aristotle. Some patrons also got receipts listing their phone number, income range, marital status, housing value and profession. For added effect, the receipt included a little map showing the location of their residence. The magnetic strips and bar codes on the back of most state's driver's licenses contain more information than people think. The way the swipers use the information might surprise them as well: Some bars and restaurants scan driver's licenses to catch underage drinkers and fake IDs, but they're also using the information for marketing purposes. Last year artists and producers Beatriz da Costa, Jamie Schulte and Brooke Singer built the Swipe exhibit in Pittsburgh to show what's on the cards we all carry. To reinforce the point, they also launched a website last Monday with a free online suite of tools that lets visitors decipher the bar codes on their IDs, calculate the worth of their data and request copies of their personal files from commercial data-mining companies like Acxiom and ChoicePoint. "We wanted to give people back their data, to empower them to prevent having their information swiped," Singer said. While many patrons thought the museum project was fun, Singer said they were "pretty stupefied." "We put what we thought was the least sensitive data on a monitor over the bar, showing maps and a person's name and age. But they were upset about that; especially about their age," Singer said. "We didn't do it to offend anyone," Schulte said, "but sometimes that's the best way to get through people's defenses. We wanted them to be aware that the data was easy to get." More than 40 states use magnetic strips and bar codes on licenses. Depending on the type of code used, some cards can store up to 2,000 bytes. In some states, a driver's Social Security number also serves as the license number, so that sensitive nugget is also on the card. And Kentucky has embedded a digital image of the driver's photo in the bar code, according to the American Association of Motor Vehicle Administrators, or AAMVA, which sets voluntary standards for states to use when creating their licenses. Bar codes on licenses generally make life easier for law enforcement. Police scan the cards during traffic stops to avoid scribbling the information on a citation report. They also can more easily retrieve information from the computer in the squad car. Bars and restaurants scan the codes to catch underage drinkers using fake IDs. Convenience stores use them to verify the age of cigarette buyers. Airports, hospitals and government buildings are beginning to scan driver's licenses for security. And businesses can use driver's license records for legitimate business purposes such as verifying identities. "But is it legitimate to then store the information and use it for marketing purposes, or however they see fit without regulation?" said Singer. Using the information, a bar can track how often patrons come in, the hours they arrive and even identify those who arrive in groups (if the cards of friends are swiped in sequence). The bar can query, for example, how old the audience for a particular hired band was or how many were male or female. Bars also can combine the info with sales data if a patron purchases drinks and food with a credit card. The combination of age, weight, gender and liquor sales could help a bar determine what kinds of drinks to market to which crowd.

Great Taste, Less Privacy
By Kim Zetter
Story location: http://www.wired.com/news/privacy/0,1848,62182,00.html

A patron walks into a bar and orders a drink. The bartender asks to see some ID. Without asking permission, the barkeep swipes the driver's license through a card reader and the device flashes a green light approving the order.

The bartender is just verifying the card isn't a fake, right? Yes, and perhaps more.

Visitors to an art exhibit at the Pittsburgh Center for the Arts got more than their martinis when they ordered drinks at a bar inside the gallery's entrance. Instead of pretzels and peanuts, they were handed a receipt containing the personal data found on their license, plus all the information that could be gleaned from commercial data-mining services and voter registration databases like Aristotle. Some patrons also got receipts listing their phone number, income range, marital status, housing value and profession. For added effect, the receipt included a little map showing the location of their residence.

The magnetic strips and bar codes on the back of most state's driver's licenses contain more information than people think. The way the swipers use the information might surprise them as well: Some bars and restaurants scan driver's licenses to catch underage drinkers and fake IDs, but they're also using the information for marketing purposes.

Last year artists and producers Beatriz da Costa, Jamie Schulte and Brooke Singer built the Swipe exhibit in Pittsburgh to show what's on the cards we all carry.

To reinforce the point, they also launched a website last Monday with a free online suite of tools that lets visitors decipher the bar codes on their IDs, calculate the worth of their data and request copies of their personal files from commercial data-mining companies like Acxiom and ChoicePoint.

"We wanted to give people back their data, to empower them to prevent having their information swiped," Singer said.

While many patrons thought the museum project was fun, Singer said they were "pretty stupefied."

"We put what we thought was the least sensitive data on a monitor over the bar, showing maps and a person's name and age. But they were upset about that; especially about their age," Singer said.

"We didn't do it to offend anyone," Schulte said, "but sometimes that's the best way to get through people's defenses. We wanted them to be aware that the data was easy to get."

More than 40 states use magnetic strips and bar codes on licenses. Depending on the type of code used, some cards can store up to 2,000 bytes. In some states, a driver's Social Security number also serves as the license number, so that sensitive nugget is also on the card. And Kentucky has embedded a digital image of the driver's photo in the bar code, according to the American Association of Motor Vehicle Administrators, or AAMVA, which sets voluntary standards for states to use when creating their licenses.

Bar codes on licenses generally make life easier for law enforcement. Police scan the cards during traffic stops to avoid scribbling the information on a citation report. They also can more easily retrieve information from the computer in the squad car.

Bars and restaurants scan the codes to catch underage drinkers using fake IDs. Convenience stores use them to verify the age of cigarette buyers. Airports, hospitals and government buildings are beginning to scan driver's licenses for security. And businesses can use driver's license records for legitimate business purposes such as verifying identities.

"But is it legitimate to then store the information and use it for marketing purposes, or however they see fit without regulation?" said Singer.

Using the information, a bar can track how often patrons come in, the hours they arrive and even identify those who arrive in groups (if the cards of friends are swiped in sequence). The bar can query, for example, how old the audience for a particular hired band was or how many were male or female.

Bars also can combine the info with sales data if a patron purchases drinks and food with a credit card. The combination of age, weight, gender and liquor sales could help a bar determine what kinds of drinks to market to which crowd.

Some people say there's no privacy violation in scanning licenses because the information on the bar code is the same information on the front of the card. A bar owner could easily photocopy the card and get the same data. But privacy advocates say the electronic file makes data collection, entry and combination far easier.

"It's an area of concern," said Rich Carter, director of technology and standards for the AAMVA. "The policy is that you shouldn't be collecting the info for one purpose and using it for another. If you're telling them you're using it to verify their age, you shouldn't be using it to market them."

Andy Rose, manager of West End restaurant in Little Rock, Arkansas, has been scanning licenses for a year. The bar downloads the scanned information into a computer occasionally. He said the restaurant doesn't use the information for marketing purposes, but he admits he glances at the data once in a while to check the female-to-male ratio.

"I saw we were running a 55-45 male-to-female ratio. We're an upscale sports bar. So as long as we can run almost a 50-50 ratio and we have the ladies coming in, that's a damn good sign we're doing well."

Rose said the bar hasn't caught a single underage drinker or fake ID with the device, but he has had customers "raise hell" over having their license scanned.

"Some people it just freaks them out. They think you're getting information on them," he said. If a patron does object, the bar doesn't insist on scanning their license.

In addition to fear of relentless marketing, there are concerns about stalking. A bar employee, for example, could create a list of all blond female patrons between the ages of 21 and 25 who weigh 120 pounds. The Driver's Privacy Protection Act of 1994 was passed to prevent states from selling driver's records, in part because people were outraged states were making money on the data. In addition, an obsessed stalker killed actress Rebecca Schaeffer a few years ago using an address obtained from public driving records.

Ari Schwartz, associate director of the Center for Democracy & Technology, said the potential for fraud is also high. Since bars and restaurants use handheld scanners, an employee could pull out a personal scanner and scan cards twice to sell the data for ID theft crimes.

"The public has the ability to pressure businesses that are using driver's licenses in this way," Schwartz said. "Unless people say it's OK and the bar has told them how they're going to use the data, bars should not be doing this."

Privacy advocates are worried that more info will be added to license codes in the future, and that efforts for standardizing the cards and creating a central database to store the information would make the driver's license a de facto national ID card.

Some states also are talking about switching to smart cards with an embedded computer chip, which would store even more information. And there are concerns about radio frequency ID cards, which can be scanned at a distance (the same way E-ZPass toll booths operate on a highway). Those card carriers would never know information was being scanned.

"Surveillance tends to creep up incrementally," said Schulte, one of the Pittsburgh exhibit's producers. "We want to make it more obvious to people so that this will bring a dialogue when it does happen."

Schulte's co-producer Singer said license scanning is a new practice, so not many people have challenged it. She said she hopes the trio's website will encourage people to take steps to protect their information.

To get the word out in Pittsburgh, they handed out stickers to museum patrons to place over their bar codes. The stickers read: "I stop shopping when you start swiping!"

The bartender is just verifying the card isn't a fake, right? Yes, and perhaps more.

Visitors to an art exhibit at the Pittsburgh Center for the Arts got more than their martinis when they ordered drinks at a bar inside the gallery's entrance. Instead of pretzels and peanuts, they were handed a receipt containing the personal data found on their license, plus all the information that could be gleaned from commercial data-mining services and voter registration databases like Aristotle. Some patrons also got receipts listing their phone number, income range, marital status, housing value and profession. For added effect, the receipt included a little map showing the location of their residence.

The magnetic strips and bar codes on the back of most state's driver's licenses contain more information than people think. The way the swipers use the information might surprise them as well: Some bars and restaurants scan driver's licenses to catch underage drinkers and fake IDs, but they're also using the information for marketing purposes.

Last year artists and producers Beatriz da Costa, Jamie Schulte and Brooke Singer built the Swipe exhibit in Pittsburgh to show what's on the cards we all carry.

To reinforce the point, they also launched a website last Monday with a free online suite of tools that lets visitors decipher the bar codes on their IDs, calculate the worth of their data and request copies of their personal files from commercial data-mining companies like Acxiom and ChoicePoint.

"We wanted to give people back their data, to empower them to prevent having their information swiped," Singer said.

While many patrons thought the museum project was fun, Singer said they were "pretty stupefied."

"We put what we thought was the least sensitive data on a monitor over the bar, showing maps and a person's name and age. But they were upset about that; especially about their age," Singer said.

"We didn't do it to offend anyone," Schulte said, "but sometimes that's the best way to get through people's defenses. We wanted them to be aware that the data was easy to get."

More than 40 states use magnetic strips and bar codes on licenses. Depending on the type of code used, some cards can store up to 2,000 bytes. In some states, a driver's Social Security number also serves as the license number, so that sensitive nugget is also on the card. And Kentucky has embedded a digital image of the driver's photo in the bar code, according to the American Association of Motor Vehicle Administrators, or AAMVA, which sets voluntary standards for states to use when creating their licenses.

Bar codes on licenses generally make life easier for law enforcement. Police scan the cards during traffic stops to avoid scribbling the information on a citation report. They also can more easily retrieve information from the computer in the squad car.

Bars and restaurants scan the codes to catch underage drinkers using fake IDs. Convenience stores use them to verify the age of cigarette buyers. Airports, hospitals and government buildings are beginning to scan driver's licenses for security. And businesses can use driver's license records for legitimate business purposes such as verifying identities.

"But is it legitimate to then store the information and use it for marketing purposes, or however they see fit without regulation?" said Singer.

Using the information, a bar can track how often patrons come in, the hours they arrive and even identify those who arrive in groups (if the cards of friends are swiped in sequence). The bar can query, for example, how old the audience for a particular hired band was or how many were male or female.

Bars also can combine the info with sales data if a patron purchases drinks and food with a credit card. The combination of age, weight, gender and liquor sales could help a bar determine what kinds of drinks to market to which crowd.

Some people say there's no privacy violation in scanning licenses because the information on the bar code is the same information on the front of the card. A bar owner could easily photocopy the card and get the same data. But privacy advocates say the electronic file makes data collection, entry and combination far easier.

"It's an area of concern," said Rich Carter, director of technology and standards for the AAMVA. "The policy is that you shouldn't be collecting the info for one purpose and using it for another. If you're telling them you're using it to verify their age, you shouldn't be using it to market them."

Andy Rose, manager of West End restaurant in Little Rock, Arkansas, has been scanning licenses for a year. The bar downloads the scanned information into a computer occasionally. He said the restaurant doesn't use the information for marketing purposes, but he admits he glances at the data once in a while to check the female-to-male ratio.

"I saw we were running a 55-45 male-to-female ratio. We're an upscale sports bar. So as long as we can run almost a 50-50 ratio and we have the ladies coming in, that's a damn good sign we're doing well."

Rose said the bar hasn't caught a single underage drinker or fake ID with the device, but he has had customers "raise hell" over having their license scanned.

"Some people it just freaks them out. They think you're getting information on them," he said. If a patron does object, the bar doesn't insist on scanning their license.

In addition to fear of relentless marketing, there are concerns about stalking. A bar employee, for example, could create a list of all blond female patrons between the ages of 21 and 25 who weigh 120 pounds. The Driver's Privacy Protection Act of 1994 was passed to prevent states from selling driver's records, in part because people were outraged states were making money on the data. In addition, an obsessed stalker killed actress Rebecca Schaeffer a few years ago using an address obtained from public driving records.

Ari Schwartz, associate director of the Center for Democracy & Technology, said the potential for fraud is also high. Since bars and restaurants use handheld scanners, an employee could pull out a personal scanner and scan cards twice to sell the data for ID theft crimes.

"The public has the ability to pressure businesses that are using driver's licenses in this way," Schwartz said. "Unless people say it's OK and the bar has told them how they're going to use the data, bars should not be doing this."

Privacy advocates are worried that more info will be added to license codes in the future, and that efforts for standardizing the cards and creating a central database to store the information would make the driver's license a de facto national ID card.

Some states also are talking about switching to smart cards with an embedded computer chip, which would store even more information. And there are concerns about radio frequency ID cards, which can be scanned at a distance (the same way E-ZPass toll booths operate on a highway). Those card carriers would never know information was being scanned.

"Surveillance tends to creep up incrementally," said Schulte, one of the Pittsburgh exhibit's producers. "We want to make it more obvious to people so that this will bring a dialogue when it does happen."

Schulte's co-producer Singer said license scanning is a new practice, so not many people have challenged it. She said she hopes the trio's website will encourage people to take steps to protect their information.

To get the word out in Pittsburgh, they handed out stickers to museum patrons to place over their bar codes. The stickers read: "I stop shopping when you start swiping!"

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Land of the Free ?