City’s IDNYC smart card chip plan slammed as security risk

September 13, 2019 Josefa Velasquez, THE CITY

City Councilmember Carlos Menchaca. Photo: William Alatriste for the New York City Council/Flickr

Pledge to protect privacy

First introduced by de Blasio in 2015, IDNYC has received extensive promotion from city government agencies as a safe form of identification of particular benefit to undocumented New Yorkers unable to access state-issued IDs such as driver’s licenses.

In May 2018, the city Human Resources Administration advertised its interest in modifying the existing IDNYC cards to including an EMV chip, like those found on debit and credit cards, to provide financial services. Bidders had until January to submit their proposals.

The administration aimed to launch the new chip-powered cards on Jan. 1, 2020, as the first IDNYCs come up for renewal.

Daniel Schwarz, a privacy and technology strategist at the New York Civil Liberties Union, said that the transmitters the de Blasio administration is hoping to include in the IDNYC cards would pose a “grave risk.”

“While people are going about their daily lives, the content of their cards — or the fact that they’re carrying an IDNYC — could be read from a third party law enforcement agency, a federal immigration agency, or a malicious actor that wants to identify what kind of card someone is carrying with them,” Schwartz said. “And that risk really exists irrespective of the encryption methodology used.”

Bitta Mostofi, the commissioner of the Mayor’s Office of Immigrant Affairs, said in a statement that the administration is continuing to “explore ways to expand the utility” of the IDNYC cards.

Bitta Mostofi, director of the Mayor’s Office of Immigrant Affairs, testifies to the City Council on IDNYC, Feb. 11, 2019. Photo by William Alatriste for the New York City Council/Flickr

“We have always held the highest standard of privacy and security protections and no decisions will be made that would change that. We will continue to work with the City Council, community stakeholders, and our cardholders to develop solutions that work,” Mostofi added.

Mayor’s Office of Immigrant Affairs spokesperson Nicole Chin-Lyn said she could give no updates about the process of selecting a company to take charge of the chip: “As with all procurement processes, we cannot comment on the names and nature of the bids.”

Bidding records show the winning company would be required to provide capacity for contactless payments, like those used on the MTA’s new OMNY fare system.

The winning firm would be responsible for maintaining customer accounts and protecting their privacy.

The bid solicitation nonetheless anticipates situations in which the card-chip company may receive a subpoena seeking customer information — and would then have to notify city officials “to potentially provide an opportunity for the City to intervene to protect cardholder information.”

A deputy mayor’s dream

The IDNYC banking chip proposal was spearheaded by Deputy Mayor J. Phillip Thompson, who as a professor at MIT had received funding from MasterCard to research the potential of debit card technology to provide financial services to underserved communities.

On leave from MIT for the duration of his service to the de Blasio administration, Thompson has touted his MasterCard-sponsored work as demonstrating the potential for an IDNYC payment chip to improve New Yorkers’ economic prospects.

Speaking at a conference at the City University of New York in April, he described being approached by a representative from “a large financial services company who said the company wants to become a social justice company” and telling him “we have to become popular with poor people if we’re going to grow.”

Thompson then worked to put a payment chip on the membership cards of a Massachusetts union, he said, using it to collect not only dues but also information about what members purchased.

The deputy mayor suggested such a card could be used to bargain bulk consumer purchases or to make payments toward community organizing campaigns, adding: “In this way, we could get real money to build civic infrastructure with no strings attached.”

Unresolved questions

For the last several months, advocacy groups — some of which were instrumental in creating IDNYC — have been meeting with the mayor’s office to discuss concerns over the chip. But questions over privacy and security are “still unanswered,” Menchaca said.

City Hall’s plan to partner with a financial technology company on IDNYC has been met with resistance not only from groups concerned about immigrants’ security but also organizations working on expanding access to banking services for low-income New Yorkers.

Among the signatories of the letter to the mayor are the Lower East Side People’s Federal Credit Union and the New Economy Project. The letter calls the financial technology industry “notorious for data breaches” and warns of “a business model that relies on the collection and sale of people’s personal data.”

Additionally, it observes that fintech companies do not have to follow the same federal regulations and consumer protections as banks and credit unions.

Says the letter: “By steering undocumented and low income New Yorkers to these entities, the city would be perpetuating, not resolving, inequality in our banking system and potentially facilitating IDNYC cardholders’ exploitation.”

This story was originally published by THE CITY, an independent, nonprofit news organization dedicated to hard-hitting reporting that serves the people of New York.