New York City

City’s IDNYC smart card chip plan slammed as security risk

September 13, 2019 Josefa Velasquez, THE CITY
Share this:

This story was originally published on Sept. 13 by THE CITY. 

Pushback against adding a banking chip to new IDNYC cards intensified Thursday, with a demand from immigration, civil liberties and consumer groups to scrap the effort and introduction of a City Council bill to block it.

The coalition of groups — which include the New York Civil Liberties Union, the Legal Aid Society, New York Immigration Coalition and Make the Road New York — warned that the privacy risks of adding a smart chip to the municipal identification cards would “outweigh any purported benefits.”

“If implemented, the proposed changes to IDNYC would facilitate unprecedented, wide-scale data collection about New Yorkers’ travel, spending, and other activities,” the coalition wrote in a letter to Mayor Bill de Blasio, sent on Thursday.

The signatories called the proposed changes to IDNYC “antithetical to the program’s original purpose and scope.”

The groups opposing the tech-powered cards argue that the smart chips could expose vulnerable people to increased surveillance, including by immigration authorities.

“Even if well-intended, connecting this kind of technology and data to vulnerable New Yorkers’ identification cards would expose people to serious risks — including dangerous experimentation or misuse by current or future administrations and private vendors,” the letter said.

Also on Thursday, Councilmember Carlos Menchaca (D-Brooklyn) introduced a measure that would bar the ID cards from containing hidden information or any transmission technology.

“IDNYC works because New Yorkers trust it. However, the mayor’s plan to add a smart chip to the card is dangerous and will not only undermine its past success, but also jeopardize its future,” Menchaca told THE CITY.

The councilmember had held an IDNYC oversight hearing in February at which he raised concerns over privacy and security for cardholders but did not then object to the payment-chip plan.

Pledge to protect privacy

First introduced by de Blasio in 2015, IDNYC has received extensive promotion from city government agencies as a safe form of identification of particular benefit to undocumented New Yorkers unable to access state-issued IDs such as driver’s licenses.

In May 2018, the city Human Resources Administration advertised its interest in modifying the existing IDNYC cards to including an EMV chip, like those found on debit and credit cards, to provide financial services. Bidders had until January to submit their proposals.

The administration aimed to launch the new chip-powered cards on Jan. 1, 2020, as the first IDNYCs come up for renewal.

Daniel Schwarz, a privacy and technology strategist at the New York Civil Liberties Union, said that the transmitters the de Blasio administration is hoping to include in the IDNYC cards would pose a “grave risk.”

“While people are going about their daily lives, the content of their cards — or the fact that they’re carrying an IDNYC — could be read from a third party law enforcement agency, a federal immigration agency, or a malicious actor that wants to identify what kind of card someone is carrying with them,” Schwartz said. “And that risk really exists irrespective of the encryption methodology used.”

Bitta Mostofi, the commissioner of the Mayor’s Office of Immigrant Affairs, said in a statement that the administration is continuing to “explore ways to expand the utility” of the IDNYC cards.

Bitta Mostofi, director of the Mayor’s Office of Immigrant Affairs, testifies to the City Council on IDNYC, Feb. 11, 2019. Photo by William Alatriste for the New York City Council/Flickr

“We have always held the highest standard of privacy and security protections and no decisions will be made that would change that. We will continue to work with the City Council, community stakeholders, and our cardholders to develop solutions that work,” Mostofi added.

Mayor’s Office of Immigrant Affairs spokesperson Nicole Chin-Lyn said she could give no updates about the process of selecting a company to take charge of the chip: “As with all procurement processes, we cannot comment on the names and nature of the bids.”

Bidding records show the winning company would be required to provide capacity for contactless payments, like those used on the MTA’s new OMNY fare system.

The winning firm would be responsible for maintaining customer accounts and protecting their privacy.

The bid solicitation nonetheless anticipates situations in which the card-chip company may receive a subpoena seeking customer information — and would then have to notify city officials “to potentially provide an opportunity for the City to intervene to protect cardholder information.”

A deputy mayor’s dream

The IDNYC banking chip proposal was spearheaded by Deputy Mayor J. Phillip Thompson, who as a professor at MIT had received funding from MasterCard to research the potential of debit card technology to provide financial services to underserved communities.

On leave from MIT for the duration of his service to the de Blasio administration, Thompson has touted his MasterCard-sponsored work as demonstrating the potential for an IDNYC payment chip to improve New Yorkers’ economic prospects.

Speaking at a conference at the City University of New York in April, he described being approached by a representative from “a large financial services company who said the company wants to become a social justice company” and telling him “we have to become popular with poor people if we’re going to grow.”

Thompson then worked to put a payment chip on the membership cards of a Massachusetts union, he said, using it to collect not only dues but also information about what members purchased.

The deputy mayor suggested such a card could be used to bargain bulk consumer purchases or to make payments toward community organizing campaigns, adding: “In this way, we could get real money to build civic infrastructure with no strings attached.”

Unresolved questions

For the last several months, advocacy groups — some of which were instrumental in creating IDNYC — have been meeting with the mayor’s office to discuss concerns over the chip. But questions over privacy and security are “still unanswered,” Menchaca said.

City Hall’s plan to partner with a financial technology company on IDNYC has been met with resistance not only from groups concerned about immigrants’ security but also organizations working on expanding access to banking services for low-income New Yorkers.

Among the signatories of the letter to the mayor are the Lower East Side People’s Federal Credit Union and the New Economy Project. The letter calls the financial technology industry “notorious for data breaches” and warns of “a business model that relies on the collection and sale of people’s personal data.”

Additionally, it observes that fintech companies do not have to follow the same federal regulations and consumer protections as banks and credit unions.

Says the letter: “By steering undocumented and low income New Yorkers to these entities, the city would be perpetuating, not resolving, inequality in our banking system and potentially facilitating IDNYC cardholders’ exploitation.”

This story was originally published by THE CITY, an independent, nonprofit news organization dedicated to hard-hitting reporting that serves the people of New York.

Leave a Comment

Leave a Comment