Adrian Short

InLink kiosks: Email to Wandsworth Council's planning applications committee

To: Councillor Will Sweet
Planning Applications Committee chairman

Cc: Councillor Tony Belton
Planning Applications Committee opposition speaker

Councillor Peter Dawson
Northcote ward

Planning case officer

Dear Councillor Sweet,

Time limit extension for BT InLink kiosks planning applications

We note that there are a large number of planning applications for BT InLink kiosks in Wandsworth that are due for a decision by 18 December. One full application (ref: 20175852) will be heard by the Planning Applications Committee tomorrow (14 December) alongside an application for advertisement consent on the same site. The case officer’s recommendation is to grant permission with conditions in both cases.

We request that the time limit for all current and future BT InLink applications is extended to 13 weeks and that the cases before the Planning Applications Committee tomorrow are deferred pending further consultations.

We are technologists with an interest in the privacy aspects of “smart cities” technologies such as these BT InLink kiosks. We are concerned that the Council has not given these planning applications sufficient consideration to ensure that their actual and potential capabilities are understood and that the broad public interest is protected both now and in the future.

Specifically, the approved specifications and proposed planning conditions give far too much latitude to the applicant to adapt these kiosks without further reference to the Council into a street-level mass surveillance system that has the potential to cause significant harm to the public. Moreover, there is evidence that this is precisely what the applicant intends, although they do not couch their intentions in these terms.

The applicant’s Executive Summary document​ gives a broad overview of the system’s capabilities and the scope for future development. As currently proposed, the kiosks are boxes in the street connected to a high-speed network. The initial services offered would be free wifi access for anyone within range, free phone calls and texts via a tablet screen integrated to the unit, USB charging, and local information such as maps and access to the Council’s website via a “Council tile” link on the tablet. These services are financially supported through two large digital advertising screens on the front and rear of the kiosk.

Under the heading “Smart City Sensors and Data”, the document says (emphasis ours):

The ​modular nature of the build​ of InLinks allows us to evaluate and invest in the best tools and techniques of collecting meaningful insights for the community as sensor technology improves.

In the future, we are anticipating introducing sensors that can monitor things like:

In other words, InLink kiosks are essentially a network of boxes that can do anything, either with existing technology or with those yet to be developed. By granting planning permission on the proposed terms, the Council will relinquish any effective control over how these kiosks are used in future. While the Executive Summary itself is one of the approved documents, even if it were construed in a way that the applicant were bound only to do things envisaged within it, its broad nature means that that could be practically anything.

Without even fitting any new sensors into the kiosks, InLinks could be used to monitor pedestrian movement in a way that would raise serious privacy concerns. Pedestrian movement can be captured using wifi device tracking that would only require the existing wifi access points already installed in the kiosks to provide the public wifi service. Every wifi device such as a smartphone, tablet or laptop has a permanent and unique identification number called a MAC address. Wifi access points such as those in these InLink kiosks can capture those MAC addresses for every wifi device within range, even if they do not connect to the wifi network. Thus, a person simply walking past or near to one of these kiosks could have a unique and permanent identifier that is directly linked to their phone logged alongside the kiosk’s location and the time and date.

Such a service enabled on a network of kiosks would enable the operator to track the movements of individual pedestrians not just past each individual kiosk but also to construct journey patterns across the city (and indeed, across the country) and over time. Similar wifi tracking systems are already used on private premises such as shopping centres.

While there are concerns over this, putting wifi into genuine public space would have much more serious implications. The only way to “opt out” would be to keep your phone’s wifi or the phone itself permanently switched off, which would defeat the purpose of having a phone in the first place. As proposed, BT InLink could enable this surveillance system with a simple software update to the kiosks and without seeking further formal permission from the Council.

Transport for London trialled a similar system using the existing wifi access points on the Tube network in late 2016. In one month, the trial captured over 500 million wifi requests from 5.6 million customer devices, the vast majority of which were “passive” requests from people not connected to the Tube wifi network but whose devices were simply sitting in their pockets scanning for available wifi networks every few seconds. These requests had been made without the knowledge or effective informed consent of the devices’ owners. The raw data collected allowed TfL to reconstruct over 42 million journeys across the network by connecting the dots as customer wifi devices such as smartphones were observed passing different wifi access points as they moved both on trains and on foot. While TfL described the data collected as “depersonalised”, the authority subsequently refused a Freedom of Information Act request to release it due to the risk that the people who had been tracked could be identified. After the trial, it emerged that TfL had estimated a potential revenue of £322 million from the commercial exploitation of wifi tracking data collected on the Tube network.

This wifi tracking technique exploits a side effect of the underlying technology that was not intended to be used in this way. It has caused such serious concern in the technology industry that both Apple and Google (who between them provide the operating systems for almost every smartphone and tablet) have taken some steps towards limiting its effectiveness. Currently there is a proposal to the IEEE Standards Association to change the specifications of the wifi protocol itself to prevent this kind of surveillance entirely. But while the wifi protocol remains unmodified it can be and is exploited in the way described.

This example demonstrates the opaque and complex nature of these technologies and how a sensor such as a wifi access point with an obvious and broadly acceptable purpose can be repurposed to something else entirely. It shows that the Council cannot hope to understand the potential effects of these systems without conducting further consultations with appropriate technology and civil liberties groups and experts. It also demonstrates the necessity for more robust conditions applied to any planning permissions granted to ensure that new capabilities are not introduced into existing kiosks without the public’s oversight and the Council’s formal permission.

The applicant proposes to give the Council 5% of the advertising screen time or roughly 18 full days per year. Combined with the exclusive access to the Council’s website available on the tablet screen (general web browsing is not permitted) this amounts to a significant commercial value and therefore gives the Council itself a direct interest in the outcome of these planning applications.

While individually these planning applications are all “minor” in the strict definition of the term (below 1000 square metres internal floor area), taken as a batch they represent a major strategic development both in Wandsworth and in London more generally. The actual and potential capabilities of a network of BT InLink kiosks are greater than that provided by any individual kiosk: the system as a whole is far greater than the sum of its parts.

As such, we consider it to be reasonable and appropriate for the decisions on all current and any future planning applications for BT InLink kiosks to be extended to 13 weeks, which is the statutory time limit for a major development. This would give the Council more time to conduct the further consultations necessary to decide these applications fairly and to ensure that the public interest is protected. We understand that an extension would generally require the applicant’s consent. Given that we are sure that the applicant would agree that their proposed network of kiosks taken as a whole represents a major planning development in all but name, we hope that such consent would be given.

We ask that the planning committee tomorrow defers a decision on the BT InLink applications until a future meeting within the 13-week timescale. We are working with a larger group of researchers to develop a model planning condition with supporting explanatory notes to improve the safeguards for digital/physical infrastructure in public space. Our aim is to secure the public benefits of ​transparency​ of these developments and ​accountability​ of their operators to the public through local planning authorities, while ensuring sufficient ​flexibility​ for the operators to make reasonable changes to the services provided as technologies and business requirements change. We would be happy to provide a copy of this as part of any further consultation on these or similar applications.

Kind regards,

Adrian Short
Richard Pope

13 Dec 2017