It’s not a privacy threat today…

Oregon is trying to devise a system to tax all those shifty, tax-evading environmentalists they have up there:

Oregon is among a growing number of states exploring ways to tax drivers based on the number of miles they drive instead of how much gas they use, even going so far as to install GPS monitoring devices in 300 vehicles. The idea first emerged nearly 10 years ago as Oregon lawmakers worried that fuel-efficient cars such as gas-electric hybrids could pose a threat to road upkeep, which is paid for largely with gasoline taxes.

“I’m glad we’re taking a look at it before the potholes get so big that we can’t even get out of them,” said Leroy Younglove, a Portland driver who participated in a recent pilot program.

Any reader of this site will see the words “GPS monitoring device” and immediately worry about privacy from prying government eyes. Don’t worry, Oregon’s got it all figured out for you:

Another concern is that such devices could threaten privacy. Whitty said he and his task force have assured people that the program does not track detailed movement and that driving history is not stored and cannot be accessed by law enforcement agencies.

“I think most people will come to realize there is really no tracking issue and will continue to buy new cars,” Whitty said, noting that many cell phones now come equipped with GPS, which has not deterred customers.

I’d love to believe that the devices present no tracking issue. Really, I would. Too bad it’s simply not true:

Though the GPS devices did not track the cars’ locations in great detail, they could determine when a driver had left certain zones, such as the state of Oregon. They also kept track of the time the driving was done, so a premium could be charged for rush-hour mileage.

If the devices can determine whether a vehicle has left the state and how many miles were driven in rush-hour traffic, there is a tracking issue.

How serious is this tracking issue? The article gives us a rough idea of what the device can do:

  1. The device can calculate miles driven based on GPS data
  2. The device can store the number of miles driven
  3. The device can determine when the vehicle has left certain zones
  4. The device can store the zones the vehicle entered
  5. The device can determine what time a vehicle was being driven
  6. The device can store the times the vehicle was driven
  7. The device can produce all data stored since its last reading

Based on the above and the stated goal of taxation based on driving, one may reasonably assume the following:

  1. The device can store the number of miles driven in a particular geographic zone
  2. The device can store the number of miles driven at a particular time
  3. The device can store the number of miles driven in a particular geographic zone at a a particular time

To do the above, the device must be receiving precise positional data as an input from its GPS unit. It must also have a clock set to the real time and date as an input. This means that the device is getting data on the exact position of the vehicle at any moment, and that the control software is only storing certain datapoints based on this. This is an adequate privacy safeguard, right? Probably not.

Considering this is a tax device, it will very likely need to be updated to reflect changes in the tax law. The need for this capability is clear. One year, the zone around Portland might incur a tax at any time of day, the next year only during rush hour. Oregon’s program might spread to other states, so now the control software in the device has to start recording miles driven in those states as well. If this is the case, then the control software could one day be updated in nearly any way, including complete tracking of movement and speed.

The other thing to consider is that the readers for these devices will be readily available, since every gas station in the state will need one. Even if the software stays the same, there’s nothing stopping a rogue police department from getting its hands on a reader and using it to gather info on people. More likely, though, if these devices became pervasive, law enforcement would push to have readers of their own.

Imagine this scenario: You’re driving a car with one of these GPS devices at the leisurely clip of 60 MPH on the highway leading into Klamath Falls. Like all highways in Oregon, the limit is still 55 MPH. A cop catches you going over the limit and pulls you over. You go through the normal rigmarole with him, except this time he checks your GPS devices and finds out that you’ve exceeded 55 MPH in the state of Oregon 22 times since the device was last read. You leave this encounter with 22 speeding tickets instead of one.

That scenario is possible with the hardware described in the device and minimal changes in the software. Only the good will of the Oregon state government is keeping it from being so. Should Oregonians really rely on that alone to protect their privacy?