For a certain type of technology company, collecting individualized data has become a business liability.
It seems antithetical to the usual narrative, to the idea that data is the new oil and those who can find ways to mine it will get rich quick. Indeed, this largely remains true in the private sector. In government, however, an opposite notion has begun to take hold: With citizens increasingly aware that new and smaller technologies are able to record, monitor and identify their activities, many agencies now insist that the products they buy avoid storing personalized information. In other words, collecting too much or the wrong kind of data can cost these businesses their customers.
At least, so say a handful of gov tech companies. Their products are diverse — ranging from recording equipment able to detect gunshots to sensors on benches that count sidewalk traffic — but their approach to data is the same: All collect information and must serve a specific mission without storing personal info that could be used to identify individuals.
The reason for this is simply that communities across the country demand it, and if the people are not OK with a product, government won’t — or perhaps, can’t — buy it. With all of that in mind, let’s look now at these five companies, the products they sell and the precautions they have installed to ensure that citizenries nationwide are comfortable having them in their communities.
[slideshow-break]
1. Only store aggregated data
Moovit is a mobility-as-a-service (MaaS) provider, which means the company offers cities and transit agencies a full suite of transportation-related tools that provide info about how people consume mobility.Yovav Meydad, the company’s chief growth and marketing officer, said that Moovit has the world’s largest transit data repository and multi-modal trip planner. As Meydad is proud to point out, the ride-share company Uber is using Moovit to start to incorporate public transit info into its own app. Microsoft, meanwhile, is another Moovit user, harnessing its MaaS capabilities to aid any internal developers who want to add location-based services to things like trip-planning apps.
Moovit is, essentially, in the business of knowing how people move through cities, and it has been since it was founded seven years ago. At that time, it offered little more than a free public transit app, one that needs to track users’ locations to function, a capability that commonly raises privacy concerns.
“From the beginning we took privacy very seriously,” Meydad said. “We choose not to require the users to create a personal account. Users with Moovit don’t need to provide any personal information, not name or gender or age.”
Basically, Moovit foresaw that people would not want their individualized data shared all over, and so the company took itself out of the data collecting game. Moovit can’t share or lose individual data, because the way its products work, it never collects that info in the first place. Instead, Moovit only stores analytics related to transit usage, doing so in an aggregated fashion.
This is a concept that came up repeatedly among other companies as well: aggregating data and avoiding any identifying characteristics. While it might limit companies like Moovit’s ability to sell user-specific data, it keeps them on the right side of governmental privacy regulations while also making them acceptable for concerned community members.
[slideshow-break]
2. Aim for privacy by default
RoadBotics Inc. comes from a simple-yet-grand tradition of gov tech companies: Its core mission is to use new tools to do an old task better.In this case, that old task is surveying roads. For many years, government agencies have decided which roads to fix based on a manual methodology that involves people going out to the roads in question, looking at the pavement and rating it on a scale. This is, of course, an inherently subjective process. What RoadBotics does is remove that subjectivity.
The company does this by enabling public servants to mount a smartphone on a passenger-side window to take stock of roads in need of repair. As they drive around, the phone records the roads. At the end of the day, the user connects to a Wi-Fi network, the recorded data is uploaded to secure cloud storage and image processing technology objectively evaluates the road conditions, said Ryan Gayman, the company’s vice president of partnerships.
RoadBotics protects privacy within its products by obscuring the faces and vehicle types that might inherently get caught in its efforts to record the roads. The company’s tech only leaves the roads clear, blurring the people and cars so extensively that someone reviewing the footage wouldn’t be able to so much as guess make or model, let alone the identity of an individual.
With clients in 12 countries, RoadBotics is sometimes required to do this by regulations, but even in places like the United States where such specific protections are yet to be codified, Gayman said the culture demands that privacy be protected.
“Even if it’s not a regulation, people care about privacy,” he said. “So, we have to go above and beyond in that respect.”
RoadBotics is engaged in image processing, a field that has vast potential to improve governmental functions. In order to do so, however, the residents of communities must once again be OK with it. RoadBotics’ approach is to ensure this by being transparent and thorough with the efforts it takes to avoid collecting individualized data. It’s not alone in this respect.
[slideshow-break]
3. Align your mission with the public interest
ShotSpotter sells a complex product that involves dozens of sensors capable of recording audio in service of a simple goal: alerting police in real time to gunshots fired.One of the points made by all five of these companies was that companies that collect data are best served by having a specific mission that the public can get behind and support, such as rapidly identifying when a shooting has occurred. ShotSpotter certainly has that.
Its operations place audio sensors in areas where they are deployed at a density of 20 to 25 sensors per square mile, which is relatively thin. They are also placed high above the street. This combo of height and sparsity makes it difficult for them to home in on conversations, which is the prevalent concern when it comes to audio products and privacy.
“We’re listening, but we’re listening for gunshots, we’re not listening for conversations,” said Sam Klepper, the company’s head of marketing and product strategy.
What’s more, the only time an actual human listens to ShotSpotter’s audio is after its recording system has clearly identified a loud and sudden noise with a high probability of being a gunshot, Klepper said. Even after a potential gunshot — a noise that is exceedingly loud, brief and sharp — is detected, a human first looks at a visual of the sound, like one might see police monitoring in a TV show or movie. That same sound also has to register on three devices for a human to have access to the audio. If it checks out, the next step is for a human to review a few seconds of audio in an effort to check for things like fireworks or a car backfiring.
Klepper also noted that the humans who listen in are very busy and often bounce from one quick-hit sound to the next. Furthermore, the company does not store any audio it records past 72 hours, leaving a small window for times that police need to review the audio to determine sequence of firing or how many shots there were.
What it really comes down to for ShotSpotter, Klepper said, is being able to articulate its operating system and its mission. Some communities have an immediate distaste for the idea of an audio sensor being monitored at all. The company, however, has had 100 percent buy-in when it has a chance to articulate what it does, how it does it and why.
[slideshow-break]
4. Work closely with government clients
Soofa makes benches with sensors that local government can use to gauge pedestrian density. Sensors like this are a cornerstone of evolving smart city efforts across the country, in major cities from Chicago to Atlanta. Soofa alone has worked with more than 100 cities, using sensors to gauge, for example, how many people pass through a park on a given day, or how popular a public events series is in terms of attendance.Putting sensors in an urban environment, however, can raise privacy concerns within the community. Soofa is aware of this, said Ed Krafcik, the company’s vice president of city development. With that in mind, they work closely with their public-sector partners to establish unique sets of privacy guidelines for the individual communities in which their products are deployed.
How closely? Well, their relationship with the Mayor’s Office of Tech and Innovation in New York City was so robust that when that massive jurisdiction developed its Internet of Things Guidelines in 2016, it used Soofa’s bench product as a case study to refine its own privacy guidelines. Krafcik described Soofa’s approach to privacy as co-creation, as a partnership with the public sector to make sure specialized needs or concerns in cities are handled properly.
As was the case with nearly every company interviewed for this piece, the gov tech market dictates that Soofa make protecting privacy a factor in all of the products it designs. Otherwise, the demand for them might not be there at all.
“At the end of the day,” Krafcik said, “if the public doesn’t trust what we’re doing — whether it’s us or another technology company — the sustainability of that product going to scale in a city becomes almost none.”
[slideshow-break]
5. Anonymize all data
Zencity, meanwhile, is a slightly different sort of company from the others featured here. Its product doesn’t monitor people in a community but instead uses artificial intelligence to collect data points for government from internal sources like 311, as well as external sources like social media feeds and local news reports.Zencity co-founder and CEO Eyal Feder-Levy said that its processes only collect data from sources that are publicly available anyway. Second, it anonymizes all the data its products collect in the interest of protecting privacy.
“Our goal is to show clients the trends that are happening,” Feder-Levy said. “It’s not important to know it’s this person or that person. We don’t even take that into our database.”
The third major privacy protection that Zencity puts in place is an algorithm aimed at removing any potentially identifying data, such as names or addresses or other incidentally added details. That really speaks to the guiding rule for not only Zencity but other gov tech companies as well: Focus on a specific use case while at the same time doing whatever it takes to avoid identifying specific individuals. Zencity, for example, wants to help local governments know what bus routes citizens think should be added. It does not, however, want to know which specific citizen takes what buses.
“It’s what our clients expect,” Feder-Levy said. “It’s what residents expect, and so it’s on us to adhere to that.”
[slideshow-break]
The Practitioner's View
On the debut episode of Government Technology’s new podcast, GovTech360, we spoke to Seattle Chief Privacy Officer Ginger Armbruster. She’s spent the last couple years building the city’s privacy practice, establishing policies and working throughout the organization to ensure new digital services are introduced in a way that doesn’t jeopardize citizen data. Here are a few excerpts from that conversation, which offers some best practices for gov tech companies looking to engage with the government market. Find the full episode and subscribe to GovTech360 wherever you get your podcasts.Q: Is there a way for cities to embrace smarter technologies while protecting citizen privacy?
I believe there is. And I think it starts with an acknowledgment that nothing is for free. So the trade-off about employing smart technology has to be weighed against what you do with all the information you’re collecting. We have to take into account that this isn’t just our world. It’s the public’s information we’re dealing with. So when I sit down with different departments, the very first part of the conversation is, what are we going to do with the data we’re collecting? What data do you need? Why do you need it?
Q: What do companies that want to work with government need to know?
What I want those companies to have done is their homework around the privacy and data policies. What do you do with the data you collect? Because so many business models are built around collecting data and selling it — I’m going to use it in this other way while I provide the service to the city that they need. And that may be OK, but I need to be able to answer those questions about the data. So I would love companies to come in with a clear idea of their data collection practices and what they’re using the data for and their privacy policy.
I also want companies to understand the legal landscape of the city and state that they’re in. We’ve had people come in who have no idea about our public records act and so they get really surprised when they find out that everything is public.
Companies tend to go into the departments and get people sold on benefits and that’s great. I used to be a salesperson. That’s certainly what you want to do to generate the interest. But don’t wait too long to get involved with the compliance side of the house. Don’t wait too long before you talk to the privacy and security people. Don’t wait too long before you realize they’re going to be the ones who say, “Nah, it’s not going to happen until I’ve had a chance to review you.” There’s a lot of delay that can happen while someone’s trying to sell something, and that can be a real disappointment and a real tension. So get involved early with the legal side of the house. Make sure you’ve covered your bases on those compliance issues.
— Noelle Knell, Editor
This interview has been edited for length and clarity.
