BART, app maker sued over allegations of "clandestine collection" of cell phone data

OAKLAND, Calif. (Lisa Fernandez/KTVU) - An Albany woman on Monday filed a federal lawsuit against BART and a Massachusetts app maker alleging the transit agency is involved in a “clandestine collection” of private cell phone identifiers. 

BART rider Pamela Moreno filed the suit in U.S. District Court in Oakland with the assistance of lawyers Eve-Lynn Rapp and Nina Eisenberg of Edelson PC in San Francisco.

Moreno is suing BART and the app maker Elerts Corp, alleging they are violating California’s Cellular Communications Interception Act, among other privacy and intrusion violations. The suit seeks to stop to the use of the app and $5 million.

“Through the BART Watch App, defendants have been secretly amassing tens of thousands of cellular identifiers linked to personally identifiable information,” the suit claims. 

On Monday, BART spokeswoman Alicia Trost sent out a statement saying the original intent of the app was to be a "helpful tool" for customers to report security concerns. The statement insisted that BART does not use the app to "randomly track users." An app's user location is only available, the statement said, if users select to share that information. "And then, BART only receives the user's location when the user is reporting an incident. There is no default setting - the user needs to agree," the statement reads. 

An Elerts spokeswoman did not immediately return a call seeking comment.

BART began using the BART Watch app in 2014 and spent about $300,000 on its development, touting the app as a “discreet” way for the agency’s annual 120 million riders to “send a report to police” on suspicious behavior. Up to 50,000 people have downloaded the app, the suit notes. The app became the focus of a separate East Bay Express investigation  in 2015, when the weekly alternative newspaper revealed that users were disproportionately reporting African- American and homeless riders for activities, and many of whom were never arrested for any crimes.

BART is not the only transit agency to use Elerts. According to the Elerts website, the Santa Clara Valley Transportation Authority  and the Sacramento Regional Transit use the same Elerts app, as do transit agencies such as DART in Dallas and the Toronto TTC.  A review of online federal court records on Monday, however, shows that Elerts has not been sued in regards to either of the other California transit agency cases. The plaintiffs' attorneys say that at this point, only BART is being sued, and that the surveillance technology is not always used in each of the applications used by other agencies.

The suit compares the BART Watch App to the controversial Stingray tracking devices used by at least 72 federal law enforcement agencies identified by the ACLU, which strongly condemns their use. The ACLU describes these “cell site simulators” or “IMSI catchers” as “invasive cell phone surveillance devices” that mimic cell phone towers and send out signals to “trick” cell phones in the area into transmitting their locations. They also gather information about the phones of “countless bystanders who happen to be nearby.” BART does not specifically use Stingray technology.

Moreno, in her lawsuit, does not agree with BART that the privacy policy regarding a user's location is clear. The suit calls the policy legalese a “gotcha” contract, which does not easily lay out BART’s data collection practices. In 2015, lawmakers passed the Cellular Communications Interception Act, requiring public agencies to post its privacy policies very conspicuously. “Defendants’ undisclosed collection of cellular identifiers and locations en masse is precisely the practice the California Legislature sought to protect against when it passed” the act, the suit contends. BART, however, in its statement, contends the user agreement and privacy policy can be found in "multiple" areas.

In an interview on Monday, Chris Conley, policy attorney for the American Civil Liberties Union of Northern California, said the issue here seems to be the ongoing information BART is collecting from users about their locations, even when they are not using the app.

And even though the app simply records “bit of information,” Conley said in this day and age, it’s really easy to “connect bits of information together and turn that into a name and a person.” That means people who have this information could figure out if you “went to an ACLU rally or an NRA rally” or “who you might be romantic with,” Conley said. “The purpose of the app seems positive, ‘Let’s make BART a safer place,’ but the data being collected seems to be divorced from its application.”