In the coming months, Metro, our esteemed public transit service, will introduce a new and convenient way for its customers to pay. The One Regional Card for All (ORCA Card) is soon to be rolled out regionally, and will provide customers with the opportunity to pre-pay for all of their transit, including bus, rail and ferry, enabling quicker and easier travel. This technology has earned the nick-name "smart card," and it will also store all of the individual-specific travel information in a central database.

While this might seem like a winning idea, some at the UW are raising serious concerns about the University's desire to link the ORCA Card to the Husky Card, enabling Metro workers, school administrators and law-enforcement officials to effectively track faculty and students' movement around the region. In essence, they're worried that the smart card might be too smart.

Gaetano Borriello is a distinguished professor of Computer Science and Engineering (CSE) at UW and is an expert in the field of smart card technology. Borriello was present for a discussion last spring between CSE staff and the UW administrators who had been working on the privacy issue, and was subsequently asked by the CSE staff to write a letter of concern to UW President Mark Emmert, which he sent in mid-July.

"The concerns of our staff regarding the privacy implications of the ORCA Card were heightened, rather than reduced, by the presentations of the UW officials and their responses to questions," the letter states.

Among the concerns outlined in the letter are that "the ORCA Card will present an unprecedented ability to collect data on the travels of all members of the UW community," and that "the mere presence of this data in a database is problematic as the data may be open to a court subpoena or may fall into the hands of unauthorized persons."

One of the UW's arguments is that the ORCA Card will help prevent fraud in the form of U-PASS cheaters, or people who loan their Husky Card to a friend or spouse. The new card may also help limit the U-PASS to UW-specific travel.

Borriello's letter argues that it is the transit authorities who should work to prevent fraudulent use of their service, and not the UW. Additionally, regarding UW-specific travel, he claims that those in his department "were all under the impression that the U-PASS program specifically encouraged the use of the pass for all travel, including personal travel."

The UW's decision on the matter seems all but final, with multiple UW Web pages touting the advantages of the pending shift and referring to full implementation in mid-2008.

An e-mail to the Husky Card information office was not returned in time for this article, but the Husky Card Web page outlining this issue says that the files with the stored travel information "will have the serial number of the active U-PASSes but will contain no names."

However, Borriello's expertise on the tracking devices leads him to point out in his letter that "by simple cross-reference it is possible to determine the identity of an individual just from the times and places they board and exit a bus." He insists that "the data collected should be reviewed by data mining and information security experts to make sure unintended inferences cannot be made."

Borriello grants that smart card technology has "many potential benefits, but their simple ability to unambiguously identify a person ... gives them a large potential for abuse." The letter concludes that those in his department "feel strongly that the University of Washington should do its best to be a shining example of how individuals' privacy can be respected."

A comprehensive interview with Borriello on this matter will be featured on What-About Radio today at 5 p.m. on RainyDawg.org.

[Reach reporter Matt Dundas at news@thedaily.washington.edu.]