Uber allegedly used secret program to spy on Grab

Grab cars in Singapore. Photo credit: BYD.

A secret Uber program supposedly spied on Southeast Asian rival Grab and collected data on its drivers, according to a Bloomberg report.

Called Surfcam, the program developed by an Uber staff scraped data that competitors “published online” to figure out how many drivers were on their systems in real-time and where they were, the report said quoting anonymous sources. It’s unclear where the software was scraping the data from and whether the data was public, or if the scraping helped make a dent in competitors’ performance. It started in 2015 while Travis Kalanick was CEO.

The tool, said to have been mainly used on Grab, raised concerns with a member of Uber’s legal team “who questioned whether it could be legally operated in Singapore because it may run afoul of Grab’s terms of service or the country’s strict computer-crime laws,” the report added.

We’ve asked Grab if it was possible for Uber to have accessed its driver data, but it did not address that specifically.

“We uphold ourselves to strict quality management standards and internal governance, and work closely with regulators and governments in all the countries that we operate in for nation-building efforts,” it said in its response. “We believe in being responsible corporate citizens and believe companies should be held accountable by the government and public for their corporate behavior.”

Uber declined to confirm the report or give a comment.

When does data scraping become illegal?

The question now becomes: was the scraping Uber supposedly did illegal?

Data scraping is more common than people realize. It’s just like how Google spiders the web to make information searchable or how aggregator websites work.

“Where the practice may potentially get problematic is if data scraping turns into something more targeted and invasive,” said Choo Zheng Xi, a litigation lawyer and director at Singapore-based law firm Peter Low & Choo.

Under Singapore’s Computer Misuse and Cybersecurity Act (CMCA), “any person who knowingly causes a computer to perform any function for the purpose of securing access without authority to any program or data held in any computer shall be guilty of an offense.”

That means if under its terms of service Grab owns the data Uber’s reported software supposedly scraped, Uber could be liable. “It’s less controversial if Uber was merely trying to obtain insights into customer behavior by data scraping public interactions on the Grab web page,” Choo explained.

In the US, several lawsuits have been filed in relation to data scraping; a recent one involved data analytics startup hiQ and LinkedIn. The latter had sent hiQ a cease-and-desist barring it from gathering information from public LinkedIn profiles, which hiQ uses to create products it sells to employers.

In turn, hiQ sought a preliminary injunction against LinkedIn. The two sides’ arguments: LinkedIn claimed it had a right to protect the privacy of its users by blocking usage that violates its terms of service, while hiQ countered that it never trespassed but only accessed LinkedIn data available to the world. A US district judge hearing the case ruled in favor of hiQ.

A string of spy projects