Beijing Public Transit Cards Track Your Every Move

If you live in Beijing and you take public transit much, you’ve probably got one of those blue Yikatong public transit cards. They work in all the buses and subway lines, and even some occasional taxis. They also, apparently, are tracking you and posting information about your movements to the internet. Surprise!

A Sina Weibo user revealed yesterday that by simply entering a card number on the card’s official website, users could view a complete list of the places they’d swiped the card.

It would almost be a neat feature for cardholders, except there’s no security whatsoever, so anyone can check anyone else’s movements provided they have the card number — which most users wouldn’t think to keep secret because they aren’t aware of this “feature” on the website. As the user who originally discovered this put it on Sina Weibo:

“If you want to know where someone goes every day, you don’t need to hire a private detective, just write down their Yitongka number and then go to the website and check it.”

The website reveals basically everything users could do with their cards, including when and how much the card was recharged, what bus and/or subway lines they rode on which days, and at what stops they boarded and exited the bus and/or subway.

In addition to concerns about stolen cards and card numbers allowing people to track cardholders, there’s also the concern that the website, if hacked, would reveal data about the movement and whereabouts of millions of people on any given day. This information could easily be used to harass individuals or even to plan more sinister acts by tracking which buses and subway lines are busiest at what times of day.

This is not the first security hole to be found with the Beijing Yikatong cards; a hole in the security of the chips used in older cards led to a hacking incident some time ago, but that hole has since been closed and the cards upgraded, according to Beijing transit officials. It remains to be seen whether this newest revelation will be treated like a security issue — as it should be — or lauded as a “feature”.

[Via Sina Tech]