Residents and visitors of Illinois will soon become part of a statewide data analysis effort that will allow traffic planners to observe and study individual and group travel patterns within the state.

Planners at the Illinois Department of Transportation entered into a $3.6 million sole-source agreement in 2018 for use of Replica, a traffic management tool that utilizes real-time location information from individual cell phones. Officials expect to access a preliminary version of the product within the next month.

Replica is a spin-off project from Google’s Sidewalk Labs venture, which is working in Toronto to build a street-to-sky smart city as a model for future urban living. Replica offers itself as an urban planning tool for government trying to better understand and prepare for the movements of its residents, a boon to city planners attempting to accommodate modes of transportation beyond motor vehicles and looking better utilize their spaces. The tool is also in use in Portland, Oregon and Kansas City, Missouri.

“We don’t plan to use this for any sort of real-time usage,” said Holly Ostdick, bureau chief of planning for the Illinois DOT. “This is a planning tool for us. What we’re hoping to see is a replica of an average travel day by multiple modes, so not just vehicles.”

Previously, IDOT has used a system that creates an image of traffic patterns by “pinging” cell phones in use within particular areas. If the agency wanted to know how many bicyclists might be traversing a particular pathway, an individual would need to be tasked to physically count the bikes as they went by.

“We’ve always been looking at it by ‘How many cars are on this road?’” Ostdick explained. “This is going to tell us how many people are on that bus, how many people are riding their bikes to the train station to get to work. That’s going to help us prioritize and plan for more multi-modal investments in the future.”

Well, hello Windy City. 👀 pic.twitter.com/xW3z27wyDa

— Nick Bowden (@njbowden) August 23, 2019

IDOT has acquired the tool with the intention of providing access to other transportation managers in the state. The agency has not yet received the product, as Replica calibrates its tool for the area using data provided by IDOT, Chicago Metropolitan Agency for Planning, and the Regional Transportation Authority.

These data points include transit ridership numbers, vehicle miles traveled numbers, speed data, and any available counts for bike and pedestrian travel. Ostdick said that Replica was also interested in numbers related to Transportation Network Company (TNC) use, which include companies like Uber and Lyft, but IDOT did not have that data available.

That data, most of which Ostdick says is publicly available and accessible anyway, is meant to help improve the accuracy of Replica’s tool. However, it remains unclear what other sources Replica is currently culling.

Replica’s affiliation with Alphabet Inc. puts it within the “Google group of companies,” which also includes Google Maps and Waze, popular navigation applications for drivers. Included in the Terms of Service for both pieces of software is the permission to track the location of the phone being used for the service and to share personal information within the “Google group of companies”.

“[T]he data being collected is anonymized. Replica has said on the phone many times that all the data and information that they have is anonymized. They don’t take non-anonymized data. In that case, they don’t have anything,” said Tim Morris, assistant chief counsel for the Illinois Department of Transportation. “And the way we understand our working relationship with SWL [Sidewalk Labs] is that the data that we receive from them will not have any personally-identifying information.”

Replica did not respond to a request for comment by publication time.

Morris said attorneys at IDOT worked with Replica and CMAP to incorporate the requirements of the Illinois Personal Information Protection Act into the agreement between the state and Replica, requiring each side “to maintain reasonable controls over how the data is stored and protected against unauthorized use or modification.” However, those controls won’t be agreed upon until after the tool has been received.

Privacy advocates emphasize that the difference between the de-identified and anonymized data is important, and even the latter, considered more secure, can have issues.

“People should be aware of if something is being used to record information on a mass scale, is there the capable to personally identify people, even if it doesn’t have any target at the time?” said Jake Laperruque, senior counsel at the Project on Government Oversight. “Or is it only retained or used in an anonymized form where you could never actually find, ‘Oh, these people were at this place and this place and this place.”

Paige Boshell, whose firm Privacy Counsel LLC works with corporate and private clients, is concerned about the spread of the secondary data market, which hasn’t experienced a level of regulation comparable to restrictions placed on the initial collection of data.

“One concept would be limiting the use for the consent is for and require that the consent be specific. We see a lot of big companies - Amazon, Facebook, and Google - their consent is we can use this in the course of our business. It’s very loose language,” Boshell said. “The other approach is to have a conversation around regulating the secondary market data. And what is kind of concerning about the secondary data market is that what we’re seeing is that this data is being used to create profiles of individuals, and then to reidentify that data, and then to be used all sorts of purposes. The individual doesn’t even know that there is a profile, what the data is that went to the profile, so there is no means to object to the profile in the first place.”

Ostdick said that IDOT has been happy with the relationship thus far and highlighted that Replica has been very transparent with the process, reiterating that the agency believes the information will be kept private and secure.

“We don’t have the tool in front of us, so we don’t know totally what it’s capable of,” Ostdick said. “Our understanding is that it’s not going to be able to go down to a single person.”

“And, if there was a member of the staff or someone else that we were in an Intergovernmental Agreement with to use this tool were to engage in that type of use,” Morris added, “to deanonymize or somehow reverse engineer the Replica mirror world data to an IRL real-life human being, then that would go against the Terms and Conditions of the contract’s protection of data and other actions between the parties would follow from that.”

Image via Replica.

Algorithmic Control by MuckRock Foundation is licensed under a Creative Commons Attribution 4.0 International License.