from the let's-try-this-again dept
Have you heard the story about how Uber was tracking ex-users even after they had deleted the app from their phone? You'd have to be living under a rock to have missed it. It came from a fascinating NY Times profile of Uber's CEO/founder Travis Kalanick and is the opening anecdote, and then it started spreading like wildfire across social media.
Travis Kalanick, the chief executive of Uber, visited Apple’s headquarters in early 2015 to meet with Timothy D. Cook, who runs the iPhone maker. It was a session that Mr. Kalanick was dreading.
For months, Mr. Kalanick had pulled a fast one on Apple by directing his employees to help camouflage the ride-hailing app from Apple’s engineers. The reason? So Apple would not find out that Uber had been secretly identifying and tagging iPhones even after its app had been deleted and the devices erased — a fraud detection maneuver that violated Apple’s privacy guidelines.
But Apple was onto the deception, and when Mr. Kalanick arrived at the midafternoon meeting sporting his favorite pair of bright red sneakers and hot-pink socks, Mr. Cook was prepared. “So, I’ve heard you’ve been breaking some of our rules,” Mr. Cook said in his calm, Southern tone. Stop the trickery, Mr. Cook then demanded, or Uber’s app would be kicked out of Apple’s App Store.
This has created lots and lots of headlines all over the place, claiming that Apple kept tracking ex-Uber users after they'd deleted the app. And some even whining that Apple "let" Uber get away with this with no more than a verbal scolding. The most egregious of these is Andrew Orlowski, over at the Register, who has never found a story about a tech company he couldn't totally misreport to make the company look worse. Here, he claims: Uber cloaked its spying and all it got from Apple was a slap on the wrist. Others just claimed that Uber was "tracking users even after they deleted the app."
Except, if you actually read what the NY Times said it notes that what the company was doing was an anti-fraud detection. Did it break Apple's rules and go too far? Yes, absolutely. Was it bad? Probably. Was it tracking users who deleted the app? No, not at all. Again, there are plenty of legitimate reasons to dislike Uber or to dislike its business practices or its management. But that's no excuse to oversell a story that already looks bad. Uber clearly broke the rules and used a fairly sketchy maneuver to track phones to prevent fraud -- but that's not the same as tracking users who deleted the app. Wired has a pretty clear summary of what actually happened:
Fingerprinting, in and of itself, has plenty of non-invasive uses. Uber, for example, deployed it to help prevent fraud. Being able to identify when a device reinstalls a particular app helps developers spot phones that are, say, bouncing around the black market. In Uber’s case, fingerprinting kept drivers, especially those in China, from gaming a promotion that rewarded them for maximizing ride volume. The company discovered that some drivers were buying stolen phones, creating dummy Uber accounts, and using those phones to call for rides.
When someone uninstalls an app that uses fingerprinting, it leaves behind a small piece of code that can be used as an identifier if the app is ever reinstalled on the device. For the iOS App Store, Apple originally permitted developers to keep track of their users over time using a broad Unique Device Identifier (UDID). Beginning with iOS 5, though, Apple scaled this back, because of the potential privacy implications of giving developers permission to individually ID users even after their app had been uninstalled. Instead, Apple turned to more limited mechanisms, like advertising IDs and vendor IDs. These still give developers the ability to do fraud defense, but with less leeway for potential privacy abuse.
Uber took it one step further, which is to say, one step too far, using application program interfaces designed to access data like an iPhone’s device registry and Apple-assigned serial number.
Again: this is not excusing what Uber did. It clearly broke Apple's rules, and using this kind of fingerprinting can have some problematic consequences for privacy. And, yes, because everything Uber does seems to come included with some secondary component that makes even reasonable actions look bad, the company geofenced Apple's headquarters to try to try to hide the fact that it was doing this. That seems like a pretty blatant admission that the company knew it was breaking Apple's rules. It just doesn't mean that the company was tracking you after you deleted its app.
I certainly understand that there's a long list of actions by Uber that make people not trust the company. And that's completely valid. But if you're going to attack the company, it should be for the bad actions that the company actually did, rather than the exaggerated and misleading descriptions that start spreading across social media.