EFF Guide to Street Level Surveillance
eff.org
eff.org
It's not even difficult, I set up a Raspberry Pi to do it and graphed the arrival and departure times of individual workers in my office. There are businesses putting tracking across a constellation of retail partners, then selling the partners information about what other stores their customers visited.
And yes, I'm aware that iOS 8 is supposed to randomize your MAC address to guard against this (cynically I'd say it helps them push iBeacons) but as of September 2014, it wasn't really working as you'd expect: http://www.imore.com/closer-look-ios-8s-mac-randomization
Eg: http://www.autoblog.com/2011/06/27/e-zpass-privacy-invasion/
and: http://www.forbes.com/sites/kashmirhill/2013/09/12/e-zpasses...
This is true as of recently for the Golden Gate Bridge as well. :/
* i have never been told, but can easily imagine my VPN connection logs (server side) can be checked for when i logged in/out (not that they could even imagine i get in also via ssh/port forward through another box, when the VPN is down due to admin negligence) so i have no expectation of privacy there either.
Second, it's common for workplaces to have cameras and doors with badge access that track this sort of thing already. So it's not like he would be doing anything creepy even if he were the employer.
Hence my question: Do his colleagues know he is doing this?
[edit] I know I am being "tracked" by colleagues when they are physically present and can see me enter the room. I also know I am being tracked by my employer when I use my swipe card to enter the office building. What I assume is not happening is that any of my other colleagues have electronic devices collecting my arrival/departure times for whatever purpose, regardless of their presence.
What if he started hiding microphones in the office? Is that ok? After all, if you say something out loud in the office, people can already use their ears to track it...
We never knew the MAC addresses of anybody but ourselves, though with physical surveillance we could have correlated MAC addresses to comings and goings.
Basically I don't feel that this is particularly creepy unless you are applying it to identifying and tracking specific people. For bulk population metrics I have no problem whatsoever, and I have no problem being tracked in this way, but as a data analyst I know that the line between 'fine' and 'invasive' is a single SQL query.
It's kind of like how tracking phone calls metadata for billing is OK, while tracking it for surveillance is not, and the difference is the collector's intention.
> What's the moral difference between that and checking to
> see whether they also emit some electronic signal when
> present?
Manually observing someone and making a note costs resources. Which means you won't bother doing it unless you have reasonable cause to. If John in accounts has a reputation for being late and not getting his work done, you might decide to have someone make a note of what time he comes in and leaves.
If it's automated, that cost goes away, and you can just randomly trawl the data and look for anyone; it's become massively asymmetric. Suddenly John in accounts who was 10 minutes late every day but doing a good job gets a call from HR.
This is generally the problem with mass surveillance and putting the data in to easily queried databases: the cost to query and surveil becomes much much less, which removes the need to have reasonable cause -- you can just go for fishing trips and see what you find.
If you are visually noted to be somewhere, then you usually subconsciously know that you were noted. He saw you, and you saw him seeing you.
It consists of watching your city council agenda for consent to purchase new surveillance technology via Department of Homeland Security grant.
Use this occasion to push for a privacy policy that governs the new equipment as a condition of purchase.
Restore the Fourth SF Bay Area, Oakland Privacy et al are seeing a pattern emerge where the purchase is either delayed or the privacy policy is adopted.
It's often possible to sign up for email alerts of the agenda for city council meetings.
The "tinfoil hat" approach is a personal-scope solution.
Part of the "what do I do when I encounter it" course of action could involve a societal-scope solution. E.g., getting involved with privacy advocacy groups or pressuring relevant lawmakers to roll overreach back. (This is, admittedly, far more work and far less likely to succeed.)