Uber and Lyft to swap data on banned drivers | Hacker News Reader

Uber and Lyft to swap data on banned drivers

bbc.co.uk

163 pointsrecursion84 comments

Open articleView on HN

Examples of competitors sharing data about bad customers across several industries:

- competitor banks share information about people who bounce checks

- competitor insurance companies share data about customers with fraudulent claims

- competitor casinos share photos of card counters

Probably many others I can't think of.

EDIT to reply: thanks for the customers' returns example. I found a story explaining the shared database: https://www.elliott.org/case-dismissed-2/the-retail-equation...

If you are banned from returning merchandise to Amazon, Home Depot, CVS, Sephora, Dick’s, JCPenney, Victoria’s Secret or Best Buy you are likely banned from doing returns by all of them.

They are all using a third party called The Retail Equation.

How would they know who you are, if you're paying cash or not using the same card?

If you're doing a return on a cash transaction, a lot of stores will ask for ID.

https://www.theretailequation.com/frequently-asked-questions...

> How does the system work?

> When a consumer wants to make a return, a retailer will scan the original sales transaction receipt and/or collect consumer identification (in certain regions that may be the individual’s driver’s license or government-issued ID card) to make an identification of the person and his/her unique return behavior.

Most ask for photo ID when you do a return.

This is why it's good for hackers to bootstrap other identities over the years. You never know when they come in handy.

(Note: I have not done this. Or have I? Well, no I haven't, but if I had you wouldn't know about it.)

It's one of the most interesting "careful" projects you can do. Something like "Satoshi Nakamoto" can release software to change the world, but you can compare their style of writing to the short list of crypto researchers whose identities are known. Similarly with JK Rowling's book released under a pseudonym. It's very hard not to slip up and have your identities connected. However, in a world where everyone is supposed to have just one identity, and present this ID to communicate or transact on a given network, and where all databases are interconnected, the only way to preserve anonymity would be to hijack someone else's identity temporarily (such as making a call from a person's phone, or having a homeless person go buy a prepaid phone for you). Sometimes people swap identities voluntarily ... such as with bitcoin mixers or when you swap DNA samples before sending them back to 23andme and other test centers (who btw keep your DNA for the government and all kinds of things). But the risk is that you can be held responsible for something someone else did, with laundered bitcoins (civil forfeiture) or some physical crime (DNA analysis might indicate it's you).

I wrote this 8 years ago: https://magarshak.com/blog/?p=114&cpage=553?p=114&cpage=553

i suppose it depends on the details, but if you're asked for state-issued identification when processing a return, and you present a falsified document that purports to be state-issued, that's a almost certainly a crime. (even the creation of such a falsified document is likely a crime.)

I presume that the parent post refers not to forged documents but to obtaining legitimate identification under a different name/alias - which is generally allowed in common law countries, where you can choose and use any name you wish, as long as you are not trying to defraud someone (e.g. here's a case example from Massachusets http://masscases.com/cases/sjc/320/320mass448.html "If acting for an honest purpose, one may lawfully use a name other than his legal name without procuring a change of name").

The question there is whether avoiding a ban on returns would count as a honest purpose; arguably it would not. A standard example for inappropriate name change is changing the name to avoid seekers of debt repayment using the previous name, this seems similar in intent.

avoiding a ban on returns should certainly be considered fraudulant - you're banned by the store's policy, which you would have agreed to when purchasing.

> competitor insurance companies share data about customers with fraudulent claims

I'm pretty sure it's any claim. If you want to see something scary request your lexis nexus consumer report.

When I switched to a new homeowners insurance provider, the insurance company helpfully mailed me a letter containing all my previous claims (not that there are many), even including claims from renters insurance policies.

Why are any of these things good for the consumer? All of these sound like DBs that should be limited if possible.

Successful insurance fraud presumably increases costs to consumers via higher premiums, right?

similarly, there are serial returners who purchase with the intent of returning later.

All these business costs are passed onto other consumers... and while maybe not illegal, businesses essentially have Terms Of Service just like any other private entity.

Rideshare banning bad customers means more people will work for them due to less fear of being murdered by crazies. End result, i can get an uber when i want one. Seems like a win for me.

It also means if you were banned in error you are banned everywhere and there is exactly nothing you can do about it. This is bad.

I do agree on services sharing banned users data, for safety or compliance reasons. But this should be limited to a set period of time, because the person you were 10 years ago grew up from who you are now and will be in 10, 20, 30 years from now. We all grow and hopefully learn from mistakes.

An implication of this “banned users” data sharing is that this data exchange must be overseen by regulators, to enforce equal access to competitors to this data and also that companies drop people from the “banned users” database after some time, not penalized for life except in rare cases.

I would argue that most users’ petty behaviors that lead to banning do not deserve to make them pay for it the rest of their lives - and that there are rare exceptions who do deserve to be banned for life because certain users’ behavior is so egregious.

Also, consider cases for jurisdictional banning and global banning. Some behaviors are not allowed in certain countries. Take a gay couple kissing in a car in Saudi Arabia - should this couple be banned? If so, just if attempting to use services in Saudi Arabia, or globally? These are serious and important considerations.

I'm not arguing that its a perfect utopia or even good per se, just that there exists a benefit to the average consumer, in response to the GP's question.

> We all grow and hopefully learn from mistakes. ...An implication of this “banned users” data sharing is that this data exchange must be overseen by regulators

the gov't can require that each company has an appeals process, which can be brought to a court if the banned user decides that it's worth escalating.

In fact, i think a general, low cost court process for digital service providers would make for a great consumer protection, but still allow digital services to be flexible in how they want to provide. For example, google can still ban people, but the user can appeal, and if the user is unsatisfied with the appeal, they can go to court (without costing exorbitant amounts of money).

A good example of banks doing this in the UK is CIFAS, member companies of CIFAS can submit a black mark against an individual, which may in turn cause their other bank accounts to be closed, even if the black mark was in error.

If you’ve ever had an account closed, you’ll discover the bank will refuse to tell you why. So if you aren’t aware of CIFAS, things can be pretty confusing.

Near zero repercussions for the bank that wrongly adds anyone to the database (potentially a 3 figure sum awarded by the financial ombudsman, again if the person is aware of the financial ombudsman).

I’m frankly surprised they’ve been able to continue to exist. Only with GDPR coming in have they given you the option to check if you are on the list without having to write a physical letter.

Examples of them screwing up:

https://www.theguardian.com/money/2020/oct/31/mortgage-fraud...

https://www.msbsolicitors.co.uk/cifas-fraud-markers-the-prob...

A noble effort, but I'm certainly concerned about the use of a background check company. This is anecdotal, but I've missed out on a job before due to misreporting from a background check company. The amount of hoops I had to go through to prevent the mistake from happening again took years - and of course, the opportunity for that job was long gone by then.

Really, the only proper way to do a background check is via your local law enforcement. These companies should not be relied on. Ever. Even if they're right a majority of time, the cases where they're wrong are too damaging to be considered trivial.

> Really, the only proper way to do a background check is via your local law enforcement.

What in the history of policing makes you think they're immune to similar mistakes?

There's more legal recourse for a mistake from law enforcement, and furthermore, they aren't going to show cases where you were acquitted. In my case, the background check company reported a crime that I HAD been arrested for but found not guilty of. Background check companies don't do their due diligence in making sure that the records they gather are still valid. I wanted very much to sue the company that cost me that job opportunity, but they've covered their bases enough to shift accountability to the customer.

Basically, they put an asterisk next to their reports saying to take them with a grain of salt. But that doesn't change the damage done by a potential employer getting a peak into your past that they never should have gotten.

Edit: fixed some typos

> There's more legal recourse...

For people who don't know lawyers, that's largely theoretical.

Let's say you are mistaken for a wanted robber and arrested and later acquitted or have the charges dropped, when that record is expunged, there is a legal duty for the government to destroy all records related to that arrest.

If they don't, you have political and legal recourse. A third-party company doesn't have the same legal obligation, nor does the public have any democratic control over that organization. Data companies have institutional pressures to preserve data at all costs, not to be proactive in destroying records of innocent folks.

And at least in my state, if you are booked after your arrest, you now have a "prisoner file number" (PFN), even if they release you immediately. This is what a cop is using when they ask if you've ever been arrested before, checking to see if you lie.

In Europe, a third party company would have a legal obligation to keep their records accurate.

"In Europe" is not really accurate here. In some countries it is actually illegal to do any background check at all apart from the ones provided by the state (you can still check if a diploma is real of course).

In some other there will be no real obligation of keeping the records accurate (sometimes there is one theoretical but not enforced, sometimes there is one but with a legal leeway that allows a certain amount of inaccuracy).

In my (limited) experience, mistakes among LEAs is more along the lines of they have data that doesn't match a real person. I'm not saying it doesn't happen, but getting people mixed up isn't something that I've seen.

There's a lot of entropy in first/middle/last names, DOBs, SSN, driver's license, etc. so accidental typo matches just means bad data, not some other person.

(Obviously, intentional identity theft notwithstanding.)

Sad truth is that law enforcement also cannot be blindly relied on for background checks. Clerical errors happen everywhere, and law enforcement is even less accountable than some random company.

I'll take FOIA and a bureaucracy with official avenues of redress over a company that likely views my ability to see and rectify their data on me as anything from undesirable to an existential threat.

FWIW, I used to work for a background check company and they operated exceedingly ethically. If there was a hit, for example, they would reach out to the given agencies and confirm that it was actually that exact person before reporting the results.

Far as I understood it, that was exceptionally rare in the industry. Not sure how prolific their customer base was or if they're still active.

I wonder if they'll start sharing data on banned passengers. I think this is a much more interesting and nuanced social issue.

A recent viral video this week showed a woman assaulting an Uber driver, she livestreamed on IG to try to justify her actions and in the process said that she would only be using Lyft, then lyft tweeted that they pre-emptively banned her.

If FAANG joined together to make a shared blocked users list, they could effectively make a digital caste system subject to little current government oversight.

> they could effectively make a digital caste system subject to little current government oversight

You mean like credit scores?

Reminds me of that one Black Mirror episode

Honestly I think FAANG know better than to try to do something like that. They are already getting closer to regulatory action to limit their influence and some politicians want to see them be broken up.

And that's just in the US, if they pull something like that in the EU it's almost certain there would be new laws put in place to inflict heavy fines.

Cancel culture ensures we basically have that already... How many times has an undesirable been unpersoned from Twitter, Facebook and YouTube within hours?

and what if they weren't really undesirable, but framed? What if they actually had a case, but the context shows a biased view?

That's why we don't rely on the court of public opinion for deciding guiltiness of an accused.

What needs to be canceled is cancel cultuer itself.

Yeah I'm agreeing. Undesirable wasn't meant to be literal.

Airlines do similar things for anything safety related. Having safer airlines is good for business and there's no sense in hoarding that information.

I wonder if other taxi services do anything similar regarding drivers they fired for safety reasons

They are still learning how to get up websites.

I'm sure the process exists, it's just much more localized.

If bob from City A's best taxi fires you and you try to get a job at City A's fastest taxi, fastest guy is probably gonna call best guy.

If you move cross-country, probably not.

Except... it ends up being a non-reviewable blacklist that most people don't even know exists.

What safeguards are there so that a grouchy driver or engineer can't use it to mess with their ex? For instance.

I would imagine there's a review process for allegations already.

I assume there is safeguards. But for the same reason these lists aren't public, their policies aren't either.

Well, I think people tend to assume there were safeguards in place for things like this, too.

https://www.techdirt.com/articles/20041207/1958200.shtml

Doing these things in the dark almost always leads to abuse.

https://www.asias.faa.gov/apex/f?p=100:1::::::

(PS: what is going on with all these colons in their urls?)

For URLs like that the answer is usually either "Java" or "Microsoft."

>What safeguards are there so that a grouchy driver or engineer can't use it to mess with their ex? For instance.

Not gonna say it's perfect, but as an engineer at one of these companies I'll say production access is generally very locked down and audited to the point of often being quite an encumbrance to even be able to debug production issues. Very unlikely anyone will be willy-nilly blacklisting drivers over personal vendettas.

The conspiracy theories never end. Next they're going to say there is some 'god view' built into the uber code allowing executives to track and retaliate against journalists that annoy them!

Which...was..proven true:

https://www.forbes.com/sites/kashmirhill/2014/10/03/god-view...

he was being facetious :)

HN is the best straight man.

It seems like you may be talking about the no-fly list (which I think is controlled by FBI's TSC with some partnership with DHS) while GP may have been talking about NTSB/FAA safety sharing programs.

I suspect NTSB/FAA are much more effective at correcting bad info than no-fly list which is managed by people who like to think they are fighting so much evil the harms of their policies are justified.

The No-Fly List[1] has been a two decades long quagmire that has put thousands of people into a situation where they're banned from travelling despite doing nothing wrong.

[1] https://en.wikipedia.org/wiki/No_Fly_List#Vulnerabilities

Despite the unethical and immoral behavior of Uber executive leadership, from the outside, Uber seems to have a better safety profile than Lyft. They added safety features to the app, such as emergency service requests, long before Lyft did. Both companies probably did it in response to sexual assaults that both companies enabled, but Uber took quicker action.

I've seen some truly horrifying behavior from Lyft in terms of safety that makes me cautious of wanting to use the app, despite liking Lyft's public presence better. I suspect it's in the interest of growth and gaining market share to have things like lax-er driver background checks so they get more drivers. In the end it ends up hurting them a lot more, and can lead to terrible things for riders.

> Despite the unethical and immoral behavior of Uber executive leadership, from the outside

Interestingly, literally every C-level exec at Uber from the Travis Kalanick era has been replaced. Uber is the "Ship of Theseus" of companies.

And yet— still the same ship, right? It would be fascinating to have some insider stories about whether overhauling the upper management has actually changed the culture of the company, or if it's largely the same attitudes and behaviours at play.

> And yet— still the same ship, right?

Not necessarily. That's the whole debate!

I joined Uber a few months before Travis left. I can share a few things that come to mind:

- shortly after Dara joined, he sent a company-wide email to the effect of "all corporate espionage projects must be halted effectively now"

- he introduced a new guiding motto: "We do the right thing. Period." and repeatedly refers back to it

- he found out about a previously undisclosed data leak and went ahead and made a proper public disclosure. The CSO had to leave the company and eventually got charged as a result[0]

- on an all-hands meeting centrally themed on making things better after the Fowler scandal fallout, a board member made a cringey sexist joke. He had to resign from the board that afternoon. This incident spoke volumes about how discrimination culture was no longer going to be tolerated.

- around the same time, as part of the HR revamp, a number of policies were introduced (training courses, anon hotline)

- there was a huge internal project called 180 days of change in response to the wave of scandals. This encompasses the safety features, along with improvements to the driver UX to make it easier to understand their income, among other things (which I hear were very well received by users).

[0] https://slate.com/technology/2020/08/uber-joseph-sullivan-ch...

Apparently he is CSO at Cloudflare now [0]

Speaking that crime doesn't pay...

https://twitter.com/joesu11ivan

edit: this and some other questionable hires and moves by Cloudflare made me do everything I can to avoid using CF services. I have many of CF hosts in my blacklist now.

That is helpful to hear, thanks for sharing— dismissing the board member especially feels like a very tangible, real thing.

This is actually a good thing. Companies that can execute while rotating leadership are companies of rules, principles, etc, not companies of people. This is a very good thing.

What if the company’s rules, principles, etc. are immoral, unethical, or otherwise bad for the company’s long-term viability?

Then it stops existing at some point in the short to medium term.

So then it sounds like within this, part of what we think of as the prevailing morality can actually be defined as the behavior of companies who have been around for long enough. This is probably why a lot of companies seem to get away with "bad" behavior: people who think of the behavior as bad simply don't know the rules. Just be sure to throw in a token fine or fire a middle manager in order to preserve the illusion.

1 principle: Make as much money as possible.

Do you remember the time Wells Fargo set such high sales targets for its employees that unless they committed fraud, they could not meet it; and then fired those who did not commit fraud and thus fell short of sales targets; and then many of those fired employees found out that they have been essentially blacklisted throughout the entire banking industry, because Wells Fargo had added negative remarks about them to their U5 to justify the firing instead of telling the truth that they were fired because they refused to commit fraud? I sure remember.

The problem with these sorts of backchannel data sharing is that unlike things like credit reports, individuals have little to no access to see what is in their file and dispute it.

https://www.nytimes.com/2016/11/04/business/dealbook/wells-f...

If you read "drivers" as "employees," this is much more mixed and can get scary fast.

Do they have a similar list for customers?

There is some atrocious behavior out there in both the passenger and driver seats.

I don't think there's a formal sharing program for shitty riders, but it definitely happens in some cases.

https://twitter.com/lyft/status/1369390197503361030

If only there were a commercial passenger permitting system that already existed, ensuring that drivers who should not be carrying passengers were denied operating license regardless of the business they work with.

(For those not familiar, we do already have this in the US, but Uber/Lyft wanted their drivers not to be commercially-licensed, so now they have to reimplement the DMV.)

This is obviously a good thing from a safety standpoint, but I worry we are increasingly becoming a one strike society. Where one instance of bad behavior locks you out of significant parts of the infrastructure. Moreoever this happens in a "court" with no documented laws/appeals process.

Cancel culture in a nutshell.

There's a reason we have "innocent until proven guilty" and lots of interlocking checks and balances in the legal system to prevent the mob from lynching people.

Nowadays they can lynch your social life and employment options over a drunken tweet.

How do we fix this?

It has been standard advice--for almost a decade-- to watch what you say online before applying for a job. And background checks have existed for work and renters for much longer.

Why is this necessary? If people are convicted of sexual assault, it's on the public record. Otherwise, even though some accusations that are not brought to court may have merit, Uber or Lyft should not be the ones to arbitrate on that.

https://www.theroot.com/uber-bans-passenger-for-life-after-s...

Honestly, I don't think this goes far enough. If you're misbehaving enough to get banned from Uber, you probably shouldn't be holding any other gig work poisition either! This should protect customer safety, by ensuring that once someone is proven problematic, they can simply be removed as a gig laborer, no matter how that looks. Perhaps this could be expanded to traditional employment, as well. This should protect companies from bad employee behavior permanently, and improve society thereby.

So social credit scores?

We basically have these already, as described by some of the interesting comments on here. It's just a fragmented system instead of being centralized.

> Perhaps this could be expanded to traditional employment, as well.

It's already hard to get a job as a felon in the US, and hasn't that worked out great!

In case it's not obvious: Just no. It's been tried. It's a horrible idea.

I hope there is some way for drivers to appeal.

what else are they sharing? who wants to bet their next paycheck that they're colluding on fixing wages?

Uber and Lyft aren't big fans of having drivers accused of sexual assault or theft. I'm sure you could come up with a nefarious take, but it's really just a way of filtering out bad actors before they hurt riders.

Reply on news.ycombinator.com