Hacker News Reader

Comment by jahabrewer | Hacker News Reader

Isn't it wild how little cultural attention is paid to supermarket tracking?

I don't think people really understand what happened. Consumer protection laws allow people to choose whether they consent to being tracked, but then this mutated into a system that effectively means you pay an extra fee to opt-out of tracking.

One of the big US supermarket chains allegedly offered their entire loyalty database to the feds in the wake of 9/11.

In what way would that be even remotely useful?

Apparently the FBI looked at dietary preferences as one way to identify terror cells. Codename Total Falafel Awareness. They deny doing it.

https://www.wired.com/2007/11/fbi-mined-groce/

It wouldn't be legitimately useful, but it can be abused by intelligence agencies. You can imagine a machine learning algorithm trained on the shopping history of terrorists and associates, which then scans the entire database to identify new potential terrorists.

For example, the US has a No Fly List with millions of algorithmically identified potential security risks. If you're on the list you can't get on a plane, but you are never notified or given a reason, and can't challenge the listing. Here's a paper that describes the issue I'm talking about: https://pure.uva.nl/ws/files/4284150/61150_Goede_M._de_Trans....

> This paper argues that the deployment of transactions data of many kinds has become the banal face of the war on terror’s preemptive strike. Because the failure to predict and prevent 9/11 is partly thought to be a failure to ‘connect the dots’ of available intelligence, post 9/11 policies seek to register, mine and connect ever more ‘dots’, or association rules, in the form of credit card transactions, travel data, supermarket purchases and so on. We argue that it is in these ordinary transactions that another spatiality of exception is emerging, one in which the traces of habits, behaviours and past practices become the basis of security decisions to freeze assets, to apprehend, to stop and search or to deport. As such, these developments constitute a relatively unacknowledged violence in the war on terror, which is in need of critical questioning.

Here's an article referenced by the paper: https://web.archive.org/web/20090101121831/http://www.indepe...

> Supermarket checkout staff are being trained by the security services in how to detect potential terrorists. MI5 has been secretly advising food retailers, including Asda and Tesco, on how to identify extremist shoppers. Measures include [...] being alert to mass purchases of mobile phones, which can be used as bomb detonators. The awareness training for staff also covers bulk sales of toiletries which could be used as the basic ingredient in explosives.

With a full supermarket loyalty database, you can just scan for anyone with suspicious toiletry purchases and an ethnic-sounding last name and bring them in for questioning.

If you know the suspect purchased a bag of funyuns, pack of marlboro lights, and a diet dr. pepper 1 liter, having the shopping history of every 7-11 customer for the last X years could give you a high probability of identifying exactly which customer it was, or eliminating exactly which customers it wasn't, from a list you compile from a large set of information sources.

Using metadata and tracked information of known individuals can illuminate the lives of people who aren't tracked through process of elimination and correlation, which is why privacy rights are so crucial to legislate correctly. Right now, the US justice system is not at all equipped to properly handle the scale and scope of private industry's panopticon providing more or less total global surveillance.

We need to see some legislation with teeth, big and sharp enough to completely kill any business, no matter how large, if privacy isn't respected. But hey, let's all enjoy being tracked, logged, monitored, and surveilled every second of every day in the meantime.

I put in fake names, addresses, email, phone numbers, and demographic info on mine.

My personal favorite was Tommy Tutone and the number I used was 8675309 with a zip code of 90210.

Lasted for a year and then they deleted it.

I'm a little less flippant now.

Hey, I've got the same phone number and zip code... were you born on the unix epoch too?

I recall hearing a stat at Yahoo orientation in 2004 that a very large % of Yahoo accounts had the zip code as 90210. I can't remember what it was, but I want to say something like 5-10%. Dramatically larger than any zip code could legitimately have.

What do you think ought to be controversial about it?

Being surveilled as to what food / sanitary, etc products an individual buys is just icky. Supermarkets already know how much they sell, now they want to sell our behavioural info too.

Insurance companies would love to have their hands on it or banks.

They operate at very low margins, 1-3% don't blame them.

Why not? They're making the decision to do these things, so it's their responsibility. That they work on slim margins doesn't enter into it.

Corner stores are gone, supermarkets took over and you have even less variety, and you want to squeeze MORE fresh fruits and vegetables out of your neighborhood? Be my guest and eat only packaged foods so they do make those high margins, don't restock any fresh food and I hope you vote with your wallet to make these supermarkets go out of business. Then you can buy nothing but high margin foods at your gas station.

Not really sure what you're on about here.

> I hope you vote with your wallet to make these supermarkets go out of business.

I do -- not to make anyone go out of business, but because I prefer to shop at supermarkets that don't spy on me. At least in my part of the US, they do still exist and while they do, that's where I'll shop.

The point (for me) isn't to encourage or discourage any particular business practice. It's purely a self-defensive move on my part.

If you don't want to use the rewards at any supermarket you don't have to, so what's the problem?

If you're not a zealot that preference probably melts as soon as you need it fast, or an exclusive price or item. Just from my observations the best performing supermarkets are in low crime areas with an ethnic minority as a majority. Supermarkets that try these tracking techniques aren't doing well, and I don't blame them for trying to survive and bring fresh food.

> If you don't want to use the rewards at any supermarket you don't have to, so what's the problem?

The problem is that stores that do use rewards programs hike up their prices so that the rewards programs are necessary just to get normal prices. This means it's not sufficient to just not use the program -- I need to use a store that doesn't have such a program.

It's also not just about rewards programs. It's about all of the various surveillance mechanisms these companies use. Going to a supermarket these days is like going into enemy territory.

But all of this isn't relevant to my comment. My comment was just that any business is responsible for the decisions it makes.

Private companies keeping records of every single thing you buy. They have a very good idea of your diet, lifestyle, health issues, pregnancy, alcohol consumption, etc.

But in return we get 10p off a pack of doughnuts.

This will come to a head when dynamic pricing becomes the norm. You'll pay more for formula and baby vitamins when you need it the most.

> You'll pay more for formula and baby vitamins when you need it the most.

... so when you have a baby? When else would you buy this?

I get the point you're trying to make, but this particular example seems somewhat strange.

Embarrassingly funny statement.

How would that work exactly?

They force vulnerable people to give up their privacy in order to enjoy normal prices.

Fortunately, at least in my part of the US, there are still a decent number of supermarkets that don't use these cards at all -- so there's still a few I can shop at and get normal prices without having to subject myself to this form of spying. I just have to avoid the major chains.

you're being downvoted, but that's exactly what's happening. Sainsbury's has locked all the price reductions (aka normal prices) behind Nectar.

Going slightly off topic, but I find it surprising that GDPR doesn't offer more protections here. The supermarkets are not using consent, but legitimate interest, as the legal basis to process data.

This is surprising because I would think you should be able to opt out of processing/marketing, while still having the loyalty/points aspect of the card. Particularly given non-member prices can be double to triple the price.

Nectar is especially bad here. I signed up because Sainsbury’s have ‘special’ prices for nectar card users on many items (presumably they increase the price and then reduce it back down for cardholders). But there was no way to opt out of marketing and tracking.

By contrast when I signed up for Tesco clubcard, even pre gdpr, I was easily able to opt out of tracking. I don’t get targeted vouchers, or any discount coupons, but I still get points and clubcard prices.

> By contrast when I signed up for Tesco clubcard, even pre gdpr, I was easily able to opt out of tracking

How do you know they stopped tracking and didn't just stop giving you vouchers and whatnot?

Good point. Although I should point out the vouchers would be for their benefit not mine - the whole point of supermarket tracking is to entice you into discovering some high margin item you will end up loving. So their motivation to track is reduced.

Reply on news.ycombinator.com