Is Uber’s rider database a sitting duck for hackers?

My guess is it would be more blackmail oriented. If you knew Senator X was taking an Uber to some hotel, it could be worth looking into if he/she has a call-girl meeting him there. Maybe he's taking an Uber to an office of some defense contractor. Those are the things that could at least lead to some further targeting that might be interesting to foreign powers.

Individual cases don't tell you much. Patterns of behaviour much more-so. If Senator A and Senator B are meeting regularly, that tells you something.

Ask any cab driver about drugs and prostitution in their locale and they'll be able to give you quite a lot of information (you might have to buy them a beer or three first). Uber's records could reveal substantially similar things, like "Person X from escort agency Y visited address Z twice a month for a year".

If you know who lives at Z, you know a lot. Again: not from one trip, but from the pattern. And not with certainty (obviously: knowledge is not certain) but with high enough plausibility to target a deeper investigation.

well, this is how textbook blackmail starts. you can probably compute an inverse "rides of glory" measure and detect people with something to hide, make a stab at what it is, approach them, and pressure them, without ever leaving the safety of your home. you could apply this to everyone. that doesn't sound bad? or do you think that people should just not have anything to hide...

Transportation data can provide clues about potential business dealings. Say you saw that attorneys and executives from Google are frequent visitors to a small but public software company's offices. You could deduce a possibility that they were hammering out an acquisition, and front-run the deal by scooping up stock in that company before the news was public. It's not a guarantee - but in an age when satellite photos of parking-lot usage are being used as inputs into trading models, you can bet that there's a price some people would be willing to pay for access to the travel records of both private citizens and public officials.

Senators use Uber?

No. This is not even remotely comparable. The Uber data would presumably contain identities and histories. The taxi cab data does not. And it is not simply "a matter of matching pick-up locations and timestamps to people of interest"...the only way to do that would be to actively surveil those people for a non-significant amount of time, and that's assuming they are taking the taxi on a regular basis...predicting the times they've taken one-off meetings would be futile.

Another big difference: taxi destination is only in lat/lng. For Uber data, it's possible that much of the data is exact address (or at least corner) of the destination...because it's just easier to enter it in the address you want as a user rather than obfuscate it (obviously, people trying to cover their tracks would try to obfuscate, but why would the use Uber in the first place if they were that self-conscious?)

One of Uber's exec was mouthing off against tech reporters at what he thought was an off-the-record dinner: http://www.buzzfeed.com/bensmith/uber-executive-suggests-dig...

Obviously, that kind of alleged discussion is not going to win the hearts of the journalistic class, but Uber's problem is that it had a reported history of using user data for unexpected purposes, like to use the God View as decoration at a company party.

One of the key points in the OP that I hadn't seen before is an anonymous Uber interviewee who claimed that he/she had total access to the Uber customer database as part of the interview...and for hours after the interview.

I agree with some people here, that this seems like an overblown story because Uber isn't any more an attractive data center than Google/Facebook/Github/etc...the problem is that what we know of how Uber has disseminated the data within the company indicates an almost certain lack of prioritization of access control. And many of the employees at Uber being human, it's only a matter of time before someone gets phished and something like an attachable Excel file of intranet-passwords is found (or other manifestation of sloppy IT-security practices/work-arounds).

And I'd say Uber deserves a little additional scrutiny...its data may not be as valuable as Google or Facebook's, but it could very well have the lowest focus on operational-security compared to companies in its tier of valuations.

( Uber v Lift v (other competitors in this space) ) v Existing Taxi industry.

There are billions of dollars in play here, and this isn't the anywhere close to the first time people are fighting dirty.

Maybe click baity, but it is a serious question which is being asked. Not out of the blue but after a pretty shocking revelation of the unnecessary information they are gathering.

Opening up innocent people to hacking is one of the most important reasons that this new school of data gathering is being discussed.

Is it unethical when it appears as if the answer is almost certinly "YES!"?

edit: I'm specifically thinking of Uber gathering which customers have phones with vulnerabilities.

As the article states, Uber is unique in a few ones. One: all signs point to employees being given unfettered access to all user data. That's A Bad Thing.

Corollary: Any headline which ends in a question mark will lead to someone commenting with a reference to Betteridge's law of headlines.

Exactly.

Not to mention, this type of reasoning could be applied to almost any technology company. Every company is theoretically an attractive target for personal information.