A federal class-action lawsuit filed today in San Francisco by an Albany resident alleges that BART police have been secretly collecting data that can identify private cell phones and track the mobile devices of anyone who has downloaded the "BART Watch" app.
According to the lawsuit, the agency has been "secretly amassing tens of thousands of cellular identifiers linked to personally identifiable information."
See also: BART Riders Racially Profile via Smartphone App
The transit district rolled out the BART Watch app in August 2014 as a means for riders to report criminal activity and other concerns.
The app allows riders to send photos and exchange text messages with BART police in real time. Tens of thousands of members of the public have downloaded the app, which is made by Elerts, a Massachussetts technology firm that has provided similar software to other regional transit agencies, including Santa Clara and Sacramento.
Albany resident Pamela Moreno downloaded the BART Watch app in 2016 onto her cell phone and used it regularly while commuting. She says she wouldn't have originally installed the app if she knew it obtained information to identify and locate her phone. The Chicago-based Edelson law firm
is representing Moreno in the lawsuit and seeking class-action status for others who downloaded the software.
According Moreno's attorneys, neither BART nor Elerts notified users that the app collects unique identifying information from their phones, or that it periodically tracks their geographic location.
BART officials say the allegations are untrue. "BART does not use ELERTS system to randomly track users," said district spokesperson Alicia Trost in a statement issued today. "An app’s user location information is only available if the user selects the option to share their location information. And then, BART only receives the user’s location when the user is reporting an incident."
Eve-Lynn Rapp, an attorney with the Edelson firm, said a team of forensic analysts reviewed the app's code to reveal the ways it clandestinely obtains data from people's cell phones and transmits it to the BART police. Rapp told the Express
that the app sends identifying information and location data to BART any time a user simply opens it, not only when they choose to send an alert.
"They’re not being forthright as to what they’re telling people," said Rapp. "A reasonable user would think they’re collecting certain things when they’re making a police report, but people are less open to the collection of information simply because they have the app open."
The lawsuit also alleges that the data collected through the app can be matched with other information obtained by an IMSI catcher — a powerful cell-phone tracking and surveillance device that mimics a cell phone tower. IMSI catchers are more commonly known as a "Stingray" devices, and they can be used by law enforcement to locate a cell phone, and even intercept the contents of communications.
Trost said BART doesn't have a Stingray system.
The lawsuit against BART claims that the agency has violated the state Cellular Communications Interception Act, consumer laws, and the state privacy act.
BART's media-relations office didn't immediately respond to emails seeking comment on the lawsuit.
But the district has been working with civil-liberty advocates on developing a comprehensive privacy ordinance which would govern the use of technologies such as the BART Watch app, and require periodic audits of surveillance tools and operations.
Last December, the BART board's technology subcommittee approved a general outline of the privacy ordinance, but the full board has yet to take up the matter.