Hacker News Reader

Comment by dnautics | Hacker News Reader

I strongly prefer lyft's side, haven't used uber in years and the last year I drove for ridesharing I exclusively drove for lyft and not uber, but I really don't have a problem with this. OF COURSE you should collect intelligence on your competitor's activities - if they expose information publically (e.g. showing the cars on the app / API) and cross-correlating with the uber drivers that still are logged on - what is the objection to this?

Mind you, some of the other things uber has done, like hail a lyft and repeatedly cancel, are totally not ok.

View on HN

Collecting intelligence is one thing. But deliberately abusing your competitor's systems in a way they did not intend to allow in order to collect intelligence is not only ethically wrong, but also likely illegal, as this article mentions.

Indeed. Quoting the article:

Hell originated after Uber created fake rider accounts on Lyft and used software to trick Lyft’s system into thinking those riders were in certain locations. This allowed Uber to see the eight closest available Lyft drivers to each fake rider.

This is a very "benign" fake, akin to scraping a website for information... Moreover, you could just as easily do it with a 'real' account; and just use the 'real' account far... Less often than you're using it to scrape the info.

This wasn't public information to be scraped, hence the requirement for an account.

Creating fake accounts for this purpose is a violation of the current terms of service [1] (these might have been different in 2016):

9. Restricted Activities

h. forge headers or otherwise manipulate identifiers in order to disguise the origin of any information transmitted through the Lyft Platform;

l. use any robot, spider, site search/retrieval application, or other manual or automatic device or process to retrieve, index, scrape, “data mine”, or in any way reproduce or circumvent the navigational structure or presentation of the Lyft Platform or its contents;

[1] https://www.lyft.com/terms

When an end user breaks the terms of service of whatever system, most people would say that terms of service mean nothing. But since it's Uber, uuuuh, the scary terms of service!!!

With how the CFAA works, yes this sort of thing can absolutely be against the law. "Unauthorized" is a pretty broad term.

That's just nasty!

If using the Android app, they could have easily run 1 or more copies in an emulator on a desktop system, setting GPS to whatever they wanted.

even android developer settings allows us to mock locations, no need for an emulator!

it's likely not defensible in court. Let's say Uber was smart (i have no idea if they actually were) and used the account to monitor lyft demand, and every so often, sent the account on an actual ride, say, with one of their recruiters, to try and hook a lyft driver.... Then the account is being used for 'legit' purposes; where do you draw the line?

At the first illegitimate use.

If an uber employee looks at the screen using mark one eyeball and by hand notes that it's on primetime, is that "illegitimate"?

If you illegitimately gain access to privileged information and use that information illegitimately for financial gain, yes, that still counts even if it was done with the most primitive technology.

That you have access to information (whether accidental or through deception) doesn't mean you're free to use that information any way you please. Especially when it comes to anti-competitive business practices.

Fake accounts to collect intelligence? That's OK?

Let's say I am a dentist in Chicago who's buying Google AdWords. Every now and then I conduct a Google search for "chicago dentist" to see who else is in the run. To ensure a random distribution and no retargeting of results, I may conduct this search incognito or under a different Gmail account I've created.

That's OK?

Agreed. I think Uber is terrible, but I also think this is just no-brainer competitor research.

There is a strong dichotomy in the minds of many american people, between large private companies and public offices.

This is an instance of it: Uber has shown in the past that they can wield considerable powers, and are prone to misuse it. Therefore, them collecting data about drivers, a population that is vulnerable towards Uber (and a subset of which we know is shared between the two platforms), is dangerous.

If you approach this dichotomy from the other side, can you imagine the NSA being described as doing no-brainer customer research ?

If Uber had been circuit-bending the Lyft app or Lyft's API or rider/driver devices, I would think it unacceptable. But this information is being provided by Lyft inside their app. Uber was just aggregating this information and storing and analysing the data.

Also the NSA is doing a lot worse things and we know this for certain. I find it distressing how many people seemingly have forgotten about that. If the NSA were only going this far, I'd be pretty happy.

> But this information is being provided by Lyft inside their app.

No it isn't. Not according to the article. According to the article a fraction of that information is provided as part of the app but Uber went ahead and exploited the lack of operational security on Lyft's side to crawl _all_ the information by traversing over information intended for other users. Repeatedly.

> can you imagine the NSA being described as doing no-brainer customer research ?

Pretty sure HN would agree with that.

No it's not. Its ok to estimate your competitors size by driving by their parking lot and counting how many cars are there. It's not ok to bypass security and access their company directory.

The ethical line is "what is publically available following all laws and regulations".

Reply on news.ycombinator.com