Uber Wants to Get the Law on Its Side

The officers, department heads for cybersecurity teams across the Netherlands, meet monthly to discuss approaches to thwart cybercrime. Pailthorpe’s slideshow didn’t elicit much of a response until he explained how Uber tried to help Parisian authorities after the November 2015 terrorist attacks, which killed 130 people. An Uber driver, he said, thought that a rider was a terrorist involved in the incident. Another slide highlighted Uber’s ability to track a driver in Christchurch, New Zealand, who’d been accused of rape. The detectives started to see the potential. “You mean store addresses? And you can see how many people were dropped off at one location?” one cop asked. Pailthorpe responded carefully, “We have to understand the investigation and know everything we share is legal and proportionate.”

Uber isn’t exactly synonymous with law and order. It’s earned a rocky relationship with authorities in many global markets—including the Netherlands, where a series of fatal accidents involving its drivers led activists to demand a ban of the service—partly because of a history of refusing to disclose possible evidence of driver abuses and other crimes. At least two dozen times, Bloomberg Businessweek has reported, Uber’s San Francisco headquarters remotely logged off equipment in overseas offices to shield files from police raids. But as the company prepares to go public, it’s trying to get cops on its side. Uber’s global law enforcement team is growing and now has more than 70 members. In 2018 they liaised with 300 agencies in 51 countries, creating relationships with police to facilitate information sharing.

With 3 million drivers providing 15 million daily rides, the company has a treasure trove of data—GPS locations; driver’s license, phone, and credit card numbers; and vehicle and insurance information—and it uses facial recognition software that can expose aliases. In 2018 app developers rolled out an emergency button that directly connects riders in the U.S. and parts of Mexico to 911; the technology gives authorities GPS updates every 10 seconds, which means dispatchers don’t have to triangulate 911 calls through cellphone towers. Uber also instituted a feature that lets friends or family follow a trip, and it’s begun deleting addresses from drivers’ apps after a ride ends.

The Uber law enforcement team, which handles inquiries into crimes ranging from robberies to human trafficking, is spread out across four offices, the biggest of which is in Amsterdam. (Two more are planned for Brazil and Mexico.) They got more than 400 information requests in 2015; in 2017 that number jumped to 14,275. Uber applies U.S. law to requests for information from North American agencies and, for the most part, Dutch law to international requests.

Calls come in from every country where Uber has a presence, and the teams reach out to police contacts when there’s a crisis. On June 3, 2017, during the terrorist attack on London Bridge, the company established a geofence around the area to prevent further pickups, limiting the ways a potential suspect could flee. Uber also assisted during the Feb. 14, 2018, Parkland high school shooting in Florida, alerting the Broward County Sheriff’s Office that the alleged shooter had taken an Uber to the school. “Uber was very cooperative and responded quickly to our detectives’ needs by providing information that quickly furthered the investigation,” a sheriff’s office spokeswoman wrote in an email.

Uber is proactive in engaging law enforcement compared with other tech companies. Mike Sullivan, Uber’s head of global law enforcement, says: “We move people in real space on the ground. We are physically in the community. Our footprint is different, so we need a different approach.”

But the company also has a history of mismanaging data. In September it agreed to pay $148 million to settle claims related to a large-scale data breach that exposed the personal information of more than 25 million U.S. users. Other scandals include one in which rider information was analyzed to determine the cities with the most one-night stands, data that was posted to an internal blog and then made public. “Uber doesn’t have the best record of keeping information private,” says Wendy Seltzer, an attorney affiliated with the Berkman Klein Center for Internet & Society at Harvard. “People that sign up for Uber need to realize their information can ... be used in a police investigation.”

Police cast a wide net when investigating a crime, and users who have nothing to do with an offense can get swept up in an information request. That customer in Paris, for example, was only an international businessman whose travel just happened to mimic the movements of some of the terrorists in the attacks.

His presentation finished, Pailthorpe opened his backpack and took out a bag of challenge coins, which military and law enforcement members share as a sign of camaraderie. “I’ve now got coins from around the world,” he said, as detectives scooped up the Uber coins. A burnished nickel about the size of a half dollar, the coins have the black Uber logo on the front and a Latin motto on the back, Aedificium Relationes Ubique, which translates loosely to “Building Relationships Everywhere.”

©2019 Bloomberg L.P.