The MTA’s Switch to OMNY Will Cost New Yorkers More Than Just Their Privacy
By Patrick K. Lin
Riders of New York City subways and buses are no stranger to the reality that they are being tracked on public transportation. Last year, the MTA successfully installed security cameras at all 472 subway stations. MetroCard data is routinely used by the NYPD to retrace a criminal suspect’s movements. Earlier this year, the MTA installed hidden surveillance cameras on dozens of train cars as part of a pilot initiative, with plans to install cameras on the whole fleet. The OMNY rollout continues this trend.
Created for the MTA by Cubic Transportation Systems, “One Metro New York,” or OMNY, uses near-field communication (NFC) technology to enable contactless payment at turnstiles via bank cards and smartphone payment apps. According to MTA documents, the contract with Cubic cost $597 million and the overall program budget has swelled from $645 million to $772 million in just five years.
Last month, the MTA announced MetroCard vending machines would be completely replaced with OMNY by the end of 2023. A payment system that ties a rider’s movements to their bank card or smartphone raises privacy and data security issues. The plan to have OMNY become the only option across all subways stations and bus stops also means New Yorkers will have no choice but to surrender their data to OMNY, with no certainty about how it will be exploited.
The information OMNY collects from riders is not insignificant either. Based on the limited information made public in OMNY’s terms of service and privacy policy, the tap-to-enter terminals collect smartphone device identifiers, location data, payment information, billing address, the point of entry to the transit system, and occasionally even user content on social media platforms. These datapoints—logged not by the MTA or the city but by for-profit corporation Cubic—can be used to map out riders’ day-to-day routines in fine detail.
Because OMNY’s privacy policy does not explicitly mention that a warrant would be required to turn information over to law enforcement, the payment system can freely share rider data with all levels of law enforcement and intelligence agencies. Given the MTA and NYPD’s fondness for facial recognition technology as well as Immigration Customs Enforcement’s reliance on transportation data to build out its dragnet surveillance system, the idea that OMNY might be used as another surveillance tool is not so farfetched.
However, the OMNY rollout is more than just a privacy nightmare. Similar to how cashless payments exclude people without bank accounts or smartphones, the elimination of MetroCard vending machines also runs into questions of equity and access. At a time when the MTA and Mayor Eric Adams are decrying fare evasion, the decision to completely replace MetroCard vending machines with OMNY only serves to disadvantage and discriminate against low-income riders already struggling to afford the subway and bus fares. The switch to OMNY coupled with Governor Kathy Hochul and the MTA’s recent announcement to install two cameras in each of the transit system’s 6,355 subway cars by 2025—a $5.5 million endeavor—shows that the MTA would rather prioritize privacy-invasive initiatives than improving the accessibility of its services.
Attempts to modernize should not come at the expense of choice. The MTA’s implementation of OMNY should supplement rather than replace the current payment system by ensuring riders can still pay in cash at all transit stations. An estimated 5.6 percent of households in New York State (approximately 415,000 households) did not have a checking or savings account at a bank, according to the most recent survey data available from the Federal Deposit Insurance Corporation.
Privacy should not be up for sale. OMNY could and should collect less data on riders or at least retain it for a shorter period. OMNY’s privacy policy should ensure user data will not be sold to advertisers or used for marketing. Even better, the city and OMNY could include a comprehensive auditing policy that would allow independent experts to evaluate the system on a regular basis to ensure the data is secure and strictly used for accessing New York City’s public transit system.
OMNY may appear to be a high-tech update to one of the country’s oldest transit systems, but it does not address the most urgent issues plaguing the MTA: infrastructure that dates to the Great Depression, 75 percent of subways stations that remain inaccessible to people with disabilities, a reduced-fare program that leaves out hundreds of thousands of New Yorkers living in poverty. Instead, the city has opted to invest in a new, more expensive barrier to one of its most essential public services.
Patrick K. Lin is a member of the Surveillance Technology Oversight Project (S.T.O.P.) Junior Board and the author of Machine See, Machine Do: How Technology Mirrors Bias in Our Criminal Justice System.