Uber takes heat for customer privacy settings

Uber the embattled but increasingly popular taxi alternative is facing more privacy-related questions. This time, users are askingwhy it needs access to their calendars and contacts.

Tech blogs last week pounced on the ride-sharing app for the wide range of permissions sought by the Uber app.

There are legitimate reasons for many of these requested permissions, says UrsHengartner, a University of Waterloo professor and an expert in mobile app security and privacy.But Uber "should haveexplained it earlier on and told people about it openly,"he says.

The criticism began when a blogger, who says hes a security researcher, dug into the Uber apps code for Android and noted the app has access to SMS, camera, internet, WiFi, contacts and calendar.

In the discussion that followed, many users were surprised to learn about Ubers broad access to their phones.

• Executive reportedly advocated smearing journalists
• Competition Bureau voices support for Uber

Uber explained the rationale behind many of the permissions though not all.

Its app, it said, needs access to calendars and contacts because of a feature allowing users to send a text via the app if they are late.

In addition, WiFi helps locate the user when GPS signals are low. Plus, users can pay by taking a picture of their credit card, thus explaining access to the camera.

"This is not unique to Uber, and downloading the Uber app is of course optional," Xavier Van Chau, a Canadian spokesperson for Uberwrote in an email to CBC News.

A big part of the problem is that, on Android, a user must agree to all permissions in order to use the app. On an iPhone, a dialogue box opens to ask users if they want to allow access to a particular part of their phone.

Hengartner says there are inherent problems with the way Android forces a user to OK a blanket set of permissions, problems that need to be fixed.

But he adds that Uber could have told users clearly in the app description in Google Play exactly which permissions it needed and why.

"I think people should be concerned if companies arent open about it, and thats the main issue here," saysHengartner.

App privacy under scrutiny

The ride-sharing app is not alone in coming under attack. Privacy commissioners around the world are closely scrutinizing mobile apps for gathering too much personal information from unaware consumers.

Canadas privacy commissioners office recently worked with counterparts around the world to pore over more than 1,200 apps.

Less than a third of those apps provided clear explanations for why they were collecting certain types of data, how they were using what they were collecting and what their disclosure policies were.

The reviewers could only understand what the company was doing with the data in about one-third of the cases even after reading the usually detailed privacy policy on the companys website.

One of the most flummoxing apps was the Super-Bright LED Flashlight. The app turns a mobile phone into a flashlight, but asked for access to users'cameras, microphones and call information.

The privacy commissioner is currently looking into the extent of permissions sought by apps and plans to make thefindings public soon.

Uber under fire

For five-year-oldUber, the swirling concerns around its permissions may be the least of its worries.

Earlier this month, a senior vice-president, Emil Michael, suggested in a conversationthat he thought was off-the-record that the company should hirea team of researchers to dig up dirt on its media critics.

Also, a New York City Uber executive accessed the Uber profile of a Buzzfeed reporter without obtaining permission.

Acompany spokesperson later denounced Michaels comments and said employees are only allowed to access and use data for legitimate business purposes.

U.S. Senator Al Franken sent a scathing letter to the start-up, demanding information about how the company uses all the data it collects and which employees can view the information. The actions of these top Uber executives "suggests a troubling disregard for customers privacy,"he wrote

For Michael Karlin, an Ottawa resident who regularly uses Uber, those two stumbles by executives were far more damning than the recent concerns over permission.

"The app is fantastic,"said Karlin, who enjoys many of its features, such astracking the Uber car as it approaches, dropping a pin to tell the company his location and the automatic payment from his credit card at the end of the ride.

"I dont have to fish for tips or anything like that. The transaction is over. Its time to move on."

Still, a few more privacy-related breaches could send Karlin back to regular taxis, he says.

Michaels comments also troubled him and madehim wonder if Uber has a broken corporate culture.

"I am really worried that they are doing more than they are saying they are,"said Karlin. "If theres a systematic abuse of my privacy, I will abandon them despitetaxis being so much worse."

Karlins more savvy with apps than most, checking permissions every time he downloads an app. But he would like to see companies like Uber make it easier to understand what it wants to access to and why.

"I would love to know more about the exact information that Uber collects. I dont know if I'll ever learn. These companies are usually not good at disclosing that."

CBC News asked Uber several questions about how it collects and uses its data, but it didn't respond.

It did, though, acknowledge what Karlinand other users already know:"Our business depends on the trust we establish with all our customers and business partners," the Uber spokesperson wrote.