Myki gates, Springvale station

Some thoughts on the Myki data leak

This, the other week, was interesting:

In a concerning revelation, researchers have found that myki, in conjunction with social media, can be used to uncover a wealth of information about card users.

ABC: ‘Shocking’ myki privacy breach for millions of users in data release

Here’s the report and media release from the Office of the Victorian Information Commissioner:

Information Commissioner investigates breach of myki usersโ€™ privacy

Here’s the original study:

Two data points enough to spot you in open transport records

What happened was that PTV released a whole bunch of Myki touch on/off data for a “datathon” event, where people see what handy things they can do with the data.

It was “de-identified” – that is, Myki card numbers were removed and replaced with another identifier, which could link trips from a single card together, but not back to a card holder.

Or so they thought.

Part of the problem was they left in a flag indicating the card type. This is not just Full Fare (Adult) or Concession – it goes down to the precise type of Concession or free pass. For instance type 39 is a War Veterans Travel Pass; type 46 is a Federal Police Travel Pass.

With more than 70 types of card, some of the more obscure types are pretty rare, so if the person you’re trying to track down is using one of them, they’re probably not that hard to find, particularly if you know which stations they regularly use.

That’s presumably how the researchers found Anthony Carbines, State MP for Ivanhoe, I’m guessing travelling on a State Parliamentarian Travel Pass – by looking at the data, and matching it up with his social media posts, which included at least one from Rosanna Station.

I’m probably in there too. And so are you. (I’ve only seen a sample of the data; a mere 30 million card touch records out of the total 1.8 billion originally released.)

Myki machines at Southern Cross

Ultimately, it’s good that data sets like this are released. There actually should be a lot more of it – at present, the data released by PTV is very limited. Anything related to patronage or bus service performance is really difficult to find.

Perhaps the problem with not adequately cleaning the data is that they’re out of practice. Almost everything currently available either has nothing to do with passengers directly, or is at such a high level that it could never be used to find individuals.

More data should be out there. Ultimately, the public transport network is funded by taxpayers, and it should be a lot more accountable and transparent than it is.

One thing’s for sure: if they have a go at releasing this level of detailed data again – and I hope they do – they’ll need to be more careful to remove information that could be used to re-identify individuals.

Mobile Myki

The Myki mobile trial is progressing

Last year the government announced that Myki would be coming to mobile phones. Early testing happened late last year, and last week PTV opened up the trial to up to 4000 participants.

The technology allows you to load a “virtual” Myki card onto your Android phone within Google Pay, and use it for travelling on public transport.

Apparently there are people out there for whom the holy grail of everyday life is being able to carry their phone but leave their wallet at home. I’m not one of those people, but this could help them meet that goal.

What you need to join in

The basic requirements are:

  • Android 5+, supporting Google Pay
  • NFC (Near-Field Communication) on your phone
  • Gmail account – this seems to be used to whitelist your account for the trial
  • Credit card – this is added to Google Pay to load up the virtual Myki card

You can apply on the PTV web site.

Mobile Myki: touching at a reader

How it works

Once you’re accepted, your Google Pay account is whitelisted. You can then go into Google Pay, then to Passes, Travel cards, and you should be able see a Myki option.

If that works, from there you can create a new Myki card on your phone. It simulates a real card, though unlike a real card, it’s free – at least during the trial.

Just like a real card it can be loaded with Myki Money or Myki Pass. (The latter is limited to 60 days, the length of the trial, but this limit will be removed when Mobile Myki publicly available.)

Curiously, the virtual card expires in two years. Not sure why.

It looks like, as with other Google Pay functionality, the phone just has to be awake and unlocked when you touch it to a reader. The phone and the reader talk to each other and Google Pay figures out that it wants the Myki card, and applies the touch.

(Someone on one of the forums reckoned it doesn’t even have to be awake. I couldn’t get that to work.)

What’s impressive here is that it works with most of the existing Myki hardware:

  • Fare readers (old and new);
  • Myki Checks;
  • handheld devices used by Authorised Officers and V/Line conductors.

This is important, as it means a full rollout can occur without expensive and time-consuming replacement of the tens of thousands of devices out there. Given the older fare readers are 10+ years old, this is almost miraculous.

PTV tells me that it doesn’t work with:

Thankfully none of these are essential to allow people to travel around the network.

Poster showing Myki equipment
Myki equipment (from an old staff poster)

Using Myki mobile

I already have a Myki card with a brand new Yearly fare on it, so I’m unlikely to use it for everyday travel at the moment.

But I’ve tried it a few times with Myki Money loaded.

As you’d expect, the fare charging is identical to a real Myki card.

Response times: initially I found it very patchy. But for I also tried (for the first time) Google Pay at the supermarket, and found the same issue.

Eventually I figured it out: it helped a lot to discover that for my Motorola phone, the NFC antenna is right at the top.

So you don’t hold the phone to the reader in the middle, and flat like a Myki card. In the case of my phone, you point the top to the reader – then it works much better.

So it’s definitely worth checking where the NFC antenna is on your phone.

Once you’ve mastered your touch technique, it seems about the same speed as a physical card: pretty fast on the new readers; somewhere between fast and slow on the old ones.

The virtual card can be registered to a Myki account, so you can then use it to top-up online, or even set up Auto Topup (which for Myki Money users is great).

Important: if you can’t be sure that your phone battery will last while you’re travelling, you may want to stay away from this. PTV tells me it’s the passenger’s responsibility to ensure that if ticket checked, their phone has enough juice.

Things that they could improve

You can top up instantly within Google Pay, which is a big plus over a normal Myki card.

But you can’t set up Auto Top-up, which would be helpful.

I’d personally love to see Auto Top-up combined with weekly and/or monthly fare capping. That would completely remove the requirement for regular passengers to ever buy Passes or top-up again, while knowing they aren’t paying more than necessary if they travel every day including weekends.

Mobile Myki: transaction history

The travel history within the app isn’t perfect – sometimes it just says “Public transport”, though usually it figures out the mode.

The mode icons are apparently Google’s, not PTVs – because it’s within Google Pay, there are limitations.

Transferring existing funds and Passes from a physical card to the phone app’s virtual card does not appear to be straightforward – this is a hangover from Myki’s existing policies and procedures. It’d be good if this was resolved in some way.

And ideally the mobile Myki could be used with any of the existing devices, opening up more top-up options such as cash or EFT/ATM cards using a station vending machine. (I’m sure I’m not the only one who periodically takes all my change to the railway station to load up onto my Myki card.)

And of course the additional payment option of using a phone doesn’t abrogate them from fixing issues with the physical Myki cards.

Why doesn’t it work on iPhone?

It’s all a bit technical, but it seems to be an issue with the different approaches from Google and Apple.

From what I can gather:

Google is happy to let developers make full use of the NFC functionality in phones to do whatever, including doing things outside Google Pay.

Specifically, PTV and others use a feature called “Host Card Emulation“, so the phone can impersonate a Myki card.

In contrast, Apple provides only limited access to NFC functionality in phones, because they want all transactions to be within Apple Pay, from which they take a cut (something like 0.15%). They won’t allow Host Card Emulation.

Here’s some technical discussion on Whirlpool about it. Don’t take it all as gospel, of course.

Elsewhere…

In some places like London (which uses the Oyster system) and Sydney (which uses Opal, which is Oyster technology), iPhones/Apple Pay can be used because they are actually impersonating a credit card, not a transport card.

This is apparently impossible in Melbourne because the readers can’t read credit cards, though I’m not sure if that’s all readers or just the older ones. You would hope the newer ones are capable, and gradually they would replace the old ones.

Simply using a credit card which charges the appropriate fare is obviously a lot easier for tourists: no mucking about to set it up; no trying to calculate how much money to load so you don’t end up over-paying with little hope of easily getting a refund.

In other places like Shanghai and Beijing, the local transport authorities are beta testing with Apple, and have presumably found a way to work with Apple’s technology and conditions.

Mobile Myki: creating a card

Leading the world?

What’s interesting is that there are actually very few jurisdictions using Google Pay for their public transport — Google only introduced it last year. Las Vegas (which shows up as an option), Birmingham (UK), and a few Asian cities apparently. And us.

So if it goes well and gets a wider rollout, we might be one of the first big systems using it.

That’s might be something you didn’t expect from Myki!

Public transport needs to be simple to use, so services need to improve, but opening up easier payment options is also important. So it’s good to see this progressing.

Myki card

Fares for short trips now double the cost of Sydney

As expected, public transport fares in Victoria go up from 1st January. This time it’s a CPI rise of 2.2% – thankfully not as high as the last four which were CPI+2.5% (budgeted by the Coalition in 2014, delivered by Labor).

This takes the standard zone 1 or 1+2 daily fare to $8.80, and the 2-hour fare to $4.40.

It’s worth noting that for short trips in zone 1, this is now precisely double the $2.20 Sydney tram or bus Opal fare for up to 3 kilometres.

The fare rules are a bit different – Sydney’s free transfers are generally limited to the same mode within 60 minutes, and the daily cap is much higher (except on Sundays).

(The short distance single zone Go Card fare in Brisbane is $3.25 peak, $2.60 off-peak. In Perth the Smartrider fare is $1.98 for two “sections”, or $2.79 for one zone.)

It turns out that the fares in Sydney in most cases are lower than Melbourne’s standard $4.40.

  • Sydney tram/bus: $2.20 for up to 3km, half the Melbourne zone 1 cost, and 26% cheaper than Melbourne zone 2 at $3
  • Sydney tram/bus: $3.66 for 3-8km, still 17% cheaper than Melbourne zone 1, though more expensive than Melbourne zone 2
  • Sydney train: $3.54 peak/$2.47 off-peak for up to 10km
  • Sydney train: $3.08 off-peak for trips of 10-20km. (The peak fare is identical to Melbourne, at $4.40)
  • Even train trips of 20-35km off-peak are cheaper in Sydney, at $3.53

Melbourne’s fares (within zones 1 and 2) are generally cheaper for longer trips: over 8km on buses (Sydney trams don’t even go that far!) or over 20km on trains in peak, or over 35km off-peak.

And the transfer rules and daily cap mean Melbourne is cheaper for roaming around all day (for instance, tourists) – but this is not what most daily commuters do.

It’s those short trips that really sting, thanks to the nearly flat fare structure. You wonder how many people choose the car by default for short inner-city trips because of it, especially when travelling in a group.

Also spare a thought for V/Line passengers. Anomalies in the zone system mean that, for instance, a passenger from Lara to Melbourne pays $4.40, but hopping on the train a few minutes earlier at Geelong will cost a whopping $13.40 in peak, $9.38 off-peak.

How much have fares gone up over time?

Looking at the basic 2-hour zone 1 adult fare, it’s gone up quite a bit over time – from $1.60 in 1990 to $4.40 in 2019. If it had followed the rate of inflation, it’d now be about $3.57.

Melbourne PT fares since 1990

See the data. I am currently missing the prices for 1993. Can anybody help?

People travelling long trips (the old zone 1-2-3) have benefited from the removal of zone 3 in 2007, and the fare capping added in 2015. In 1990 the 2-hour fare was $3.80, from January it’ll be $4.40. If that had followed the rate of inflation, it’d be about $8.49.

There was a slight drop for all fares in 2013 (actually in the last days of 2012) when single use Metcards were phased out, forcing everyone onto the bulk price Myki fares.

Solutions are hard

Solutions are hard because so often the politicians reject any policy change where anybody is disadvantaged.

The flat fare has pros and cons. The only logical alternatives are more zones, or point-to-point pricing. The latter is difficult given the older Myki readers still common around the system on trams and buses are so unreliable, and Myki zone detection is so hopeless.

It appears for instance that buses have two GPS systems. One is able to, usually, tell the real-time apps how far away the bus is to a minute’s accuracy; the other is often unable to figure out which of two gigantic zones it’s in.

Introducing off-peak fares is another option. V/Line gives a 30% discount for off-peak. Perhaps this should be looked at for metropolitan trips too. The same discount would bring that $4.40 fare down to $3.08, matching Sydney on more trips. This would help improve demand at off-peak times, and would shift some trips out of peak.

There is a kind of off-peak pricing: between 6pm and 3am you’ll only pay one 2-hour fare – this was inherited from Metcard, and inherited from the 1980s era paper tickets before that! There is also the weekend/public holiday $6.30 cap.

And another upgrade that would be of benefit: re-instating the weekly and monthly caps once planned for Myki would help stop Myki Money users paying too much, and remove the confusion of having to choose between Money and Pass to get the best deal.

Myki card

What we know about the Myki mobile phone trial

The State Government has announced a trial of a mobile phone app for Myki.

Here’s what we know about the trial.

Will it mean the end of Myki cards?

No.

Despite the fascination of headline writers with Myki being replaced, a phone app will be an additional option, alongside cards.

Some people don’t have mobile phones, and may never have mobile phones. They’ll still need cards.

Will it only be E-class trams, as first thought?

No, the government now say it’ll be systemwide, without the need to rollout new equipment. Which is good – there are thousands of devices out there on stations, trams and buses. Replacing them all would be extremely expensive.

Why only on Android?

I’m told it’s because Apple has the iOS NFC feature heavily locked-down, apparently in the hopes of controlling all payments made with iPhones.

NFC isn’t on all Android phones, but it is on an increasing number of them. It’s already used by a number of public transport cards in some way, including being able to instantly check your balance on Sydney’s Opal.

Perhaps in time Apple will come to the party.

Myki, Smartrider, Go card, Opal public transport smartcards

Will it cover Myki Pass and Myki Money?

Yes, both. The app will be able to act as a Myki card, with the same fares.

It will also allow instant top-up, without the current 90 minute online delay. (This delay is similar on all public transport smartcards).

Will it cost $6 like a real card? Will it expire like a card?

I doubt it will expire. (Most phones don’t last 4 years like a Myki card is meant to!)

The cost is unknown. The $6 cost of a real card is partly because you can commence a (non-V/Line) trip on a zero balance, so the balance can drop as low as minus $4.30. It’s not yet clear how the app will work in this regard.

Perhaps if in some way it enables a user to pay just the cost of a daily fare, this can partly negate the need for a single use ticket, which isn’t currently provided.

What about contactless credit cards, such as Paypass?

It looks like existing Myki equipment isn’t compatible with that.

That’s a shame, as I suspect a lot more people have contactless cards than NFC mobile phones. Card payment works really well in London, and many cities (especially those that use a variant of London’s Oyster) are trying it.

But that may be changing over time, and it’s still a positive move to help make it easier to pay a fare.

And on balance, it’s better not to go down the path of huge expense to replace all the equipment around the system. Perhaps that can be planned for the new generation of station/bus/tram devices, to allow a later upgrade.

New Myki signage on trams, October 2015

When will the trial happen?

The trial is expected to run from July until early 2019.

I hate topping up. I want it now.

If you use Myki Money, you should consider Auto-Topup.

It was a bit kludgy when first introduced, but works really well now. I’ve had it set up on my kids’ cards for years.

Unfortunately it doesn’t work with Myki Pass, which is why they should really implement Myki Money weekly and monthly capping, which was originally planned.

How do I get involved in the trial?

PTV says: To stay up to date with the Mobile myki trial, including how to register your interest in participating in the trial later in the year, make sure your myki is registered.

What else?

This government fact sheet might help:

PTV: Mobile Myki fact sheet (28/5/2018)

…or leave a comment/question and I’ll see if I can get an answer.

Bacchus Marsh station mural

Crosstown traffic / Bacchus Marsh stopover

All of us have data being captured about us all the time.

For many of us that includes Myki travel data (though even that is tiny compared to the myriad of information captured by our smartphones).

Mostly for me it’s the drudgery of everyday work commuting, but every so often there’s something of interest.

Crosstown traffic

26/01/2018 13:49:14 Touch off  Train 1/2 Bentleigh Station - - -
26/01/2018 13:09:15 Touch on   Train 1   Footscray Station - - -

This is not a typo. On Australia Day (public holiday timetable) we managed to do Footscray to Bentleigh in 40 minutes.

There was a little bit of trickery involved. The train from Footscray ran into the Loop clockwise (being a weekend), and as we came into Melbourne Central the app told me a train from there clockwise to Richmond was imminent, so we swapped onto it, then just managed to get a connection at Richmond onto the Frankston line to Bentleigh.

Jumping through that hoop saved us about 10 minutes — a timetabled journey with just one change should take about 48 minutes.

Still, it shows that good frequencies along direct routes mean a fast trip, even when it involves connections.

You’d struggle to get across town that fast in a car. Google Maps reckons 30-50 minutes on the weekend if driving — there’s frequently congestion in King Street if you drive through the CBD, and taking the Bolte or Westgate then Kingsway is no better, as the exit onto Kingsway is often clogged.

Melbourne, like any big city, has transport demand from many places to many places. Public transport needs to cope better with this.

The more routes (be they train, tram or bus) go to frequent (10 minutes or better) services, the better connections will be, and the more trips will be competitive with driving, and the more people will choose public transport instead.

Ballarat station

Copycat from Ballarat

08/02/2018 23:02:22 Touch off  Train 1   Southern Cross Station	- -     -
08/02/2018 21:34:15 Touch on   Train -   -                      - -     -
08/02/2018 21:28:04 Touch on   Train 8   Ballarat Station	- -     -
08/02/2018 19:39:43 Touch off* Train 8   Ballarat Station	- $6.72	$26.98
08/02/2018 19:04:15 Touch on   Train 2/3 Bacchus Marsh Station	- -     -
08/02/2018 18:29:49 Touch off  Train 2/3 Bacchus Marsh Station	- -     -
08/02/2018 17:23:46 Touch on   Train 1   Southern Cross Station	- -     -

I thought I was being so clever.

I wanted to get to Ballarat, but I had missed the 17:10. The next train all the way was at 17:50.

But the timetable also showed a 17:35 to Bacchus Marsh, arriving there at 18:18, just ahead of the next Ballarat train. So perhaps I could have a quick stop-off at the Marsh?

That went fine until by Sunshine the train was running late. No need to panic though, it’s just one track each way; they can’t overtake, right?

Wrong. The train was held at Melton for a few minutes to let the Ballarat train fly past. D’oh. That’s a lesson for next time.

So I had an unscheduled half-hour in Bacchus Marsh. Which was charming.

The kicker is this made me late for a PTUA Ballarat branch meeting. Oh well, they welcomed me when I eventually got there, and we had an interesting discussion.

After some dinner I headed back. The 21:34 touch-on was the conductor checking the fare. (When conductors check fares, they also set the default fare to the end of the service, making it important that you touch-off after using V/Line.)

Also notable: breaking the trip at Bacchus Marsh meant my Myki Pass covered part of the trip, and I got charged just $6.72 the rest of the way to Ballarat, rather than the usual $21.60 (minus $4.30 for Zone 1/2 on my Pass). This is the anomaly facing V/Line users thanks to changes to metropolitan fares — some trips are dirt cheap, some are expensive.

That $6.72 also seems to have covered my fare home afterwards: Marsh touch-on at 19:04 to commencing the trip back at 21:28 is more than 2 hours, but because it’s a trip across six zones, the “fare product” is 3 hours, not 2.

Cheap with the stop-off? Yes. But I’d have preferred to be there on time.