As background to this one. you might want to read the more general article we just wrote for the Huffington Post on why we call for a national dialogue about (and promise for) location privacy. Below are some specific ways we might technically provide location privacy in for cars.
We start with what we consider to be the gold standard:
A privacy-preserving taxing protocol should reveal the minimum possible amount of information needed to achieve the policy goal, in this case the amount of tax owed.
Most current systems (e.g., E-ZPass) operate on the "trust us" model:
the government promises to properly respect the security of the driver, but collects potentially invasive information. But we all know, there just aren’t any “trusted third parties” that can be trusted forever. And we don’t need to rely on them.
For some kinds of applications, simply having a tamper-resistant device in the car that calculates the tolls and reports only the amount owed would suffice. Such a device could be auditable (so that drivers could know that the device is not secretly delivering information about their position) and equipped with a self-destruct feature (to erase location information) so that the driver could hide her information if necessary (perhaps at a cost of paying an excessive "default toll").
But wouldn't it be great if the tolling and traffic software could run on any smartphone? For this kind of setup, there are more sophisticated solutions available. One of the truly amazing aspects of modern cryptography is that it makes it possible to design protocols for mutually untrusting parties to act as if there is a trusted third-party mediating, without actually requiring such a third-party. For instance, electronic cash allows people to pay bills anonymously and untraceably, but in a way that assures merchants that they are actually getting paid (it's hard to forge). Anonymous credential systems allow individuals to prove that they are authorized to access certain data or enter particular areas without revealing their identity. We need to demand that these sorts of protections are required and part of any future road pricing systems.
Cryptographic protocols can be designed to allow the government to collect taxes, detect infractions, and record aggregate traffic statistics without violating the privacy of drivers. For a more comprehensive discussion of such solutions, see here. The big contractors likely to be involved in designing and implementing the road pricing systems (e.g., IBM and Siemens) have on staff some of the finest cryptographers in the world. Requiring such protections would pose no substantial obstacle to the technical adoption of a mileage-based system.
This post was co-authored by Andrew Blumberg.
Photo by Gerlos.