Everyone aboard the M4 bus in Upper Manhattan this spring was staring at a woman in her early forties as she tried to prove she had paid the fare. Two transit cops had stopped the bus to check that no one had snuck on without paying (as more than half of bus riders do, according to the Metropolitan Transportation Authority), the biggest contributor to the nearly $1 billion in lost revenue last year.
The cops were looming over the woman, who told her story to the Prospect on condition of anonymity. They were using a handheld device to scan her smartphone, which she’d tapped on a card reader to pay the fare with Apple Pay. But the cop’s scanner kept pinging her digital bus card, which had run out of money, the reason she’d used Apple Pay instead. The cops told her to pull up her payment history so they could check recent transactions. She’d never done that before, she told the Prospect, so it took a minute. At the time, all she cared about was getting the information so everyone could be on their way. But now she’s wondering, what data did they mine from her phone? And how will they use it?
More from Whitney Curry Wimbish
That’s what civil rights and immigrant advocates said they want to know, too, as more public transportation systems across the country install tap-and-go fare payment kiosks, especially those operated by private equity–owned defense contractor Cubic Corporation. The company runs the payment systems for transit systems in several cities targeted for mass immigration raids: In addition to New York City, it contracts for Atlanta, Boston, Chicago, Los Angeles, Minneapolis-St. Paul, San Francisco, Washington, D.C., and municipalities in Washington state.
Cubic executives—all of whom have a background at major weapons manufacturers—signed a partnership late last year with Palantir, the artificial intelligence company that built ImmigrationOS for Immigration and Customs Enforcement (ICE) to help federal agents hunt immigrants.
Immigrant advocates across the country say they’re worried that municipalities rushed to install automated systems ahead of major events like the FIFA World Cup that’s under way in multiple states, plus the Super Bowl and the 2028 Olympics in Los Angeles, without thinking through how that might harm Black and brown residents, regardless of their immigration status. One alarming example is in Missouri, where Kansas City intends to put AI facial recognition on its municipal buses.
Immigrant advocates say they’re worried that municipalities rushed to install automated systems without thinking through how that might harm Black and brown residents.
They don’t trust that Cubic’s transportation division is truly separate from its defense division, especially given that Cubic has in the past invoked trade secrecy to hide information. The company sued LA Metro in 2024 in this fashion to prevent the publication of its pricing data. LA Metro mounted no defense, and Cubic declared victory early last year.
“If they’re partnered with Palantir and the U.S. military, you better believe that every bit of information they get … will be handed off and used and monetized in any way they can,” said Eric Sheehan, an organizer with NOlympics LA, an organization fighting to protect Angelenos from the immigration dragnet that’s likely to come with the 2028 Olympics, as the Prospect reported.
“One of the big concerns I have regarding this all is if your credit card is connected to your OMNY or TAP card, they can find out who you are, they can track where you got on or off,” Sheehan said. “Palantir will happily provide that information to ICE.”
Brian Fritsch, associate director with the MTA’s Permanent Citizens Advisory Committee in New York, said that Cubic’s technology captures credit card, phone, and OMNY card data and transfers it to a cloud database. If riders have privacy concerns, he said, they can buy their transit cards with cash.
But that’s not an option for anyone who lives far from the major transit hubs that have Cubic card dispensers, Sheehan pointed out, the situation of many bus riders in both L.A. and New York. “There are almost no places to pay cash” other than those hubs, he said. “It’s impossible if you live on a bus line.” That means anyone who’s undocumented and fearful of the system tracking their movements must go far out of their way to load cash payments onto their cards.
“If you’re gonna claim you’re a sanctuary city, you need to make methods available for undocumented folks to travel through the city without their every movement being tracked and tied to their identity, especially if you’re going to literally employ a company that partners with both ICE and the military,” Sheehan said.
AMONG THE FRUSTRATIONS with the new payment systems is that it’s unclear exactly what data they’re collecting or how it may be exposed, questions that have been unanswered for years by lawmakers, transit officials, and corporate executives.
As The Intercept reported four years ago, those who use Cubic’s mobile account system to access their municipal transit are handing over their data to be “aggregated, linked, and shared,” though it’s not clear what data or with which partners, specifically. The Intercept noted that the Cubic Data Management & Analytics Platform brochure doesn’t say, either, only that it offers “advanced data warehousing, reporting and analytics capabilities” about passengers’ journeys, “including origin, destination, and linked passenger trips.”
Cubic says its analytics come with a “de-identification” of sensitive and personally identifiable information, turning it “into an analytics ready dataset that can be securely consumed for research, monetization schemes, and other internal and external purposes” and that its offerings include “personalized actionable information” sent directly to riders’ phones.
Some rider advocates and transportation system experts said all of that data is information the state may reasonably want so it can manage transportation services. But they said it’s possible to collect planning data without putting individuals’ movements and personal information at risk. As 404 Media demonstrated in 2023, the website for New York City’s OMNY system allowed anyone to track a rider’s travel history by entering in their credit card information, obtainable from criminals online, which especially endangered stalking and domestic violence victims.
That problem has since been fixed, a spokesperson for the MTA told the publication. But spokespeople would not answer detailed questions from the Prospect about other aspects of the system, including what technology enables the handheld scanners to check credit cards or what policy or law requires riders to produce a personal credit card for inspection. Instead, they provided links to public hearings that did not include answers to those questions, said that fare evasion has been down for three consecutive quarters since the implementation of the scanning devices, and when pressed, wrote that “we have nothing further to add.”
Cubic did not respond to questions, including what data their tap-and-go fare payment kiosks and handheld verification scanners capture, how far back in time the handheld scanners look for proof of payment, what other information the company collects, and how that data is stored. The company did not respond to a question asking what happens if a rider paid by phone and the phone battery dies before it gets scanned, nor did they say what information the company aggregates and gives to its clients in New York state.
The MTA is a public benefit corporation that is the state’s responsibility and ultimately answers to the governor and the state legislature, not the mayor. Spokespeople for Mayor Zohran Mamdani did not immediately respond to a request for comment on Thursday; advocates noted that his campaign promise of fast and free bus service would resolve the surveillance issue and make the city safer for undocumented residents.
“If we had free buses, there wouldn’t really be cause for any of this,” said Danny Pearlstein, policy and communications director at New York advocacy group Riders Alliance. “This endless OMNY transition has been going on for many, many years and is farcically bad … there’s a concern for immigrants, for consumer protection, and obviously for riders’ personal data.”
Former Gov. Andrew Cuomo inked a contract with Cubic to replace the old MetroCard system in 2017 and began rolling it out in stages in the following years; Gov. Kathy Hochul expanded it and fully installed the system this year. Spokespeople for Hochul did not respond to requests for information about data collection or Cubic.
New York City says it doesn’t store financial data when transit riders tap into the MTA system, but the MTA “doesn’t have a great track record when it comes to data collection and retention,” said William Owen, communications director at the Surveillance Technology Oversight Project, which is fighting to end surveillance and implement laws to protect New Yorkers’ privacy.
Like others asking for greater transparency in how riders’ data is collected, stored, and used, Owen said that answers to detailed questions about Cubic are practically impossible to get from any level of government. Officials say they’re being transparent, but then refuse to answer questions; document requests come back heavily redacted with the claim that agencies must protect companies’ proprietary information.
Owen pointed out that a proposed state law would help address many issues because it would prevent the MTA from sharing riders’ OMNY fare data with police and government agencies without a warrant. Democratic state Sen. Kristen Gonzalez proposed it in February 2025, and it has been sitting in committee since then. Owen also noted that the MTA has been on a charm offensive lately, casting their payment verification scanning as a “European” practice.
“If they’re so proud of their supposedly European-style system that they’re rolling out,” he asked, “why are they avoiding transparency around the vendor and around other aspects of the system?”
