While I’ve been in love for a long time with the idea of mobility-on-demand and the robocar taxi, I continue to have some privacy concerns. The first is simply over the idea that a service company gets a map of all your travels. Of course, your cell phone company, and companies like Google with its Location History (Warning, don’t click or you will be freaked out if you didn’t know about this) know this already, as does the NSA and probably all the other spy agencies in the world. That doesn’t make it much better to add more trackers. The online ride companies like Uber are tracking you too.

It will be sad to lose the anonymous taxi we used to have, where you hailed a cab and paid in cash and no record was made (until cabs got tracklogs and video) of your travels. In my article on Robocars and Privacy written many years ago I outlined some plans for anonymous taxi service and I continue to push this idea.

I outline the concern that a taxi company will want to be able to photograph the vehicle when you’re not in it, to assure you haven’t dirtied or damaged the interior, and also to check if you left something in the vehicle by accident. People will be less comfortable with a camera that can be turned on all the time, and LEDs to inform you if a camera is on can’t really be trusted, so we want to have a physical shutter.

This led me to a simple solution: The physical shutter on the camera could be the switch by which you signal the start and end of a ride. The ride can’t begin until you close the physical shutter, and it doesn’t close out until you open it. You want a lever for the shutter on the outside of the car by the main passenger door, so you can open and close it when you are not in the car, so it doesn’t take a picture of you if you are trying to use an anonymous taxi. A connected lever inside could allow people who are not trying to be anonymous (but rather just private on their journey) to both control the shutter, and signal the car to go or conclude the ride.

You might not want to be inside when it takes the photo anyway, because a bright flash would be advised, for a millisecond brighter than the sunlight coming in the car. That way the images will be under the same light, night or day, making it easy to compare before and after images to detect dirt or lost items.

If you leave the car without opening the shutter, it would honk at you, or ding on your phone to remind you to come back and open it.

Cars will likely have some other cameras too, for video conferencing. I expect video conferences to be popular in robocars, and while your own phone can do that for you, a camera with stabilization in it could be a useful idea. Here, we could use a physical shutter, though this time with a remote actuator that makes noise, so you can easily see if it’s open.

Even more simply, the video camera and monitor might not connect to anything in the car, but rather only connect to your phone via a car dock. (The connection must be wired, unfortunately.) If the camera is not connected you can be reasonably confident it’s not spying on you.

Of course, a truly malicious operator could have hidden cameras, or a secret connection to the video conference camera, but there’s not to much you can do about that. What we want protection from are attackers breaking into the car’s system, and vendors who change their mind about your privacy. We also want a stake in the ground that routine surveillance of passengers is not acceptable.

Editor’s Note: This article was republished with permission from Brad Templeton’s Robocars blog.