Methodology & Citations
Sources & Bibliography
Every factual claim in “Surveilled by Default: How NYC's Free Wi-Fi Became a Surveillance Network” traces to a primary document, an independently reviewed audit, an academic paper, or on-the-record reporting. This page lists every source cited in the report, grouped by type, with a note on what each supports and a link back to where it appears. Government filings, litigation records, and audit PDFs were downloaded and read directly rather than taken from secondary summaries; where a claim depends on characterizing a source's argument rather than a fact it states outright, the note below says so.
Legislation & Public Policy
6 sources-
Digital Fairness Act — Senate Bill S4276 Legislation
The pending state bill this report calls on readers to support. Would require affirmative, opt-in consent before a business collects personal data from 500+ New York residents — closing the contractor loophole that exempts CityBridge from the POST Act. As of publication, no companion bill has been introduced in the Assembly; an earlier version of this report incorrectly cited a carried-over bill number, A3308, from the expired 2023-2024 session.
-
Establishes the probable-cause-and-court-order standard the NYPD must meet before deploying a Wi-Fi geolocation device. This is the legal baseline LinkNYC's kiosks operate without, and the basis for the report's central comparison.
-
NYC Internet Master Plan Government
Source of the city's own “Internet Deserts” intervention-zone map, later shown to closely mirror the districts mandated for Link5G deployment.
Cited in: Who Pays -
Link5G Design Proposal & Briefing Government
The city's own presentation on Link5G tower design, including the technical rationale for the 32-foot height and the per-district equity-mandate kiosk counts.
-
Big Apple Connect Government
Documents a sensor-free municipal broadband alternative already serving roughly 330,000 NYCHA residents — evidence the city has a working model for public Wi-Fi that isn't bundled with ambient data collection.
Cited in: Who Pays -
Powers the report's live kiosk count and interactive map. Because this feed updates continuously, its figures will differ from the static counts cited in the surrounding prose.
Cited in: The Map
Franchise, Audits & Oversight
4 sources-
CityBridge / LinkNYC Privacy Policy Corporate · Legal
The operative legal document governing kiosk data collection, and the report's most-cited primary source — the basis for its central comparison to the NYPD's POST Act standard and for the finding that camera footage and passively collected data can be shared with law enforcement without a warrant requirement.
-
Source of findings PF-01 through PF-04. Downloaded and read directly against this report's claims: PF-01 found MAC addresses were encrypted but not anonymized after a mid-2020/2021 vendor transition, not stored in plaintext as an earlier draft of this report incorrectly stated.
Cited in: The Audit -
CityBridge's formal response to the KPMG audit, asserting all four privacy findings had been remediated.
Cited in: The Audit -
State-level financial and oversight audit of the LinkNYC program, cited for franchise-compliance and revenue context surrounding the 2019–2021 renegotiation.
Cited in: The Map
Civil-Liberties & Advocacy
10 sources-
The NYCLU's earliest formal objection to LinkNYC, filed the same year the network launched. Source for the finding that the original privacy policy permitted data retention “essentially indefinitely.”
Cited in: The Finding -
Presented the KPMG audit's findings at a City Council hearing, six months after OTI quietly posted the redacted report, and notes it took “many months and repeated outside pressure” before OTI released it at all. Not to be confused with the NYCLU's 2016 testimony above — the two share a near-identical URL.
Cited in: The Audit -
Submitted at the same hearing as the NYCLU's 2023 testimony; provides a detailed policy history of LinkNYC and quotes the KPMG audit's PF-01 finding directly.
Cited in: The Audit -
Source of the “barely mitigated privacy disaster” characterization quoted in the report, and of the NYCLU's review of Intersection's advertiser-facing marketing materials describing audience segments by age, education, and income.
Cited in: The Machine -
The organization's formal memo of support for S4276, cited for the bill's committee status and the case for its passage.
Cited in: The Fix -
Documents how data collected across the city's surveillance apparatus feeds the NYPD's Domain Awareness System and flows onward to federal agencies, including U.S. Immigration and Customs Enforcement.
-
Source for the finding that NYCHA security cameras were connected to the Domain Awareness System without resident notification, and for documented ICE access to NYPD data involving sealed records.
Cited in: Who Pays -
Litigation challenging the legality of the Domain Awareness System, cited as background on the surveillance architecture that LinkNYC-derived data can ultimately feed into.
Cited in: The Finding -
Black and Brown NYC Communities Disproportionately Exposed to Facial Recognition Surveillance Advocacy
Independent research corroborating racial disparities in New York City's camera-based surveillance footprint, cited alongside Amnesty International's findings below.
Cited in: Who Pays -
Decode Surveillance NYC: Facial Recognition Technology Reinforcing Racist Stop-and-Frisk Policing Advocacy
Crowdsourced mapping of more than 25,500 NYC CCTV cameras. Found that in the Bronx, Brooklyn, and Queens, the higher a neighborhood's proportion of non-white residents, the higher its concentration of facial-recognition-compatible cameras — the source for this report's claim that the Link5G mandate districts also carry histories of intensive policing.
Cited in: Who Pays
Academic Research
5 sources-
Source of the statistic that four spatio-temporal points are sufficient to uniquely re-identify 95% of individuals in a mobility dataset — used throughout the report to explain the re-identification risk posed by ambient location data.
-
“From Phone Booths to Wi-Fi Kiosks: The Spatial Inequality of Public Connectivity in New York City” Academic
Spatial-statistics analysis of the LinkNYC rollout, concluding that kiosk placement operated independently of broadband need and did not measurably reduce digital inequality.
Cited in: The Map -
Documents that MAC-address randomization is an incomplete defense against tracking, because a device's radio hardware emits a distinguishable physical signature that persists across software-level identifier changes.
Cited in: The Machine -
Applies radio-frequency fingerprinting specifically to non-cooperative re-identification for mobility-intelligence applications — the category LinkNYC's advertising platform falls into.
Cited in: The Machine -
Comparative case study tracking InLinkUK smart kiosks in London's Tower Hamlets, cited to show the correlation between kiosk deployment in lower-income neighborhoods and intensified data-driven policing is not unique to New York.
Cited in: Who Pays
Journalism
2 sources-
“Big Tech Pays to Supersize LinkNYC” Journalism
Reporting on the 2021 franchise renegotiation and the shift to a mixed revenue model that leases pole space to cellular carriers as 5G antenna platforms.
Cited in: The Map -
Found that only two of roughly 200 installed Link5G towers had carrier equipment fitted at the time of reporting, while the towers' sensor and Wi-Fi functions remained fully active throughout.
Cited in: The Map
Industry & Corporate
3 sourcesSources produced or commissioned by CityBridge or its consortium members. Used to represent the network's own claims about itself, not as independent verification.
-
CityBridge's own usage figures, including the roughly 473,000 free phone calls facilitated monthly — cited to illustrate the population's structural reliance on the network for essential services like the EBT helpline.
Cited in: Who Pays -
New Yorkers & Public Wi-Fi Survey Corporate
Source of the 77%-support statistic for Link5G, cited alongside the survey's own disclosure that support strengthens only after respondents are read a description of the poles' benefits.
Cited in: Who Pays -
Foundry Entity Resolution Corporate
Example of a commercial data-integration service capable of linking pseudonymous identifiers across datasets back to individuals — cited to explain why hashing a device identifier does not by itself guarantee anonymity.
Cited in: The Audit
Photography Credits
4 sources- Chelsea kiosk photograph (23rd St & 8th Ave) by Epicgenius, used under CC BY-SA 4.0.
- Jamaica Ave & Guy R. Brewer Blvd kiosk photograph by DanTD, used under CC BY-SA 4.0.
- 3rd Avenue, Bronx kiosk photograph by Hugo L. González, used under CC BY-SA 4.0.
- Kiosk interface and equity-mandate map photography by NYC DoITT, from the “Link5G Briefing” presentation, Oct 2021.