The availability of app and web-based technology is spreading like a wildfire and becoming a “must have” and “go to” for transportation companies in their efforts to stay relevant and compete within their industry. Many shippers now require motor carriers to offer sometimes costly app-based technology services to their drivers, and brokers and shippers are prevalently tracking shipments using GPS. Not to mention, Tinder is not the only matchmaking going on. . . shippers and brokers are hooking up with motor carriers to haul their customers’ cargo through apps or on websites. Nonetheless, users of newer transportation and logistics technology should bear in mind that the benefits of technology use are not without significant risk, and steps must be taken to mitigate against new exposures.

What is it and what are the benefits?

Vendors now offer users and providers of transportation services GPS-driven crowdsourcing technology products that capture real-time information to map and relay exchanges of information between service users and providers. For instance: uShip matches shippers wanting freight to be transported with carriers to haul the loads; the Ubers of cargo transportation, GlobalTranz and Fleet, help shippers find freight brokers to arrange transportation of domestic and international shipments, respectively; and Trucker Path enables drivers to map routes, locate loads ready to be hauled, find parking, fuel stops and weigh stations, manage loads, view metrics, etc.

If you have sea legs, ships can be chartered through the use of the GetMyBoat app; Maersk and Alibaba are reported to have partnered up to enable shippers to track ocean-going shipments; and Walmart has been experimenting with the use of Blockchain technology to bring traceability and transparency into its food supply network and better ensure food safety during transport.

New data-sharing technology can also be used for driver and crew onboarding services, temperature monitoring, measuring productivity, and to improve operations and reduce costs generally.

What kind of information do apps and online platforms collect or generate?

The way that these new online and app-based technology platforms work is by sharing information that is oftentimes sensitive. Information collected and shared by apps and online platforms include:

• User names or personal identifying information

• Financial information

• Date and time the vessel, truck, cargo container, or other transportation equipment is in operation or use

• Location of vessel, truck, container or other transportation equipment (as determined by satellite or terrestrial sources)

• Engine hours

• Distance travelled, truck routing, or vessel sailing schedules (including terminal or port arrivals and departures)

• Speed of the carrier

What are the risks?

Sometimes too much information can be harmful, particularly when a transportation company may be imputed with having knowledge of all of the data in its possession or made “available” to it, including data that is used for regulatory compliance.

For instance, if a shipper were to engage and require a freight broker to use an app that collects driver information, including hours of service, and it became apparent, through the app, that the driver was making a delivery for a particular shipper in violation of the driver’s hours of service, the shipper or broker could potentially be imputed with that knowledge. This would be even more detrimental if the driver were to, because of fatigue, cause a truck accident. Arguably, a broker having accessed this abundance of driving information (and perhaps, thereby, being too connected with the driver through the app) could be viewed as having exercised too much control over the driver’s actions, such that the broker could be held responsible for the driver’s actions as if the broker were the driver’s actual employer under a vicarious liability theory.

Further, as with Electronic Logging Devices (ELDs), drivers may be concerned about privacy and harassment issues associated with app use, since some of their personal information is collected through the use of trucking apps. Similarly, carriers may be concerned about their proprietary information being disclosed to their competitors through service providers’ sharing of information with third parties or because of cybersecurity attacks. Email messages oftentimes trick users into downloading malware, allowing criminals to access computer systems to read files, obtain personal and financial information, and send messages from email accounts.

Many data-sharing technology service providers have terms of service and/or “privacy” policies, to which one agrees by using the app or the services. These terms and conditions and policies typically provide that the service provider cannot guarantee the security of any data disclosed online or through use of the app. Further, these policies shield the service providers from any liability for security breaches unless the breach is caused by the service provider’s negligence. The service provider’s terms may also permit the service provider to share user data with third parties or require disputes arising out of the use of the app to be resolved in foreign countries through the application of foreign law.

In the open seas, GPS tracking of containers on containerships has reportedly led to higher incidences of cargo theft and cyberattacks interfering with vessel operations. In the event of a cyberattack, Automatic Identification Systems (AISs), Global Navigation Satellite Systems (GNSSs), Electronic Navigational Charts (ENCs), and Electronic Chart Display and Information Systems (ECDISs) charts could disappear from bridge screens or be modified. A compromised AIS, for example, might prevent a ship from providing movement information, create phantom vessels, make it apparent to other AIS users that a vessel was in a false location, or make structures disappear. Similarly, a compromised GPS signal could change a ship’s direction and provide false interpretations of course parameters to the ship’s navigation systems. This could all result in dastardly collisions or allisions and colossal liability exposure for the vessel owners and operators.

Who owns it?

Who owns the data being shared through online app-based and other platforms is typically dictated by the contracts or service provider’s terms and conditions governing the service provider’s and service user’s relationship.

Without a written contract, you could be subjected to the service provider’s one-sided terms and conditions, which oftentimes grant the service provider a nonexclusive, royaltyfree, sublicenseable and transferable license to use your data. This use is typically without any obligation on the service provider’s part, and provides the service provider with full license to use, reproduce, distribute, publish, display, perform, transmit, stream, broadcast, modify and otherwise utilize your data and any modifications and derivatives thereof.

Of course, without negotiating otherwise, a license to use the service provider’s app or online platform is generally much more limited—only for internal business purposes, and the user agrees to indemnify the service provider for any claims that arise from breaching the service provider’s terms and conditions and “applicable law.”

Limiting Exposure

Before using the new technology, confer with professionals. To limit exposure when entering into relationships with app and other onlinebased data-sharing platform service providers, it is imperative that you ensure that your contract sufficiently protects the ownership of and sharing of a driver’s personal information and company proprietary information, and that you push back on service provider terms and conditions that do not.

Further, information technology personnel can help you minimize the risk of a cybersecurity attack by making sure that you keep a good upto-date antivirus on all computers. You will also want to be sure to change operational-systems passwords often, and be aware of and limit access to and the use of computer systems. Be sure that “sensitive data” is stored only on hard drives and not on the network whenever possible, block websites that are known common malware points of entry, use a secure web portal for online transactions requiring the use of log-in credentials, limit use of bill pay, online banking, and similar activities, particularly when on board vessels. It is also important to inform crew members and truck drivers about the prudent use of social media so that personal identifying and corporate proprietary information is not shared to third parties.

It is also advisable to establish a privacy and data security governance program, assigning roles and responsibilities to corporate personnel, and developing a training program identifying security data breach risks and measures for  protecting against those risks. Information retention and destruction policies should be included in the program. Obtain buy-in from the top down within your company. Determine who will need to know about any data breach that occurs and how you will notify those entities and individuals, both internally and externally. The privacy and data security governance program should be flexible and updated periodically. It should also be audited to determine where any gaps exist so that they can be fixed.

In some sense, the use of apps and online portals for sharing data and information puts freight brokers at greater arm’s length from the contract carriers’ drivers—where they need to be (you do not want to contact drivers directly to determine shipment status, location, etc.). However, arranging for communications between brokers and motor carriers’ dispatch personnel through app-based and similar technology, in lieu of drivers, is preferable.

When using GPS technology, shippers and brokers should not hold out or represent, in applicable agreements, on their websites or otherwise, that they are providing or will provide “control” or a tracking device. Instead, indicate that the carrier may provide a vehicle equipped with the device and the recorded tracking information or that you have the ability to track or monitor shipments (i.e., the cargo itself and not the driver or vehicle) through the carrier’s transportation of the shipment. Indicate in the shipper/carrier and broker/carrier agreements that the carrier will use and install a tracking device and relay shipment-monitoring information to you as the broker or shipper. The carrier should be left to determine the details as to how it will track shipments and relay the recorded information to the broker or shipper.