Carris has changed the lock on the door and João Vasconcelos, who had created an application to help Carris passengers, can no longer see the buses in real time. The company has not responded to several requests from Lisboa Para Pessoas.
Hours after the news from Lisboa Para Pessoas about GeoBus, a application that João Vasconcelos created voluntarily to help people know where the Carris buses are in real timethe carrier's data became inaccessible. Carris changed the key, making it impossible for João to access the API. Without real-time information about the buses, GeoBus becomes useless. "It leaves me quite frustrated and disappointed. Even more so because Carris is a public company, now under the management of the Lisbon City Council."João laments.
Two and a half weeks have passed since December 19th, the day that Lisboa Para Pessoas published about GeoBus and shortly afterwards this application lost access to Carris' data. Lisboa Para Pessoas contacted the public relations office of the municipal company several times but never got an answer. We asked about GeoBus' access to the API and also how the carrier views this kind of voluntary, non-profit project that seeks to offer an alternative to public transport users.
João also contacted Carris again. The company answered him on December 26, in an e-mail that the young man shared with us: “Carris is still in a phase of evolution of its internal systems, not having, at this moment, the capacity to support additional applications, with requests to the time estimator. Even some Carris services that use the estimator are off-line, as it cannot handle the load during the morning and afternoon peak hours. As such we are currently unable to accommodate the GeoBus application request, but as soon as developments are assured we will respond to the expressed need." João had last exchanged emails with Carris in September 2020 to ask for the company's cooperation in accessing the data. At the time, Carris had told him that "the access to the API" was "to be studied". Since that moment and until John's insistence late last year, John had never received any response.
How John had accessed the API
To Lisboa Para Pessoas, João Vasconcelos, 27, an environmental engineer and programmer, explained that accessed the Carris API in 2019, when it was "freely available at carris.tecmic.pt, documented and without any restrictions"and that in early 2020 began developing the GeoBus "to make up for the lack of information made available to transport users, Carris' customers". In April, it published the app on the App Store for free for iPhone and, in the summer, "Carris decides to close access without any notice"he claims. "The API continued, however, to be available at gateway.carris.pt, now only accessible with a key/password. By the way the internet is designed and by the way authentication is implemented in all online services, it is always possible to access this key. Since Carris provides an official app on the App Store that consumes data from this API, you just have to inspect the HTTP requests from this app to easily discover this key".he explains without going into details of how exactly he proceeded.
But it was by this means that João Vasconcelos made GeoBus functional again, that is, with real time information from the buses. "Carris' attitude is not the most productive, ignoring and isolating itself from the community that is dedicated and working to improve its own service. When Carris closed access to API I tried several ways to get in touch, never getting a response."he laments. The author of GeoBus was not satisfied with the answer he received from Carris: "Carris indicates that allowing access to GeoBus may compromise the stability of its infrastructure. This is not true for the simple fact that GeoBus is quite conservative in the requests it makes to the API, more conservative than the official application itself, and in my opinion it is a much more useful, well designed application with a more comfortable user experience."
The young programmer feels "frustrated and disappointed" and understands that Carris "should be primarily concerned with providing an excellent, reliable and useful transportation service to the population". "GeoBus goes against this concern and is not only ignored but rejected by the entity itself"he adds. "My wishes for 2023 are that Carris will come to its senses and make API access available, allowing the community to be able to build information tools that contribute to a more inclusive, sustainable and accessible city for all."
"An example not to be followed"
When given full access to Carris' data, the GeoBus not only shows the real-time location of Lisbon's buses and streetcars, but also presents estimates of waiting times based on a machine-learning algorithm that analyzes patterns, segment by segment, of a given route, taking into account factors such as city traffic. These estimates complement the waiting times officially shown by Carris and may, in certain situations, be more realistic.
Listened to by Lisboa Para Pessoas, the association D3which is dedicated to the defense of digital rights, understands that Carris is "an example not to be followed" but it says "will not be a unique case". “Public entities are very late in implementing open data policies, and in some cases, such as Carris, the problem is even revealed at the cultural level of the entity itself, completely contrary to what is indicated by the Legislation in force." D3 refers to Open Data Law in the public sectorof 2021, which indicates that public entities such as Carris "must ensure that the documents and data they produce or make available are, where possible, open from their conception, with a view to their future availability to citizens and social organizations". As for the previous Law of Access to Administrative Data (LADA)of 2016, clarifies that these same entities must make available "dynamic data for reuse immediately after its collection"i.e. in real time, via API.
This same law "states that mobility data is high-value data and should be machine-readable, accessible via API and made freely available. It is no accident that the law defines this data as high-value data."says D3. "For example, they are very rich sources for educational contexts (e.g. courses in data analysis or urban planning). Similarly, the emergence of alternative platforms is key to enabling other ways of looking at information and improving existing solutions." For this association committed to the defense of digital rights there seems to be no "valid reasons to refuse access, since the cost of maintaining an API is not significant, and from a technical point of view there is no reason for third-party access to harm Carris' system".
Carris data "are public, which does not mean they are free".
In OctoberCarris had told Lisboa Para Pessoas that the accesses to your APIs "they are no longer public, but more restricted and time-controlled"to safeguard the "speed and availability" of the bus information on the operator's official application. Carris had detected that more people and entities were accessing their API and therefore overloading their server, so they felt the need to "introduce new security and credential use processes". The carrier also said that its data "are public, which does not mean they are free"and that it is available to provide access credentials to its APIs through a review "based on several parameters: purpose, type of data, project description, measures for maintaining the sites". "In addition, whenever requested, we accompany the implementation with technical support and recommendations, so that we preserve the value and credibility of the information."the company further informed.
Contrary to Carris, the Lisbon Metro makes its APIs publicly available with real-time information on train locations, waiting times, service disruptions, and other data. This openness on the part of this operator has allowed the emergence of community projectsas the application Next Metrowhich shows in a simple and practical way how long it will take to get to the next subway at any station; or the website Perturbações.ptwhich presents the most complete analysis of the availability and unavailability of the Lisbon Metro service over several years.
Although Metro de Lisboa makes real-time data available through its public APIs - which any person or entity can use - this information feeds the company's own website or Twitter account, where it is possible to consult the "state of the lines" and know if there is any service disruptionand also the physical panels of the stations. Metro can ensure that third-party requests for access to the APIs do not disrupt the availability of information on the company's official channels, technically privileging the server response to official channels over third-party requests; this way, in a more critical overload situation, Metro de Lisboa's most important means of communication, such as its website and panels, may not fail while everyone else fails.
