Creepy Tracking at the House of Mouse

If it’s been a few years since you’ve been to Disney World, you’re in for a surprise on your next visit. It seems the Happiest Place on Earth has become the Trackiest Place on Earth thanks to the Disney MagicBand, a multipurpose wristband that acts as your pass to all the Disney magic.

[Adam] recently returned from a Disney vacation and brought back his MagicBand, which quickly went under the knife for a peek at the magic inside. It turns out the technology is fairly mundane — a couple of flex PCBs with trace antennas and the usual trappings of an RFID transponder. But there’s also another antenna and a chip identified in a separate teardown as an NRF24LE1 2.4 GHz transceiver and microcontroller. The whole thing is powered by a coin cell, meaning the band isn’t just being interrogated by RFID – it’s actively transmitting and receiving.

What exactly it’s doing isn’t clear; Disney was characteristically cagey about specifics when [Adam] looked into the details, saying only that the bands “provide information that helps us improve the overall experience in our parks”. If you put aside the privacy concerns, it’s truly mind-boggling to think about the systems that must be in place to track thousands of these MagicBands around the enormous Disney property. And we can’t help but wonder if some of Disney R&D’s EM-Sense technology is at work in these wearables.

Thanks to [JohnU] for the tip.

70 thoughts on “Creepy Tracking at the House of Mouse

  1. Looks like a job for an SDR gadget, like a HackRF One. Best would be to interrogate it in its native environment, but a bit of initial bench testing would probably help set up for easier field work.

  2. If I were Disney I’d have been doing this ten years ago. Think of all that sweet, sweet marketing you can do, in the name “Providing a magical experience.” It will seem repulsive until you walk into a castle and a magic mirror lights up with your five year old daughter’s favorite princess, who then greets her by name.

    The Princess Power is very difficult to resist.

      1. There’s various roving and non-roving photographers that will take your photos, then scan your magic band. You don’t need any further interaction at the time to pay for or link to the photos, you go access (and pay for, if you didn’t pay in advance) them online at your convenience. I think ride photos may work the same way, I don’t recall.

    1. You don’t have to resist it…just buy Disney stock :-)
      After a trip to WDW in 1988, I bought some. Best performing stock in my (small) portfolio!

      If you can’t resist the corporate power, the next best thing is to get in on it :-)

  3. Lubricious. Seems America gets a kick out of looking for every which way way to capitalize on prophet margins.
    Even if it comes to privacy violations.
    Fuck Disney! Obnoxious children, smelly greasy food, densely packed crowds. How can this be a desirable
    vacation? Nevertheless for grown adults?

          1. I think gasoline and cordite vices are pretty universal too – the difference in America is that they’re far easier to indulge over here. When I put a Corvette up for sale a few years ago, the buyers were working on behalf of some Swedish guys who wanted it shipped over there.

      1. I don’t think it’s by default a privacy problem, and certain examples people have cited are pretty neat, but damn if it ain’t creepy at the same time.

        There’s huge potential for a problem though, and when it involves thousands of people’s kids it’s well worth at least pausing to consider the risks.

        Also, I don’t trust the mouse. Never have, never will.

    1. I get why some people love to hate Disney but those people probably don’t have children. Disney and Pixar consistently make quality family-friendly entertainment. Giving kids good role models and life lessons in movies is a major plus. A friend’s two disabled children watched “The Little Mermaid” and other Disney fare hundreds of times and it was one of the few things in their too-short lives that gave them joy. Disney’s products makes kids happy and going to the theme park(s) is on the wish-list for most kids here in the USA. Sure its overcommercialized but if you ever go to a Disney park I can GUARANTEE you will see something that as a hacker you will think “how did they do THAT?” Its pretty cool.

      What did you mean by “lubricious”? I don’t think you meant “offensively displaying or intended to arouse sexual desire” or “smooth and slippery with oil or a similar substance.”. Did you mean ludicrous?

      1. Yes, Thanks for the spelling correction.
        At the end of it all, It’s still just entertainment. You go there, piss away some several thousand dollars (assuming you’re renting a home) And for what?!. To go back to the life you started from? And don’t get me started with the “role models” of which you speak of. The stories mostly revolve around the same “price save the princess nonsense”. With falsified perceptions of foreign countries. You can’t possibly compare “the little mermaid” with a thought evoking masterpiece like Neon Genesis Evangellion or Ghost in the Shell.

        Or with the alleged “wow factor” you mention with some of their demonstrations. This is the equivalent of showing a say a 3D LED matrix cube to your average non tech-savy person and they say “wow, so cool!”. while on the flip side, showing a quantum CPU with all of it’s intricate networks of heat-pies, while explaining methods to successfully transport liquid nitrogen to it. And just because it doesn’t “blink or sing” it’s lame.

        1. I’m guessing you don’t have a family?
          I’m not a big Disney fan myself. I’d sooner be walking in the lakes, but my kids aren’t big enough yet.
          For many families, the vacation is a big family event, where memories of the family which will last a lifetime are made. And if outdoor activities aren’t appropriate, or if your daily life is outdoor activity, something more lethargic like Disney is a good option. Though it’s overpriced.

      1. To be fair, I actually like you Brits.
        Folks are rather laid back, funny and genuine.
        Unlike quite a number of Americans I’ve ecountered
        (Particularly females) which are frivolous and shallow.
        American white women of major cities are the absolute worst.

      1. I have some family in the middle of nowhere who would swear that one does. To them, a job takes however long it takes, and the sun goes down when the sun goes down.

        1. That actually sounds great, I’ve always admired the subsistence lifestyle – sadly to get to that stage you need land. But to buy the land you need money, and to earn said money you need a job. And so on and so forth.

  4. This is an optional device that makes things easier in the park. If you don’t like don’t use it. So what if they are tracking you,. You are in their park and you can take it off when you leave. A more interesting post would be a about a potential hack to make these do something cool outside the park.

  5. So what if they are tracking you. You are in their park and you can take it off when they leave. A more interesting post would be of a potential hack to make them do something cool outside of their park.

  6. So sure there are some truly dodgy tracking stuff going on today, but this looks like nothing more than a means for Disney to trace movement around the park, useful for all sorts of reasons.
    Notably park safety, improving emergency evacuations, keeping patron density levels down in any particular area, methods for determining amusement visit frequencies, patterns, helpful for cutting down on overcrowding certain rides, reducing patron waiting times in queues, etc etc etc.
    Now if it extends to outside the park, and they’re actively gathering and analysing outside data, then that’s a different story.

  7. Most likely they are using them to track the movement of crowds so that they can get an idea of how people move around the park so that they can improve congestion in areas or discover paths through the park that do not get used and determine why. At least, that is what I would do if I ran such a large network of attractions.

  8. Well from a workflow optimization standpoint this is gold.
    Diverting half of the new shift to another part of the park because people decided to gather there, customer flow in real time, statistics for EVERYTHING. This answers pretty much any question the manager of such a monstrous park might have. Having the layout of your lemonade stands optimized with this should give 25% or more in revenue for example.
    Of cause they are gonna try to squeeze more $€¥ from the customer this way, but used wisely it also has great potential to enhance user experience. Less waiting, better service, focussed cleaning, in-time distribution. They will know when to order more BORT signs ;-)
    Great feature for families would be to track/find your kids after you send them off to wait for hours in the line while you get some beer and food. Guess that’s gonna be the next step.

  9. I imagine that the CEO or park-director has hooked up a hacked version of Sim Theme Park (Theme Park World) to the park and MagicBand’s.
    Then he would be able to tune the speed of the rides to match the desired level of vomiting without ever leaving his chair.

  10. My bets are on it being a BLE beacon of some sort. Very easy to geofence the park with BLE central devices to report where people are roughly. Not enough battery in it for the device to act as a BLE central itself.

  11. I’m reasonably certain that they’re leveraging the park WiFi for tracking purposes — the WiFi coverage is really very good, and IIRC rolled out about the same time as the bands. Don’t knock WiFi in a theme park either – last time we went with our Niece and Nephew, we gave them cheap/used iPod Touches so we could communicate with them (and their parents). Worked out well for coordinating park activities.

    The bands are also your room key, and can be used to pay for items at most places (like you already could using your card based room key). They’re also used for FastPassses – pre-book a time slot on busy rides and skip (most of the line). The Genius there is that it gives you more time out in the park to spend money on food and trinkets.

    One of the restaurants – Be Our Guest – actually uses the location feature. You order/pay on the way in, then you can sit anywhere in the rather large dining room. Food shows up shortly after at your table, based solely on using the band to locate you. (the food runners have handheld devices to point them to you).

  12. I’m normally very sensitive to privacy concerns, but this isn’t a typical case:

    What sensitive information would be revealed about you by your movements /within a Disney theme park?/

    The worst I can think of is frequent bathroom trips (possibly implying diabetes, Chrones, BPH, etc.) As long as Disney isn’t selling data to insurance companies, I can’t think of a legitimate privacy concern here. Of course, Disney should be up front about their ability to do location tracking.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s