Yesterday afternoon (June 12), as some protesters in Hong Kong appeared to be dispersing for a lunch break before regrouping later in the afternoon, I noticed something odd at the Admiralty subway station: instead of swiping through the turnstiles with their pre-paid, rechargeable cards, there were scores of people lining up at cash-only ticketing machines.

Protesters had gathered overnight outside the local government offices to protest a controversial proposed extradition bill, which would make it possible to extradite people from Hong Kong to mainland China to face charges. By the morning, the crowd had swelled to tens of thousands as protesters occupied large swathes of a major highway as riot police looked on.

Local Hong Kong residents almost never use these ticketing machines these days to buy single-journey tickets. For starters, everyone has a rechargeable smart card, called the Octopus card, that is widely used across the city to pay for everything from transport to meals and groceries. Purchasing a physical ticket not only takes time, it also costs more than the equivalent trip paid for with the Octopus card. It ends up being mostly tourists who use the ticketing machines.

And yet there the protesters were, queuing in droves to pay for their train tickets in cash. A line of at least 10 metres stretched out from each of the five ticketing machines in one area of the station. One protester said they were afraid of having their card data traced back to them and used as proof that they were at the protest, should the police decide to press charges—as they did against key protest leaders from the 2014 pro-democracy Umbrella Movement.

Between yesterday and today (June 13), police said they have arrested 11 people for the clashes.

“We’re afraid of having our data tracked,” the female protester said. She added that during the 2014 Umbrella Movement protests, this kind of ticket-buying in cash wasn’t as prevalent. But five years on, people knew better and were wary.

The use of Octopus card data to trace criminal suspects is not new. As early as 2010, police used such data to track down a suspect in an acid-attack case, who was later convicted. Each Octopus card contains a chip that stores its outstanding balance and transaction records, and each card has a serial number for identification. These days, they can even be linked to a credit card to automatically top-up when the balance runs low, making the cards even easier to trace. As police officers put it to the South China Morning Post, the card is like a GPS system because it can locate where and when the holder uses it.

There have been other cases of transit card data being used to identify criminal suspects. In 2001, a New York subway employee was arrested for the murder of his ex-girlfriend, after his alibi crumpled when police analysed his MetroCard data (paywall). The man was later convicted. In another case, MetroCard data was used to charge a man for the 1999 assault and robbery of a supermarket manager in Manhattan.

The Hong Kong protesters’ behavior raises questions about data privacy, surveillance, and the dangers of “smart cities” as companies and governments sweep up ever-increasing troves of personal data. The protesters’ deliberate decision to use cash, despite its seeming inconvenience, also shows how increasingly cashless societies can present dire privacy concerns. Cryptocurrency advocates argue that electronic cash, such as Bitcoin, offers the solution for private digital payments.