Clearly, the stories in the press have hurt them, especially the police abuse. Requiring case codes is a good step, and proactively catching signs of abuse is a big change from "we're just an unopinionated tool; you should talk to your police department". They're still passing the buck on educating users on the limitations of their tool. I remain skeptical of any of their claims around data ownership.

Reading these actions, you can pick apart how to circumvent them, and the security audit is still pending — let's see how damning of a report they'll allow to be released.