chaps

Sigh. Just because you don't understand why something is confusing to someone doesn't mean it isn't confusing. That's literally the point I'm trying to make. I'm glad it wasn't confusing to you.

Gotcha, thank you.

(just to be clear, my post was just to point out that the article is very difficult to make heads or tails of. it's easy to misinterpret a lot of the points many different ways! kind of like they're being overly implicit with the expectation that everyone'll know what they mean. it's something I do too and my way of cutting through it is to cut my writing in half and focus on clarity over mystique)

Honestly? It's weirdly written and incredibly hard to understand what their point is. I can't tell if they hate or love privacy.

Like I told dang in his response to my email:

Believe me, I'm tired of hearing about it too. But when it's used to deport my friends, it's important for me to hear about.

---

I hope you can understand why it's aggravating to hear that the tools used to deport my friends are "boring".

Principle of charity, friend; that's not really what's at-issue here. The post was on the front page one minute and the next it was shoved deep to the back. That aint right.

As a reminder, Flock is a ycombinator company.

Unrelated, in about a minute this post went from the front page to the third page.

My position is that no amount of policy will ever make these tools safe, fullstop. I've been an investigative journalist doing research into the use of technology by police and prosecutors and the shit I've personally seen is beyond shameful. The modes of failure for these systems are such that it's inevitable that they'll be abused and even when abuses don't happen, accidents do. And also FWIW, I've been a sysadmin at some pretty large companies, have seen how the meat is made, and I have a deeply grim understanding of how systems are secured.

Some example: Chicago Police Department accidentally sent me the ALPR XML data from the state's system (LEADS). The data included about a thousand social security numbers, many credit cards, the fingerprint hashes. This happened during FOIA litigation and when we raised it to them, instead of freaking out, they asked us if wanted them to actually redact. We said yes, they came back later and the XMLs still had many SSNs and credit card numbers. Third time was better, but it's still awful. Thousands of pages.

Another example: City of Chicago has given me the license plate records for millions of vehicles through FOIA. You can read about it at the end here: https://mchap.io/losing-a-5yr-long-illinois-foia-lawsuit-for...

Another example: Cook County Sheriff's Office's electronic monitoring program was using a 20 year old webserver that was exposed to the internet, leading to this: https://www.vice.com/en/article/contractor-exposed-the-movem...

Another example: City of Seattle accidentally sent me 30 million emails (including police): https://mchap.io/that-time-the-city-of-seattle-accidentally-...

The town I grew up in was a target of Bovino's ICE. A FOIA request for the usage of Flock in that town returned back the longest FOIA denial I've ever received, and I've done thousands, including over a dozen lawsuits. The friends that I graduated with, who think of this country as their home are being targeted. It's hard to express the grief of that. https://www.muckrock.com/foi/waukegan-11153/flock-safety-alp...

Another example: Recently I even found an S3 bucket used by police to share photos of people across state lines. Just... on the internet. Facial recognition, flock, etc.

I think you're hyper-focusing on the 4A public space stuff honestly. The 4A issue that I specifically research is about the extent of exculpatory information given to defense attorneys during criminal prosecution. Of the 150 arrests done by Chicago Police that I found in Flock audit lots, only one arrest report actually mentioned Flock. People have a 4th amendment right to have access to the exculpatory information about their arrest in order to make a proper defense.

This is all just stuff that I've found in my research and I feel like I've barely scratched the surface.

Care to explain? Not getting a good vibe from you, Mr. CEO.

What you do is: you sue. On my 13th FOIA lawsuit and I have a couple more in the works ;)

Depending on where you're from, it's pretty easy to find a pro bono attorney. In Illinois, the plaintiff's attorneys recoup their costs on a successful win.

It's definitely not. For example, police in Illinois have warrantless access to ipass scans.

https://www.documentcloud.org/documents/20645486-re_-externa...

  HB 4006 nullifies the entire purpose of obtaining Tollway information in an active investigation by requiring promptnotification to the subject of a search warrant and potential criminal actor. This information can be incredibly usefulin a multitude of criminal investigations, including homicides, kidnappings, and interstate trafficking of contraband.With this provision, law enforcement would not proceed with seeking a search warrant if it could jeopardize the abilityto apprehend the suspect, result in the destruction of evidence, or even worse result in harm to a victim.

  Additionally, the proposed bill forecloses the possibility of obtaining information about a person traveling through aTollway pursuant to a subpoena, including license plate information or photographs of the driver, where a knownsuspect may not be identified but the route of travel could be useful to generate leads. A warrant is not required toobtain this information. Placing such a requirement that creates greater protections beyond those required under theFourth Amendment creates an unnecessary limitation on law enforcement's ability to investigate crime. The currentrequirement to obtain a subpoena is sufficient to ensure that law enforcement has a documented investigative purposeand criminal predicate tied to Tollway information.

  Some case law background explaining why a warrant is not required for this type of Tollway information:

  "This court has not previously addressed in a published opinion the question of whether an individual has areasonable expectation of privacy in his license plate. In two unpublished decisions, however, this court has agreedwith the other circuits that have decided this issue by holding that no such privacy interest exists. The reasoning ofthese opinions, as well as that of the Supreme Court in related cases, leads us to agree that a motorist has noreasonable expectation of privacy in the information contained on his license plate under the Fourth Amendment.No argument can be made that a motorist seeks to keep the information on his license plate private. The very purposeof a license plate number, like that of a Vehicle Identification Number, is to provide identifying information to lawenforcement officials and others."

No need for snark; I'm genuinely interested in your position. From my re-read and re-read, you've provided a conclusory statement without actually explaining the details.

Is your definition of "stupid" anything that contradicts 50 years of case law? That seems.... tautologically limp.

And public defenders are the main line of defense against prosecutors yet prosecution budgets are significantly higher.

You really sully your position when you call it a "stupid extension of the idea of viewing = searching."

Again, details matter: how is it stupid.

Of course they can and of course they do. It gets much more complicated when you consider that each state has different laws about records sharing.

And, lol, yes the 4th amendment extends to driving on a public roadway... roads aren't international waters. Probable cause and such are still important. I recognize what you're saying but -- details matter, dammit.

Friend, that's a.... deep, deep mischaracterization of how the courts work. The cops, prosecutors and judges have deep relationship with each other. Yes, these are "courts problems", but you can't have these courts problems without cops, without prosecutors, without judges, etc.

Ask yourself: why do public defenders have a tiny fraction of the budget of prosecutors?

> Try to get something out of the CEO of Bank of America or some other faceless corporation

I have. It's easier than you think.

Knowing about the CEO of a company is the lowest bar for, "testament to accountability" I've ever seen.

You'd think so. Legacy servers that've been running for ten years really puts a hitch in that.

Systems definitely care, especially in finance and trading systems.

Was involved in rolling out a large NTP annealing patch about ten years ago. We missed a couple and the effect was largely overall muted, but we did have one server with an old JVM hard crashing the server right at the second shift.

That specific server was already hobbling along so it wasn't a surprise. But it required a bit of firefighting.

Please actually just look at any audit log and just search yourself. If you think there's no signal, then you clearly haven't looked. If you're going to continue to be lazy in your analysis, then ask a damn LLM. There are 528 agencies who used "suspicious". This is not a bloomingdale problem; it's much larger. Just fucking look, man.

  select count(*),org_name from flock_bloomingdale where reason = 'suspicious' group by org_name order by count desc;


   count |                     org_name
  -------+--------------------------------------------------
  2678 | Skokie IL PD
   828 | Joliet IL PD
   678 | Houston TX PD
   391 | Fayette County IL SO
   309 | Chicago IL PD
   256 | Katy TX PD
   245 | Itasca IL PD
   244 | Steger IL PD
   229 | Athens-Clarke County GA PD
   215 | Lucas County OH SO
   209 | Oak Lawn IL PD
   208 | Westmont IL PD
   199 | La Salle County IL PD - OLD
   194 | Zion IL PD
   191 | La Grange Park IL PD
   174 | Kenosha County WI SO
   173 | Champaign County IL SO
   170 | Roselle IL PD
   160 | Lake Villa IL PD
   152 | Bradley IL PD
   152 | Madison County IN SO
   143 | LaSalle Co. IL SO - New
   135 | Flossmoor IL PD
   132 | Sauk Village IL PD
   116 | Oak Brook IL PD
   106 | Crete IL PD
   104 | Villa Park IL PD
   101 | Darien IL PD
    97 | Cicero IL PD
    94 | Wilmington IL PD
    89 | Rockford IL PD
    80 | Lake County IL SO
    80 | Dolton IL PD
    79 | Texas Department of Public Safety
    76 | Will County IL SO
    75 | Naperville IL PD
    72 | Minooka IL PD
    68 | Hillside IL PD
    63 | Carpentersville IL PD
    55 | Kent County MI SO
    55 | Zanesville OH PD
    54 | Winnebago County IL SO
    51 | Logan County NE SO
    46 | Romeoville IL PD
    46 | Menomonee Falls WI PD
    46 | Homewood IL PD
    44 | Burnham IL PD
    44 | Baldwin County GA SO
    43 | Venice FL PD
    39 | Elmwood Park IL PD
    37 | DuPage County IL SO
    36 | Greensboro NC PD
    34 | Lowndes County GA SO
    34 | Henry County GA PD
    34 | Tinley Park IL PD

  They're matching specific descriptions of cars to incidents, like, "this vehicle has been present at the site of 5 previous package thefts".

You're hand-waving a hell of a lot of things away and you expect that everyone knows what you're talking about. Please stop doing that.

- Who is "They"?

- Why do you say "nobody has time for that"? What is "that"?

- Why are you dismissing genuine concerns through unhelpful language like, "coming to it with movie plot concerns".

- Why wouldn't "that" be a big deal? What is "that"?!

- What are the deeply problematic things?

- "They're matching specific descriptions of cars to incidents" -- no they're not. Just looking at Bloomingdale's audit logs, there are 13k examples of searches done for the simple reason, "suspicious".

- Why does municipalities being the primary operators matter?

Asking from a place of genuine confusion by how you think about these things.

With a search warrant, I can submit FOIA requests or go to the courthouse.

With flock searches, I (usually) can't because Illinois law exempts ALPR records. Here's the most egregious example I've seen: https://www.muckrock.com/foi/waukegan-11153/flock-safety-alp...

Eh, looking around, I think you're thinking of Debian. They re-enabled it by-default back in 2009. So, sure, I guess. But if you're dealing with an OS that's from 2009 these days, whether /dev/tcp is enabled in bash or not isn't exactly relevant anymore. And I've seen enough broken python installs (even with stdlib) to put my faith in /dev/tcp working in bash :)

Once had a coworker tell me to never to use this because "you never know when the customer doesn't have bash installed; use python instead" even though our contract required that the customer had bash. I'm still laughing at that.

An important thing you should recognize: the judicial system is painfully nontransparent in such a way that even figuring this sort of thing takes an extensive amount of time and is often even impossible. I've personally gone down a similar route (did some journalism for a bit) by trying to understand how shotspotter is used in prosecution, many of which resulted in false arrests and many, many years of life lost across all the people arrested falsely from it.

If you would like to begin trying to answer these, I recommend starting with submitting some FOIAs. Considering your stance seems to be that you won't believe what others are telling you -- I promise you that you'll be surprised.

Throwing yourself at something that's never been done is fun.

But know what's really fun? Taking something that's been done before, has been forgotten about, and can be iterated on with your own spirit. There's so much exploration to be done.

Are you asking for articles that show how connected car data is being sold left and right?

Never let your memes be dreams nor your dreams be memes.

The moment my JSON has any sort of depth and I need to write a parser for it and potentially account for unspecified behavior. JSON's nice when it's nice, but it's terrible when it's terrible. It's 100x easier to write SQL than writing jq and... dear god if I have to use grep -A or -B, I'm doing something wrong. Constraints are actually a good thing!

The underlying database isn't the most important thing. Just use SQL. Its namespacing (eg, through CTEs) is good and you're more likely to have colleagues who know SQL compared to jq.

For folks wanting to answer this question, please ask yourself:

Which laws?

Where were the cameras installed?

Are the fines disproportionate?

Are subpoenas necessary to access footage/data? If so/not, who's accessed it?

Are there ways to FOIA the data to answer these questions?