‘The police are basically renting access to data’: Cybersecurity expert warns about Flock cameras

KIRO host John Curley likes Flock cameras. One of them helped him get his stolen car back. His producer, Joe Wallace, thinks they’re the start of a surveillance state. So Wallace brought in someone he said could explain the risks better than he could.

Noah Williams, a cybersecurity engineer who works in cloud development operations and access management, joined “The John Curley Show” on KIRO Newsradio to explain why he thinks Americans are losing the fight over their own privacy.

Curley started with cost. He estimated a police department might pay around $2,500 a month for a set of Flock cameras, and was surprised by how cheap that was. Williams told him there was a reason for that.

“What Flock has constructed is a nationwide signals intelligence gathering platform,” Williams said. “Flock owns this data in all practical purposes. They get to control it. They get to sell it. They get to do what they want with it. The police are basically renting access to data.”

Who owns the data

Williams explained people picture Flock cameras like a security camera in a corner store. He described something much bigger: a network that logs license plates, makes and models, and patterns of movement across the country.

He claimed newer versions of the technology, from Flock and some other vendors, also pick up signals from the devices people carry, like phones, smartwatches, and car infotainment systems. Each device has a hardware identifier called a MAC address.

“All these things are benign themselves, but they combine together to form a very accurate picture of what your own personal signals intelligence footprint looks like,” Williams described.

That claim is disputed. Flock cameras can’t access what’s on your phone, but separate Bluetooth and Wi-Fi traffic readers used by some local governments do detect device MAC addresses as cars pass by, according to WhistleOut.

Williams said the bigger problem is who controls the data. In the old days, a police department ran its own camera system on servers it owned, often in a closet in its own building.

“This is not that at all,” Williams said. “The cops just don’t control this data, and they have no means to audit who actually does.”

Protestors across Washington have rallied against Flock cameras in their communities. Renton voted to physically cover its 24 Flock cameras in August.

What can police do?

Curley asked what someone could actually do with all that information. Williams said an algorithm could flag a gun owner who goes to the range twice a week as a potential threat, even though he’s just exercising his Second Amendment rights.

Then he made up a guy named Richard. In Williams’ example, Richard calls an ex at 2 a.m., stops for gas on the way over, and spends the night. Nothing illegal happens.

“He’s not driving impaired. He’s not doing anything,” Williams said. “He’s just breaking hearts and doing questionable things, which we all have the right to do as adults.”

The next morning, both of them start getting targeted ads based on what Richard bought at the gas station. Williams said nobody could prove which company connected the dots, because the data could come from credit card records, location data, or a signals profile.

Williams added these systems also get things wrong. If a stolen car has a similar make and a partially muddy plate, an innocent driver can be stopped by police.

“You just happen to have a hit for a similar-looking license plate because half of it was covered in mud,” Williams shared.

How can we push back?

Curley pushed back with the argument he hears most: the average person doesn’t care. He wanted to know what it would take for people to actually rise up and want their privacy back.

Williams said the backlash has already started, but nobody knows whether Americans will win. He pointed to China, where people have changed their behavior to fit a government that watches everyone.

He said the U.S. still has the First Amendment, and the ability to push local governments to drop these contracts. Williams pointed out private businesses are putting up the cameras too.

“We just lack any meaningful data protection legislation in this country right now,” Williams said, pointing to the European Union’s stricter rules on selling personal data.

Curley put it in football terms.

“They’ve got 21 points. What do we have on the board? Three,” Curley declared. “Have we gotten into the red zone?”

“We’ve been losing this battle for quite a while, and it doesn’t have to be like this,” Williams clarified. “Remember that these people are humans, and they’re not smarter than us. They’re not better than us.”

Private companies, no accountability

Curley asked what drives people to want that much control. Williams said some people just get “drunk on power.” Williams is worried now that private companies run these networks instead of the government.

He pointed out that when the NSA’s warrantless wiretapping came out after Edward Snowden’s leaks, Congress could at least haul officials in and force documents out of them.

“These private entities are just not accountable to that,” Williams said.

He also noted videos of people cutting Flock cameras off their aluminum poles, but physical damage is usually the tip of the iceberg.

Companies keep everything

Curley suggested companies will eventually start paying people for their data, the way car insurers offer discounts for letting them track your driving. Williams said that’s already happening with smart TVs, which he said are often sold below cost because the company plans to make money off your data.

Wallace claimed some LG smart TVs connected to the internet can listen through their microphones.

“So you save $400, but you give away,” Curley remarked.

Williams said the data can also come back to haunt you years later. If someone decides to run for office, he said, a company could still have records of their late-night habits from a decade before.

“10 years down the line, 20 years down the line, there’s nothing specifying that they have to delete,” Williams said.

What you tell the chatbot

Curley asked whether his questions to AI chatbots were protected. Williams said no.

He said large language models, the technology behind chatbots, don’t actually have memory. Companies add memory on top by storing what you type. Big companies often pay so their data won’t be used to train future models. Regular users usually get the free version, and Williams said they pay with their data.

“You’ve now consented to train the next LLM on all of the data that you’ve input into this chatbot,” Williams remarked. “You’ve probably consented in the fine print to selling it to advertisers or data brokers or whoever else.”

Curley asked where people could start protecting themselves. Williams pointed to DeFlock.org, a crowdsourced map of license plate camera locations.

“You can do your best to avoid the routes that they’ve been placed on,” Williams advised.

“Oh, my God! So depressing,” Curley responded.

“At least your TV was cheap,” Wallace quipped.

Watch the full discussion in the video above.

Listen to The John Curley Show weekday afternoons from 3 – 7 p.m. on KIRO Newsradio, 97.3 FM. Subscribe to the podcast here.

Follow @https://twitter.com/jcurleyshow