‘This vendor needs to go’: Cybersecurity engineer warns Seattle’s camera system is one merger away from a nationwide dragnet

Seattle’s surveillance camera debate has largely been framed as a choice between safety and privacy. But cybersecurity engineer Noah Williams, a member of the Community Not Cameras coalition, told “The John Curley Show” on KIRO Newsradio that the real problem isn’t cameras themselves. It’s the system running them.

Williams, who recently toured the Seattle Police Department’s Real-Time Crime Center, said the city’s camera network is operated by Axon, a vendor that controls the system’s cloud-based platform. While the footage may be stored locally on the cameras, Williams said it is streamed through Axon’s infrastructure when analysts access it, and uploaded to Axon’s cloud platform, evidence.com, during investigations.

“While our contract with the vendor states that they will only do certain things with that data, we have no means to independently verify that, and neither do the auditors currently auditing the project,” Williams said.

Williams said he was able to open the same web application used by the Real-Time Crime Center in an unauthenticated state on his own browser, something he said dramatically expands the system’s vulnerability.

“That doesn’t automatically mean that the data has been breached, but it means that the attack surface is much greater,” he said. “Anyone who goes after Axon and decides to hack them, or coerces them through commercial pressures, subpoenas, can readily obtain access to that data and pull footage from our cameras without our knowledge.”

Williams: ICE could subpoena Axon, and Seattle would never know

Williams warned that the architecture of the system means federal agencies like ICE could bypass the city entirely.

“If ICE wants to get data from Axon, they’re going to subpoena Axon blindly, and Seattle’s never going to know about it,” he said. “They’re not going to subpoena Seattle because they know that we have a policy that we don’t share data with them.”

Williams noted the issue isn’t just this particular system but the broader industry forces driving how surveillance technology is built and sold, warning that the same market pressures that created Axon’s architecture could lead to something worse.

“This vendor needs to go,” Williams said. “And the commercial pressures, the same commercial pressures that lead them to make systems like this, are the same ones that Flock is trying to go after in the market.”

“Flock could buy this company tomorrow,” he continued. “One thing I learned about this Fusus system is it used to be its own company until Axon acquired it, and in this merger-friendly Federal Trade Commission, there’s no guarantee that Flock doesn’t buy Axon tomorrow and then merge the two systems into one giant surveillance dragnet accessible from out of state.”

Williams points to Metro buses as the ‘gold standard’

When KIRO fill-in host Jim Dever asked whether there’s a version of cameras that could work, Williams pointed to King County Metro’s bus cameras as the model.

“Thanks to the demands of ATU Local 587, King County Metro buses are equipped with local DVRs,” Williams said. “That video footage is there for accountability if somebody assaults somebody on a bus, but that footage lives on the bus, and it’s not connected to the internet. It is only used for purposes of accountability, and it cannot be remotely accessed.”

Williams said any replacement system should store data exclusively on servers that Seattle owns and manages.

KIRO hosts push back on the anti-camera stance

KIRO fill-in host Angela Poe Russell challenged Williams directly, noting that the coalition’s name, Communities Not Cameras, suggests an opposition to cameras in general, not just this vendor.

“The fact that you don’t have cameras around your home makes me think you must be in a really good neighborhood,” Russell said. “Whenever I hear people say, ‘I don’t want the cameras,’ I’m just like, do you live in my world? What world are you living in that you can not have cameras around your house? It makes me think you have a privileged life, and other people maybe don’t, and they do want the cameras.”

Russell described her own family’s experience with gun violence and the lack of evidence to identify a shooter.

“My husband was driving down the street, and a bullet went through the door of his car,” Russell said. “There was no way to figure out who was responsible.”

Dever acknowledged the risks Williams outlined but said his ideal world would still include cameras.

“In my perfect world, there’d be cameras everywhere,” Dever said. “Those cameras would be there solely to keep people safe. You would have public safety civilians monitoring the feed. You’d be able to take the evidence as needed, but it wouldn’t be put into the hands of the federal government, and it wouldn’t be used by other states to monitor people receiving reproductive medicine.”

KIRO producer Joe Wallace offered a middle ground, noting that Williams is conceding cameras can work if the system is closed and locally controlled, pointing to the bus system as proof.

“He is saying, he is conceding that if you are going to have a camera system, the bus system has a perfect example of that,” Wallace said. “If a crime is committed, you can go back and access the exact footage. So the system exists — it’s just a closed system. It’s not an open system with internet access where any bad actors can get a hold of it, and you’d never know if they did.”

The NYU Policing Project is expected to release its audit of the camera system by the end of September. Williams said the report should, at minimum, address where encryption keys are stored and who controls them.

“That’s kind of the difference between saying, ‘I contracted out security to a private company to install locks on my doors with keys that I own,’ versus ‘I contracted it out to a company that can remotely change the keys on my doors,'” Williams said. “That’s a big, big difference.”

Watch the full discussion in the video above.

Listen to John Curley weekday afternoons from 3 – 7 p.m. on KIRO Newsradio, 97.3 FM. Subscribe to the podcast here.

Follow @https://twitter.com/jcurleyshow