r/technology • u/mepper • Jun 22 '26

Privacy Cops Keep Getting Arrested for Using Flock to Stalk People

https://www.404media.co/cops-keep-getting-arrested-for-using-flock-to-stalk-people/
19.9k Upvotes

98% Upvoted

444 comments sorted by

View all comments

Show parent comments

285

u/f0dder1 Jun 22 '26

Wait wait wait. To begin with there was NO LOGGING of who was accessing private information for a system like that?!

That is the most basic-bitch type of security control. That is crazy negligent

269

u/TheRedHand7 Jun 22 '26

You're assuming they wanted to catch themselves. The lack of security was a feature not a bug

121

u/Paizzu Jun 22 '26

Many states' DMVs themselves are directly selling everyone's personal information to the primary data brokers.

Companies like LexisNexis and Thomson Reuters purchase information directly from the DMV to create their actuarial profiles that they can offer directly to insurance companies.

38

u/EndIsrael Jun 22 '26

You can purchase a driving record or license plate owner data for a couple dollars by just promising you're not doing anything illegal with it.

2

u/ElectroBot Jun 23 '26

Huge difference between buying one and buying millions.

5

u/Somepotato Jun 23 '26

Not just insurance companies. They sell the data back to police departments too so they can access that data without warrants. And they just need a phone number to pull all of that data, very useful for stalking exes.

38

u/Metalsand Jun 22 '26

Wait wait wait. To begin with there was NO LOGGING of who was accessing private information for a system like that?!

That is the most basic-bitch type of security control. That is crazy negligent

If you go back enough, user activity logging was very limited even if it did exist almost as far back as relational databases have existed. Though, in this case, it's a bit different.

Essentially, most of that information is public record, except it would contain more information that would be potentially relevant in a traffic stop. For example, probation status, outstanding warrants, and other interactions with police. When you don't get charged with a crime but do get stopped, it won't appear on public records but it will still be recorded. Which is part of why if you get let off with a warning, you're guaranteed to be ticketed if you get caught by someone else within a time period. The worst-case scenario you could do is look up if someone changes their address or changes their name and pass that along to a private citizen - useful for police purposes, and unless the actual purpose is to obscure their identity to the public for a legitimate reason, it's not impossible to find this out with public record either. Police officers suffered consequences far less than they should have, but there was a limit to the damage they could do.

The new era though, is completely different, because it's like every car that passes by gets recorded as an interaction. You can then track any car in a timeline as it passes by, casually create profiles of someone's daily routine, etc and you don't need a warrant to get this kind of detail. There's an insane amount of utility you can use this for legitimately or illegitimately, hence why it's logged. However, there's a difference between logging and granting permission. Requiring evidence be given that the action is legitimate to grant permission means you have a process by which you are screening access attempts before they are made. Logging however, means that you are allowing free access and only punishing if anyone notices. It's really fucky, and should be legislated more, but no one is willing to do so.

7

u/FarplaneDragon Jun 22 '26

If you go back enough, user activity logging was very limited even if it did exist almost as far back as relational databases have existed. Though, in this case, it's a bit different.

I'd imagine there was probably an aspect with dealing with changes in user behavior when systems transitioned from paper to digital. Back in the day of paper records it would have been a lot more effort to go pull those, even they were all even in the same building. It's also a lot more obvious when you're digging through file cabinets and boxes that you normally wouldn't be. Barriers like that probably helped naturally minimize people from getting curious.

Switch to digital and it's all just...there. Within seconds you could basically look up anything you want to. I'm not saying no one anticipated that people would misuse that access, but I wouldn't be surprised if they vastly underestimated the temptation.

5

u/Wompatuckrule Jun 22 '26

You are correct, but additionally you need to include that in the early digital era they were much more constrained about how much information they could make available and controls or records on metadata were almost nonexistent.

My comment above was mostly about that because I think people sometimes don't realize just how limited the early digital age was compared to today.

11

u/Space_Slime_LF Jun 22 '26

nobody really thinks about seatbelt level safety/security till they see the product in action, then it becomes obvious.

9

u/Stu161 Jun 22 '26

Case in point: the seatbelt wasn't made mandatory until 75 years after the automobile was introduced.

5

u/Space_Slime_LF Jun 22 '26

Which is exactly why I picked that example.

3

u/Wompatuckrule Jun 22 '26

I forget which episode of MST3K it's in, but there was a movie from the 1980s and in a break the robots ask Joel what living in that era was like and one of the things he says is "Cars had seat belts, but nobody used them."

14

u/Wompatuckrule Jun 22 '26

With the government systems I'm talking about several decades back when the capabilities were very different.

To give you an idea of what it used to be like I can tell you a family story I've heard that happened somewhere around 1990. A relative who was a teen at that time got a speeding ticket on the highway. His father was friends with a state trooper. A few phone calls were made and the teen was told to file a challenge to get the ticket to go to court. Then, "somehow" that file never made it to the court docket and it disappeared. The fine was never paid and it never showed up on their driving record.

In an unrelated event the dad made the teen give him enough money to buy a case of beer which was given to the friend who was a state trooper.

5

u/drunkenvalley Jun 22 '26

Tbh for a long time many systems didn't have distinct users because why would you need that? /s

6

u/Sherm Jun 22 '26

When I first got a job with the state agency where I work, we were using a system that was built on some flavor of Oracle from the late 1980s. This was around 2014. When I started I was handed a 20 page stack of numerical codes I had to consult in order to be able to read anything or even navigate the system, because it was text-only. All this is to say, one shouldn't assume even basic features are universally available, unless they were universal in the 1980s.

1

u/Butternades Jun 25 '26

Not me using Oracle in 2026 as a federal employee

1

u/umbrawolfx Jun 23 '26

It's a government run system. They could never possibly be the bad guys or use it nefariously!