7 ms·

But the data collected is property of the government and flock is not allowed to use that data for additional business gain (according to their statements)...

But the data collected is property of the government and flock is not allowed to use that data for additional business gain (according to their statements)... So they can't sell the fact that you're at Target at 8:00 p.m. on Thursday to anybody... Nor build profiles to sell to advertisers... And if that's the case that's very similar to cloud storage vendors. If I access hacker news, and the record of my visit is stored in an AWS S3 bucket, I can't submit to AWS to delete my visitor record, even though the server, network cards, wires, and storage medium are AWS property, it was hacker news' website that generated that record and their responsibility to take my request to delete it.. AWS' stance would rightly be "talk to the website operator for CCPA requests"

tptacek 5mo ago
This is also true according to their contracts (we were one of the first munis in the country to ostentatiously cancel our Flock contract, and the lead up to that was a bunch of progressive legal experts poring over that contract looking for holes.)
- fsckboy 5mo ago
  >a bunch of progressive legal experts poring over that contract looking for holes all attorneys represent their clients; your attorney does not have to share your opinion of the law or public policy, they can still interpret what the law means to you. if you are afraid your attorney might have a bias (they are human) you may get better advice from the "misaligned" POV: the flaws/holes in a privacy law found by a pro-business conservative attorney are more likely to find sympathy in the courts from both fellow conservatives and progressive judges.
  - shermantanktop 5mo ago
    As a practical matter, this may be good advice. But it also places a demand on someone with a legitimate concern that they go find an ideological "beard" to make themselves more palatable and sympathetic. It's not hard to see how this enables an institution to gate itself from criticism.
deleted 5mo ago
[deleted]
thaumaturgy 5mo ago
Except that Flock very clearly benefits financially from having direct access to this data: owning (and in their own documentation, they very clearly do own it) a network of 80,000 surveillance devices across the country, and owning every single transit point for the data they collect, is what gets them to a $7.5 billion valuation from investors. The fact of the matter is that Flock is playing two-step with the concept of "ownership" of data. They disclaim ownership as a way to leave local agencies holding the bag for liabilities, but they fight tenaciously to retain complete and unfettered access to that data. (After organizing a community group that won Flock contract cancellations in multiple jurisdictions in Oregon, I went on to coauthor state legislation regulating ALPRs. I am very well familiar with all the dirty ball they play.) Also, Flock's cameras collect more data than is provided to police agencies. Who owns that data, I wonder?
- necovek 5mo ago
  That makes them a data broker in my reading, and at least in California, Data Broker legislation should apply. CA Data Broker registry gives me access denied, but that could be because I am outside US.
  - ScoobleDoodle 5mo ago
    I looked it up at https://cppa.ca.gov/data_broker_registry/ https://cppa.ca.gov/data_broker_registry/ and didn't find Flock / Flock Safety in that list of the currently registered 566 data brokers.
    - tptacek 5mo ago
      Because Flock isn't a data broker. Flock's customers own their data, not Flock, and they use Flock's platform voluntarily to share data with other customers.
      - necovek 5mo ago
        I was referring to the claim that "Flock's cameras collect more data than is provided to police agencies" — that suggests that there is data not "owned" by the customers, which implies it's Flock's data, thus it might make them liable under Data Broker legislation.
unethical_ban 5mo ago
This is worth validating independently, but to be clear: Are you saying Flock itself does not have access to any of the data, and that the data they store on behalf of local governments is not fed into any central datalake? That every organization's data is completely, unalterably separate from everyone else's? If so, that makes the panopticon slightly less powerful.
valeriozen 5mo ago
The AWS analogy breaks down because AWS doesn't encourage customers to pool their S3 buckets into a nationwide searchable index. Flock operates a federated network. If you drive past an unmarked camera, you have absolutely no way of knowing which specific HOA or town leased it so how are you realistically supposed to know who the "data controller" is to send your ccpa or deletion request to?
- giancarlostoro 5mo ago
  Start standing in front of the cameras looking sketchy long enough till police are sent out to ya, then ask the cop who called.
  - chaps 5mo ago
    Someone once dropped some fireworks not too far from me at 3am a few years back. They were loud and, yeah, cops were called. A few minutes later about five cars drive past me about 30mph over the limit. Not sure how they didn't see me or try to see me. But I know they didn't catch the BRIGHT orange and lifted care. Me being me, I submitted a FOIA request for the dashcam footage of the five cop cars and the dispatch logs. Instead of pulling over the easily identifiable car, they pulled over some random guy. They were behind him the whole time but five cop cars pulled behind him thinking that he fired a gun a few minutes back. He was let go without a citation, but the official reason, despite being paired with the dispatch for the firecracker, was a broken headlamp.
    - giancarlostoro 5mo ago
      I may or may not know a business owner who got criminals off their business' street by saying he thinks he saw a gun any time criminals showed up to do things, everything from prostitution to selling drugs. Cops showed up immediately. They stopped coming by altogether, probably the safest street in quite a rough part of town. It's crazy how cops just rush to very specific and nuanced crimes. Someone likely said they heard gun shots, and then they scrambled to find them.
jnovek 5mo ago
I don’t care. I don’t care who owns the data. If I can’t easily get private information like my movements removed from a database like this, the legislation does not sufficiently protect me. It should absolutely be Flock’s responsibility to remove my data and we should absolutely require it by law. Full stop.
- lazide 5mo ago
  A reasonably nuanced defense could likely claim that to be able to do what you want, would have much worse side effects on privacy. For example, would you want to be able to tell Public Storage (or some other storage unit place) to remove any naked photos of you stored anywhere in their storage units? For them to actually be able to do that would require they have nigh omniscience on everything stored by/for everyone in every one of their storage units. Even inside closed boxes. Now, it's not the same thing of course - but hopefully you understand what I'm referring to?
  - LadyCailin 5mo ago
    Except that the analogy is that they already have, or can easily create, that list. If they couldn’t, their value proposition would be lame. “We know you’re looking for a specific license plate, here’s a million hours of footage from all over the city, have at looking through it all.”
    - lazide 5mo ago
      Only for paying customers, which you aren't of course. If those customers paid public storage to inventory their stuff, then that inventory is their property. Surely it would be inappropriate to use their inventory data to find your naked photos. A violation of privacy even. (/s, kinda) I was enumerating the likely defense, not that it's valid.
      - shakna 5mo ago
        "Existing capability" removes the argument against onerous requirements, in a legal setting.
eagleinparadise 5mo ago
If I lease out a property to a tenant (apartment, retail, industrial use, whatever) and that tenant is committing an illegal activity on the property. Would the landlord be liable for knowing it? Or not? "Sorry FBI, the tenant renting my warehouse out to manufacturing cocaine is not my responsibility. I won't do anything about it. You deal with them." Nope, that's a failure of a duty to act and aiding and abetting a criminal activity if you hace constructive knowledge.
wavefunction 5mo ago
I assume they are building "meta-data" profiles of people based on the data they say they can't use directly. That seems like an easy work-around that satisfies the lip-service they've given to the issue.
gorgoiler 5mo ago
That’s a pretty compelling argument, but what if I went round to AWS’ house, peeked into their kitchen, and saw a crate of photos on their table with me in them? I’d absolutely say: “Hey, that’s me! Give me those right now!” I’d also be pretty angry if they told me: “Sorry we’re storing those for Corp Inc. Go ask them.” To refute my own point though, this only sounds annoying because the data processor is being irritating by manually referring me to the data controller. In practice, it would be trivial for them to automatically forward communications between me and the controller. That’s what feels is amiss with the top level article.
marcus_holmes 5mo ago
> But the data collected is property of the government I thought this was the get-out clause from the constitutional problems with Flock? That because Flock is a non-government organisation it isn't restricted by the constitution (i.e. the constitution only restricts what the government can do). They can't have it both ways - if Flock are collecting the data then they are subject to the privacy laws. If it's the government collecting the data via Flock as just a service, then they are subject to constitutional restrictions.

tptacek 5mo ago

This is also true according to their contracts (we were one of the first munis in the country to ostentatiously cancel our Flock contract, and the lead up to that was a bunch of progressive legal experts poring over that contract looking for holes.)

fsckboy 5mo ago
>a bunch of progressive legal experts poring over that contract looking for holes all attorneys represent their clients; your attorney does not have to share your opinion of the law or public policy, they can still interpret what the law means to you. if you are afraid your attorney might have a bias (they are human) you may get better advice from the "misaligned" POV: the flaws/holes in a privacy law found by a pro-business conservative attorney are more likely to find sympathy in the courts from both fellow conservatives and progressive judges.
- shermantanktop 5mo ago
  As a practical matter, this may be good advice. But it also places a demand on someone with a legitimate concern that they go find an ideological "beard" to make themselves more palatable and sympathetic. It's not hard to see how this enables an institution to gate itself from criticism.

deleted 5mo ago

[deleted]

thaumaturgy 5mo ago

Except that Flock very clearly benefits financially from having direct access to this data: owning (and in their own documentation, they very clearly do own it) a network of 80,000 surveillance devices across the country, and owning every single transit point for the data they collect, is what gets them to a $7.5 billion valuation from investors. The fact of the matter is that Flock is playing two-step with the concept of "ownership" of data. They disclaim ownership as a way to leave local agencies holding the bag for liabilities, but they fight tenaciously to retain complete and unfettered access to that data. (After organizing a community group that won Flock contract cancellations in multiple jurisdictions in Oregon, I went on to coauthor state legislation regulating ALPRs. I am very well familiar with all the dirty ball they play.) Also, Flock's cameras collect more data than is provided to police agencies. Who owns that data, I wonder?

necovek 5mo ago
That makes them a data broker in my reading, and at least in California, Data Broker legislation should apply. CA Data Broker registry gives me access denied, but that could be because I am outside US.
- ScoobleDoodle 5mo ago
  I looked it up at https://cppa.ca.gov/data_broker_registry/ https://cppa.ca.gov/data_broker_registry/ and didn't find Flock / Flock Safety in that list of the currently registered 566 data brokers.
  - tptacek 5mo ago
    Because Flock isn't a data broker. Flock's customers own their data, not Flock, and they use Flock's platform voluntarily to share data with other customers.
    - necovek 5mo ago
      I was referring to the claim that "Flock's cameras collect more data than is provided to police agencies" — that suggests that there is data not "owned" by the customers, which implies it's Flock's data, thus it might make them liable under Data Broker legislation.

unethical_ban 5mo ago

This is worth validating independently, but to be clear: Are you saying Flock itself does not have access to any of the data, and that the data they store on behalf of local governments is not fed into any central datalake? That every organization's data is completely, unalterably separate from everyone else's? If so, that makes the panopticon slightly less powerful.

valeriozen 5mo ago

The AWS analogy breaks down because AWS doesn't encourage customers to pool their S3 buckets into a nationwide searchable index. Flock operates a federated network. If you drive past an unmarked camera, you have absolutely no way of knowing which specific HOA or town leased it so how are you realistically supposed to know who the "data controller" is to send your ccpa or deletion request to?

giancarlostoro 5mo ago
Start standing in front of the cameras looking sketchy long enough till police are sent out to ya, then ask the cop who called.
- chaps 5mo ago
  Someone once dropped some fireworks not too far from me at 3am a few years back. They were loud and, yeah, cops were called. A few minutes later about five cars drive past me about 30mph over the limit. Not sure how they didn't see me or try to see me. But I know they didn't catch the BRIGHT orange and lifted care. Me being me, I submitted a FOIA request for the dashcam footage of the five cop cars and the dispatch logs. Instead of pulling over the easily identifiable car, they pulled over some random guy. They were behind him the whole time but five cop cars pulled behind him thinking that he fired a gun a few minutes back. He was let go without a citation, but the official reason, despite being paired with the dispatch for the firecracker, was a broken headlamp.
  - giancarlostoro 5mo ago
    I may or may not know a business owner who got criminals off their business' street by saying he thinks he saw a gun any time criminals showed up to do things, everything from prostitution to selling drugs. Cops showed up immediately. They stopped coming by altogether, probably the safest street in quite a rough part of town. It's crazy how cops just rush to very specific and nuanced crimes. Someone likely said they heard gun shots, and then they scrambled to find them.

jnovek 5mo ago

I don’t care. I don’t care who owns the data. If I can’t easily get private information like my movements removed from a database like this, the legislation does not sufficiently protect me. It should absolutely be Flock’s responsibility to remove my data and we should absolutely require it by law. Full stop.

lazide 5mo ago
A reasonably nuanced defense could likely claim that to be able to do what you want, would have much worse side effects on privacy. For example, would you want to be able to tell Public Storage (or some other storage unit place) to remove any naked photos of you stored anywhere in their storage units? For them to actually be able to do that would require they have nigh omniscience on everything stored by/for everyone in every one of their storage units. Even inside closed boxes. Now, it's not the same thing of course - but hopefully you understand what I'm referring to?
- LadyCailin 5mo ago
  Except that the analogy is that they already have, or can easily create, that list. If they couldn’t, their value proposition would be lame. “We know you’re looking for a specific license plate, here’s a million hours of footage from all over the city, have at looking through it all.”
  - lazide 5mo ago
    Only for paying customers, which you aren't of course. If those customers paid public storage to inventory their stuff, then that inventory is their property. Surely it would be inappropriate to use their inventory data to find your naked photos. A violation of privacy even. (/s, kinda) I was enumerating the likely defense, not that it's valid.
    - shakna 5mo ago
      "Existing capability" removes the argument against onerous requirements, in a legal setting.

eagleinparadise 5mo ago

If I lease out a property to a tenant (apartment, retail, industrial use, whatever) and that tenant is committing an illegal activity on the property. Would the landlord be liable for knowing it? Or not? "Sorry FBI, the tenant renting my warehouse out to manufacturing cocaine is not my responsibility. I won't do anything about it. You deal with them." Nope, that's a failure of a duty to act and aiding and abetting a criminal activity if you hace constructive knowledge.

wavefunction 5mo ago

I assume they are building "meta-data" profiles of people based on the data they say they can't use directly. That seems like an easy work-around that satisfies the lip-service they've given to the issue.

gorgoiler 5mo ago

That’s a pretty compelling argument, but what if I went round to AWS’ house, peeked into their kitchen, and saw a crate of photos on their table with me in them? I’d absolutely say: “Hey, that’s me! Give me those right now!” I’d also be pretty angry if they told me: “Sorry we’re storing those for Corp Inc. Go ask them.” To refute my own point though, this only sounds annoying because the data processor is being irritating by manually referring me to the data controller. In practice, it would be trivial for them to automatically forward communications between me and the controller. That’s what feels is amiss with the top level article.

marcus_holmes 5mo ago

> But the data collected is property of the government I thought this was the get-out clause from the constitutional problems with Flock? That because Flock is a non-government organisation it isn't restricted by the constitution (i.e. the constitution only restricts what the government can do). They can't have it both ways - if Flock are collecting the data then they are subject to the privacy laws. If it's the government collecting the data via Flock as just a service, then they are subject to constitutional restrictions.