ICE's Backdoor Into a Nationwide AI Surveillance Network

0:00In today's world, data breaches happen all the time. And even the most secure companies can't always protect their employees' personal information from ending up in the wrong hands. That's where Delete.me comes in. Delete.me is a service that removes your employees' sensitive information from hundreds of data broker websites. Sites where hackers can find phone numbers and emails within seconds. Rachel Toback, CEO of Social Proof Security, says attackers use this data to target employees with phishing messages and AI-powered phone scams. But Delete Me makes it harder for these bad actors by scrubbing your employees' details regularly.

0:38It's simple. Attackers are lazy. If it's too hard to find contact info, they'll move on to easier targets. Delete Me takes care of this for you, doing the heavy lifting so you don't have to. And over time, they keep removing the information so it stays down, protecting your team from constant exposure. If your business has a social presence or deals with clients, you need DeleteMe. Visit DeleteMe.com slash 404media and start safeguarding your team's information today. That's DeleteMe.com slash 404media.

1:17Hello, and welcome to the 404 Media podcast, where we bring you unparalleled access in the world, both online and IRL. 404 Media is a journalist founded company and needs your support to subscribe go to 404media.co as well as bonus content every single week subscribers also get access to additional episodes where we respond to their best comments gain access to that content at 404media.co i'm your host joseph and with me are all of the 404 media co-founders the first being sam colt hey emmanuel mayberg hello and jason kebler hello hello uh we have We have new Doom. Oh, this is on the document.

1:57I should have waited for you. You're about to say it. You're about to bring it up and I preempted you. We have a tank top for order up for presale on our Shopify page. This is by huge request. Lots of people actually emailed me asking for a tank top. I think it's really cool. It features the actual code from Doom. it's a 404 ASCII art Sam you want to talk about it because I feel like you were the sort of originator of this this design it was me and Ronan Wood who's our designer of most of our merch or he's the one who puts the cool logos onto the shirts and hats and things it was like weirdly hard for us to find just like the raw doom code which is probably fully a skill issue but he and I both were like hunting for days being like, where the fuck do they put just like the regular ass code that is in everything apparently is running on like refrigerators and toothbrushes and stuff.

3:00But yeah, I think he found it or one of us found it without having to run Python or something. It was a weird process. It's been open source since like 1999 or something like that. But however, I also went to go fact check this after we had already placed the order with the printer and I was like, where is the Doom code? What does it say? And it's on GitHub. There's many files. So I wasn't actually sure which one to grab. It looks good. It looks good on the tank top. It looks fantastic. So check it out. They put Doom on a shirt. That's good. And it's open source as you said. So Ird, please don't sue us.

3:43I mean, they're not going to do that. And I'm just going to cover our asses now. Doom the Dark Ages really, really good game. See, now they can't be mad at us. For me, it endorses the Dark Ages. We don't really do endorsements, but that's the one we're probably going to do. Alright. Emmanuel, do you want to take this first story? Yeah. Our first story is from Jason and Joe. The headline is, Ice Taps into Nationwide AI-enabled Camera Network Data Shows. You guys worked on this for quite a while. And the camera network in question here is Flock. It's a service called Flock, which we've covered several times over the years.

4:30But I'm sure not everyone is familiar with it. Maybe let's start with what is Flock? How does it work? How common is it? Yeah, so Flock is an automated license plate reader camera. It basically sits at different intersections or just different places on a road. And it scans the license plates of cars as they drive by. And Flock, I believe it's the most popular one. It's one that's used by different homeowners associations and neighborhood watch groups. There's also a Motorola one that is extremely widely used. But Flock is sort of like a Silicon Valley startup whose CEO has said that He wants to use these to get rid of crime everywhere.

5:23And so that's the pitch is like, put these in and over time, we will completely eliminate crime, which is obviously like a very, very, very lofty claim. And so over the last few years, they've kind of gone state by state, city by city, trying to sell these both to neighborhood watch groups and shopping malls and places like that. But then also, of course, to the police, to local police. And so over time, there has become a very large network of Flock cameras. so it's not just you know the city of dallas that has access to fly cameras it's like once you're in it you can query the cameras of other uh states and municipalities you can do either a statewide search or you can do a nationwide search and so in some cases you can like say you're a local police department you can say hey i'm looking for this license plate of a stolen vehicle and you're not just searching the cameras that you have personally bought and paid the subscription fee for.

6:37You can search all the ones in your state, all the ones in the country if you want to. So it's become this massive network of tens of thousands of devices. And you really can't drive in many major cities and even some small towns at this point without driving by one of these things. The AI of it, is that the ability to find and identify the license plates? Is that the AI portion of it? I think it's that. I think it's the fact that it's all sort of connected in one of these larger networks. And then also in the second half of this show, spoiler alert, Joseph will talk more about features that are being added to Flock that are going to make them smarter and more, I guess, more like AI-ified.

7:31Well, it's that. And you can be like, I want to search for all red cars that were in this area. And there's some sort of object recognition there. And like, yeah, some people may be like, oh, that's not really AI. It's like, well, yeah, it's not chat GPT, but it is AI or machine learning, I guess. So what is this data that we got? Yeah, so very crucially, there is something that cops who have flock are able to look up themselves, and it's called an audit report. And basically, this audit report allows the cops of any given city to find out how many times their cameras have been searched. So as I said, you can either opt into a nationwide network or a statewide network.

8:25And in this case, the Danville, Illinois Police Department has opted their own cameras into both a statewide network and a nationwide network of FLOC. meaning that any, I don't know if it's any, but many, many, many different police departments from around the country, when they are searching for a license plate or searching for whatever they're doing, like when they're doing a flock query, they are pinging the Danville Police Department's flock cameras. They're pinging their database of whatever cars have driven by them. And so this is a feature that flock cameras have that allow police to do compliant stuff.

9:15If someone says, like a city council member says, show me all the times that our flock cameras are accessed, they can go in and download this data. And so some researchers filed a public records request with the Danville Police Department and got all of the times that their cameras had been queried over the last year, I believe. And it was like 6 million times. And so this just means that they were effectively grabbing what we believe to be a pretty comprehensive picture of how police are querying flock cameras all around the country. And in these, like, basically, there's a massive CSV spreadsheet file.

10:04and for each individual entry, it says the police department that searched Blox Network, it says the... It shows how many devices were searched. In this case, it was sometimes 40 ,000, 50 ,000 different devices across the country, which we believe means 40 ,000 to 50 ,000 different cameras across the country. And then crucially, they need to put a reason for doing that search. And for many of these, it just says like stolen car, property theft, things like that. But for a lot of them, for between 4 ,000 and 5 ,000 of them, it says immigration, or it will say HSI, which is Homeland Security Investigations, which is a division of FLOC, or sorry, it's a division of ICE.

10:58Sometimes it just says ICE. sometimes it says immigration and then sometimes it says ice plus ero which is enforcement removal operations i believe i don't have it in front of me right now but it's basically the division of ice that does deportations crucially there was like some searches from the dallas police department that were doing that so basically this shows that uh local cops around the country were searching flock cameras to do immigration enforcement. And crucially, they were doing it on behalf of the Department of Homeland Security, HSI, and also ICE. So if I'm the FBI and I'm doing an investigation of Sam, Sam has committed some horrible crime, and I will call records, I can go to AT &T with a warrant and be like, show me Sam's call records.

11:59That is not exactly what we're seeing here with Flock. How would you describe the process by which ICE or other police departments are getting this license plate data? Yeah, so a few things. One, ICE does not have a contract to use Flock. Neither does the Department of Homeland Security of which ICE is a part. So right now the feds supposedly do not have the software that allows them to do these queries directly. So they can't go, they can't open up a Flock dashboard and say, show me all the license plates that drove by this specific intersection or whatever. They don't have that ability. They haven't procured Flock, which has a process where they're taking bids and they're purchasing the software and they're like kind of legally allowed to use it because they bought it.

13:01What's happening here is local police are doing these searches for ICE and or the Department of Homeland Security. And we talked to like, I emailed, I think, like 25 different police departments. Joseph emailed probably like 20 of them. And what they're saying is in some cases, these are like formal requests from the department of homeland security like the feds are saying hey look this up we're trying to solve this crime or whatever and they're doing that in other cases they said it was quote informal meaning someone just like asking for a favor and what's notable is that police feel like they don't need to get a warrant to search block because it's something that they're like, it's a service that they're paying for.

13:53And we see this with a lot of surveillance technology where like, if you're buying it from a private company, they feel like they don't need to get a warrant. There's like various court cases right now from people saying, like arguing that they should need to get a warrant, but currently, cops are not getting warrants. And so what's happening is basically like the feds are getting either backdoor or side door access to flock system without paying for it uh i say backdoor side door because like experts i talked to both called it both of those things there's no real like distinction here but basically they're getting like unofficial access to this incredibly powerful surveillance network through local police and there's like no oversight of this whatsoever there's like no meaningful oversight.

14:39And so, sure, I believe that ICE could probably enter a contract with Flock and get direct access to this. There's nothing that I know of that would stop them from doing that. But they haven't done that yet. And this is a really powerful network and they have access to it through this pretty unofficial mechanism. So what do you think it matters that ICE has this access? Is there a legal implication for them being able to do this? Isn't the fact that they're getting this informal access indicate that they're unable to do it officially at the moment? In the story, you talk quite a bit about what ICE is, or not ICE, local agencies are able or not able to do in terms of helping ICE with immigration enforcement.

15:35Yeah, so a few things. One, I've learned over the last, I mean, a lot of people probably have known this for a while, but I've learned reporting on this and the massive blue story that we did a few, like a month ago, that generally local and state police do not have jurisdiction over immigration matters. Like they are not allowed to say, hey, you're in the country illegally. We are going to detain you. Like that is specifically a federal function. But what Trump has done and what Trump has become very obsessed with is the idea of empowering local police to enforce immigration laws. And they've done that through this program called 287G, which is just like an ICE program that different police departments have to apply to.

16:28And then ICE says, okay, we are empowering you. It's like a delegation is what it's called. We're delegating to you the authority to conduct some immigration enforcement type stuff. So the concern here is that this incredibly powerful nationwide network of license plate cameras is going to be used to pick up people for ICE, but also that this surveillance network has been built, this apparatus has been built largely by going community to community and saying, we're going to use this to find stolen cars, or we're going to use this to help prevent or solve really violent crime, things like that.

17:19And a lot, Flock is in a lot of liberal neighborhoods, like largely according to both what we've reported on, but also the experts that I spoke to, like a lot of them were saying, it's like rich people trying to protect their homes and stuff like that. And by and large, like at city council meetings where they discuss like, should we buy this? Should we not? They're like, oh, we're going to use this to solve violent crimes. And it seems to me, based on talking to different police departments, that a lot of them don't really understand that they have like accidentally opted themselves into this large surveillance network that is being used by cops all over the country for all sorts of things.

18:07And they don't even know what it's being used for in many cases. Like I talked to some of the cops about different searches that they ran and they were like, oh yeah, like someone on our force did that search, but we don't like exactly know why. So can you talk, because you point out the legal issue with them helping ICE and federal agencies with immigration stuff. You're pointing out that the reason field in the searches very clearly says that these are immigration or ICE issues. And they say, what? like what are the responses to that contradiction? Yeah, I mean, sometimes, so it ends up being like a quite a complicated story in some ways because this came from Illinois, which is one of the few states that actually explicitly bans their police from working with ICE.

19:08They have a law that is basically makes it like a sanctuary state. And so like all the cops there are like, oh no, no, that wasn't for immigration. We're not allowed to do that. we comply with Illinois law. But then I show them a spreadsheet thing that says, well, it says here that you did this for, quote, immigration violation or something like that. And they'll be like, oh, yeah, but that was a specific criminal case. And yes, the person might have been illegal or undocumented or whatever. They might have had a not legal immigration status, but that's not what it was for. And in many cases, they weren't able to tell me what it was specifically for either because they didn't know like some of them said straight up like we actually don't know why this search was run and we don't know why it said immigration there because like i believe it's because access to flock is just like so widespread it's like it was described to me by some of the experts we spoke to as like a google search engine for cars.

20:14So it's like, oh, I'm doing this case, gonna go on Flock and type in what I'm looking for. And because there's very few restrictions on how it's used, cops are just using it for whatever. And it's like, if I ask you, why did you Google that thing three weeks ago, you might not be able to tell me specifically what it was for. Or maybe even more to the point, if someone asked me why Sam or Joseph googled something, I'll be like, maybe it was for this story, but I have no idea what it was actually for. And so it seems like access to this like massive surveillance network is now so commonplace that the cops don't even know like why they are searching it half of the time.

20:58And I just, I think that that's like very notable actually, because we've built a system that can track the movements of anyone with a car in the United States, which many of these communities are unlivable without a car. You need a car to go anywhere. And at first, this was a technology that was built for local police to, again, find stolen cars, to find people who find robbers and murderers and stuff like that. And now it's being used in this way to help the feds under an administration that has become obsessed with undocumented immigrants. And so we've built this surveillance apparatus, and it's just being used in a really commonplace way, in a way that I find to be really concerning.

21:53I don't know if that answers your question. I don't even remember what your question was. But that's why I think the story is important. The comparison to Google, I think, is very good and a good transition into the next story we're going to talk about. But I guess just before we go to that, back at Motherboard, we did a bunch of stories, most of them from Caroline Haskins, who is now at Wired about Ring. And I see a lot of parallels with Ring in the sense that it is a device that is sold to groups or individuals as the product is getting popular and widespread, people don't realize that they're building out this network that can be accessed by cops.

22:42How would you say this compares to Ring in terms of the surveillance dystopian aspect of it? Better, worse, comparable? I think it's an apt comparison in terms of like the business model and sort of how it works i think ring didn't ever have it like they haven't sold tons and tons of ring devices to cops directly like that was something where they were selling it to homeowners and then homeowners were opting into this system where cops could access it and but cops were like pitching ring to communities yeah yeah because cops were basically trying to get this like ad hoc network of just like thousands of ring cameras in an individual community.

23:31And that was sold originally as, we will use this to make sure that people don't steal your Amazon packages. And then it became something larger than that. And there's been all sorts of privacy concerns with Ring, security concerns with Ring. We don't need to get into it. But basically, it started out as something that was for consumers and then was used by cops. uh what flock is it was initially pitched to again like neighborhood watch groups and homeowners associations and they can share that information with cops but now i believe i'm not positive that this is the case but i believe that the vast majority of ring cameras are sort of like bought and operated by cops so it's become more of a specific police technology but the the nationwide network thing is really very important and very, very similar.

24:30I think Flock is actually maybe more concerning than Ring because all of the systems interconnect. So like, I don't know, you could track a person across the entire country if they were to drive across the country and you could track their movements and things like that. And it's funny because a lot of the cops say, well, we're not tracking people, we're just tracking cars. And And it's like, well, who do you think is in these cars? Cars that specific people own. Yeah, and that'll go directly into Joseph's next story. But it is very much like you cannot move around this country without being tracked passively.

25:14And I should have said this at the top, because every time we talk about flock, I feel like most people understand the issue or what is being built here. But it's like, these are not speed cameras. They have nothing to do with speed cameras. They have nothing to do with red light cameras. They catch every single car that drives by the camera. And they add it to their database and with a timestamp and all that sort of thing. It has nothing to do with like, oh, well, just don't speed or just don't run a red light and you'll be fine. It's like there's a database of your movements if you drive by one of these.

25:55And we've written about it before, but there's an open source project called Deflock that is trying to track where these are. And if you look at that, you'll see they're in a lot of... Every mid-sized city, tons of suburbs, lots of big cities. They're in many, many, many U.S. cities. So we'll leave that there, as Joe says, and we'll take a break and then we'll come back with the other flock story.

26:32My dad is a real storyteller. He loves to tell me all about his adventures and his misadventures while we're grilling or sitting around a backyard fire. But I don't have one place to keep all of stories, which is why this year for Father's Day, I'm getting him and me StoryWorth memoirs. Each week, StoryWorth emails your dad or other loved one a memory-provoking question that you get to help pick. Questions like, did you ever get into trouble in school? Or what were your favorite toys as a child? All your loved one needs to do is respond to that email with a story. They can either write a story over email or record it over the phone for StoryWorth to transcribe.

27:14You'll be emailed a copy of your loved one's response as they're submitted over the course of the year. You'll get to enjoy their retelling of the stories you already know or be surprised by the stories you've never heard before. After a year, StoryWorth compiles your loved one's stories and photos into a beautiful keepsake hardcover book. It's a treasure you'll be able to share and revisit for generations. Customers love StoryWorth. They've preserved millions of family stories since their founding over 10 years ago. They have more than 40 ,000 five-star reviews on Trustpilot. And The Wirecutter, The Strategist, CNN, and more agree, StoryWorth is the perfect gift for people you love the most.

27:53I can't wait to get my dad's StoryWorth answers compiled so I can pass it on to my own kids one day. Give the dads in your life a unique, heartfelt gift you'll all cherish for years. StoryWorth. Right now, save$15 during their Father's Day sale when you go to storyworth.com slash 404. That's storyworth.com slash 404 to save$15 on your order.

28:42before journalism. That gave birth to 404 Media. Since then, we've stopped the spread of AI books and public libraries, triggered class action lawsuits against AI companies, got Congress to pressure big tech in various ways, and we've even shut down surveillance companies. This real world impact is only possible because of our paying subscribers. As a journalist-owned business, they are the engine that powers our journalism, and where the vast, vast majority of our revenue comes from. So please consider signing up today for$10 a month or$100 a year at 404media.co slash membership and get bonus content every week and access to all of our articles.

29:23Thank you and enjoy the rest of the podcast.

29:42And we are back with a story that Joseph did that's extremely related. This is a Flock mega episode. We should have said that up top. But license plate reader company Flock is building a massive people lookup tool, Leak Shows. So this leads on to some of the things we were talking about in the first segment about tracking people versus cars, tracking cars versus people, the AI parts of Flock and things like that. Joseph, this story is about Nova, which is a new tool from Flock. What is it and how are they marketing it to cops? Yeah, so Nova is this new product, which I believe they're rolling out or at least advertising and marketing to cops at the moment.

30:33And it's almost like an add on to the Flock network. So if you thought that automatic license plate weeding technology, as you say, following cars and by extension drivers all across the United States was invasive enough, or maybe should require a warrant or whatever. This is now going to add additional information to those searches. And I'm looking at the Flock website now with a page about Nova, and it says you can, quote, see the full story connect people vehicles and locations across agencies nova helps you solve crime and prevent the next one faster and it's supposed to bring all of your agency's data in one place you know so video and 911 calls and of course the flock um automatic license plate reader networks as well but scrolling through this page like i am now as i said it's kind of all marketing speak it doesn't actually really talk about um what the nova tool is or what data it uses and that is what this story is about which is based on a leak that we got from flock yeah so i actually was the nova page up by the time we did this article it was i'm not sure if we actually quoted it explicitly.

31:55Maybe we did in the earlier draft. Well, there's almost nothing about it, as you said. Like, what a next-gen public safety data platform actually is wasn't known. And so you had a source who leaked you information about what it is, actually some information from within Flock and the problems that people had with it at the company. So, I mean, what sort of data is included in Flock? Or, sorry, in Nova? And so what is this product? Yeah. So as you say, the marketing material is really, really sparse. But then when you go through the leak, I mean, there's some, I would say, incredibly interesting and illuminating stuff in there.

32:42The first being that Nova plans to at least use hacked data. So that is data from breaches that's being published online. and that could be then married with the automatic license plate reader data as well. And one concrete example they give is Park Mobile, an app that was hacked a while ago. You actually use Park Mobile, right, Jason? What is it? Park Mobile is a smartphone app that you use to park mobily off your mobile device. No, so a lot of states, a lot of cities have replaced their parking meters with ParkMobile. So basically, you put in your license plate and then when you park in a specific spot that would normally have a parking meter or a publicly owned parking lot, you say, hey, I'm parked here.