HN user

chaps

4,982 karma
Posts14
Comments1,273
View on HN

Respectfully, a lot of what you're saying in this thread sounds a lot like the lies that gamblers tell themselves. Saying this as someone with a strong tendency towards addictions.

Some of these things are only possible to really see in hindsight. Yes, you've been working on these things for a while, but these systems are notably different in their capacity and strings they pull on us.

Be well, please.

Sigh. Just because you don't understand why something is confusing to someone doesn't mean it isn't confusing. That's literally the point I'm trying to make. I'm glad it wasn't confusing to you.

Gotcha, thank you.

(just to be clear, my post was just to point out that the article is very difficult to make heads or tails of. it's easy to misinterpret a lot of the points many different ways! kind of like they're being overly implicit with the expectation that everyone'll know what they mean. it's something I do too and my way of cutting through it is to cut my writing in half and focus on clarity over mystique)

Like I told dang in his response to my email:

Believe me, I'm tired of hearing about it too. But when it's used to deport my friends, it's important for me to hear about.

---

I hope you can understand why it's aggravating to hear that the tools used to deport my friends are "boring".

My position is that no amount of policy will ever make these tools safe, fullstop. I've been an investigative journalist doing research into the use of technology by police and prosecutors and the shit I've personally seen is beyond shameful. The modes of failure for these systems are such that it's inevitable that they'll be abused and even when abuses don't happen, accidents do. And also FWIW, I've been a sysadmin at some pretty large companies, have seen how the meat is made, and I have a deeply grim understanding of how systems are secured.

Some example: Chicago Police Department accidentally sent me the ALPR XML data from the state's system (LEADS). The data included about a thousand social security numbers, many credit cards, the fingerprint hashes. This happened during FOIA litigation and when we raised it to them, instead of freaking out, they asked us if wanted them to actually redact. We said yes, they came back later and the XMLs still had many SSNs and credit card numbers. Third time was better, but it's still awful. Thousands of pages.

Another example: City of Chicago has given me the license plate records for millions of vehicles through FOIA. You can read about it at the end here: https://mchap.io/losing-a-5yr-long-illinois-foia-lawsuit-for...

Another example: Cook County Sheriff's Office's electronic monitoring program was using a 20 year old webserver that was exposed to the internet, leading to this: https://www.vice.com/en/article/contractor-exposed-the-movem...

Another example: City of Seattle accidentally sent me 30 million emails (including police): https://mchap.io/that-time-the-city-of-seattle-accidentally-...

The town I grew up in was a target of Bovino's ICE. A FOIA request for the usage of Flock in that town returned back the longest FOIA denial I've ever received, and I've done thousands, including over a dozen lawsuits. The friends that I graduated with, who think of this country as their home are being targeted. It's hard to express the grief of that. https://www.muckrock.com/foi/waukegan-11153/flock-safety-alp...

Another example: Recently I even found an S3 bucket used by police to share photos of people across state lines. Just... on the internet. Facial recognition, flock, etc.

I think you're hyper-focusing on the 4A public space stuff honestly. The 4A issue that I specifically research is about the extent of exculpatory information given to defense attorneys during criminal prosecution. Of the 150 arrests done by Chicago Police that I found in Flock audit lots, only one arrest report actually mentioned Flock. People have a 4th amendment right to have access to the exculpatory information about their arrest in order to make a proper defense.

This is all just stuff that I've found in my research and I feel like I've barely scratched the surface.

What you do is: you sue. On my 13th FOIA lawsuit and I have a couple more in the works ;)

Depending on where you're from, it's pretty easy to find a pro bono attorney. In Illinois, the plaintiff's attorneys recoup their costs on a successful win.

It's definitely not. For example, police in Illinois have warrantless access to ipass scans.

https://www.documentcloud.org/documents/20645486-re_-externa...

  HB 4006 nullifies the entire purpose of obtaining Tollway information in an active investigation by requiring promptnotification to the subject of a search warrant and potential criminal actor. This information can be incredibly usefulin a multitude of criminal investigations, including homicides, kidnappings, and interstate trafficking of contraband.With this provision, law enforcement would not proceed with seeking a search warrant if it could jeopardize the abilityto apprehend the suspect, result in the destruction of evidence, or even worse result in harm to a victim.

  Additionally, the proposed bill forecloses the possibility of obtaining information about a person traveling through aTollway pursuant to a subpoena, including license plate information or photographs of the driver, where a knownsuspect may not be identified but the route of travel could be useful to generate leads. A warrant is not required toobtain this information. Placing such a requirement that creates greater protections beyond those required under theFourth Amendment creates an unnecessary limitation on law enforcement's ability to investigate crime. The currentrequirement to obtain a subpoena is sufficient to ensure that law enforcement has a documented investigative purposeand criminal predicate tied to Tollway information.

  Some case law background explaining why a warrant is not required for this type of Tollway information:

  "This court has not previously addressed in a published opinion the question of whether an individual has areasonable expectation of privacy in his license plate. In two unpublished decisions, however, this court has agreedwith the other circuits that have decided this issue by holding that no such privacy interest exists. The reasoning ofthese opinions, as well as that of the Supreme Court in related cases, leads us to agree that a motorist has noreasonable expectation of privacy in the information contained on his license plate under the Fourth Amendment.No argument can be made that a motorist seeks to keep the information on his license plate private. The very purposeof a license plate number, like that of a Vehicle Identification Number, is to provide identifying information to lawenforcement officials and others."

No need for snark; I'm genuinely interested in your position. From my re-read and re-read, you've provided a conclusory statement without actually explaining the details.

Is your definition of "stupid" anything that contradicts 50 years of case law? That seems.... tautologically limp.

Of course they can and of course they do. It gets much more complicated when you consider that each state has different laws about records sharing.

And, lol, yes the 4th amendment extends to driving on a public roadway... roads aren't international waters. Probable cause and such are still important. I recognize what you're saying but -- details matter, dammit.

Friend, that's a.... deep, deep mischaracterization of how the courts work. The cops, prosecutors and judges have deep relationship with each other. Yes, these are "courts problems", but you can't have these courts problems without cops, without prosecutors, without judges, etc.

Ask yourself: why do public defenders have a tiny fraction of the budget of prosecutors?

Systems definitely care, especially in finance and trading systems.

Was involved in rolling out a large NTP annealing patch about ten years ago. We missed a couple and the effect was largely overall muted, but we did have one server with an old JVM hard crashing the server right at the second shift.

That specific server was already hobbling along so it wasn't a surprise. But it required a bit of firefighting.

Please actually just look at any audit log and just search yourself. If you think there's no signal, then you clearly haven't looked. If you're going to continue to be lazy in your analysis, then ask a damn LLM. There are 528 agencies who used "suspicious". This is not a bloomingdale problem; it's much larger. Just fucking look, man.

  select count(*),org_name from flock_bloomingdale where reason = 'suspicious' group by org_name order by count desc;


   count |                     org_name
  -------+--------------------------------------------------
  2678 | Skokie IL PD
   828 | Joliet IL PD
   678 | Houston TX PD
   391 | Fayette County IL SO
   309 | Chicago IL PD
   256 | Katy TX PD
   245 | Itasca IL PD
   244 | Steger IL PD
   229 | Athens-Clarke County GA PD
   215 | Lucas County OH SO
   209 | Oak Lawn IL PD
   208 | Westmont IL PD
   199 | La Salle County IL PD - OLD
   194 | Zion IL PD
   191 | La Grange Park IL PD
   174 | Kenosha County WI SO
   173 | Champaign County IL SO
   170 | Roselle IL PD
   160 | Lake Villa IL PD
   152 | Bradley IL PD
   152 | Madison County IN SO
   143 | LaSalle Co. IL SO - New
   135 | Flossmoor IL PD
   132 | Sauk Village IL PD
   116 | Oak Brook IL PD
   106 | Crete IL PD
   104 | Villa Park IL PD
   101 | Darien IL PD
    97 | Cicero IL PD
    94 | Wilmington IL PD
    89 | Rockford IL PD
    80 | Lake County IL SO
    80 | Dolton IL PD
    79 | Texas Department of Public Safety
    76 | Will County IL SO
    75 | Naperville IL PD
    72 | Minooka IL PD
    68 | Hillside IL PD
    63 | Carpentersville IL PD
    55 | Kent County MI SO
    55 | Zanesville OH PD
    54 | Winnebago County IL SO
    51 | Logan County NE SO
    46 | Romeoville IL PD
    46 | Menomonee Falls WI PD
    46 | Homewood IL PD
    44 | Burnham IL PD
    44 | Baldwin County GA SO
    43 | Venice FL PD
    39 | Elmwood Park IL PD
    37 | DuPage County IL SO
    36 | Greensboro NC PD
    34 | Lowndes County GA SO
    34 | Henry County GA PD
    34 | Tinley Park IL PD
  They're matching specific descriptions of cars to incidents, like, "this vehicle has been present at the site of 5 previous package thefts".
You're hand-waving a hell of a lot of things away and you expect that everyone knows what you're talking about. Please stop doing that.

- Who is "They"?

- Why do you say "nobody has time for that"? What is "that"?

- Why are you dismissing genuine concerns through unhelpful language like, "coming to it with movie plot concerns".

- Why wouldn't "that" be a big deal? What is "that"?!

- What are the deeply problematic things?

- "They're matching specific descriptions of cars to incidents" -- no they're not. Just looking at Bloomingdale's audit logs, there are 13k examples of searches done for the simple reason, "suspicious".

- Why does municipalities being the primary operators matter?

Asking from a place of genuine confusion by how you think about these things.

Eh, looking around, I think you're thinking of Debian. They re-enabled it by-default back in 2009. So, sure, I guess. But if you're dealing with an OS that's from 2009 these days, whether /dev/tcp is enabled in bash or not isn't exactly relevant anymore. And I've seen enough broken python installs (even with stdlib) to put my faith in /dev/tcp working in bash :)