Can Flock cameras ever be trusted? An ethical hacker weighs in

Across the country, use of automatic license plate readers is skyrocketing, and with it, concerns about mass surveillance. The Charlottesville City Council discontinued its contract with Flock Safety after a one-year pilot of 10 automatic license plate readers. While proponents cite law enforcement benefits, critics argue the technology enables broad surveillance without adequate privacy protections. 

University of Virginia Associate Professor Daniel Graham, author of the bestselling cybersecurity book, "Ethical Hacking," conducts research at the intersection of cybersecurity, software engineering, and data science. We sat down with him to discuss why license plate readers have sparked public concern and what technology companies could do to better protect privacy.

What challenges arise when license plate readers like Flock cameras are embedded into public spaces?

Flock cameras are connected, and this connectedness is what really makes these Flock cameras a challenge for how people’s privacy is infringed. When you can share information across multiple locations, you can establish trends with the people who are moving around in that environment. Because this data is collected and then stored in a single location, anybody with access to that single location can query those cameras without a warrant. This is one of the key ideas that is extremely challenging with Flock cameras.

Walk us through what happens, technically, from the moment a camera captures a license plate to when that data lands in a database that a police department can search.

The camera will look for details, like license plates and other characteristics about the car on the camera, and then once it’s done that local processing, send that off securely to a central database that can then be queried. The processing actually happens on the camera. A new camera being installed is not an extra person that needs to monitor it. Because the camera is intelligent, it can synthesize that information and store it. This is a key distinction.

Your cell phone, every time it connects to a tower, it can be triangulated to give your location. And so, as we’re walking around with our cell phones, there’s actually this mass surveillance that’s happening for us on a day-to-day basis.

But there was a case, Carpenter v. United States, in which the Supreme Court determined that access to historical cell-site location records should generally require a warrant. In order to get access to those records, the government generally has to have a warrant, subject to exceptions. Mass surveillance like this is not new, it’s just that in the past, we’ve decided that this is a violation of the Fourth Amendment in terms of search and seizure, and so we’ve put in software gates into these systems to prevent warrantless access.

Are these same privacy measures in place for these license plate cameras?

The same software safeguards are not currently in place for the Flock cameras. But surveillance systems like this will occur. Intelligent systems will get propagated into our society. We just need to make sure that we have the same safeguards that we have for cell phone data where you need a warrant and due process to access this information.

As new systems are put in place like the Flock cameras, if we can give the public the assurances that the government is stepping in to protect their personhood, we can still have some of the benefits of these systems without as much public backlash.

What would it take for you to trust this kind of system with your own data?

It’s interesting to consider mass surveillance that we’re comfortable with versus the Flock cameras, which is mass surveillance that we’re not yet comfortable with. 

For example, take Google: Every time I search on Google, it collects that search data, but Google also lets me delete that data or retrieve it from the system. So, you can download your search history even though Google can track that. Being able to say, “Hey, I want to delete my data from the Flock system” would be one of the things that would give people confidence.

For these Flock cameras, if my data isn’t useful for a particular case, maybe it should expire earlier than the 30-day timeline that currently Flock has. Maybe it should expire in five days.

These cameras might have some benefit to society — we just have to figure out how to trust that the information being collected is being used in the right way.

There are reports of Flock systems being misused by people outside of their intended purpose. How does that kind of breach usually happen? 

If you are given access to a Flock system but you don’t turn on particular protections that Flock has built in by default, then the person who’s accessing the system might be granted more access than they were supposed to have. So they can query multiple times or the same license plate — that was the famous incident with the police officer — or they might be able to access Flock systems outside of their region. If the system wasn’t set up correctly you might be able to access the Flock cameras across the country. We need to be much more careful about how we manage the configurations of these systems.

For financial systems, for example, we have auditors that will come in and look at financial systems and make sure people are doing things correctly for large companies. There is a large collection of ethical hackers and cybersecurity firms that will come in and look at these systems for you … and really spending time to audit is one way to build public confidence.

From an ethical hacking perspective, are there technical safeguards that are missing from these networks? If so, do they affect accuracy or are there other ramifications?

With these safeguards I think there are three levels. People want to deploy these systems and they’re new, so they might not be familiar with all of this and they might misconfigure. That’s the first level.

Then the second level is, the Flock team needs to really think about ways to design systems so that those misconfigurations are much more difficult to do.

The last level is policy. We’re going to see more connected intelligent devices beyond Flock cameras. As we have these systems that get deployed, we really need to make sure that our policies are keeping pace with what the reasonable expectation of privacy is for people in the society that’s being monitored and secured.

As we think about this future, I think ethical hackers can help from the technical perspective, but we really need policy thinkers to shape these ideas that we want to implement. And then audit these systems to make sure they’re compliant with the law.