A few years ago I was driving along a provincial road somewhere in central France. France has installed an impressive number of speed cameras over the years, partly to catch speeding drivers and partly, of course, to persuade everybody else not to speed in the first place. Many French drivers are not particularly enthusiastic about them (who is?). Most seem to deal with that by complaining a bit and then sticking more or less to the speed limit.
But on that particular road I came across a slightly more physical form of citizen protest. We passed a speed camera that had clearly had a difficult night. The camera itself had more or less been broken off its pole. And apparently somebody had decided that this was not quite enough, because a fire had also been lit around the bottom of the structure. What remained was a rather sad-looking, blackened pole with what was left of the camera on top.
I thought about that camera again when I read a fascinating report by 404 Media about Flock Safety cameras in the United States (https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/).
Flock operates automated license plate reader cameras that photograph passing vehicles and send images and related information to the company’s servers. Police agencies can then search those records. But hackers from a group called stegan0gram did something rather more ambitious than simply knocking one of the cameras over: they removed a camera, copied much of the software inside it and started reverse-engineering.
What they found makes the story particularly interesting. The camera runs Android and contains roughly twenty Flock-developed applications handling functions such as motion detection, photography, object classification, uploading data and receiving updates. When something moves into view, the camera does not simply take one neat photograph of a number plate. It shoots a rapid series of images using different exposures. A normal passing vehicle generated around 28 images in the analysed data, while some produced more than 100. Over about 21 days of recovered activity, one camera had photographed roughly 50,200 vehicles and generated around 1.6 million images.
Even more interestingly, the software explicitly detects more than cars and number plates. It can also recognise people and bicycles and records where a person appears in an image together with the software’s confidence in that detection. Tests performed with models extracted from the camera confirmed that they could detect people. There was no evidence that Flock’s software was actively performing facial recognition, but the distinction is still worth noting: these are not simply electronic number-plate readers. They are cameras running computer-vision software that analyses what passes in front of them.
The analysis also showed how imperfect that software can be. The system occasionally interpreted bumper stickers, dealer frames and other graphics as number plates. In one case it even isolated an American flag patch on a motorcycle saddlebag as though it were a licence plate. Much of the actual identification work — reading plates and identifying vehicle make, model and colour — appears to happen later on Flock’s servers.
And that is where the discussion becomes bigger than one damaged camera. Citizens are generally prepared to accept rules, laws and a certain amount of enforcement. Most French drivers may dislike speed cameras, but by and large, they still slow down when they approach one. Most people probably also understand why police would like tools that help them find stolen cars or vehicles connected to serious crimes.
The difficulty starts when people become convinced that the technology has moved beyond what they consider reasonable. Flock’s wider system can make camera records searchable across large networks of law-enforcement agencies, and reporting has shown that the technology has also been used to search for people and patterns of movement rather than simply individual vehicles.
Then protest sometimes changes form. In France, somebody apparently decided that writing an angry letter about speed cameras was no longer enough and set fire to one. In the United States, somebody decided that simply destroying a Flock camera was not enough either. They took the software with them so that people could find out what the camera was actually doing.
Are either of those actions a good idea? Probably not. But can I understand why people sometimes feel the need to protest in ways that go beyond submitting a letter to the editor or politely speaking for three minutes during a local council meeting? Yes, maybe I can. That does not remove personal responsibility. If you decide to break, remove or tamper with somebody else’s equipment, you also have to accept that there may be legal consequences.
But governments and technology companies might want to pay attention to something else as well. When perfectly ordinary citizens start attacking surveillance equipment or taking it apart to discover how it works, perhaps the most interesting question is not only who damaged the camera? It might also be: why did they feel they needed to?