A journalist drove 300 miles through rural Virginia, then filed public records requests with law enforcement agencies to see what surveillance footage they had of his car. He received responses from various agencies, including small town police, sheriff's departments, and university police. Some agencies had no footage, while others had license plate reader (LPR) data or images from traffic cameras. The experience highlighted the patchwork nature of public surveillance, with data retention policies and access procedures varying widely. While some agencies promptly provided information, others were unresponsive or claimed exemptions. The experiment ultimately revealed the growing, yet inconsistent, presence of automated surveillance in even rural areas and raised questions about data security and public access to this information.
The author recounts their experience in an Illinois court fighting for access to public records pertaining to the state's Freedom of Information Act (FOIA) request portal. They discovered and reported a SQL injection vulnerability in the portal, which the state acknowledged but failed to fix promptly. After repeated denials of their FOIA requests related to the vulnerability's remediation, they sued. The judge ultimately ruled in their favor, compelling the state to fulfill the request and highlighting the absurdity of the situation: having to sue to get information about how the government plans to fix a security flaw in a system designed for accessing information. The author concludes by advocating for stronger Illinois FOIA laws to prevent similar situations in the future.
HN commenters generally praise the author's persistence and ingenuity in using SQL injection to expose flaws in the Illinois FOIA request system. Some express concern about the legality and ethics of his actions, even if unintentional. Several commenters with legal backgrounds offer perspectives on the potential ramifications, pointing out the complexities of the Computer Fraud and Abuse Act (CFAA) and the potential for prosecution despite claimed good intentions. A few question the author's technical competence, suggesting alternative methods he could have used to achieve the same results without resorting to SQL injection. Others discuss the larger implications for government transparency and the need for robust security practices in public-facing systems. The most compelling comments revolve around the balance between responsible disclosure and the legal risks associated with security research, highlighting the gray area the author occupies.
Birls.org is a new search engine specifically designed for accessing US veteran records. It offers a streamlined interface to search across multiple government databases and also provides a free, web-based system for submitting Freedom of Information Act (FOIA) requests to the National Archives via fax, simplifying the often cumbersome process of obtaining these records.
HN users generally expressed skepticism and concern about the project's viability and potential security issues. Several commenters questioned the need for faxing FOIA requests, highlighting existing online portals and email options. Others worried about the security implications of handling sensitive veteran data, particularly with a fax-based system. The project's reliance on OCR was also criticized, with users pointing out its inherent inaccuracy. Some questioned the search engine's value proposition, given the existence of established genealogy resources. Finally, the lack of clarity surrounding the project's funding and the developer's qualifications raised concerns about its long-term sustainability and trustworthiness.
Summary of Comments ( 255 )
https://news.ycombinator.com/item?id=43504413
Hacker News users discuss the implications of widespread police surveillance and the journalist's experience requesting footage of his own vehicle. Some express concern about the lack of transparency and potential for abuse, highlighting the ease with which law enforcement can track individuals. Others question the legality and oversight of such data collection practices, emphasizing the need for stricter regulations. A few commenters suggest technical countermeasures, such as license plate covers, while acknowledging their limited effectiveness and potential legal ramifications. The practicality and cost-effectiveness of storing vast amounts of surveillance data are also debated, with some arguing that the data's usefulness in solving crimes doesn't justify the privacy intrusion. Several users share personal anecdotes of encountering ALPRs (Automatic License Plate Readers), reinforcing the pervasiveness of this technology. Finally, the discussion touches upon the challenges of balancing public safety with individual privacy rights in an increasingly surveilled society.
The Hacker News post "I asked police to send me their public surveillance footage of my car" generated a moderate discussion with several interesting points raised in the comments. Several commenters focused on the practicalities and legalities surrounding the request and the broader implications of such surveillance.
One commenter discussed the variability of police responses to such requests, noting that some departments are cooperative while others are obstructive, even when legally obligated to provide the information. They highlighted the importance of public records laws and advocated for utilizing resources like MuckRock to facilitate these requests. This commenter also touched on the disparate impact of ALPRs (Automatic License Plate Readers) based on geographic location, suggesting that smaller towns might have less comprehensive or easily retrievable data compared to larger cities.
Another commenter shared a personal anecdote about their experience obtaining ALPR data from their local police department. They emphasized the ease with which they received the information, contrasting it with the difficulties described in the original article. This difference highlighted the inconsistency in how different police departments handle these requests.
A significant thread developed around the legality of license plate scanning and the legal precedent surrounding it. Commenters discussed the Fourth Amendment implications and the varying interpretations by courts across the US. Some argued that tracking vehicles without probable cause constituted a violation of privacy, while others cited court decisions that have upheld the practice. The discussion also delved into the potential for abuse of this technology and the lack of clear regulations governing its use.
The technical aspects of ALPR data were also explored, with commenters discussing the types of data collected, the storage methods employed, and the potential for inaccuracies in the data. One commenter pointed out the possibility of "ghost plates" – misreads of license plates leading to incorrect data being associated with a vehicle. This raised concerns about the reliability of the data and the potential for misidentification.
Finally, some comments offered practical advice for individuals seeking to obtain their own ALPR data, recommending resources like the Electronic Frontier Foundation (EFF) and providing tips on framing the request to law enforcement agencies. This practical focus complemented the broader discussion on legal and societal implications.
Overall, the comments section offered a multifaceted perspective on the use of ALPRs and the public's access to the data they collect, covering legal, technical, and practical considerations. The variety of experiences shared by commenters highlighted the inconsistencies in law enforcement practices and the need for greater clarity and regulation in this area.