One Password, 1,000 Searches: When Surveillance Infrastructure Becomes a Weapon

This morning, a cop in Savannah handed her login credentials to her ICE agent husband, and he ran nearly a thousand license plate searches online.

the overwhelming majority targeting Hispanic drivers.

Using a system he had absolutely zero authorization to touch.

And the city's initial instinct was an eight-day suspension.

Eight days.

For what amounts to a civil liberties breach that a decent data security team should have made structurally impossible in the first place.

That's the story.

That's the one.

Let me tell you what this actually is because the framing of... officer fired, case closed, is going to let a lot of people off the hook.

This is not a personnel failure with a clean ending.

This is a data governance catastrophe wearing a termination notice as a Halloween costume.

The platform in question is flock safety, license plate reader, infrastructure, deployed across hundreds of cities, and the architecture apparently allowed a single set of shared credentials to unlock nearly a thousand searches with no automated flag, no interagency access review, no tripwire of any kind.

He just logged in as her and started pulling plates.

For weeks, apparently.

The system had no idea.

I've spent 15 years in enterprise software, and I can tell you, in any halfway serious enterprise environment, what Tyler Harp did would have triggered an anomaly alert.

before he got to search number 10.

Location mismatch, access pattern deviation, usage outside normal hours.

These are table stakes for enterprise credentialing in 2024.

The fact that a law enforcement surveillance network doesn't enforce them isn't a bug someone forgot to fix.

It's a product that was never designed to ask hard questions about who's actually on the other end of a login.

And when you're talking about a tool that can track a person's physical movements across a city based on their vehicle.

That is a catastrophic design choice.

Here's the part that should make every tech vendor in this space genuinely uncomfortable.

Savannah PD had no data sharing agreement with ICE.

This morning, a cop in Savannah handed her login credentials to her ICE agent husband, and he ran nearly a thousand license plate searches online.

the overwhelming majority targeting Hispanic drivers.

Using a system he had absolutely zero authorization to touch.

And the city's initial instinct was an eight-day suspension.

Eight days.

For what amounts to a civil liberties breach that a decent data security team should have made structurally impossible in the first place.

That's the story.

That's the one.

Let me tell you what this actually is because the framing of... officer fired, case closed, is going to let a lot of people off the hook.

This is not a personnel failure with a clean ending.

This is a data governance catastrophe wearing a termination notice as a Halloween costume.

The platform in question is flock safety, license plate reader, infrastructure, deployed across hundreds of cities, and the architecture apparently allowed a single set of shared credentials to unlock nearly a thousand searches with no automated flag, no interagency access review, no tripwire of any kind.

He just logged in as her and started pulling plates.

For weeks, apparently.

The system had no idea.

I've spent 15 years in enterprise software, and I can tell you, in any halfway serious enterprise environment, what Tyler Harp did would have triggered an anomaly alert.

before he got to search number 10.

Location mismatch, access pattern deviation, usage outside normal hours.

These are table stakes for enterprise credentialing in 2024.

The fact that a law enforcement surveillance network doesn't enforce them isn't a bug someone forgot to fix.

It's a product that was never designed to ask hard questions about who's actually on the other end of a login.

And when you're talking about a tool that can track a person's physical movements across a city based on their vehicle.

That is a catastrophic design choice.

Here's the part that should make every tech vendor in this space genuinely uncomfortable.

Savannah PD had no data sharing agreement with ICE.