Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Extracting video and audio from used police body cam (twitter.com/d0tslash)
108 points by alexfromapex on July 3, 2020 | hide | past | favorite | 87 comments


Ethically, it’s inappropriate to post some of these photos without blurring identifying details that are not material to the newsworthiness at hand.

We don’t need to see the officers’ unblurred faces to confirm that these were successfully extracted from a random eBay purchase, as their precise identities are not relevant to the story.

We do need to see the cop cruiser unblurred, because that’s materially relevant to the story and serves as likely (but not certain) evidence of the source of the images.

We don’t need to see the exterior shot of someone random person’s house, because that could result in their location being identified and the press mobbing them pointlessly.

We do need to see the safe interior shot of someone’s house, that doesn’t reveal any identifying information, since that protects their identity while supporting the story at hand.


>We don’t need to see the officers’ unblurred faces to confirm that these were successfully extracted from a random eBay purchase

This feels like bootlicking. Officers are legally allowed to be filmed while doing their job. It may not be relevant to the story, but its irrelevant to blur them at all.

>We don’t need to see the exterior shot of someone random person’s house, because that could result in their location being identified and the press mobbing them pointlessly.

Sorry but this too is considered public photography. photos of a persons house exist on google maps and generally across the internet as a whole.

>We do need to see the safe interior shot of someone’s house, that doesn’t reveal any identifying information, since that protects their identity while supporting the story at hand.

Nope, not at all. You generally cannot just film a private home or business, and police filming a home is a pretty shady area for anything but the purportedly advertised use for a bodycam. the TV show COPS learned the hard way that just because the police can enter a home, doesnt mean you get to film it without permission or consent. places like Disneyland and concert halls routinely have legal standing to enforce a restriction on flash photography as it is again, private property.


I disagree, ethically it is not only fully appropriate but also mandatory to post everything that said cameras contain.


I'm having trouble grasping what common good you see coming from your proposal. I would accept "independent review board chosen from the jury duty pool must review all bodycam fotage", but your position as you represent it is far too easy to abuse.

By this logic, if the police break into your house while you're having an affair, you have no right to deny them publication of it immediately to a public website. There is tremendous potential for abuse here. For example, corrupt cops would immediately begin 'accidentally' (wink, wink) recording bodycam footage while 'not on duty' (wink, wink) when paid to by their buyers, or whenever someone is naked, since publication would be automatic and they would be immune to prosecution for their corrupt and abusive actions.

From a societal injustice standpoint, it would be an extremely effective way for abusive police to enforce white male privilege upon citizens (in the same way that doxxing does). If you aren't white and male, you're at a much higher risk of being killed or driven to suicide by this "publish everything" approach capturing some behavior that abusive people can use to justify attacking you. If you are white and male, you can just shrug it off and other white men (the most likely attackers in this scenario) will give you a pass so they can get away with it too. Statistically, significantly fewer white men will suffer as a result relative to other subgroups.

If you're able to see a way forward that does not have a high risk of doing damage to US society (including to people other than white men), please share it.


The policemen can talk about what they saw, the jury can talk about what they saw, the violation of privacy happens the moment that the police walk into your house. If something is not private enough for a group of random people to review then it is not private enough for the wider public either.

> By this logic ...

No, not really. The point of this is to establish a form of full disclosure - this is also my position about disclosing vulnerabilities. It should be public and uncensored so that the public knows about the full extend of data leakage and can act accordingly. I do not see how what you said follows from what I said.

> while 'not on duty'

They can just use normal cameras then.


> If something is not private enough for a group of random people to review then it is not private enough for the wider public either.

The possibility of jurors disclosing sealed evidence does not negate the importance of the jury process, or of sealing evidence from public disclosure. It is still valuable to take these steps, even if fewer than 100% of participants adhere to the rules.

> It should be public and uncensored so that the public knows about the full extend of data leakage and can act accordingly.

I disagree. If medical records are leaked, they should not be treated as "public and uncensored". If criminal records are sealed and then leaked, they should not be treated as "public and uncensored". If the home address and work phone number of every citizen is leaked, that should not be treated as "public and uncensored". The public does not need comprehensive access to the data that was leaked in order to grasp "the full extent of data leakage". It is absolutely essential that a dependable third party review that data set — I trust HaveIBeenPwned, and I mostly trust press reporters — but their summary is generally quite sufficient without having them republish all of that data for anyone to review.

> They can just use normal cameras then.

Per your statement, bodycam footage should be disclosed publicly regardless of content, which would require legal protections against anyone suing to have footage taken down. Use of normal cameras would not provide such legal protections. This is not a valid equivalence to consider.


Body camera footage has to be reviewed and made public if appropriate. But not all body camera footage should be made public. To protect the rights and privacy of the innocent.


It's this exact mechanism that allows police to bury mistakes. Rarely are the innocent truly protected.


I agree that this 'review' mechanism allows police to bury mistakes when the review process is operated by a captive body, such as the police or their union. Correcting that process to independent review is an essential step.

I personally think that the review process should instead follow the jury duty process, where citizens are selected at random from the population to review police footage, but I would accept an independent review board as long as less than one third of the members are political appointees.


not really


Yes, really. There have been countless cases where the police "accidently" "lost" footage critical to a case.


I think that loss of bodycam footage should be treated equivalently to discharge of a police weapon, with the officer assigned to desk duty until forensic analysis by an independent third party can confirm that the loss was caused intentionally.


Most police body camera footage should never be made public. People have a right to privacy. You don't lose that right just because you had an encounter with a police officer that was filming you.


Leaking the footage to the buyer as in the link is the same as making it public.


This logic does not follow. If some third-party data leak results in my social security number being published, does that mean it is now ethical for a researcher studying that data leak to post my social security number without redaction?

This is not a contrived example: Equifax was, apparently, compromised in full, which means that all American social security numbers issued prior to that compromise can safely be considered 'leaked'.

The logic follows that I should be permitted to post anyone's social security number for any reason at all, without regard for the ethics of doing so, because "it's been made public" and therefore all ethical concerns are void.

I disagree with this premise. Context of disclosure matters, even if the information has been previously disclosed. Ethical considerations apply regardless of previous disclosure.

One disclosure of personal data does not negate the ethical considerations around that same disclosing personal data, even if it has been made public at any point previously. This approach ends up supporting doxxing — where 'public' information is used unethically to target individuals for harassment.


What would have we lost if he burred the faces?


Seems crazy to me that they don't encrypt the videos on the device given how much personal information about other people can be on there. There is a full video of the inside of someone's house in that feed. Couldn't they just have some kind of public/private key encryption, where they put the public key on the bodycam and have it encrypt all the videos it takes? Then you could just decrypt them at the station with the private key.


PKI is insufficient protection in this case. If someone obtains the hardware and has a few years to sit on it, it is possible that private keys can eventually be broken (or compromised via other channels).


Maybe so, but not using encryption at all is clearly worse.

What would be a better system?


Hardware security. These devices should have been built from day 1 with the idea that they would eventually need to be retired from service. They could be designed to self-destruct their own memories if a certain signal is not received within a certain timeframe. Procedures would be built around this such that cameras would need to be periodically checked-in for audit and refresh of the hardware kill timer. If an officer fails to check in a certain camera (presumably with the intent to expire the hardware timer), you could assume malicious intent and have whatever arbitrary penalties to discourage this behavior. Set the timer at 48~72 hours and it would be virtually impossible for even the most sophisticated attacker to physically breach the HSM in time for extraction of the data/symmetric key.

Combine this with a PKI and you should then have a solid solution. If you want maximum traceability, you could throw in LTE or satellite connectivity for logging major audit events or triggering certain device features remotely.


Your Honor, the department misplaced the devices during the chaos of debriefing. By the time we retrieved it the data has self-destructed.


You could spin any bullshit story around any device. If you do not have some degree of discipline with your meatspace domain, there's no hope for the hardware domain either. Even the most secure devices on earth can eventually be compromised if you allow all policy to fall away and just let the hardware fend for itself.

The police can and should be held to a higher standard regarding evidence and chain of custody. The tools are only half of this picture. It is a synergistic approach.


Shouldn't that policy or standard be about proper data disposal in the first place?


I think symmetric encryption would be fine here for simplicity. When it's time to wipe the drive, securely erase the key.

I'm curious as to who is responsible for not properly erasing the files: the IT department, or the manufacturer. It could be that the station didn't wipe/reset the cameras before selling them. Or they only reinitialized the file system. Or the firmware's reset function only reinitializes the file system rather than shredding the contents.


I just sat a sales presentation for a competitor's body cameras a few days ago. The cameras, in that case, are completely "black box" and no mention of threat models associated with the authenticity, confidentiality, or integrity of the data on the cameras was made. The particular cameras I saw pitched record continuously, and a "supervisor" is capable of accessing the raw buffer to extract video that an officer didn't otherwise flag as an "event" by way of a "password".

I can only imagine that the information security story around all of this kind of hardware is probably pretty awful.


Uh, I'm not sure it's a good idea to post pictures of the camera footage on Twitter? Especially as one also have military personnel in it...


There's a few comments about the legal status of doing this. In the US, wouldn't this be considered dumpster diving(https://en.m.wikipedia.org/wiki/Dumpster_diving) and lawful?


I believe if the device is obtained lawfully, there isn't much anyone can do regarding what you then decide to do with it or any of its contents.

This is precisely why you should drill through hard drives and flash media before removing them from your secure areas.


There's plenty of precedent to find dumpster diving (or more specifically using sensitive information obtained that way) unlawful in a variety of situations. Most precedent in support of dumpster diving for sensitive information is in the context of law enforcement searches which are regarded somewhat differently by courts than a random individual obtaining sensitive information with questionable intent. Just Wikipedia mentions a case in which the dumpster-diver was ordered to pay damages in response to sensitive information retrieved by dumpster diving. It's just doesn't seem at all clear-cut that what the person here did is legal.


From the link it isn't clear. The guy bought a cam from ebay and found the pictures still on there, which is what he's posting on twitter.

https://www.azmirror.com/blog/fort-huachuca-police-body-cam-...

Its kinda sad, I love the idea of reusing old electronics instead of dumping them, but is usually too difficult to secure.


Yea, this is why companies destroy perfectly good hardware- so this doesn't happen :(


I this guy opening himself up to a lawsuit by publishing everything like that? Last I remember, people got nailed for simply pointing out there was an issue on a server and with anti-repair laws out there, you never know what's gonna happen.


This isn't a remote server; the cameras were acquired legally by the tweeter.


Was it legally obtained? Purchasing an illegally obtained good is still illegal in the US.


Given that police are fine with torturing and killing people illegally, I don't know that this will mean anything.


> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.

https://news.ycombinator.com/newsguidelines.html

Please, read the guidelines. It should be pretty clear that I know an SD-card isn't a server.


I just see two pictures of a disassembled camera. Is there more info?


It's all unrolled here:

https://threadreaderapp.com/thread/1278413772680507392.html

Personally, I think this is bad form. He should have quietly told the seller that the data is recoverable rather than broadcast it all over Twitter. The last thing we need is the Police finding reasons NOT to wear bodycams.


All police body cam footage should be public. Their work is paid for by tax money, they are supposed to be public servants. Governments, including their police force should be transparent to public they're supposed to be serving.


>> All police body cam footage should be public.

Even if they're busting a brothel? Or arresting drunk drivers? Or breaking up a bar fight?

I get that people want transparency for "public servants" but I dont think people necessarily want transparency into regular peoples lives even if their actions are questionable. That leads to 24/7 suveilence under the poor argument of "if you have nothing to hide..."


Redaction systems exist and are used for exactly this purpose. It's entirely possible to be transparent and protect citizen privacy.

I work with a company that provides this type of technology for FOIA requests so I'm fairly familiar with it :)


How do you redact the arrest of someone who turns out to be innocent?


You remove their face and change their voice in the video. At least, when you're talking about body cam footage. You also blur license plates, addresses, etc. That's what is already being done for information requests to law enforcement.

This isn't a hypothetical btw. This is actually how it happens in many jurisdictions, and some law enforcement agencies are being proactive about this and thinking through how to be more transparent without risking privacy of innocent or guilty parties (both deserve privacy).


Usually via the general fund of the locality where the video was recorded.


This is trying to solve an institutional issue (police accountability) with technology. I don't think it will work and it will just normalize more surveillance. No amount of body cam footage is going to force DAs to prosecute, juries to convict, and police departments to discipline as long as a culture of circling the wagons exists. If you doubt that, look at how much footage was available of the arrest and murder of Eric Garner. And the officer responsible was still not indicted.


While I agree with the sentiment that public workers should be accountable to the tax payers, let's not forget they are still humans. Would you like your employer to point a cam at your desk and have it recording at all times?


>Would you like your employer to point a cam at your desk and have it recording at all times?

I mean, many employers go as far in that direction as they legally can. See the recent thread here about "bossware."[0]

However, my employer can't seize my private property, lock me or my family in a cell, torture me or simply shoot me dead in the middle of the street in broad daylight and get away with it. Police can, and do, all of those things all the time.

[0]https://news.ycombinator.com/item?id=23705495


That's a bad idea. A lot of policing is taking someone aside an giving them a warning, defusing a situation between angry people, etc... A camera only complicates these matters.

What might be a better idea is stripping them of their privileged position. Today, if a police officer says something in court, it is automatically the truth. Take that away from the police, and let the camera be the official truth teller. Give accused people automatically a full version, so prosecutors can't edit against them.

UPDATE whoops, this should be attached to the grandparent post.


Fortunately, my job doesn't require me to carry firearms, detain citizens or uphold laws.

Furthermore, when I was being paid by government grant money, we were accountable for every thing we did while being paid and every penny we spent. We were required to make regular reports and justify everything. It'd be nice to see even that level of accountability with policing.


>Would you like your employer to point a cam at your desk and have it recording at all times?

You can always... get another job. If you don't accept the surveillance that comes with your power to inflict violence with impunity, maybe you shouldn't be given the power in the first place.


That's not a good way to deal with this. If you leave, the next guy will have the same shitty spying going on. Plus, nothing stops your next gig from spying on you as well. Until you've quit so many times that no employer is interested anymore. Better to tackle the problem at the root. No spying unless specifically defined how.


I agree with that sentiment, however...

In EU there are shows where TV crew is embedded in highway police (traffic police). They never let people off with a warning. I literally never seen it happen.

And in Europe in real life you have a chance to be caught for small infraction and receive waggle of the proverbial finger of the law.

So having all police live stream their cams might not only curb bad behavior of bad cops, but also good behavior of good cops.


I hear this argument a lot (ie. "body cams will eliminate/reduce police discretion"), but I always wonder, is that a bad thing? If the department policy is that everyone that goes 10mph over the limit is ticketed, and you don't get off because of your charisma (or not being a minority), is that a bad thing?


If my desk was the outside and I was enforcing "laws" with possibly deadly force, I shouldn't have a say in if I like it or not: it (should) come(s) with the work.


Well, my understanding is that there is no expectation of privacy if you’re using your employers equipment or network. I think it’s pretty clearly written on that offer letter when you sign the contract - or at least the ones I sampled. Not to mention the proliferation of CCTVs in almost all work places.

So to answer your question, yeah, I fully expect my employer to record what I am doing all the time and it’s a price that unfortunately I have to pay to survive in this digital world.


Even bathroom breaks?


I wouldn’t be surprised if they counted those as well. I don’t think they’ll go so far as installing cctv inside the bathrooms lol


It's simple. You encrypt the data. Only the DA has the key. This also prevents the police from being able to use their own footage when trying to make a statement, a benefit the public doesn't have.

If the DA determines that a crime was likely committed, then they can decrypt the footage and review, otherwise it stays stored for a short period of time, then destroyed.


This scheme assumes DAs are trustworthy, but there are a plethora of cases where DAs have protected bad cops. If only the DA can decrypt the video, that severely limits the opportunities of would-be whistle-blowers.


On the one hand: Police having privacy while on the job.

On the other hand: Not letting police get away with torture, murder, planting evidence, lying about what happened, throwing innocent people in jail.

Hmm... tough choice.


The issue is the privacy of the people they're interacting with.


Cops are civil servants with power of life and death over people.

Do not compare it with other jobs.


The takeaway here is that while I wouldn't want that, the consequences of my dicking around on YouTube are significantly less severe than the consequences of police misconduct


You may want to read the dystopian book “The circle”, that reasoning is a part of the plot.

https://en.wikipedia.org/wiki/The_Circle_(Eggers_novel)

Spoiler: creating a public panopticon doesn’t necessarily results in a sane society


You forget that body cameras also record victims and bystanders.


And the _accused_. Those people need the most protection of all. The only category people that get any "special rights" in our Constitution are the accused. And for good reason.


And if you were falsely arrested, and had the footage out there without your consent, you'd be happy for that too? It's a double edged sword I think.


I don't think the parent comment (or anyone for that matter) is advocating for the unauthorized public release of bodycam footage. I think his point is that as public servants with extraordinary power, the public interest trumps any personal expectations of privacy while on the job. As such, the public shouldn't tolerate "but privacy!" as an excuse from police officers not to have bodycams.


By this argument all government employees must wear body cams, and the archived streams should be open to public viewing.

I don't think OP believes that. But it's what they said.


Not sure what telling the seller would do, they are just some third party reseller.

I suspect that there probably is a way to wipe these, although I don't know for sure, and the manufacturer should take this as an opportunity to remind agencies to do so before disposal.


It would be great if police found ways to do their jobs that didn't require them to wear body cams because they can't be trusted not to lie, kill, steal, and torture citizens.


You need to follow the twitter thread. Click the first tweet (or go to https://mobile.twitter.com/d0tslash/status/12784137726805073...). Then scroll down and click on "more replies" to keep going. Feel free to curse Twitter's UI/UX along the way.


There's an entire thread under the linked tweet.


Which may or may not show. I had to refresh to see that thread. (I loaded the URL again in a fresh Private Browsing window, and sure enough, I didn't see the thread.)

Another reason Twitter is a poor substitute for a blog post.


Twitter UX sucks pretty badly, especially for those who have not used it much.


I don't like Twitter's UX either, but to get to the rest of the thread you just scroll down? Isn't that how we've always viewed documents on the internet?


You have to open the link OP posted here and then click the top tweet for it to open, then you can scroll down. Without clicking it, you only see two tweets with no indication there's more.

I only see 4 photos at that point and have to click "11 more replies" to see more, but there's no indication that there's more before you "open" the first tweet.


Weird. Maybe it's because I'm logged in, but clicking the link immediately lets me scroll through the entire thread.


Nope, that's not how it's visible to me. I just see 2 posts with images, and then "comments" to those have new images but clicking on them does not allow me to conveniently view the next one but have to instead return back and do the whole process from the start.


Forth tweet says "so this happened" and is a picture of a wedding ring on a woman's finger. Next is a Voltron gif, a pic of some woman's makeup, and a fantasy corset.


I agree. But that's partly because people are use a microblogging platform to post things that are definitely not micro blogs.


Except a microblogging platform would probably work here, even though Twitter doesn't.


I'd be scared for my life if I was him... hopefully he posted that stuff anonymously. I've seen some white people getting killed on video in a similar manner to George Floyd's killing, but even worst (i.e.: The police have the medic inject the victim with strong drugs right after he passes out from getting choked to death). This video is very troubling but if someone wants to see it I will post it (what is even more troubling is that no one lost their job).


A little further down the thread they post the success! https://twitter.com/d0tslash/status/1278458524742361089?s=21


Completely made my day. I can just gush with love for stuff like this.


what a doofus.

> Me trying to extract video from this body cam like: OHHHH please work!

more like: "me putting my head in a lion's mouth"


A more appropriate medium would have been a technical blog post, with redacted information and blurred photos.

Not an attention seeking twitter thread with lolspeak...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: