America Under Surveillance with Michael Soyfer

Summary

Podcast Summary: "America Under Surveillance with Michael Soifer"

Software Engineering Daily | January 15, 2026
Guest: Michael Soifer (Attorney, Institute for Justice)
Host: Kevin Ball

---

Overview

This episode explores the rapid expansion of government-run surveillance technology in the United States, focusing on automated license plate readers (ALPRs), the legal and ethical challenges these systems pose, and the difficulty of keeping legislation and oversight in step with technological change. Michael Soifer, an attorney specializing in Fourth Amendment rights at the Institute for Justice (IJ), discusses the institute's lawsuit against the city of Norfolk, Virginia, and broader issues of privacy, legislative lag, and how technologists and everyday citizens can engage in the fight for civil liberties.

---

Key Discussion Points & Insights

1. What Are Flock Cameras and Automated License Plate Readers?

• Flock cameras read license plates and various vehicle features (“vehicle fingerprinting”)—including make, model, color, and other distinctive attributes (like bumper stickers or roof racks)—at high speeds and log the data into searchable police databases. [03:00]
• Police can use these cameras to track the long-term movement of vehicles within a city, building a "rich picture" of people's daily lives. In Norfolk, VA, a network of 172 Flock cameras makes it nearly impossible to drive any distance without being tracked. [03:00]

“We saw the police chief briefing the city council... telling them it would be difficult to drive anywhere of any distance without running into a camera somewhere. We thought that was just bonkers.”
—Michael Soifer [04:00]

2. Why This Is Different from Corporate Tracking

• While web and app companies collect user data, government surveillance is fundamentally different due to the vast power imbalance and lack of consumer “opt-out.” [05:56]
• After Carpenter v. United States (2018), which required warrants for cell-site location info, law enforcement increasingly sought to “cut out the middleman” by collecting data directly themselves, leading to widespread, unregulated deployment of government-owned surveillance tools.

“The government is just different. It's collecting information to keep tabs on us in a way that just wasn't possible in the past.”
—Michael Soifer [06:00]

3. The Slow Pace and Outdated Basis of Regulation

• Law and regulation lag behind: legal cases can take nearly a decade to reach resolution, and Supreme Court precedent still relies on 1980s-era “beeper in a vat” cases.
• Flock's rapid, “startup-style” rollout outpaced meaningful oversight—“move fast and break things” doesn’t work well when what’s at stake is constitutional order. [09:55]

“So courts and legislatures have been very, very slow to regulate it. ...This technology rolled out a lot faster than courts or legislatures could regulate it.”
—Michael Soifer [11:10]

4. The Fourth Amendment and the Balance of Interests

• The Fourth Amendment is intended to balance public safety with privacy and liberty by requiring warrants for invasive searches based on probable cause, reviewed by a neutral judge. [14:22]
• Modern surveillance tools upend this balance by allowing for “pervasive, permeating” monitoring of the general, law-abiding public without individualized suspicion.

“For law abiding people, where police have no reason to suspect you of any wrongdoing, of committing any crime, you should be left alone to go about your day without having your movements tracked in a huge police database.”
—Michael Soifer [16:56]

5. Data Retention, Minimization, and Use Cases

• The core distinction: real-time alerts for “hot list” matches (e.g., stolen cars) are useful law enforcement tools. Mass, long-term data retention and retroactive tracking are what cross the line, unless a warrant has been obtained. [17:29]
• Cites New Hampshire’s policy: delete LPR data within three minutes unless there is a direct law enforcement reason to retain.

6. Comparison with Private Sector Data Protections (GDPR etc.)

• US government data-collection faces far fewer restrictions than private companies, who may be subject to regulations like GDPR in Europe or CCPA in California. [22:14]
• Law enforcement access to this sensitive data is often loosely protected (example: lack of mandatory strong authentication; unsecured sharing across departments/agencies).

“...Very, very minimal regulation when the government is collecting kind of similar information for its own means and often frankly not guarding that information even as well as tech companies might.”
—Michael Soifer [22:49]

7. The Role of Citizen and Technologist Engagement

• Legislation is slowly emerging at the state and city level (e.g., Virginia recently reduced ALPR data retention from 30 to 21 days).
• Meaningful change is likely to be local and incremental for the foreseeable future: city councils, statehouses, and citizen pressure all matter—a handful of passionate residents can have an outsized impact.
• The Institute for Justice’s Plate Privacy Project (PPP) offers a model “PEEPS Act” bill for responsible surveillance policy, emphasizing data minimization, warrant requirements, robust audit trails, access restrictions, and true oversight. [25:16, 47:21]

“Oftentimes people don't even know what's going on with their local legislatures or even their state legislatures... When you're interested in an issue, just reaching out can often have an outsized impact.”
—Michael Soifer [37:14]

---

Memorable Moments & Notable Quotes

• On the “move fast and break things” model of Flock's rollout:
  “I don't think the model of like move fast and break things works well when the thing you're breaking is our constitutional order.”
  —Michael Soifer [11:00]
• On becoming a plaintiff in public interest litigation:
  “That's the crazy thing, is that there are trade-offs between maintaining your privacy and bringing these cases publicly. And I'm hugely grateful to our Norfolk clients, who are very private people, but have put themselves out there...”
  —Michael Soifer [33:38]
• On the audit-logging “solution” and lack of oversight:
  “Flock always points to... this audit tool that they can use, and it's really their job to oversee how their officers are using the system. ...But what we found out in Norfolk is that no one audited it for two years.”
  —Michael Soifer [43:37]
• On the limits of trusting good intentions:
  “The real way to prevent this information from being abused is not to have it in the first place and not just to trust that the government right now will not abuse it. Because... they're always susceptible to future abuse.”
  —Michael Soifer [50:00]
• On accountability and best practices:
  “Even if you do think that, hey, police should have this type of stuff, they should have at least the same level of safeguards that we expect companies to put in place. Of course, and they don't have anywhere near that.”
  —Michael Soifer [51:52]
• On who polices the police:
  “Really the question of who police is the police comes up and oftentimes it's no one.”
  —Michael Soifer [52:18]

---

Suggested Actions & Further Resources

• Find out about surveillance in your locality:
  • IJ's Plate Privacy Project: [Google "Plate Privacy Project" or visit IJ’s website] [39:08]
  • deflock.me: Map of Flock camera locations [39:08]
• Model Legislation Reference:
  • PPP’s model “PEEPS Act” bill for cities and states [47:21]
• Engagement Tips:
  • Attend city council meetings—local government can be surprisingly responsive [37:14]
  • Contact local/state representatives and advocate for transparency and oversight [36:19]
  • Participate in (or file) amicus briefs to inform the courts from a technologist’s perspective [34:54]
  • Media engagement and op-eds can also be influential [36:19]

---

Conclusion: The Broader Challenge

License plate readers are “just the start of a new era of big police surveillance.” Without robust legal, civic, and technological pushback, mass data retention—ostensibly “just in case”—threatens to erode constitutional protections for everyone, not only those suspected of wrongdoing. Ongoing vigilance, technical expertise, and civic engagement are all essential in defending individual rights.

“You don't have to mistrust the government writ large. You just have to believe that there can be bad actors.” —Kevin Ball [51:03]

Transcript

[Narrator/Host Introduction]

Surveillance technology is advancing faster than the laws meant to govern it. Across the United States, police departments are deploying automated license plate readers, facial recognition tools, and predictive systems that quietly log the daily movements of millions of people. These tools promise efficiency and safety, but critics argue that they represent a form of warrantless mass surveillance and raise deep constitutional questions about privacy, accountability, and the limits of government power in the digital age. Michael Soifer is an attorney at the Institute for Justice, a non profit public interest law firm focused on defending individual rights. His work centers on the Fourth Amendment and the growing use of surveillance technologies by local governments. Michael joins the show with Kevin Ball to discuss the rise of Flock safety cameras, the Institute for Justice's lawsuit against the city of Norfolk, Virginia, how decades old legal precedents struggled to keep up with modern technology, and what citizens, technologists and policymakers can do to protect privacy in an era of pervasive data collection. Kevin Ball, or K. Ball, is the Vice President of Engineering at Mento and an independent coach for engineers and engineering leaders. He co founded and served as CTO for two companies, founded the San Diego JavaScript Meetup, and organizes the AI in Action discussion group through Leighton Space. Check out the show notes to follow K. Ball on Twitter or LinkedIn or visit his website K Ball LLC.

[Kevin Ball]

Michael, welcome to the show.

[Michael Soifer]

Thank you, thank you. It's great to be here.

[Kevin Ball]

Yeah. I'm really excited for this conversation. Let's start with a little bit of introduction about you and the Institute for Justice.

[Michael Soifer]

My name is Michael Soyfer. I'm an attorney at the Institute for Justice. I've been here since early 2024. I primarily work on issues related to the Fourth Amendment, especially surveillance of people's movements and public spaces and kind of the growing government surveillance state across the country. The Institute for Justice is a national nonprofit public interest law firm. We litigate cases in a bunch of areas. The one that's kind of closest to my heart is our project on the Fourth Amendment.

[Kevin Ball]

Yeah. And I think for those wondering, listening to a software podcast, what are we talking about here? I think some of these requirements, recurring themes around how technology interacts with our rights and the legal system and all those things are something I'm very excited to dive in with, someone who understands the kind of legal half of that. So let's maybe look at this particular Fourth Amendment case and Flock cameras in particular. So can you kind of give us the high level overview for folks who haven't been paying attention? Like what even is this situation and how the surveillance state is growing with it?

[Michael Soifer]

So I'll talk about our case in Norfolk, Virginia first. You know, we'd noticed that Norfolk had installed a network of 172 flock automatic license plate readers. They're cameras that when you pass them, even at high speeds, they take a picture, and then from that picture, they read certain features of the car. The most notable being the license plate, which is a really easy way to track people and, and connect their movements at the same location over time. But they also gather other vehicle features. Flock refers to this as vehicle fingerprint. That's kind of a marketing term for the ability of its cameras to take down the make of a car, the type of car, the color, and some other distinctive features of the car. Like it will be able to tell if the car has a bumper sticker, if it has a roof rack, things like that. And that will all go in a police database where police can search for the license plate number, either full or partial, can search based on those vehicle features, and can see every time in the past, usually it's 30 days where that car was seen and when. And that lets you kind of build this rich picture of where people are going within a city. And in Norfolk, we saw the police chief kind of briefing the city council and telling them it would be difficult to drive anywhere of any distance without running into a camera somewhere. So we thought that was just bonkers. It was extremely disturbing that the police were gathering this sort of information about people's long term movements. And at the time we initially sued, there wasn't really state law regulating the use of these systems. So the Norfolk police department had just adopted a policy that said, said the system can only be used for a law enforcement purpose. But what that meant it was up to every individual officer. And so we partnered with some local Norfolk residents who found that level of surveillance really disturbing, didn't want the police logging their movements for a month at a time. And we sued in federal trial court in the eastern district of Virginia and claim that that ongoing surveillance violated the fourth amendment.

[Kevin Ball]

So let's maybe dig into some of the details of how it is, because I think for folks who work particularly in, like, the web or things like that, they're used to hearing about, oh, there's tracking. I can tell where everybody's going on the web if I need to, if a particular company owns that or gps, my phone is tracking everywhere that I'm going and all of these different things. So what makes the current issue with the license plate readers different than some of these other areas that folks are maybe more familiar with the thing that's.

[Michael Soifer]

Different is the government is doing it and doing it at a population level. The government is and always will be more powerful than any of the companies that are maybe logging your location here and there through an app or even your cell phone company that's collecting information about your movements for its own business purposes. The government is just different. It's collecting information to keep tabs on us in a way that just wasn't possible in the past. And what we've seen is as it's become more difficult for the government to access private repositories of this type of information, they've tried to develop ways to just gather it on their own. So for instance, the government used to be able to go to many private companies that gather location information and with a simple subpoena or just a request, sometimes get location information from them. The Supreme Court really revolutionized this area of the law in 2018 when it decided a case called Carpenter vs United States. In Carpenter, the Supreme Court held that the government needed a warrant to access cell site location information. That's the information that our cell phone companies collect about where and when we connect to towers. And it will sort of tell you just like which towers coverage zone a person is in at a given point in time. And the Supreme Court recognized that people have a reasonable expectation of privacy, which is kind of the, the key fourth Amendment question in that data, because it's collecting their movements in a way that's impossible for any given person to do unless that person's stalking you, for instance. So those forms of information have become more difficult for the government to access, especially without a warrant. And we've seen governments in recent years trying to be able to harvest this population level surveillance information themselves, not having to go through a middleman. So for instance, and this is one of the reasons that we decided to file this case at Norfolk, there was a program in Baltimore where the city was flying spy planes 12 hours a day during daylight hours and taking second by second pictures of the entire city. The idea was that if you know a crime had occurred, you knew where it occurred. You could kind of follow people as little pixels on a map to see if they went to a residence, if they went somewhere else, all of that sort of stuff. And the U.S. court of Appeals that covers Maryland, Virginia, north and South Carolina and West Virginia held that that was unconstitutional. It violated the fourth Amendment to gather that type of long term location information about everyone in a city. And we think that many of these places that are using license plate readers are Just trying to accomplish the same thing from the ground that Baltimore was from the air, creating this repository of people's long term movements that the police can use for really whatever reason they want in many places with very little regulation.

[Kevin Ball]

So I think that raises one of the key questions here, which is we see all over the place technology will get out ahead of regulation and then things will catch up in different ways. And you raised the example of cell phone tracking data Technology got out ahead. We had the ability, the cell companies have the ability to know where somebody or at least their phone is traveling through all of this time. Police groups, governmental groups were leveraging that until the case got to the Supreme Court and they said, hey, no, you can't actually do that. So for this audience, folks may not be familiar, what is the process of getting that legal trail and establishing what folks can and can't do?

[Michael Soifer]

Sure. So there are a few different forms of regulation that can apply to police use of technology. Obviously there are department policies and directives, things like that. There's the judicial process, where constitutional law comes into play, and there's the legislative process. All of those have really trailed the rollout of this technology, I think. So I'll just start with talking about the judicial process. The Supreme Court is very behind in bringing the fourth Amendment into the information age. I mean, it first considered cell site location information in 2018 in a criminal case that had been filed around I think 2010, 2011. These things take a long time to work their way through the court and the Supreme Court generally just hasn't been taking many fourth Amendment cases recently. So the process has been extremely slow of kind of updating the fourth Amendment to take into account all of these new technologies. And so you see law enforcement and Flock and other vendors relying on kind of 80s era Supreme Court case law that considers really crude location tracking technologies. The, the central case in this area is about police putting a beeper in a vat of a drug precursor to try to follow a suspect. And the beeper, like they had to basically stay within a certain distance of the beeper to continue getting signals from it. And that's the case that many police departments, government entities, Flock and others point to and say, well, you have no reasonable expectation of privacy in your public movements. The fourth Amendment doesn't apply. We can gather whatever information we want. So it's very slow kind of going through the judicial process. We're ourselves trying to work our way through that. And this technology rolled out a lot faster then courts or legislatures could regulate it. Flock has A product that's much easier to use, much cheaper than previous iterations of license plate readers. They have very slick marketing. They rolled their product out really quickly, installed it really quickly, got a lot of users really quickly. I think following frankly a well hewed model of tech startups scaling up. And I don't think the model of like move fast and break things works well when the thing you're breaking is our constitutional order. So kind of overnight we've seen these systems proliferate across the country in a way that was unimaginable even just a few years ago. And so courts and legislatures have been very, very slow to regulate it. Virginia only this year enacted a license plate reader law and it reduced somewhat the amount of data that the city of Norfolk and other cities in Virginia were collecting. Most of them defaulted to flock's default of 30 days. And Virginia law now limits data collection to 21 days. It also limits sharing to other Virginia state law enforcement entities. And it limits when police can search this database, but it doesn't require a warrant. And frankly, I think in practice the protections are just extremely weak and do very little to protect people's fourth Amendment rights and privacy.

[Kevin Ball]

Let's maybe dig in a little bit because I think in the tech industry we're often very familiar with, you know, hey, this regulation is outdated and maybe it's not actually good anymore. So like thinking about, and I'm sure, you know, Flock is making a case, they're saying, hey, like this is going to help you keep people more secure or solve crimes faster or something like that. So how do we as a society kind of make these decisions? What makes for example, the fourth Amendment in this case so important around this, like how do we think about these types of decisions? Because they, there are cases where the new technology enables something that was never thought about before, maybe was not even within people's considerations. And that ends up being a good thing.

[Michael Soifer]

Sure. So sometimes my opposing counsel in Norfolk accuses me of wanting to return to 18th century policing. And I absolutely do not want to do that. But when we, we do think historically, back to the founding, policing really wasn't proactive. Most police officers, constables, worked part time, generally weren't very well regarded, and a lot of the investigation of crime was done privately. The police would generally get involved only when private parties would go to a judge or a justice of a peace and get a warrant. That kind of forced the police to do something. Physical evidence wasn't very important, often just witness testimony, that sort of thing. And no one is Arguing that we should return to that era, especially in a modern complex society like the one that we have. At the same time, the Fourth Amendment balances two interests. It balances the people's interests in being secure in their persons, houses, papers and effects with effective law enforcement. And it lets law enforcement do a lot of things, even really, really invasive things, provided that they get a warrant, they have to go to a neutral judge. And that neutral judge stands as kind of a check between really zealous law enforcement and a citizen's right to security and privacy. If they do that, they can break down doors, they can rip up your walls to look for things inside of them, they can search your computer, your file cabinets, whatever. And what the Supreme Court has said is that the Fourth Amendment is meant to prevent a 2 permeating police surveillance. It's meant to prevent us from living in a society where police can kind of break down doors whenever they want and no one can be secure in their persons, in their houses, anywhere. Because there's always, you know, the possibility that police are going to come bursting in, that they're going to be tapping your phone lines, that they're going to be tracking you from one location to another. So I think it's important to reinforce those concerns and try to preserve a balance that's similar to the level of security and privacy people had at the founding era. The kind of underlying idea is that for law abiding people, where police have no reason to suspect you of any wrongdoing, of committing any crime, you should be left alone to go about your day without having your movements tracked in a huge police database and have this police dossier built up about you.

[Kevin Ball]

Yeah, that makes sense. So thinking about some of the analogies you're making there then would the eventual state we'd want to land in is none of this surveillance surveillance, but only you can access it if you have a warrant. Like how are you all thinking about the desired state?

[Michael Soifer]

I think generally if police have no reason to suspect a person of a crime and they don't have a warrant, then they should have to delete data pretty promptly, I would say by the 24 hour mark. In New Hampshire, for instance, license plate reader data has to be deleted within three minutes unless there's a reason to retain it, basically. So one of the kind of core uses of license plate readers, this has been true for a while because police cars have had license plate readers on them for quite a long time now. And those license plate readers, generally all that they do is alert. If they scan a license plate that's stolen or that's registered to someone who has an open warrant out for their arrest, or there's like a missing person alert, things like that. Those are called hot list alerts. And that's really just sort of enhancing what the police can see. Right. Because a police officer can always go enter that license plate number and derive whatever information's in their database. And so that's really just helping the police officer see that there's a stolen car there. But those weren't tracking people across days and weeks. And that's really where we draw the line is police can always see if someone is at a place at a point in time. It's really when you start following them day after day after day and you can pick up on their habits, patterns, routines, that sort of thing, that it crosses that threshold. So we don't have a problem with these systems sort of flagging stolen cars, flagging missing persons, that sort of thing. And we don't have a problem if police have a warrant to track someone to do that and to collect that information across days and weeks as authorized by a warrant. But for law abiding people who are just going about their days, we don't think the police should be hanging on to that information.

[Kevin Ball]

Yeah, this sounds very analogous in a lot of ways to the ways that a lot of tech companies have to deal with pii personal information of different sorts. Right. Is it, it flows through, it's retained for some time period, usually driven by some sort of regulation, whether it's like an automatic audit period that you have to keep it available, or maybe it's a contract you have with the customer, what have you. And then unless there's a flag that somebody says, okay, I need you to investigate this, it's automatically deleted and rolled off and that sort of thing. You're a developer who wants to innovate. Instead you're stuck fixing bottlenecks and fighting legacy code. MongoDB can help. It's a flexible, unified platform that's built for developers by developers. MongoDB is acid compliant enterprise ready with the capabilities you need to ship AI apps fast. That's why so many of the Fortune 500 trust MongoDB with their most critical workloads. Ready to think outside rows and columns. Start [e-mail] build if you're using AI.

[Narrator/Host Introduction]

To code, ask yourself, are you building software or are you just playing prompt roulette? We know that unstructured prompting works at first, but eventually leads to AI slop and technical debt. Enter zenflow zenflow takes you from vibe coding to AI first engineering. It is the first AI orchestration layer that brings discipline to the chaos. It transforms freeform prompting into spec driven workflows and multi agent verification where agents actually cross check each other to prevent drift. You can even command a fleet of parallel agents to implement features and fix bugs simultaneously. We've seen teams accelerate delivery 2 times to 10 times. Stop gambling with prompts, start orchestrating your AI. Turn raw speed into reliable production grade output at Zenflow Free SEDaily listeners Quick question. When things go wrong in production, do you know why? In minutes or hours App Signal is the application performance monitoring tool designed for developers who want clean, actionable insights without a huge observability bill. You get all the tools you need to fix issues before customers notice, like error tracking, performance monitoring, log management, and more. AppSignal works for teams of all shapes and sizes from startups and side hustles to SMEs and enterprise, and is especially great for teams that build with Ruby on rails, Elixir, Node JS and Python. Start your free 30 day trial and get 10% off a yearly plan with code SCD10. Go to www.appsignal.com sed that's www.appsignal.com Sed and use code SED10.

[Kevin Ball]

Now I know in the EU there's a GDPR that regulates very very broadly and I know there's a lot of hate for it actually in the tech industry because it is a very blunt hammer, it's a very blunt tool. But it would seem to head off issues like this because this is personal data in some form and so you would have to get consent, you'd have to explain how it's being used, like all these different layers. So are there any similarly proactive measures that we could take in the US to kind of get ahead of this never ending race of technology?

[Michael Soifer]

I think we could the GDPR doesn't apply to law enforcement activity, so of course the license plate readers used by law enforcement wouldn't be covered. But that just goes to the extensive regulation there is for private companies collection of data, at least in some places, you know, in Europe and California. But very, very minimal regulation when the government is collecting kind of similar information for its own means and often frankly not guarding that information even as well as tech companies might. Because you know what you see in in place after place is that the data governments are collecting about people, about their movements, among other things, is just pretty freely available to police officers and there often aren't great protections for it, whether it's within the department in terms of policy, whether it's a warrant requirement, whether it's a data minimization requirement, whether it's access restrictions, that sort of thing, you just don't see those. And oftentimes, even the kind of technological protections for these data are pretty minimal. So Senator Rod Wyden sent a letter to the FTC just the other day about Flock not using multi factor Authentic or, well, not enforcing multi factor authentication for its users. They make it available, but they don't require police departments to actually use it.

[Kevin Ball]

Yeah. You don't have to dislike police use of this even necessarily to be concerned about that. Right. It takes a single bad actor or a single naive policeman falling for a phishing attack or what have you. And all of a sudden, anyone's historical movement data is available.

[Michael Soifer]

Yeah, absolutely. And I mean, what we've seen is police departments where officers will share passwords with federal officers, for instance, and things like that. And that's possible if you don't have multifactor authentication.

[Kevin Ball]

Yeah. So you've talked about how slow it is to get something to the Supreme Court, and you mentioned the example of, like, eight years to get this, like, view into it for cell tracking data and gps. What other mechanisms are being pursued? Are there things that different state governments are doing around this? Like, what are all the different ways that this is being looked at?

[Michael Soifer]

Sure. So, you know, now many state governments are coming around realizing that this is a huge issue, that their constituents really want some guardrails on police use of these databases, and they've started acting. You know, I've mentioned in Virginia, for instance, there was legislation passed earlier this year. Many other states are looking at similar legislation. Many city councils have started to put the brakes on these programs. What we often see is police departments sort of acting like an unaccountable fourth branch of government and going out and just buying massive surveillance systems and installing them without any real oversight by the city council, because many of these systems have been purchased with outside grant money. In Norfolk, for instance, federal relief funds were used to purchase the vast majority of the cameras. So that didn't have to go through the city council. There really isn't a democratic check on this sort of thing. We're seeing right now, you know, a fight play out in Denver over whether they'll continue to have license plate readers where there seems to be a disagreement between the city council and the mayor, and they're sort of fighting about whether to keep them up. So at ij, we're approaching this from multiple different angles. We've talked to lots of different stakeholders. We're calling it the Plate Privacy Project. Ppp. Everyone loves alliteration, where we have a model bill which is called the PEEPS Act. I won't remember off the top of my head what that's an acronym for, but it was very important that it be peeps. So we've approached it. We've engaged with legislators, we've engaged with activists. And there are more routes than just the judicial angle. But. But we're obviously pursuing that, too. In the Norfolk case, we defeated a motion to dismiss earlier this year, meaning our case could proceed to discovery. We got through discovery at the beginning of September, and both parties have filed motions for summary judgment, which is essentially those motions ask the court to resolve the case without a trial. And depending on how the court resolves those, we may have a trial in February of next year. That does seem like a long time considering. We started last October. But this court is known around the country as the rocket docket. And so I can tell you that's lightning fast for federal litigation. So we're certainly trying to push this case along.

[Kevin Ball]

Well, and this is the thing I just keep grappling with. Right. Because, like, timelines in the tech industry are bananas. And we're talking right now about Flock cameras. But like, I'm also thinking about things like facial recognition technologies, different types of AI agents correlating data and doing different things. Are there any mechanisms that move faster than the legal system on this? How do we get ahead of this?

[Michael Soifer]

It will be with legislation and through legislation that anticipates future technologies and is generally applicable, the judicial process generally, it should result in rules of general applicability. But courts have been pretty slow and have sort of considered each technology on its own. You know, we think the principles from the case I mentioned about cell site location information and the case I mentioned about aerial surveillance generalized to license plate readers. Obviously, the city of Norfolk and Flock disagree with that. So they're litigating very vigorously on the other side. And the outcome is to some extent uncertain. But those judicial opinions should apply more broadly. The problem is that none of that will move. Move as fast as. As the tech industry does. And like you pointed out, there are other technologies coming into use. I mean, not just facial recognition, but Flock has video cameras, apart from its. Its license plate readers that will look for certain features like a green hat or red shirt and try to find people across many different cameras that way. Rolling out technologies like gunshot detectors that listen for screams and that sort of thing. We've seen cities install extensive systems of facial recognition cameras, from Detroit to Philadelphia to New Orleans and various other types of surveillance of people's public movements kind of becoming a reality. So I think flock is really kind of the canary in the coal mine. That's not quite what. What that phrase means, but I can't resist a bird pun when it comes to flock, where license plate readers were really kind of accessible form of surveillance, I guess, where it's pretty easy to recognize the characters on a license plate and to use that as a proxy to track someone across times and locations. Whereas facial recognition and these other technologies have been much more crude. But what we're seeing is just increasing government surveillance at every level of government and kind of entering the age of big data government surveillance. The question is whether our legal system and our legislatures are going to anticipate that and react to it and put guardrails on it or just adhere to these really, really outdated concepts that are based on much more archaic technologies that collected much less data.

[Kevin Ball]

A thing I'd love to then explore with you. And looking at the legislature, like, if you look at the types of professions that lead into becoming a legislator, things like lawyers or policy analysts or military or sometimes teachers, you very rarely get a technologist in there for multiple reasons. I know. I spent three years on a Citi panel, and it bored me to tears because I'm used to things moving quickly and being results oriented. And a lot of government is people who like to talk, talking to each other, which we need, like, no judgment on that. But that is not me. And I think a lot of technologists feel like they wouldn't want to be there. So how do we, as an industry, who maybe is able to see a little bit more where things are going, how do people in this industry influence that development of proactive legislation or other things that might cut this off? Because, I mean, I look at this and I'm terrified, right? Like, I talk to people who. And people in this industry often are familiar with, like China. And you go there and you are tracked everywhere, and everything you do is tracked. And personally, that once again, sounds terrifying. Like, I wouldn't want anything to do with that. So how do we start engaging as an industry in this process?

[Michael Soifer]

That's a great question. I don't know that I have great answers. Government is frustrating sometimes. Government moves slowly. You know, here at ij, we sue the government a whole lot.

[Kevin Ball]

So that's one thing you can do. We can't do that. But one thing you're doing is just suing them.

[Michael Soifer]

Okay, well, you know, frankly, if you want to be a plaintiff in a public interest lawsuit, well, you can reach out to IJ or you can reach out to other organizations that. That certainly would be happy to represent you. And I do think the perspectives of people in the tech industry as parties, as plaintiffs in public interest litigation would really be valued, because sometimes people assume that tech likes tech and everyone kind of favors the rollout of new tech that's tracking you everywhere you go. And people in the tech industry don't actually care about that.

[Kevin Ball]

I will say the people I know who are the most paranoid around things like web tracking, search engines, what's available online are people who have worked in search engines or other things. Like, they know and do not like it. But. Okay, wait, I want to go on that a little bit more because you say that, okay, you could be actually. What are the words you use?

[Michael Soifer]

Like, be the plaintiff in public interest litigation.

[Kevin Ball]

Okay. A plaintiff in public interest litigation. I have no idea what that actually entails. Like, I know high level. That's like, okay, the case is on my behalf in some way. But, like, what does that mean? What would somebody actually go through what becomes public about them if they choose to do that?

[Michael Soifer]

Yeah. So that's the crazy thing, is that there are trade offs between maintaining your privacy and bringing these cases publicly. And I'm hugely grateful to our Norfolk clients, who are very private people, but have put themselves out there for public examination. Now, you know, we've been able to protect their privacy to a great extent. The defendants in our case actually asked for all sorts of invasive discovery about them. So it wanted, you know, like, all of their social media, all of their cell site location information. It wanted them actually to keep a log of everywhere they went and everywhere they saw, a period of five months. And the court said no to all of that. The court thought that that was ridiculous and irrelevant. So thankfully, we were able to preserve that. But, I mean, you do come in for pretty invasive discovery as a plaintiff. At the same time, you get to have your views known. You get to make it clear that you find this form of surveillance disturbing, unsettling. But I'll say, you know, you don't have to become a party to a case. You don't have to sue a city or police department, whatever it is, to make your views known. There are lots of other ways to influence public policy. Even in litigation, you can file amicus briefs.

[Kevin Ball]

What is that for all of us who are not legal folks sure.

[Michael Soifer]

So an amicus cure is a friend of the court. And you can file a brief that sort of gives the court your distinctive point of view. And in many cases that involve technology, frankly, companies and people who work in the industry will file briefs with the court to kind of give them better perspective on technology. In, you know, these cases that involve privacy will oftentimes hear from privacy scholars. And those things are very helpful to courts, frankly, which might not have a nuanced understanding of privacy, research of technology, and where the parties might not have that level of understanding in many cases.

[Kevin Ball]

Well, that gets to. I think one of my core frustrations in general with regulation around technology is it if you read any of it, you're like, this was clearly written by people who have no clue about how this actually works. So being able to share knowledge of like, hey, I've been deep diving in this industry for 20 years or whatever it is, and let me actually try to explain it in that way seems valuable. How does that, like, do you have, like, a request out? Like, in our world, it was like, request for comments. Is there a request for amicus briefs of like, oh, we're in this case, we need this set of expert opinions? Or is it something individuals go and find cases that are ongoing? Or how does that work?

[Michael Soifer]

It kind of works both ways. You know, I'll say in litigation, just generally speaking, the parties will often reach out to people that they want to weigh in. You know, it can be for any set of cases, like a pretty known set of characters. It can be looking for other people. Sometimes people reach out in cases they're interested in and ask the parties, like, hey, can I file a brief that expresses this view or provides this information or that sort of thing? And obviously I should just put out there that, like, the litigation process isn't the only way to influence regulation of these things. Like, you can also talk to your state legislators. You can also talk to local leaders, city council members. You can talk to the media, you can write op eds, you can do all sorts of things that influence public policy without having to enter the fray in a lawsuit for sure.

[Kevin Ball]

And like, I think folks tend to underestimate how impactful they can be locally. Having dabbled a little bit in local stuff, like, if you show up to a city council meeting, I live in Mountain view. There's like 100,000 people who live here. Or so I'll show up and I'm like one of 20 people. If I give comment, like, that is substantial. People notice sometimes there's contentious things and there's many more people. But your ability to impact a local legislature is large.

[Michael Soifer]

Yeah. And I mean, oftentimes people don't even know what's going on with their local legislatures or even their state legislatures. And it can be difficult for people to figure out how to get their comments in. You know, you may not be able to appear by zoom. It might be during hours when you have to be working. It's very hard. And so when you're interested in an issue, just reaching out can often have an outsized impact, especially at the local and state level, where they may not at times be hearing as much from people. And oftentimes, you know, when it comes to policing issues and surveillance issues, on the one side, you have police who feel very strongly about this. You might have a private company that has skin in the game and is lobbying really hard. And then on the other side of the balance, you might have no one, because it's kind of an intangible. Right. And people might not realize how much it's slipping, May not realize that they need to show up, and may not realize how tilted the balance in the legislative process is towards police and private industry.

[Kevin Ball]

If someone wanted to know what is my city's take on this? Or what is my state doing here? I'll use myself as an example. I'm in mountain view, california. I want to know what is my city council saying about flock cameras or license plate readers or what have you. Where would I go?

[Michael Soifer]

If you Google plate privacy project IJ has a website that gathers a lot of data about flock cameras in various localities. We've gathered a lot of information from places that have flock transparency portals. We also link to a website called deflock, that's d. E flock me, which shows locations of flock cameras. And those are all great ways to find out whether you have the cameras in your community where they are. It can be hard to figure out if there is action at any given point in time. The best you can really do is google it, search the news, what have you.

[Kevin Ball]

Ooh, I'm feeling good now. I just looked and my city is a blank spot and surrounded by bubbles. All right, good job, Mountain view city council or something.

[Michael Soifer]

Yeah, yeah, mountain view, I guess. Unless they're just not mapped there. But maybe mountain view cares about your privacy a lot more. Ironically, as we've seen people. Well, I'll put it this way. Oftentimes we hear from flock that people are afraid of what they don't understand, and if they understand the technology more, they'll be less worried about It. And what I've seen is just the opposite is true. Oftentimes, these systems rolled out, like I said, without city council oversight, without much fanfare. The cameras just go up, and they can be hard to notice. They're pretty discreet. So many people might miss them. But as people have become aware of them, there has been huge backlash in many places. And many communities remove their cameras. And it's always surprising to me seeing, you know, some small town way out there that had a car break in, like, six years ago installing five, six, seven flock cameras. And people rightly question if that's even necessary and if there's, you know, sufficient offsetting benefit to give up their privacy in that way and to have their movements logged in this enormous database.

[Kevin Ball]

Yeah, no, it is fascinating, and I am going to recommend this site because I'm digging. I'm looking at it as we're talking. There are a couple cameras I found somewhere in my city. They do appear to all be in intersections that I actually could well be just traffic. They're bad intersections. Like, they're doing traffic light monitoring. I don't know. But, yeah, it's. You can dig in. Some cities look like you can just see the density, and it's wild.

[Michael Soifer]

Yeah. In many places, it's really crazy. In Norfolk, I mean, they have 176 cameras now, and they're concentrated along main thoroughfares at intersections. And so if you're trying to get anywhere in the city, like, you will pass those cameras, you will be at an intersection where there's an array of four cameras that can tell which way you turned and which direction you're going in. We had an expert who's a professor of applied mathematics, create a simulation of 15,000 realistic routes across the city and try to assess what you could tell about those routes using the cameras. And lots of routes. The majority of routes will pass at least two cameras such that you can connect the dots and pretty much figure out the route a person took. Some routes you could reconstruct, like almost the entirety of the route. And there were lots of areas within Norfolk where many of people's trips could be reconstructed in that way to a really disturbing extent.

[Kevin Ball]

Yeah. No, this is fascinating. And I am already imagining, like, even just showing up to your city council and asking, what are your policies on this? What is going on with this? Because I bet a lot of the city council members have not thought very much about it.

[Michael Soifer]

Yeah, I mean, there's often very little oversight. The police department might come up with its own policy. That policy may or may not be posted somewhere that's publicly available. And, you know, the city council might not have much oversight over it. And I think it's time for people to ask hard questions about who has access. Do we need every single officer to have access? Do we need them to have access to all of the data in the database to do their jobs? What are we telling them about when they can search the database? You know, how much guidance are you giving to an officer just saying, oh, only use it for law enforcement purposes? Is it really a lot of guidance? And isn't a great limit on when officers can use it? How much information is it collecting? How long is it being kept? How is it being used? And then a really important question is, what oversight is there? So to give you the example, in Norfolk, we found out that they didn't conduct any audits for two years. And so whenever there's a scandal involving officers searching flock's database for impermissible reasons, Flock always points to the fact that, oh, well, we give all of our customers access to this audit tool that they can use, and it's really their job to oversee how their officers are using the system. And all that means is you can download a spreadsheet that gives you the reasons that your officers are searching the system, but someone actually has to look at that, and someone actually has to audit it. And what we found out in Norfolk is that no one audited it for two years. And even then, you know, in many cities, the vast majority of the reasons that officers will give for their searches, as has been seen in many, many different news articles, are extremely vague. They're things like law enforcement investigation, that sort of thing. Virginia now requires slightly more detailed rationales. But unless someone is, you know, really rigorously auditing the data, not just doing kind of a box checking exercise of, did you put a reason? Does it pass the smell test? There's going to be so much misuse of these databases that's just kind of flying under the radar. So the example I always give is there were two police officers in the Wichita, Kansas area who were caught using flock databases to stalk their exes. And one of them, he was a police chief. Actually, if you look at the reasons that he put for his searches, they all look facially legitimate. There are things like missing person, drug investigation, that sort of thing. And so unless someone is really taking a hard look and spotting that this officer is doing a lot of searches there for this specific license plate and like digging into what that license plate is, you're not going to catch that sort of misconduct. And I just don't think there is that level of oversight anywhere, frankly, over these data.

[Kevin Ball]

Well, that kind of gets me to another question related to this, which is one of the things that's standing out to me through this conversation is this is likely to, at least for the foreseeable future, be a very locality by locality type of situation. The pace at which anything is going to be decided at a federal level is going to be slow. It is likely to be overly specific. Apply to, for example, maybe it just applies to flock cameras, but then the next generation of technology changes. So if, if folks are looking at this at a local level and saying, hey, I'm willing to go and make a stink at the city council, which I cannot advocate enough because I have done that. I have been that person. City council, school boards, they actually kind of listen to you because they don't get yelled at by very many people, unlike Congress people who are used to being yelled at. But is there a model to point to where you can say, oh, you know what? This is what responsible use of these tools looks like? Because I mean, I live in neighborhoods that there's a lot of people who are safety concerns. They might say, yeah, we want responsible use. We don't want to get rid of this stuff. But like, we do want an audit trail. We want observation. We want something that makes sure they're being used for the right purpose. So is there a model out there like a municipality or state that's doing this? Well, that somebody could say, hey, you don't need to reinvent the wheel, just go look at them.

[Michael Soifer]

So I love New Hampshire, which Requires deletion within 3 minutes unless there's a hot list alert that's probably not feasible all across the country. And you know, there are valid and helpful uses of these license plate readers to kind of flag stolen cars or in the wake of a robbery, to be able to go look up an image quickly and get a lead that way. And the point is really to balance that against the invasion of ordinary law abiding people's privacy. So at IJ on our Plate Privacy Project website, I referenced it earlier, we have a model bill called the PEEPS act and the acronym is Protecting everyone from excessive police surveillance. It's primarily intended to limit the use of license plate readers, but it's a little bit broader than that. And it does cover other police surveillance technologies and would iterate over time as new technologies come online. But it has a lot of the components that we've been talking about. You know, data minimization, warrant requirements, access restrictions, audit requirements, genuine audit requirements, having someone actually look at the data skeptically, and disciplinary requirements for officers who violate the law.

[Kevin Ball]

Yeah, I'm looking at it now. So scanning this, it looks like it's largely aimed as a model bill for state level legislatures. But one could point to that if you had a city that was interested or something like that as well.

[Michael Soifer]

Of course, yes.

[Kevin Ball]

Fascinating. Well, certainly I now have a bee in my bonnet. I want to go and talk to some of the folks in my city about this. Are there any things we haven't talked to about this that you think would be important to talk about before we wrap up today?

[Michael Soifer]

I don't think so, but I just underscore that license plate readers are really just the start of a new era of big police surveillance. Police using all sorts of tools, all sorts of data to build massive dossiers about people just in case they need them. Right. And we've seen in recent years police buying data from data brokers, police maybe even using data from data leaks, police investing in surveillance technology. And that's just kind of inconsistent with this country's tradition of limiting police surveillance, of letting people live their lives free from the suffocating atmosphere of police surveillance if they're not doing anything wrong. And the idea that police would be hanging onto information just in case is totally inconsistent with our constitutional order. And I would just warn people, like a lot of the attention right now, and rightly so, is on the misuse of license plate reader data, of other surveillance data for oppressive immigration enforcement, or to, you know, go after women who may be going out of state to get abortions, that sort of thing. To me, those are all the symptoms, not the disease. The disease is just having this massive government surveillance. And the real way to prevent this information from being abused is not to have it in the first place and not just to trust that the government right now will not abuse it. Because as we see, these systems are set up with good intentions usually, but they're always susceptible to future abuse.

[Kevin Ball]

Well, and to point to some of the examples you said before, you don't have to mistrust the government writ large. You just have to believe that there can be bad actors.

[Michael Soifer]

Absolutely.

[Kevin Ball]

Because as you highlighted, a lot of the constraints that are already there for tech companies don't apply to government. A lot of the best practices that certainly every tech company I've ever worked at have thought about in terms of data access on all those different pieces may not be there. If you look at a Google or a cell phone company or someone else that has this massive amounts of data. They also have all these different internal policies and things to prevent bad use of data. You have double opt in. Why do you need to do this? Who actually has access to what audit trails all those other things. Even if you do think that hey police should have this type of stuff, they should have at least the same level of safeguards that we expect companies.

[Michael Soifer]

To put in place of course and they don't have anywhere near that. And the government is terrible at ensuring police accountability. One of the other areas IJ works in we have a project on immunity and accountability which seeks to get rid of all of the various doctrines that protect police and other government officials from having to face the consequences of their actions in the ways that any private party would. So really the question of who police is the police comes up and oftentimes it's no one.

[Kevin Ball]

That actually sounds like a great close. It's a good rap.