Right now, as you drive to talk of bell to put some Diebler dusted chicken nuggets on your payment plan, AA small black camera bit into a poll is taking a picture of your license plate running through in on device neural net work and upload the results in a nationwide search able database where cops from across the country and the out a odd in the newborn in the lord safety and $8.4 billion surveillance start up and went from catching package eos in the Atlantic suburbs and billing a real life Mitra map of car in America today’s video, and turn out the narrator work, work from the edge in the pipeline, in the cloud architecture.
现在,当你开车去 Taco Bell 把一些 Doritos 裹粉鸡块加到你的付款计划上时,一根杆子上安装的小型黑色摄像头正在拍摄你的车牌,通过设备上的神经网络运行,并将结果上传到一个全国可搜索的数据库,全国各地的警察以及 ATF、DHS 和这家价值 84 亿美元的监控初创公司都可以访问。这家公司从在亚特兰大郊区抓包裹小偷起家,到构建一张真实的美国汽车地图。今天的视频,我们将了解它们的工作原理,从边缘到管道,再到云架构。
Then look at the 50 year old legal exploit that makes the whole thing possible, and find out how nerds are using a olive techniques from 2003 to surveilled the surveillance.
然后看看使这一切成为可能的 50 年历史的法律漏洞,并了解极客们如何利用 2003 年的老技术来监视监视者。
It is August four teeth, NNN 84.
今天是 8 月 4 日,1984 年。
And we were watching the code reports and flock wba in in 2017 by an engineer named ga. Linley, who was frustrated that police wouldn’t look into crimes in the neighborhood if they didn’t have a license plate number, and so we out what any of us would do and built a simple, automated license plate reader and then sold it to the only organization.
我们正在观看 Code Report,Flock 于 2017 年由一位名叫加勒特·兰利的工程师创立,他感到沮丧,因为如果邻居没有车牌号,警察就不会调查附近的犯罪,于是他做了我们任何人都会做的事:建造了一个简单的自动车牌读取器,然后把它卖给了唯一会资助监控国家的组织。
While in two funda surveillance state, over some unpicked weeds, home owners associations from their flock moved up market to police departments, and today its cameras operate in the ands of communities and scanned billions of plates every month.
在资助监控国家方面,从一些未修剪的杂草上的业主协会开始,Flock 升级到警察部门,如今它的摄像头在数千个社区运行,每月扫描数十亿个车牌。
And the company even claims that its technology and solve the percent of the orca err AS state verified by the victim scientific method of massaging data to fit into the trust me benchmarks.
该公司甚至声称其技术能解决一定比例的犯罪,这一说法通过“受害者科学方法”验证,即按摩数据以符合“相信我”基准。
And the flagship camera is called the falcon.
旗舰摄像头被称为 Falcon。
And from an engineering perspective, it’s pretty clever.
从工程角度看,它相当聪明。
It’s basically at 2017 era android solar powered spy device with an LTE modem in the red night vision and the emotional trigger camera that you can zip tie anywhere.
它基本上是一个 2017 年时代的安卓太阳能间谍设备,带有 LTE 调制解调器、红色夜视和运动触发摄像头,你可以用扎带固定在任何地方。
But instead of Ben video to the cloud, the falcon runs machine learning inference at the edge when a Ctrip, the motion sensors and indeed model LMSSSSTT flag calls a vehicle fingerprint by classifying the mac model color dance runs reflex and a baby on board sticker that tells the world you don’t use the of them.
但 Falcon 不是将视频发送到云端,而是在边缘运行机器学习推理,当运动传感器触发时,一个模型会标记车辆指纹,通过分类品牌、型号、颜色、车灯、反射和“车上有宝宝”贴纸(告诉世界你不使用转向灯)来识别车辆。
This is why the system still works when they played, is missing or covered, because police can query for a Tesla Model three what they run.
这就是为什么当车牌丢失或被遮挡时系统仍然有效,因为警察可以查询一辆特斯拉 Model 3,加上他们开的什么车。
Paul, 2000 na bumper sticker and get your car only the images and structured meditate, get shipped over LT, E, two flags cloud, which keeps span with low, and a Luna cheap enough to deploy by the thousands from there.
加上 2000 年代的保险杠贴纸,就能找到你的车。只有图像和结构化元数据通过 LTE 发送到 Flock 云,这保持了低带宽和足够便宜的部署成本,可以成千上万地部署。
Every car that drives by becomes a Rolen database that is constantly compared against hot list for things like a len, an vehicles Embro ert.
每辆经过的汽车都成为一条滚动数据库记录,不断与热名单进行比较,比如被盗车辆、通缉犯等。
And when they wanted car roles PaaS the camera.
当被通缉的车辆经过摄像头时。
And every cop in the area gets a push notification, like a weird or willing in game of Pokemon go.
该地区的每个警察都会收到推送通知,就像玩 Pokémon GO 时遇到稀有精灵一样。
But you can get to a billion dollar valuation and selling a few cheap old android boxes.
但你不可能通过卖几个便宜的旧安卓盒子达到十亿美元估值。
What’s really valuable is the data they’re aggregated and scan on its own.
真正有价值的是他们聚合和扫描的数据本身。
And then they play with the time camp, but with billions of San stitch together, they know where you sleep, where you work, who you visit and which parking lots you cry on.
然后他们利用时间戳,将数十亿次扫描拼接在一起,他们知道你睡在哪里、在哪里工作、拜访谁,以及你在哪个停车场哭泣。
And because departments can opt into nationwide sharing a deputy, and in the town of a lot, people can Carry that history across all 50 states.
由于各部门可以选择加入全国共享,一个在人口众多小镇的副警长可以跨所有 50 个州携带这段历史。
Now you’re probably wondering how any of this is legal.
现在你可能想知道这一切怎么合法。
And the answer is an unpacked exploit in the American legal system called the third party doctrine.
答案是美国法律体系中一个未公开的漏洞,称为第三方原则。
And the 1070 of the Supreme Court ruled that once you voluntarily hand your data to a third party, you no longer have a reasonable expectation of privacy.
1970 年代最高法院裁定,一旦你自愿将数据交给第三方,你就不再拥有合理的隐私期望。
He said. The government doesn’t need a warrant to get it.
他说。政府不需要搜查令就能获取它。
That was finding the seventies, but today it creates A Op le where the government government circumvented the Fourth Amendment by subscribing to assets where the dashboard is a dragnet and the only thing standing between the database and abuse and an input field in work cops, right in the reason for their search.
那是 70 年代的裁决,但今天它创造了一个漏洞,政府通过订阅服务来规避第四修正案,仪表盘就是一个拖网,唯一阻止数据库被滥用的东西是警察输入搜索理由的输入框。
But it turns out the honor system doesn’t stal very well.
但事实证明,荣誉系统并不太可靠。
Last year, and Ida H. Sheriff un, his wife license played more than 700 times and three months using test as a reason in audit in linos, caught local cops running searches for federal immigration agents with immigration as the reason, and they can, as police chief for an as extra friends, played 164 and the new boyfriend as the four times, and they assume that wasn’t foreign embryo t stop.
去年,爱达荷州一名警长用“测试”作为理由,在三个月内查询了妻子的车牌 700 多次。伊利诺伊州的审计发现当地警察以“移民”为理由为联邦移民机构进行搜索。堪萨斯州一名警察局长查询了一位朋友的车牌 164 次,以及新男友的车牌 4 次,他们假设那不是为了交通拦截。寻求帮助吧。
Get some help about the backlash is growing.
寻求帮助吧。反弹正在增长。
Austin and Evanston voted to ripped their cameras entirely and and they lost it in Virginia or used.
奥斯汀和埃文斯顿投票决定完全拆除摄像头,弗吉尼亚州也失去了它们或已停用。
This is exactly the drag at the forth amendment was supposed to prevent.
这正是第四修正案本应防止的拖网式监控。
But flock doesn’t seem to worried because it’s busy expanding into gunshot detecting microphones to frame and the entire law enforcement operation system called flag.
但 Flock 似乎并不担心,因为它正忙于扩展到枪声检测麦克风,以及整个执法操作系统,称为 Flock OS。
Oh, it even had a partnership with Amazon ring that would let cops request dorma footage through flock platform that isn’t tell ring ring a creepy super blade.
哦,它甚至与 Amazon Ring 合作,让警察通过 Flock 平台请求门铃摄像头 footage,这难道不让 Ring 显得更 creepy 吗?
And it had a AI to find lost dogs.
它还有一个人工智能来寻找走失的狗。
And the backlash was bad, that they had to dump block within a week.
反弹非常严重,他们不得不在一周内放弃该合作。
But it’s not all bad news because nerds are fighting fire with fire, with a project called deflation and open source data and the intros down the location of tens of thousands of flock cameras across the country.
但并非全是坏消息,因为极客们正在以火攻火,有一个名为 DeFlock 的开源数据项目,记录了全国数万个 Flock 摄像头的位置。
It was started by a software engineer named will eem, and it notice the camera s pop up all over Alabama, and it had annoy that nobody could tell them where they were or who approved them.
它由一位名叫 Will 的软件工程师发起,他注意到阿拉巴马州各地出现了摄像头,并且感到恼火,因为没人能告诉他它们在哪里或谁批准了它们。
And so we built a map himself on top of open street map, and the open source community of the rest.
于是他自己在 OpenStreetMap 上构建了一张地图,开源社区完成了其余部分。
In fact, Fock was so impressed by this community effort that their lawyers sent three male season desist, for which he responded by saying, no, it’s component to know.
事实上,Flock 对这个社区努力印象深刻,以至于他们的律师发送了停止和终止信,他回应说:“不,这是公众有权知道的。”
We have people out there still finding the cold, light, light code rabbit, the sponsor of today’s video.
我们还有人在外面寻找冷光、光代码兔,今天视频的赞助商。
They got tired of seeing me make new videos and the expo heading in the pines every week.
他们厌倦了看到我每周制作新视频和在松树里曝光。
So they just launched code Ababa security and provide continuous code security.
所以他们刚刚推出了 CodeRabbit Security,提供持续代码安全。
And it powered by actual reasoning, instead of brutal reggae rules that their security agents are designed to think like an attacker in order to hunt for real vulnerabilities across your entire code, ase, that the prioritized actual risks based on real baby exploitation and blast radius.
它由实际推理驱动,而不是残酷的正则规则,他们的安全代理被设计成像攻击者一样思考,以便在整个代码库中寻找真正的漏洞,根据实际可利用性和爆炸半径优先处理实际风险。
And it explains the problem to you and plain English, and suggest a fix you can approve and merge from the depths rabbi curies across every pr before merge.
它用简单的英语向你解释问题,并建议一个你可以批准和合并的修复方案,从每个 PR 合并前的深度审查中。
And you can also schedule deep scans across your four code base to protect your back door and for the and get get the code base and expand for free today at the link below, this has been the code report.
你还可以安排对整个代码库进行深度扫描,以保护你的后门,并免费扩展代码库,点击下方链接。这就是 Code Report。
Thanks for watching, and I will see you in the next one.
感谢观看,我们下期再见。