First of all, what is ShotSpotter? Here's how they describe their technology & process.
Essentially, their technology wiretaps neighborhoods in an attempt to alert police in the event of a gunshot detection.
Ninety (90) U.S. cities were already using this technology as of 2017.
The primary article they're complaining about in the lawsuit against VICE dropped on July 26th and describes outright fabrication of evidence (fraud) in one specific case and suggests this may have occurred in other cases.
A seventh-grader, Adam Toledo, was killed in Chicago in March when ShotSpotter picked up a sound and dispatched Police.
As you can see by this chart, their stock price did begin to drop around the time of the article's release, and hasn't recovered.
When an issue involves a public company, I like to look at what the financial analysts have to say about the stock's trend, and what the company itself tells shareholders both in their Quarterly Earnings Calls and in their income/operating statement.
Here is a transcript of their most recent earnings call.
"Quarterly adjusted EBITDA was $2.9 million compared to $3.4 million last year."
Read: "Our revenue dropped this quarter compared to the same quarter last year
"The decrease was largely due to unbudgeted marketing and legal spend associated with addressing a 'defund the police' variant intended to falsely smear the efficacy of our real-time acoustic gunshot detection and post incident forensic services."
Read: "Not our fault"
"Although distracting this misguided effort for now appears to have had little to no impact on our short-term to medium-term revenue growth prospects."
Read: "Don't worry, even though I led with this, none of it matters, stay calm, hold/buy more of our stock)
"However, we intend to vigorously defend our long-term brand reputation and are carefully evaluating our strategic options, including legal actions going forward."
Read: "Heads up: We're going to have a spend a lot more money on lawyers to raise the stock price again."
The worst thing here is that the CEO decided to use fallen police officer Ella French's name to market his company and gain sympathy amongst the shareholders.
Here's Adam, who was 13 when he was chased and gunned down by police due to a ShotSpotter dispatch.
He had no bullets. Someone else fired the shots which were detected. Either way, extrajudicial murder should never be condoned.
We are a country of laws, and we failed Adam.
On August 24th, the Chicago nonpartisan watchdog agency, Office of Inspector General, released a comprehensive report about ShotSpotter's ineffectiveness.
"The inspector general’s office found that between Jan. 1, 2020, and May 31 of this year, over 50,000 ShotSpotter alerts were confirmed as probable gunshots, but that actual evidence of a gun-related crime was found in about 4,500 instances, or only about 9%"
NINE percent?!
Imagine dispatching police - expending limited resources - sending people armed with badges, tasers, nightsticks, and guns - to investigate a "threat" which has a 91% chance of being NOTHING.
In the world of information security, a 9% effectiveness rate would mean a complete scrapping of the detection technology in question.
No organization can AFFORD to spend that kind of time on what are essentially false positives.
When pressed about potential errors from the company’s algorithm, ShotSpotter CEO Ralph Clark declined to discuss specifics about their use of artificial intelligence, saying it’s “not really relevant.”
^^^
This topic is also relevant to #EthicsinAI! Very relevant!
65-year old Michael Williams sat behind bars for almost a year, accused of murder, before a judge dismissed the case against him last month at the request of prosecutors, who said they had insufficient evidence.
While in jail, Michael made concrete plans to take his life.
Prosecutors said ShotSpotter indicated Williams shot and killed the man.
“I kept trying to figure out, how can they get away with using the technology like that against me?” said Williams, speaking publicly for the first time about his ordeal. “That’s not fair.”
ACLU points out many problems with this opaque, non-peer-reviewed or independently-evaluated product.
"The company turned down a request by the independent security tech research publication IPVM to carry out independent tests of its methodologies."
In addition, many agencies may try to downplay or even hide their use of this technology. Most agencies do not publish a list of the automated technologies they use in the process of policing.
- There is no evidence this product works
- Evidence may be modified during the analysis process
- A false positive seems to have led to the police killing of a child
- Its effectiveness is not independently evaluated
- Chicago OIG said it doesn't work
- People are being thrown in jail on serious charges which were later dropped due to lack of evidence based on the output of this system
- Police agencies are not typically transparent on their use of this technology
- 20 to 25 microphones per sq. mi. are deployed & monitored
We've also learned that word is out about ShotSpotter's lack of effectiveness as our "criminal justice system outsources some of society’s weightiest decisions to algorithms and computer code", which they claim is a trade secret and won't reveal.
Jonathan Manes, an attorney and adjunct professor at Northwestern Law, released a report earlier this year analyzing ShotSpotter alerts. His numbers look aligned to other analyses, including Chicago OIG
Some communities have investigated ShotSpotter's effectiveness, finding unacceptably high false positive rates, and/or have decided ShotSpotter isn't worth the expenditure.
So, we know many police departments have used this technology in the last half-decade, with many deciding the data no longer justified the expenditure.
Looks like word was already out on the street about the ineffectiveness of the technology long before VICE wrote about it.
At a trial in 2017, a forensic analyst for ShotSpotter testified in court that the company’s accuracy guarantee had been invented by its marketing team.
That analyst is listed in the VICE lawsuit as one of ShotSpotter's current two forensic experts.
“Our guarantee was put together by our sales and marketing department, not our engineers,” Greene said.
“We need to give them [customers] a number,” Greene continued. “We have to tell them something. … It’s not perfect. The dot on the map is simply a starting point.”
Anyway, in the wake of all this evidence that ShotSpotter doesn't work, and leads to poor outcomes, especially in marginalized communities, here is the list of cities in which they operate.
(This is the only mention of the word "privacy" in the text)
Customers aren't allowed to disclose implementation details, including "your deployment methodology, results, or related facts"
IANAL, and again, my opinions only, but pretty sure we shouldn't be allowing these types of terms in contracts for technologies which provide policing automation.
With iOS 15, Apple has ended my ability to link two of my wireless radios to create a hotspot without interference from my wireless service provider, eliminating my choice to work from a coffee shop this morning and to use the hardware I own in the manner I so choose
I can no longer turn on the Hotspot (CONTROL MY OWN HARDWARE RADIOS) without permission from Verizon
This probably has something to do with the fact that I changed off an unlimited plan a few weeks ago, but changed back to it recently. Maybe it isn't iOS 15- it was always a problem, and I'm only noticing because I switched off an unlimited, hotspot-inclusive wireless plan.
Creating art which is then roundly enjoyed by others has helped me with perfectionism.
Intellectually, I know that ‘perfect is the enemy of good’.
Unfortunately, my standards for my own work are often far too high to encourage incremental progress & learning in public.
2/8
Part of the reason why I feel that way is because the security community is so frequently negatively judging. As this is the community I joined from a young age, it has molded my behavior to be far too constrained & limited — in direct opposition to the hacker ethos.
People who cheat & steal harm the rest of us through their actions. These “bad apples” who act in their own self-interest above the common interest tend to rely on secrecy and obfuscation in order to commit their misdeeds.
One can have privacy without secrecy. This is the model being tested in cryptocurrency now.
If you’re interested in learning about some avant-garde technical work, check out the work done by various groups to advance the concept of Decentralized Autonomous Organizations (DAOs).
It would be really cool to establish HackerDAO. I’ve given it a lot of thought, but ultimately I don’t think that it is an ‘idea whose time has come’ for the majority of folks who follow me. These ideas take time to percolate, and DAOs are still a very niche idea at present.
Have you ever wanted to drop out of infosec and become your own defensive consultant? Learn from us and our mistakes.
Some things @0xBanana and I learned running our first startup, a boutique cybersecurity consultancy 2018-2020.
A thread🧵
1/
Having lots of enterprise contacts will only get you so far.
Lg corps who have interesting infosec problems to solve typically won't hire a small consultancy unless they have a decent assurance the risk of doing so is low, and the value which will be gained will be high.
2/
Small to mid-size corps have much, much less interesting infosec problems to solve.
In this category, orgs who happen to have a budget with which to hire infosec mostly need product-focused security engineering support, and some nascent devsecops capability.
3/
“When presented with such warrant […] Australian companies, system administrators etc. must comply, and actively help the police to modify, add, copy, or delete the data of a person under investigation”
Despite all of the “intractable” problems we seem to have, for at least half of these, money gathered in service of our country and Her people, allocated carefully, is the solution.
Republicans refuse to participate in increasing taxation while claiming to be the party of limited government as justification. Excuse me, that ship sailed long ago.
For neocons, or whatever the GOP even are anymore, a small government is no longer a priority.
2/
The main priority of the GOP leadership (and a few Dem leadership as well), based solely on their actions, appears to be the acquisition & maintenance of power for power’s sake. In politics, money drives the machine, so they’ll do whatever is needed to keep it coming in.
3/