Whack-a-Mole: Why Banning One Surveillance Camera Company Doesn't Fix Anything

There’s a post doing the rounds on r/privacy about Flock Safety, the US company whose number-plate reading cameras have been getting ripped down in city after city amid lawsuits and public pressure, only for the same councils to turn around and sign contracts with Axon or Motorola or Rekor instead. Same technology. Same database. Same cop who can pull up everywhere your car has been in the last six months. Different logo on the box.

I read that thread end to end with the specific kind of tired recognition you get when you’ve seen this movie before. One commenter put it better than I could: they reckon the other manufacturers might be quietly grateful Flock became the lightning rod, because it lets everyone else sneak in through the smoke. Whether that’s a deliberate strategy or just how these things shake out, I don’t know. But it tracks. We did the same thing with Clearview AI a few years back, got outraged, moved on, and facial recognition kept right on getting built into shopping centre cameras and stadium turnstiles under names nobody bothers to protest.

The thing that gets me isn’t the cameras themselves, it’s the shape of the argument every single time. Someone points out the surveillance, there’s a burst of anger, a council votes to can the contract, and everyone treats it as a win. But the actual problem was never “Flock specifically.” The problem is automated number-plate recognition feeding a searchable database that police, and sometimes private companies, can query without much oversight. Banning the brand name is like quitting one cigarette company and taking up another one because the logo was less annoying.

We’ve got a milder version of this here. Victoria Police have been expanding ANPR cameras on major roads for years, sold to us as a road safety and stolen-car measure, which is fine as far as it goes. Nobody I know objects to catching stolen cars. What nobody ever really answers is how long that data sits around, who else gets to look at it, and what it gets used for once the stated purpose has been satisfied. I drive the Monash most days for work, past at least two of these rigs, and I’d wager very few people even clock that they’re there, let alone wonder where that data ends up.

Second thing from that same Reddit thread that stuck with me: a few commenters went straight to “this means revolution is coming,” and a few others, fairly reasonably, pushed back and said doom-posting isn’t a strategy. I lean towards the second group, but I get the impulse. There’s a genuine, reasonable fatigue that sets in when every privacy win turns out to be temporary, and the tech just reappears wearing a different badge a year later. The mistake is letting that fatigue curdle into “nothing can be done,” because that’s exactly the outcome the people selling this stuff are banking on. Apathy is a feature for them, not a bug.

There was a smaller story the same day about German customs police reading Signal messages, not by cracking the encryption, which nobody can currently do properly, but by tricking a linked device onto someone’s account. Classic human-layer attack, the kind that makes cryptographers want to lie down in a dark room. Signal’s encryption held up fine. The weak point was a person scanning a QR code they shouldn’t have. It’s the same lesson as the camera story, just at a different scale: the technology is rarely the only vulnerability. The systems and habits around it matter just as much, and that’s a much harder thing to legislate than a logo.

None of this means give up on fighting it. It means the fight has to target the actual capability, the data retention rules, the lack of a warrant requirement, the absence of any real audit trail, rather than the company currently wearing the outrage. Ban the behaviour, not the brand. It’s less satisfying than a viral headline about torn-down cameras, and it’s a lot more work, which is probably why it happens so rarely. But it’s the only version of this that doesn’t just reset the clock for round two under a new name next year.