Citizen Continues Its Push To Become Cops-For-Hire By Leaking Sensitive Data… Twice

Failures

from the another-confidence-boosting-PR-debacle dept

The bad news keeps coming for Citizen, the app that really wants to be a cop.

Not only is its desire to become some sort of private party/law enforcement hybrid generating it some bad press, but its prior incarnation as “Vigilante” suggests it has always wanted to be in the business of taking down bad guys, with or without the requisite lawfulness.

The former “Vigilante” proved true to its past moniker following a wildfire in California, promising a $30,000 bounty to any user or employee who took down the bad guy identified by Citizen. Well… misidentified. After calls from CEO Andrew Frame to “GET THE FUCKER,” Citizen had to offer up a bunch of apologies for turning an innocent person into a prime suspect.

Coming on the heels of all of this bad news is even more bad news. First off, as Joseph Cox reported late last week, Citizen leaked a bunch of users’ COVID-related data following its expansion into contact tracing late year under the name “SafePass.”

Crime and neighborhood watch app Citizen, which also launched a COVID-19 contact-tracing feature and broader citywide COVID surveillance program, exposed users’ COVID-related data to the public internet, allowing anyone to view specific users’ recent self-reported symptoms, test results, and whether their device had recorded any close contacts with other people using the feature. The information is directly linked to a person’s username, which often is the person’s full name.

Hacker collective Anonymous was able to access the data and pointed Motherboard in its direction. The exposure of this data runs contrary to Citizen’s security claims.

The feature’s privacy policy says that “We have specific systems to control data access, and all access is logged and regularly audited.” The SafePass website says “Data is private and encrypted” and that contact tracing data is deleted after 30 days (some of the data in the exposed cache dates from earlier than 30 days ago).

Citizen fixed its leak shortly thereafter, claiming the exposure only affected a limited number of users. But that set the stage for a larger breach and another successful hacking of Citizen’s databases.

A hacktivist has scraped a wealth of data from the crime and neighborhood watch app Citizen and posted it on a dark web site, Motherboard has learned. The data includes a huge amount of data related to 1.7 million “incidents”—events that Citizen informs users about concerning crime or perceived crime in their area—such as the GPS coordinates of where the incident took place, its update history, a clip of the police radio that the incident relates to, and associated images.

Posted with the accompanying slogan of “Fuck snitches, fuck Citizen, fuck Andrew Frame and remember, kids: Cops are not your friends.”, the data appears to contain plenty of what’s already publicly-available through Citizen’s online portal. The difference here is it’s all in one place, which makes it much easier for researchers and journalists to parse the data for patterns and analyze user behavior.

And there’s also some stuff Citizen doesn’t make available to users and site visitors in this data dump.

The list appears to include videos that have been marked for removal from public consumption on the app by Citizen’s content moderation team, with some including the tag “Moderator Blocked Stream,” according to the hacker and Motherboard’s viewing of the files. These videos are still accessible if visited with the direct link included in the scrape.

Not exactly a confidence booster, especially when the app’s founder wants Citizen to become a crucial part of the law enforcement experience, if not actually law enforcement itself. But a combination of PR blunders and data breaches sounds about par for the (government) course, so maybe this is just Citizen inadvertently laying the groundwork for its move into the public sector.

Filed Under: data breach, leaks, private law enforcement, snitching, vigilante
Companies: citizen