South Korea: Is Total Surveillance Inevitable?
May 26, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
I read “Police Plan to Require Cases Opened, Investigated Same Day for All Stalking Reports” about a somewhat interesting policy. Note that the article is about a law enforcement approach in South Korea, not the United States. Before looking at the write up, I want to define stalking as I understand it. Stalking means the behavior of a person who watches, follows, or monitors another individual. The behavior is not a one off; the stalker evidences a pattern of intentional activity. The person stalked realizes something is amiss and then behaves in an out-of-character way; fear of leaving work or an apartment. I want to point out that stalking using social media is a go-to service for some bad actors. Monitoring posts, planting an Apple-type tracking device, or just hanging out in the hopes of spotting the target through a window provide a stalker with tools that Jack the Ripper could not have imagined without the help of AI.
Thanks, MidJourney. Good enough.
So what’s the policy shift?
The write up makes clear:
The [South Korean national] police plan to require cases to be opened and investigated the same day for all stalking reports…
This is a going to be difficult. Stalking, particularly online stalking, is one of the cyber crimes that is in high-growth mode. GenZ criminals may not realize that their doom scrolling and Instagram habits can freak out people if the stalker’s actions are detected. That means there will be a steady increase in the number of stalking cases reported to the police in South Korea.
Second, the idea that “all” stalking cases have to be investigated the day a case is opened. The killer is the “all”. The number of police, regardless of country, is finite. At this time, the law enforcement officers without whom I interact have made it clear that their case loads are increasing. One US cyber crime investigator told me that a job with a policeware vendor was in his future. “I’m burned out,” he said.
Third, as if the “all” was not enough and probably impossible as most “real news” categorical affirmatives are, a law enforcement officer has to initiate an investigation the same day it is “opened.” That’s great if there are officers with slack time. How often does that happen?
I understand the policy. I have no problem with implementing it as long as the investigating officer has time the day the case is opened.
But I want to take this policy in a different direction.
In my opinion, “all” and “same day” will not be what happens. In some cases, the gap will lead to a victim’s suffering serious harm. If crimes continues to rise (particularly the online social media variety), the policy will be wonderful on paper, but in real life, not so great.
The logical solution, in my opinion, is total surveillance. Here’s why:
- A Palantir-style “seeing eye” allows online access to an information lake. That lake can be explored electronically; thus, this type of policeware makes the South Korean policy possible
- Since stalking is one of the online crimes that is in growth mode, the use of total surveillance makes sense. Why roll a vehicle with two or more people to look for a shadow figure? Why use existing cyber investigative tools when more sophisticated systems provide a better way to spot a signal? Therefore, money will be allocated to amp up existing policeware service procurement.
- Only a total surveillance solution can cope with the same day requirement. Any other type of approach introduces delay and hence a policy failure. That means the head of the police will be subject to administrative review. This is not a positive step in a senior officer’s career in my experience.
Net net: South Korea’s stalking policy may set the country on a path that leads to “total surveillance.” I may be wrong. I hope I am. But the risk seems high that administrative machinery will roll directly to this type of solution. Crime is a big problem, and it is getting bigger boosted by — what else? — smart software. Bad actors use bots / agents to do the heavy lifting. Law enforcement is working to catch up. That is why the “same day” phrase is a key signal.
Stephen E Arnold, May 26, 2026
BAIT Does Not Attract the UK Fish
May 25, 2026
Is American big tech becoming a bit of a problem in the UK? Probably not, some of the BAIT folks would say. BAIT is my jargon for big AI tech. Perhaps “attitude” may be more of an issue? The do-what-we-tell-you approach may be unpalatable in some countries. After working in the UK on a number of projects over the years, in my experience saying “excuse me” when someone steps on your shoes indicates a different mental approach that stepping on a person’s toe and snarling excuse me at the individual whose 10 pound shoe shine has been besmirched.
Thanks, Midjourney. I did not know knees could speak. Good enough, of course.
I noted a BBC report a couple of weeks ago. The story “Millions’ Of Pounds Saved By Replacing Palantir Tech In Refugee System” suggests that the Palantir Technologies Tolkien infused intelware was not working for The Homes for Ukraine. That group replaced Palantir’s seeing stone with software designed by its own team. What began as a free service morphed into a US government procurement scale invoice.
Instead of paying the bill, the Ministry of Housing, Communities, and Local Government (MHCLG) said its new in-house system was equipped to handle high standards of security and was more flexible. The BBC pointed out that is was proud to have supported the project and helped to resettle 157,000 refugees displaced from the Russia “special operation.” The decision to step away from Palantir was celebrated:
“That message may be particularly welcome to those who have criticized Palantir and its contracts across UK public services – including with the NHS, the Ministry of Defense (MoD), the Financial Conduct Authority and 11 police forces. Some argue the firm’s success is because its tech is badly needed and works well. But others contend Palantir’s involvement with US immigration enforcement and Israel’s military, as well as the beliefs of its two most prominent founders, make it an unsuitable partner. There are also concerns the UK is relying too much on large US tech suppliers.”
On May 22, 20266, the Guardian online service published “Palantir Hits Back at Sadiq Khan after £50m Contract with Met Police Blocked.” The article reported:
Palantir has accused Sadiq Khan of “putting politics above public safety” after the London mayor blocked its £50m contract with the Metropolitan police in a move that has also led to tensions inside Labor over its involvement with the US tech company. Louis Mosley, who heads Palantir in the UK and Europe, accused Khan of politicizing procurement after he rejected a two-year deal for Scotland Yard to use AI to process intelligence in criminal investigations, as first revealed by the Guardian. Mosley said: “What Londoners value is not being mugged, not being raped by a serving police officer.”
According the the article, Palantir has been raising the hackles of some in the UK. Here’s how the Guardian presents Palantir’s sales suavity:
Last year, when the company’s chief executive, Alex Karp, was challenged that “Palantir kills Palestinians” in Gaza, he said: “Mostly terrorists, that’s true.” Khan’s stance puts him at odds with the UK government which has a £330m NHS England deal with Palantir and a £240m deal with the Ministry of Defense.
Instead of beating the anti-BAIT tambourine, the article presents this:
Ministers say they are aware of the need for less reliance on foreign AI companies as the technology becomes increasingly applied in the delivery of public services. Kyle said: “We need to have more British AI companies that can do those kinds of things, which is why I’ve taken equity stakes in British AI firms and British tech firms, so that we can scale them up much, much faster.”
I think this is part of the “pardon me” offered by the person who is looking at a ruined shoe shine. The polite phrase does not mean, “Hey, you baseball-cap wearing American, I am at fault.” Nope, the excuse me means that the rude oaf is a social menace. But it sounds nice, doesn’t it?
Stephen E Arnold, May 25, 2926
Check a Date with Epstein Epstein Epstein
April 17, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
I have not been thinking about Epstein Epstein Epstein. Other matters have occupied my mind. Surprises happen. Melania Trump gave a talk. Almost immediately links flowed to me via my newsfeed. One caught my attention.
You can fiddle around with what’s called Epstein’s calendar. He has no open dates as far as I can tell.
There’s an expression that says “idle hands are the devil’s playthings.” If that’s the case than idle time is the Internet prankster’s best friend, because just for sillies and giggles they decided to replicate Jeffrey Epstein’s calendar from the past twenty years.
Newsweek has the story about Epstein’s fake online calendar: “The People Who Cloned Epstein’s Email Have Done The Same With His Calendar.” These pranksters already replicated Epstein’s email account, now they’ve released a cloned version of the convicted sex offender’s calendar released from the US Department of Justice.
Here are the responsible parties:
“Riley Walz, a noted online prankster, and Luke Igel, the cofounder of the AI video-editing tool Kino AI, created Jmail. This time around, Matheus Mendes, a Swedish software engineer, has been credited for building Jcal using Reducto, a document intelligence platform for turning unstructured docs into data.”
Here’s what you can use the calendar for and how:
"The calendar’s various appointments give an indication of where he was at any given time, who he met with and how regularly these meetings took place. It also offers unique insights into his day-to-day activities that might have otherwise gone unnoticed.”
The calendar does have a risk of error. Every event comes with a reliability percentage rate that indicates the likelihood of the event taking place based on an email (that is also clickable).
The people behind the calendar also created JeffTube, a YouTube spoof with 1,083 files from the DOJ files. Censorship is alive and well where Russian financial transactions and Epstein Epstein Epstein are the subjects. It seems that 134 of those videos were removed because of questionable content, although they can still be accessed through the DOJ’s website. Epstein Epstein Epstein is just as disturbing as losing a source of hand-fabricated rugs.
Whitney Grace, April 17, 2026
Social Links: A Fraud Fighter
March 27, 2026
Another dinobaby post. No AI unless it is an image. This dinobaby is not Grandma Moses, just Grandpa Arnold.
Ivan Shkvarun is the CEO and founder of Social Links. Years ago, I would have described this system as “policeware.” Today many non-law enforcement and intelligence professionals want to integrate disparate data. The firm’s current positioning strikes me as providing open source intelligence with a dashboard and modules. The purpose of the system is to protect an organization from AI threats. That’s a modern positioning. Specialized software firms have to find a way to explain their product in a very short, snappy elevator pitch.
An online publication called Pulse2 interviewed Shkvarun in, “Social Links: Interview With Co-Founder & CEO Ivan Shkvarun About Fighting AI Fraud.” I learned that Mr. Shkvarun is dedicated to building tools that can verify and assess information. The origin story of Social Links was a deepfake video of former President Obama that zipped around the Internet in 2017. Social Links was built to restore people’s trust in data. Social Links’s product line includes AI Defender, a modern digital risk platform.
Shkvarun was asked how his work has global impact:
“ ‘If we look at the rise of software-as-a-service two decades ago, SaaS initially represented only a marginal share of the global software market. The transformation that followed was not driven by explosive growth in overall IT spending, but by a shift in how value was created and delivered. Over roughly fourteen years, SaaS expanded from approximately 2% of the market to more than half, fundamentally reshaping the industry.’
He adds:
‘Artificial intelligence now sits at a similar inflection point. Today, the global software and IT services market is estimated at around $10 trillion, while AI represents only a fraction of a percent of that total. Even under conservative assumptions, AI-driven revenue could exceed $12 trillion within the current decade.’”
Social Links includes functions that help a licensee deal with fraud. Payment fraud can generate substantial revenue for a bad actor. Continuous effort is required to cope with the problem. What makes Social Links different from other companies is its expertise, positioning, and strategic focus. The company continues to grow while maintaining a devoted customer base because it delivers trustworthy and reliable products.
The companies relies on webinars to showcase its interface and the system’s functionality. If you scout around, you can sign up for a webinar.
Whitney Grace, March 27, 2026
Explaining Graykey: Helpful or Harmful for Law Enforcement?
November 25, 2024
I am not keen on making some “secrets” publicly available. Those keen on channeling Edward Snowden may have glory words to describe their activities. I take a different view: Some types of information should be proprietary and made known only to those engaged in trying to enforce applicable laws. That said, I want to point to a Reddit.com post about “privacy.” The trigger for the post is an article behind a paywall about a device used to extract information from a mobile phone.
The Reddit post provides a link to the source document “Leaked Documents Show What Phones Secretive Tech ‘Graykey’ Can Unlock”. That write up is typical of non-LE and intel professional reactions to certain types of specialized software and hardware.
What I want to mention is that the Reddit post provides some supplementary information which is not widely known and generally not bandied about outside of certain professional groups. You can find this post, the links to the additional information, and some commentary to disambiguate the jargon used to keep chatter about specialized products and services within a “community.” Here’s the link to the Reddit information: https://shorturl.at/KsDwc
To be frank, I miss the good old days when information of a sensitive nature did not become course material for a computer science and programming class or a road map for outfits competing with US firms. But I am a dinobaby. Believe me, no one cares about my old-timey thoughts.
Stephen E Arnold, November 25, 2024
Surveillance: Who Watches What, When, and Who?
September 18, 2024
Here is an interesting resource: Surveillance Watch compiles information about surveillance tech firms, organizations that fund them, and the regions in which they are said to operate. The lists, compiled from contributions by visitors to the site, are not comprehensive. But they are full of useful information. The About page states:
“Surveillance technology and spyware are being used to target and suppress journalists, dissidents, and human rights advocates everywhere. Surveillance Watch is an interactive map that documents the hidden connections within the opaque surveillance industry. Founded by privacy advocates, most of whom were personally harmed by surveillance tech, our mission is to shed light on the companies profiting from this exploitation with significant risk to our lives. By mapping out the intricate web of surveillance companies, their subsidiaries, partners, and financial backers, we hope to expose the enablers fueling this industry’s extensive rights violations, ensuring they cannot evade accountability for being complicit in this abuse. Surveillance Watch is a community-driven initiative, and we rely on submissions from individuals passionate about protecting privacy and human rights.”
Yes, the site makes it easy to contribute information to its roundup. Anonymously, if one desires. The site’s information is divided into three alphabetical lists: Surveilling Entities, Known Targets, and Funding Organizations. As an example, here is what the service says about safeXai (formerly Banjo):
“safeXai is the entity that has quietly resumed the operations of Banjo, a digital surveillance company whose founder, Damien Patton, was a former Ku Klux Klan member who’d participated in a 1990 drive-by shooting of a synagogue near Nashville, Tennessee. Banjo developed real-time surveillance technology that monitored social media, traffic cameras, satellites, and other sources to detect and report on events as they unfolded. In Utah, Banjo’s technology was used by law enforcement agencies.”
We notice there are no substantive links which could have been included, like ones to footage of the safeXai surveillance video service or the firm’s remarkable body of patents. In our view, these patents represent an X-ray look at what most firms call artificial intelligence.
A few other names we recognize are IBM, Palantir, and Pegasus owner NSO Group. See the site for many more. The Known Targets page lists countries that, when clicked, list surveilling entities known or believed to be operating there. Entries on the Funding Organizations page include a brief description of each organization with a clickable list of surveillance apps it is known or believed to fund at the bottom. It is not clear how the site vets its entries, but the submission form does include boxes for supporting URL(s) and any files to upload. It also asks whether one consents to be contacted for more information.
Cynthia Murrell, September 18, 2024
Is This Incident the Price of Marketing: A Lesson for Specialized Software Companies
April 12, 2024
This essay is the work of a dumb dinobaby. No smart software required.
A comparatively small number of firms develop software an provide specialized services to analysts, law enforcement, and intelligence entities. When I started work at a nuclear consulting company, these firms were low profile. In fact, if one tried to locate the names of the companies in one of those almost-forgotten reference books (remember telephone books), the job was a tough one. First, the firms would have names which meant zero; for example, Rice Labs or Gray & Associates. Next, if one were to call, a human (often a person with a British accent) would politely inquire, “To whom did you wish to speak?” The answer had to conform to a list of acceptable responses. Third, if you were to hunt up the address, you might find yourself in Washington, DC, staring at the second floor of a non-descript building once used to bake pretzels.
Decisions, decisions. Thanks, MSFT Copilot. Good enough. Does that phrase apply to one’s own security methods?
Today, the world is different. Specialized firms in a country now engaged in a controversial dust up in the Eastern Mediterranean has companies which have Web sites, publicize their capabilities as mechanisms to know your customer, or make sense of big data. The outfits have trade show presences. One outfit, despite between the poster child from going off the rails, gives lectures and provides previews of its technologies at public events. How times have changed since I have been working in commercial and government work since the early 1970s.
Every company, including those engaged in the development and deployment of specialized policeware and intelware are into marketing. The reason is cultural. Madison Avenue is the whoo-whoo part of doing something quite interesting and wanting to talk about the activity. The other reason is financial. Cracking tough technical problems costs money, and those who have the requisite skills are in demand. The fix, from my point of view, is to try to operate with a public presence while doing the less visible, often secret work required of these companies. The evolution of the specialized software business has been similar to figuring out how to walk a high wire over a circus crowd. Stay on the wire and the outfit is visible and applauded. Fall off the wire and fail big time. But more and more specialized software vendors make the decision to try to become visible and get recognition for their balancing act. I think the optimal approach is to stay out of the big tent avoid the temptations of fame, bright lights, and falling to one’s death.
“Why CISA Is Warning CISOs about a Breach at Sisense” provides a good example of public visibility and falling off the high wire. The write up says:
New York City based Sisense has more than a thousand customers across a range of industry verticals, including financial services, telecommunications, healthcare and higher education. On April 10, Sisense Chief Information Security Officer Sangram Dash told customers the company had been made aware of reports that “certain Sisense company information may have been made available on what we have been advised is a restricted access server (not generally available on the internet.)”
Let me highlight one other statement in the write up:
The incident raises questions about whether Sisense was doing enough to protect sensitive data entrusted to it by customers, such as whether the massive volume of stolen customer data was ever encrypted while at rest in these Amazon cloud servers. It is clear, however, that unknown attackers now have all of the credentials that Sisense customers used in their dashboards.
This firm enjoys some visibility because it markets itself using the hot button “analytics.” The function of some of the Sisense technology is to integrate “analytics” into other products and services. Thus it is an infrastructure company, but one that may have more capabilities than other types of firms. The company has non commercial companies as well. If one wants to get “inside” data, Sisense has done a good job of marketing. The visibility makes it easy to watch. Someone with skills and a motive can put grease on the high wire. The article explains what happens when the actor slips up: “More than a thousand customers.”
How can a specialized software company avoid a breach? One step is to avoid visibility. Another is to curtail dreams of big money. Redefine success because those in your peer group won’t care much about you with or without big bucks. I don’t think that is just not part of the game plan of many specialized software companies today. Each time I visit a trade show featuring specialized software firms as speakers and exhibitors I marvel at the razz-ma-tazz the firms bring to the show. Yes, there is competition. But when specialized software companies, particularly those in the policeware and intelware business, market to both commercial and non-commercial firms, that visibility increases their visibility. The visibility attracts bad actors the way Costco roasted chicken makes my French bulldog shiver with anticipation. Tibby wants that chicken. But he is not a bad actor and will not get out of bounds. Others do get out of bounds. The fix is to move the chicken, then put it in the fridge. Tibby will turn his attention elsewhere. He is a dog.
Net net: Less blurring of commercial and specialized customer services might be useful. Fewer blogs, podcasts, crazy marketing programs, and oddly detailed marketing write ups to government agencies. (Yes, these documents can be FOIAed by the Brennan folks, for instance. Yes, those brochures and PowerPoints can find their way to public repositories.) Less marketing. More judgment. Increased security attention, please.
Stephen E Arnold, April 12, 2024
The RCMP: Monitoring Sparks Criticism
March 5, 2024
This essay is the work of a dumb dinobaby. No smart software required.
The United States and United Kingdom receive bad reps for monitoring their citizens’ Internet usage. Thankfully it is not as bad as China, Russia, and North Korea. The “hat” of the United States is hardly criticized for anything, but even Canada has its foibles. Canada’s Royal Canadian Mounted Police (RCMP) is in water hot enough to melt all its snow says The Madras Tribune: “RCMP Slammed For Private Surveillance Used To Trawl Social Media, ‘Darknet’.”
It’s been known that the RCMP has used private surveillance tools to monitor public facing information and other social media since 2015. The Privacy Commissioner of Canada (OPC) revealed that when the RCMP was collecting information, the police force failed to comply with privacy laws. The RCMP also doesn’t agree with the OPC’s suggestions to make their monitoring activities with third party vendors more transparent. The RCMP also argued that because they were using third party vendors they weren’t required to ensure that information was collected according to Canadian law.
The Mounties’ non-compliance began in 2014 after three police officers were shot. An information monitoring initiative called Project Wideawake started and it involved the software Babel X from Babel Street, a US threat intelligence company. Babel X allowed the RCMP to search social media accounts, including private ones, and information from third party data brokers.
Despite the backlash, the RCMP will continue to use Babel X:
“ ‘Despite the gaps in (the RCMP’s) assessment of compliance with Canadian privacy legislation that our report identifies, the RCMP asserted that it has done enough to review Babel X and will therefore continue to use it,’ the report noted. ‘In our view, the fact that the RCMP chose a subcontracting model to pay for access to services from a range of vendors does not abrogate its responsibility with respect to the services that it receives from each vendor.’”
Canada might be the politest of country in North America, but its government hides a facade dedicated to law enforcement as much as the US.
Whitney Grace, March 5, 2024
Student Surveillance: It Is a Thing
March 1, 2024
This essay is the work of a dumb dinobaby. No smart software required.
Once mobile phones were designed with cameras, all technology was equipped with one. Installing cameras and recording devices is SOP now, but facial recognition technology will soon become as common unless privacy advocates have their way. Students at the University of Waterloo were upset to learn that vending machines on their campus were programmed with the controversial technology. The Kitchener explores how the scandal started in: “ ‘Facial Recognition’ Error Message On Vending Machine Sparks Concern At University Of Waterloo.”
A series of smart vending machines decorated with M&M graphics and dispense candy were located throughout the Waterloo campus. They raised privacy concerns when a student noticed an error message about the facial recognition application on one machine. The machines were then removed from campus. Until they were removed, word spread quickly and students covered a hole believed to hold a camera.
Students believed that vending machines didn’t need to have facial recognition applications. They also wondered if there were more places on campus where they were being monitored with similar technology.
The vending machines are owned by MARS, an international candy company, and manufactured by Invenda. The MARS company didn’t respond to queries but Invenda shared more information about the facial recognition application:
“Invenda also did not respond to CTV’s requests for comment but told Stanley in an email ‘the demographic detection software integrated into the smart vending machine operates entirely locally.’ ‘It does not engage in storage, communication, or transmission of any imagery or personally identifiable information,’ it continued.
According to Invenda’s website, the Smart Vending Machines can detect the presence of a person, their estimated age and gender. The website said the ‘software conducts local processing of digital image maps derived from the USB optical sensor in real-time, without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.’”
Invenda also said the software is compliant with the European Union privacy General Data Protection Regulation but that doesn’t mean it is legal in Canada. The University of Waterloo has asked that the vending machines be removed from campus.
Net net: Cameras will proliferate and have smart software. Just a reminder.
Whitney Grace, March 1, 2024
Ottawa Law Enforcement and Reasonable Time for Mobile Phone Access
February 5, 2024
This essay is the work of a dumb dinobaby. No smart software required.
The challenge of mobile phones is that it takes time to access the data if a password is not available to law enforcement. As more mobiles are obtained from alleged bad actors, the more time is required. The backlog can be onerous because many law enforcement agencies have a limited number of cyber investigators and a specific number of forensic software licenses or specialized machines necessary to extract data from a mobile device.
Time is not on their side. The Ottawa Citizen reports, “Police Must Return Phones After 175 Million Passcode Guesses, Judge Says.” It is not actually about the number of guesses, but about how long investigators can retain suspects’ property. After several months trying to crack the passwords on one suspect’s phone, Ottawa police asked Ontario Superior Court Justice Ian Carter to allow them to retain the device for another two years. But even that was a long shot. Writer Andrew Duffy tells us:
“Ontario Superior Court Justice Ian Carter heard that police investigators tried about 175 million passcodes in an effort to break into the phones during the past year. The problem, the judge was told, is that more than 44 nonillion potential passcodes exist for each phone. To be more precise, the judge said, there are 44,012,666,865,176,569,775,543,212,890,625 potential alpha-numeric passcodes for each phone. It means, Carter said, that even though 175 million passcodes were attempted, those efforts represented ‘an infinitesimal number’ of potential answers.”
The article describes the brute-force dictionary attacks police had used so far and defines the term leetspeak for curious readers. Though investigators recently added the password-generating tool Mentalist to their arsenal, the judge determined their chances of breaking into the phone were too slim. We learn:
“In his ruling, Carter said the court had to balance the property rights of an individual against the state’s legitimate interest in preserving evidence in an investigation. The phones, he said, have no evidentiary value unless the police succeed in finding the right passcodes. ‘While it is certainly possible that they may find the needle in the next two years, the odds are so incredibly low as to be virtually non-existent,’ the judge wrote. ‘A detention order for a further six months, two years, or even a decade will not alter the calculus in any meaningful way.’ He denied the Crown’s application to retain the phones and ordered them returned or destroyed.”
The judge suggested investigators instead formally request more data from Google, which supplied the information that led to the warrants in the first place. Good idea, but techno feudal outfits are often not set up to handle a large number of often-complex requests. The result is that law enforcement is expected to perform certain tasks while administrative procedures and business processes slam on the brakes. One would hope that information about the reality of accessing mobile devices were better understood and supported.
Cynthia Murrell, February 5, 2024
-
- Subscribe to Beyond Search
Feature archive
News archive
-
