Federal judge labels Flock indiscriminate mass surveillance

A federal judge characterized the Flock surveillance system as “indiscriminate mass surveillance.” That is the confirmed fact, and the operative word is indiscriminate. Indiscriminate describes a collection behaviour that applies no selection boundary. A judicial finding at the federal level that a deployed system is indiscriminate is a statement about the system’s design, not about a single misuse event. It says the system behaves this way as built.

The characterization is a control statement. Indiscriminate means the system does not distinguish between a subject of interest and a person with no connection to any inquiry. Mass means the collection scope is broad rather than targeted. Both properties describe what the system does, not what someone did wrong with it. Neither property describes an operator error or a one-time deviation. They describe designed behaviour. The framing provided reinforces this: design flaws, overreach, and absence of privacy controls. All three attach to the system, not to its operators.

What is not confirmed is everything the input does not state. The specific data types collected are not confirmed. The volume of records is not confirmed. The retention period is not confirmed. The jurisdictions, the case particulars, the identities affected, and the technical collection mechanism are not confirmed. Treat each as not confirmed. Do not substitute general knowledge about similar systems. The confirmed inputs are two: the judicial characterization of the system as indiscriminate mass surveillance, and the framing of that system as exhibiting design flaws, overreach, and a lack of privacy controls. Everything in this assessment traces back to those inputs or it is marked not confirmed.

The observable failure is indiscriminate collection. A surveillance system that operates without a selection boundary collects on the population within its reach, not on defined subjects. The judge’s term names exactly this behaviour: no discrimination between targets and non-targets. That is the externally observable output. The system takes in people who are not subjects of any stated inquiry at the same rate and under the same conditions as those who are. That is what indiscriminate means when it is restated as a system property.

The second observable property is the absence of privacy controls. The facts state the system lacks them. A control that is absent cannot constrain anything. This is not a weak control, a misconfigured control, or a control bypassed by an attacker. The input does not describe a bypass and none should be inferred. The input describes a missing control. Absence of a control is a condition, and the condition here is that there is no stated limit on what the system collects or on whom. Where there is no limiting control, there is nothing to constrain the behaviour the judge described.

The third property is scope that exceeds any specific subject. Mass surveillance combined with indiscriminate describes reach that extends beyond a defined target set. Whether that reach exceeds a specific legal authority in a specific proceeding is not confirmed beyond the judicial characterization itself, and the particulars of that proceeding are not stated. What is confirmed is that the collection scope is broad and unselective by design, and that a federal judge named that scope as the problem. The failure is therefore not in how the system was used. It is in what the system was built to do.

The system allows indiscriminate collection, so indiscriminate collection is the result. That is the mechanism, stated as plainly as the facts allow. No privacy control is stated to exist. A system with no stated limiting control produces unconstrained output. The observable output is indiscriminate collection across the population in reach. That output matches the judicial characterization exactly, which is why the characterization and the described design are consistent rather than contradictory.

In a surveillance context, the boundary that must exist is the distinction between a subject under lawful inquiry and everyone else. The facts indicate no such boundary is enforced. Without an enforced subject boundary, every individual within collection range is treated identically to a subject. Identity is the boundary, and here the boundary is not present. That is the definition of indiscriminate restated as a control failure. The system does not fail to apply a boundary occasionally. It applies none, because none is stated to exist.

Privacy controls are the layer that would constrain collection against a defined scope. The facts state that layer is absent. A system with nothing to validate collection against will collect whatever is in range, because nothing stops it. This is not inference about internal logic, which is not stated and is not claimed here. It is the necessary implication of two confirmed facts held together: the system collects indiscriminately, and the system has no privacy controls. A broad collection capability with no enforced scoping produces indiscriminate mass surveillance as output. The judge did not describe an incident. The judge described a design doing what it was built to do.

The mechanism is not an error path. A system that collects without a selection boundary does not malfunction when it collects on a person who is not a subject. It executes as designed. There is no decision point that fails, because the facts state no such decision point exists. Every collection event within reach is handled on identical terms. Subject and non-subject receive the same treatment because no test separates them. The output the court named follows directly from that absence.

When a limiting control is absent, output equals capability. A broad collection capability bounded by nothing produces collection at the full extent of its reach. Indiscriminate is the plain name for output that equals capability. The distance between what a system is intended to collect and what it actually collects is held by the limiting control. The facts state that control is not present. With nothing to hold that distance, there is no distance. Intended scope and actual scope converge on whatever is in range.

This failure is deterministic, not probabilistic. It does not depend on volume, on a specific operator, or on intent, none of which are confirmed. It requires no misuse, no deviation, and no attacker. A system that collects indiscriminately reaches that result by construction. That is what separates this from an incident. An incident is a departure from designed behaviour. This is the designed behaviour. The scale of who was collected and how much is not confirmed, but the character of the behaviour does not depend on scale. One record or many, the treatment is identical, because the boundary that would differentiate them is the control that is absent.

The pattern is narrow and it is strict. Where an enforced scoping control is absent, a system’s behaviour equals the maximum its capability permits. Stated purpose does not constrain behaviour. Usage policy does not constrain behaviour. Only an enforced boundary constrains behaviour. The court measured the system by what it does, not by what it was meant to do, and the two are the same thing once the limiting control is removed from the equation.

Identity is the boundary. In any collection function, the single control that makes collection discriminate is an enforced distinction between subject and non-subject, applied where collection happens. If that distinction lives anywhere other than the collection boundary, it does not constrain collection. A subject test that is not enforced at the point of collection does not separate subjects from non-subjects. The collection function then behaves identically whether the person in range is a subject or not, because the test that would separate the two cases is the control that is absent. That is the same mechanism restated, not a different one.

This generalises without leaving the mechanism. Any capability paired with no enforced scoping control produces its maximum output. The property does not belong to this system in particular. It belongs to the relationship between capability and enforcement. Flock is the instance a federal court examined and named. The pattern is the rule the instance demonstrates: absence of an enforced boundary is not a smaller version of a boundary. It is no boundary, and no boundary means full-capability output.

Controls that are not enforced are not controls. The absence the court identified is not a gap to be documented and tracked. It is the condition that produces the behaviour. Documenting it changes nothing. For the characterization to change, the design must change. A policy that states collection should be limited does not limit collection. A review that happens after collection does not limit collection. Only a boundary enforced at the point of collection limits collection, and the facts do not state one exists.

What must now be true is specific. An enforced subject boundary must exist at the point of collection, such that a person who is not a subject is not collected on the same terms as one who is. Until that boundary exists and is enforced, the system remains what the court named it. There is no configuration setting, no training, and no oversight process that substitutes for an enforced boundary, because none of those act at the point where collection happens. The control either runs at collection or it does not run.

If a system allows indiscriminate collection, it collects indiscriminately. That is not a risk to be rated. It is the current state as characterized by the court. The design is accountable for that state, not the people operating it, because the behaviour follows from what the system was built to do. A federal judge named the behaviour. The behaviour traces to the design. Change the design or own the name. There is no third position.