The system ran one veteran 100 times

One person was queried more than 100 times inside a Flock tracking system. That is the stated fact. A single named individual, run against the system past 100 separate lookups. Volume at that level against one subject is not lookup activity. It is sustained tracking of a person.

The person is a veteran who recorded a traffic stop. That the recording occurred and the tracking occurred is stated. That one caused the other is not confirmed. Motive is not confirmed. Sequence between the recording and the queries is not confirmed. What is confirmed is the pairing. A person performed a legal act, and that same person was queried more than 100 times.

My position is direct. The system permitted more than 100 queries against one individual and returned results on them. A control that bounded query volume to a legitimate purpose was absent or ineffective. If enforcement had held, the count does not reach 100. The count reached 100. The control did not hold. Whether a control was designed to exist at all is not confirmed. Its effect is confirmed by the outcome, and the effect was none.

The observable failure is the completion of the queries. The system accepted lookups against one subject and executed them. It executed them more than 100 times. It returned results each time. At no observed point did it halt, throttle, or refuse the repeat lookups against the same person. A person-search platform ran the same person past 100 times and finished the work on every pass.

The access layer authenticated the party running the queries. Whether it authorized that party for that specific subject at that specific volume is not confirmed. Whether the queries came from one account or several is not confirmed. What the completed queries show is that authentication was sufficient to operate the system and that scope was not bound to the subject. A party with access could aim the system at one individual and keep aiming it. Nothing in the observed behavior stopped that.

Whether a purpose field existed in the query flow is not confirmed. Whether any lookup required a stated justification is not confirmed. What behavior confirms is enforcement, not design. If justification was required and enforced as a condition of execution, more than 100 queries against one person do not complete. They completed. Purpose validation, if it existed, did not gate the queries.

A tracking system answers one question on demand. Where has this person been seen. The system answered that question more than 100 times for one subject. It does not read intent. A query run for a legitimate reason and a query run for a harassment reason arrive in the same format, from an authenticated party, and return the same result. At the point of execution the two are not distinguishable. The system ran all of them because it held no basis to separate them.

That property is what makes the tool usable to track a single person more than 100 times. The capability that answers a lawful lookup is the same capability that answers an unlawful one. No second control reads why the query was run. Identity was authenticated. Purpose was not validated as a condition of execution. When purpose is not a gating condition, volume is not a gating condition, and one subject can be queried without a ceiling.

Stalkerware and person-tracking platforms operate on the same mechanism. The product is location on demand. The misuse of the product is location on demand. Both are the same operation against the same interface. A system built to return a person’s movements to an authenticated user will return that person’s movements to an authenticated user acting in bad faith, because the reason is not part of what the system checks. The observable behavior here, more than 100 completed queries against one person, is that mechanism running as built.

The mechanism is authentication standing in for authorization. The system verified that a party was permitted to operate it. Whether it verified that the same party was permitted to run this subject at this volume is not confirmed, and the observable behavior indicates it did not. A party authenticated to the platform ran one named individual past 100 lookups and the system completed each. No second boundary is observable between an authenticated party and a single subject. Had a second boundary been enforced at execution, the count does not reach 100. It reached 100. The boundary that held is the one that admits the party to the system.

The boundary that held reads identity. It does not read intent. A lawful lookup and an unlawful lookup arrive from an authenticated party in the same format and return the same result. The system completed all of them because it held no basis to separate them. The logically necessary implication is that identity was the operative control and that purpose was not enforced as a condition of execution. Whether a purpose control was designed is not confirmed. Its effect on the count was none.

The trust relationship is the failure surface. The platform extends its full query capability to an authenticated party and, in observed behavior, does not re-validate that trust against the subject being run. Trust granted at access applied to more than 100 queries against one person. Whether those queries originated from one account or several is not confirmed. Either condition produces the same result, because the boundary was blind to the subject. Continuous validation of trust against the target is absent from the observed behavior.

This exposes a class of system, not a single event. Any platform whose sensitive operation is location on demand, and whose only enforced gate is authentication, completes abuse in the same shape it completes legitimate use. The two requests are identical at the interface. The system holds no basis to distinguish them. The ceiling on queries against one subject is set by the operator running them, not by the platform. One individual queried more than 100 times is that property measured.

Stalkerware and consumer tracking apps run on the same mechanism. The product returns a person’s location to an authenticated user. The misuse returns a person’s location to an authenticated user. Same operation, same interface, and the reason is not part of what the system checks. The consumer tool and the enterprise person-search platform fail on one axis. Intent is not a validated input. Nothing about scale, branding, or intended market changes that axis. A system that answers where a named person has been seen answers it for whoever is authenticated to ask.

Scale is the multiplier. Automation applies the same operation at machine volume, and it applies control and failure at the same rate. When purpose is not a gating condition, volume is not a gating condition, and a single subject can be queried without a ceiling. This is also where the legal and technical layers separate. A legal restriction on why a person may be queried is not visible to a system that checks only who is asking. A restriction that is not enforced at the point of execution is, to the platform, not present. The lawful query and the prohibited query execute through the same path. Law can name the prohibited one. The system cannot, unless a control reads purpose at execution. Observed behavior shows no such control.

The control did not hold. More than 100 completed queries against one person is not a gap in an otherwise sound system. It is the system stating its own boundary, and the boundary was identity. Identity alone does not bound a location-on-demand capability, because identity does not carry intent. A platform that authenticates the asker and returns the answer will return the answer every time an authenticated asker requests it.

What must now be true is specific. Purpose must be validated at the point of the query, or it is not a control. Volume against a single subject must reach a ceiling that triggers refusal, or there is no ceiling. Trust must be validated at each query against the subject, not established at access and applied without limit, or trust is unbounded. These are not enhancements. They are the conditions under which the observed outcome does not occur. If they are not enforced as gates at execution, they are documentation, and documentation did not stop 100 queries.

Controls that are not enforced are not controls. If a system allows it, it will happen, and here it happened more than 100 times against one named person. Whether that person’s recording of a traffic stop drew the queries is not confirmed. Whether the motive was harassment is not confirmed. Neither is required to explain the outcome. The system did not need a motive. It needed an authenticated party and a name, and it had both. That is the finding. Everything the platform did not enforce, it did not control, and the count is the proof of what it did not enforce.