Call with Jay on Verkada Screening

5:55PM Apr 29, 2022

Speakers:

Keywords:

ricotta

data

registries

issues

third party

id

information

visitor

database

talk

sex offender

guess

system

research

facial recognition

address

person

sex

third party provider

lists

Hi, Isabella. Hey, Jay. How are you? Not too bad. Good, good. I'm glad to hear that. Thank you. Yeah. Thank you so much for taking the time to talk to me today. Of course, like, as we said, off the record, just some background information for you. I did some research into how exactly the, like screening works and like what data is extracted, for example from the ID that is scan. And really, I think today like, I just want to be able to kind of talk to you about like, just, you know, right off the bat kind of like what is what are some, like privacy issues that you see? And then also, just like, if you're aware of anything, I asked some light research, like if you're aware of anything that the ACLU like, has said, or like kind of the research that you guys have done about specifically either just like in regards to, you know, kind of like privacy issues are also around just like sex offender registrations and things like that. So, so I guess just to start off, like very high level, I'll kind of give you like a 32nd rundown of how the berkata system works actually let me back up, because we've talked a lot about flock safety, but do you like how do you know kind of anything about ricotta or like, you know, the research that we've done on them and like kind of what type of company

they are. I did a blog post on them and I talked to John about them. Okay, great. So I know they're ethical. They're

troubled, right? Yes. And I guess the main thing that was like kind of interesting to us is, I guess it's right off the get go. Kind of like visitor management, sex offender, kind of like the screening process. Like we ibvm does a little bit of like visitor management related research because we have, you know, we do access control related things. So like swipe cards, but of course, it's like not the majority of kind of our content, right? Like we really do focus on video surveillance, but like within video surveillance companies, and even like access control companies, sex offender screening isn't like a thing that you typically see, although like I could completely understand like, just business wise, why schools or like daycares would want something like that.

But this is a product that they have like advertised on their site.

Yes, it's new. It only started becoming advertised I think it's like it only rolled out and be in was advertised starting in February of this year. So very new. Okay, yeah. Very new. Yes, I guess the thing that like was interesting to us like when we first saw this is like one of the big kind of posts that we did with about ricotta with mainstream media. So I think we did a piece with vice and with Bloomberg. Last fall was like an investigation into ricotta is what office culture they had, like a lot of allegations of like sexual harassment against the sales team. And there was like a Slack channel that was like to have just like wildly inappropriate comments about like woman who worked there. So yeah, so like that's that's also just like an issue that that they've had ethically in the past that they've kind of like swept under the under the rug is their you know, they deal with their own kind of like sexual harassment issues. So I guess Yeah, so in terms of in terms of the system, so just kind of overview This is my understanding of how the system works is so you know, it's kind of the visitor management system is kind of like a typical system that you would see you know, when you like sign in to an office, you give up you, you know, presents to a separate receptionist, kind of your ID, they're like, check you in, and then you get a badge printed out, right. But with this sex offender screening, what happens is you take your state ID. So, as of right now, passports aren't supported. It has to be like a state issue ID so like, it's like a driver's license, for example, and you hold it up in front of like a scanner, and according to ricotta, it takes, like extract information. So this is where like, I'm gonna get in touch with her caught about this. This is where there's a little bit of like, contradictory Enos is So bottom line is ricotta says, you know, we scan your ID, but we're not using facial recognition to match you know, your picture on the ID with like pictures in sex offender databases, for example. All we do is we take extract information which is like your full name, your date of birth, your address, and we take that and we match it against registries, again, like there's a little bit of contradictory Ness here because according to their public marketing material, ricotta has said that they'll take let me go back to my notes. So yeah, so ricotta has said that they will take the visitors full name, photo address and date of birth, but then ricotta says the data that's being sent to like the database to match against is only the full name and the date of birth. So kind of my question there for ricotta is like why do you need someone's picture right and like, why do you need their address if you're saying, you know, you could do it with the you could kind of match with the full name and the date of birth? So that's that's a question for record I have. The other thing is, so ricotta is record itself is not compiling. Kind of compiling these national and state registries. They're sending the data that they're extracting from the visitor's ID to a third party database, or to a third party who like hat who owns this database of aggregated sex offender registry information. So I think like for me, it was like some question there right like there's this ricotta doesn't own you know, kind of isn't doesn't kind of ricotta doesn't oversee the aggregation of this data. So like one, how do you know that it's accurate? And also, just as data is flowing like that's, that's one kind of extra entity of the party database. So so I don't know the name of it. That's also a question I don't know I doubt ricotta will tell me but all all that is said in their marketing materials is that it's some kind of third party provider. I've done some research

already provider gets data from that's a big question for

me. Okay, like right. So where's the third party provider getting this like registry? registry data from? Yeah, okay.

Are they scraping public? I mean, I don't I don't know that much about sex, offender registries. It's kind of like more in our criminal law, which is one reason why I need to talk to some of my colleagues, right. We figure out if we can, somehow we will comment on this but yeah. Yeah, I mean, I, I guess some of the state sex offender registries are public and you can look them anybody can look them up, right? So presumably, this company is spraying.

Right, right.

A different state? Well, I don't know. Is there a there's a federal license or a Federal sex offender registry? I don't even

know. Yes, I think there's, I think there's a federal because I did some research. I did did some research into this. I guess there was a federal one. Yeah, I guess like my question also is you know, like, is it okay, to scrape um, to like, scrape these registries for like a commercial purpose. I like I don't know if there are laws against that. You know, versus just like me going in typing in my address and looking up, like, who lives near me?

Yeah, I mean, the only the only extent that we've gotten involved in scraping issues is to defend those who do scraping for academic research.

Right, right. Right. Okay. That's That's good. I'll, I'll think about that as well. Yeah, like just kind of, yeah, this where's this third party getting the information from and also is it you know, not only is it reliable, but also is it? Are there any issues yet? Yeah, the reliability issues, any legal issues with kind of, like taking it from from these websites, or taking it from these registries? Hey, there, I think we're, you're reconnecting Okay, you're back. Are you ready for now? No, it's okay. I think. Yeah, there was

our Lighthouse for the internet. Oh, sorry. Okay. Make sense. So anyway, I mean, presumably, these these lists are government lists. Right. So I don't think there would probably be a legal issue scraping government data as possible there's some legal issue there, but that doesn't seem like a promising. But the but yeah, I mean, the accuracy and the privacy issues are huge. Yeah. Yeah. Here's an even like, I mean, I just missed one female directors. I don't know that much about them. I'm not like a spokesperson. But like, I mean, there are people on those lists who are on those lists for you know, they're not necessarily like child predators or whatever, like you get on those lists for a pretty wide variety of offenses. And some of them are just like a one time flukey thing maybe, and these are not like really bad people. And like, you know, I mean, there's days where you get on the list like, you know, you're 17 and you have sex with a 16 year old or stuff like that. Technically, it's a violation of you know, you're having sex with underage person, but you know, your

kids only five months older than the other one, but so, I mean, there are issues there too. So I've been

there I guess there are issues around like, various you on the sex offender list, or do we want to like make it so you can do anything, go anywhere, anywhere your whole life? Is that like, is that proportionate?

Right? Right, right. Yeah,

I mean, is, is there actually a danger of a sexist somebody's like walking around? In public school? I mean, obviously, it's very sensitive with children and so forth. But I mean, realistically, what are you gonna do walk into a classroom and I don't know.

Yeah. It seems like, like a marketing thing as much as anything,

but yeah, for sure. But anyway, he keep telling me about what you know, and how it works and so forth.

Yes, so yeah, so the main thing is like what like I said, they're like, kind of the questions are, apparently it doesn't, you know, apparently this matching doesn't use facial recognition. It pulls like, name and name. Yeah. So name, date of birth, like your address off of the ID. And supposedly like the your name and the date of birth is sent to the third party. And we had that discussion about, you know, kind of, who is this third party where this getting started? getting this information from? And then basically, if there's a potential if there's a potential match, the like, receptionist who's using this system would get an alert on their computer that actually recorded did like a mock up of this. And it'll side by side show you you know, the image the the image of the person's visitors ID, and then the information that's sent back from the third party database with their full name, their date of birth, their address, and their also their height and their weight, apparently, and like, you know, kind of image from that registry of that person. And then the receptionist has to wait so

the third party, third party registry has photos.

Yes, that's my understanding, because you get Yes, that's my understanding. Because, you know, if there is a potential match, you get a picture of that, you know, the potential match inside the registry? Yes. And then the receptionist has to physically say yes or no, you know, this person, is the person standing in front of me or no, you know, like this is somehow wrong. So there's that final piece of like, human element in the system. And that's kind of you know, and then if it's yes, or, you know, if the person does match, then then they're presumably denied a badge and they're not allowed to enter and then but if it's no then you can kind of override the system. Yeah, yeah. So, I think there are also some issues there, right, like, you know, at the very end, it is a human check. So, you know, you could just override the system and let someone in. But at the same time, you know, again, with accuracy issues that you pointed out, you know, I and I was because as I said, like I had looked at kind of ACL use work on these registries previously, and like some some, you know, like an issue that was brought up is just, you know, like, people move a lot addresses change. So, you know, if there's like a Mac for the address, and you happen to have to have the same name, like you know, kind of what happens and then also, even if there's a human identifying, right, like people are, like, honestly, just like very bad, even if someone's sitting in front of you, like sometimes if, especially if that person is Caucasian, like, it's very hard to, like tell, right, like, people will just say like, oh, like, Yeah, I think you look similar. So there's that final like human I think ricotta, definitely market to market it as a plus, right? They're like, oh, there's like a human check at the end. But I think that also leaves like room for for mistakes.

Yeah, yeah. Interesting. Yeah. I mean, they're also issues. Yeah. Okay.

Yeah, I think I mean, I think this like talk was helpful just in terms of thinking kind of, like, giving me new, like, just information about Yeah, I think like, you know, the issues that could go wrong. So I mean, yeah, that's kind of like the overview of the system. I'm doing some more research on like, on Yeah, kind of the issues I'm gonna talk to ricotta about like, where they were, you know, who this third party provider is like, where they're getting the information from? This kind of like contradictory nice in terms of extracting the photo, like not extracting the photo, you know, what information is actually being used? And then also, I think, yeah, just generally, like, this data is, I mean, it's the Viagra. The Biograph. I mean, like biographical data is important, but also especially like at schools right? I think it could be especially, like sensitive information, like who's visiting the school, like when and kind of what protections are in place for protecting the data at ricotta and also, at this third party database that they're sending the information to? Yeah, I think it would be, you know, it'd be great if I think we're still trying to figure out like the kind of the angle that we're going at, but I think like, you know, if there's any information that the ACLU kind of has on, like its previous research with kind of these registries like accuracy issues, I think is like one big thing. Privacy issues with like how this data is used or like sent. Anything like that would be really helpful for us.

Yeah, I mean, there's definitely a ton of issues around like if they're scraping data on people's IDs. Yep. How's that? Who gets to see that data? That data store?

Yeah, it was one is it dropped? Like, is it yeah,

this third party data if they're paying them, sending them data? Is there a match to your database, that third party could be saving that data, even if there's no match? Unless it's contractually prevented from doing so?

Yeah, yeah. Yeah, so you know, the thing is, so ricotta has, I guess the the plus side is because, you know, attempted to address some of these issues. So, you know, it's at least good in terms of they haven't, you know, they kind of considered the issues. Obviously, there are, you know, like, policies or policies and like whether or not people will follow them and whether or not they're hacks are a different story. But I think the idea right now is that when we got back to my notes, so the idea is that yeah, I guess I guess I think I think the main thing for us to figure out and I'll definitely let you know whoever publicize if they respond to us at all is there just seems to be like contradictory information. So like, one was the facial recognition part and then the other is I'm reading back my notes now and, you know, ricotta on their kind of information document for this feature, they said the third party database provider deletes the information used to conduct the search once completed, but then in a separate section on the same document for kata says that, you know, if there is a match, the data remains with our third party providers for no more than 24 hours after which it is expunged from the system. Right so like that seems to contradict for me, like, Is it is it deleted automatically? Or like, do you save it, you know?

Yeah. I mean, also, there's this third party Alright, so sounds like ricotta is contractually obligated to delete the data, or KSM sends to them does Makeda delete their data? Like I was at my kid at the elementary school and they now they have my image of my ID that they've OCR, right? Maybe accurately, maybe inaccurately, like does, sorry, roquetas mysterious third party database, and I suspect that you might be able to figure out who that is. I mean, how many of these databases are there? Right, maybe there's a lot I don't know. But so it's not just a third party database issue. It's for Qaeda itself and even the school like it was roquetas system allow the school to maintain records. who's visiting when? Yeah, yeah. Yes, that's probably the least sensitive because the school doesn't have the same commercial incentives to use data in different ways or whatever. question to ask. Yeah,

yeah. For sure. Yeah. Okay, yeah, this is really helpful. That's that's like, that's all for me for now.

And I'm trying to figure out who our criminal our project if anybody, like can talk about all this. It may be that I come up dry, but I will do my best to get somebody to comment for you.

Okay, thank you. That'd be that'd be very helpful. Thank you so much. All right. Okay, thank you. Thank you have a good weekend and have a safe trip to Europe to

thanks. Yeah. Good luck on your on your story. Thank you so much. Thanks.