Ryan Koch (00:00)
Josh, thanks so much for joining us here on Civic Tech Chat. Could you introduce yourself and tell us a bit about what you do?

Josh (00:08)
I'm Josh. Uh I go by the handle uh waffle hacker online. I've been coding, you know, uh software engineering, web development for about fifteen years. Um I have a day job um and that's you know uh building landing pages and um engineering marketing and ad infrastructure for a marketing company.

I do build uh civic tech as well as other, you know, little fun side projects that I have on my portfolio at wafflehacker.dev. But uh yeah, the main one um that I have been focusing on is uh Antifreeze. and then plus the little sub project off of Antifreeze called Flockwatch. and I also write about, you know, the Civic Tech and other technologies that I make.

on the Daily Kos and then I write about pretty much everything on my sub stack.

Ryan Koch (01:03)
What would you say is your personal why? That thing that drives you to get out of bed each morning and do what you do?

Josh (01:10)
I do believe that uh people have the right to know uh when law enforcement is operating around them. And that's true for, you know, any government power used in public and it matters most for the people uh, you know, with the most to lose.

I haven't really liked how ICE has been handling things and not gonna pretend to be neutral about that. Uh but from an engineering's per perspective, um, when I saw that the app Ice Block, which does the same thing as my app does, it was called Ice Block. It was in the uh Apple App Store and I think it was in the Google Play Store too, but anyways, it was uh pulled by Apple and Google under the pressure from the administration.

And I believed in what it was doing, but I also saw that there was a single point of failure. Uh it depended on app stores.

Ryan Koch (02:01)
Let's uh take your headspace back to October of twenty twenty five, this kind of getting at what you were just talking there about apps being pulled. But Apple had pulled ice block, as you mentioned, based on Justice Department demand. And Google also pulled similar apps applications. What was your headspace then? And what did you decide to do as you learned about that?

Josh (02:25)
it just kinda disappointed me because I you know they had reportedly a milli you know millions of users, you know, using their app and you know, any you know, people now lost access to that because it was, you know, because it got pulled from the app stores. And I don't know, as an engineer, uh, you know, as someone who likes to build things, um the first thing that popped in my head was

you know, uh I would love to do the same thing. You know what I mean? Like I would I would love to you know, I I have it's it's finding about s finding solutions. That's what I meant to say. So um I was just thinking, oh man, you know, what what if I made it a web app and, you know, put it on a website, people can install it. or, you know, at you know, 'cause with when it comes to, you know, uh it's called PWA's progressive web apps. And so it it

It's like a it's pretty much a web page but it acts as an app, you know, where you can get push alerts and whatnot and I decided, you know, that I just wanted to go with it. Like I just uh wanted to build it out and see if I can get users on it and I wanted to make it as um censorship resistant as possible, you know, and I kinda thought ahead. Um I

got a server outside of the US jurisdiction. and yeah, and so I just registered antifreeze.app and just started putting it out there.

Ryan Koch (04:02)
the two projects, as listeners are probably realizing that we're gonna talk about today are Anti-Freeze and Flockwatch, both both of which you've mentioned and given a little bit of description on. Um could you talk a bit more about what those are and why you started them specifically?

Josh (04:18)
antifreeze is the main project. Um you pretty much would go to antifreeze.app um on your mobile phone. Uh you would hit the install button, and if you're on Android, um you would actually get the native prompt from your browser saying, you know, would would you like to add this to your home screen? You hit add or install.

Now you have you know an icon in your app drawer. Uh and so pretty much what would happen is uh you can report sightings near you. and if there is a sighting within a five mile radius of your location, uh you will get an alert on your phone. I also have

partnerships with other um similar websites. There is, you know, stopice dot net and um defroster is another one. It's smaller, but and yeah, we pretty much uh instead of being competitors, we're you know partners and we share sighting data. So anyways, so yeah, people get um, you know, alerts on their phones, uh whenever someone does report a sighting.

And uh you can also go into the app um and you can see a uh all the list, you know, all the listings there. you can either they'll show you all the listings within a twenty five uh mile radius within the last forty eight hours, as well as you can hit, you know, view all sightings and then it'll show you, you know, everything and it would be sorted from, you know, the newest sighting, you know.

To the latest sighting within the last 48 hours. ah Now, Flockwatch was something that I actually just recently built. And it kind of just shows you a map of

all the flock cameras. And I was reluctant to build this because there's a similar site called uh DFlock. And uh but one thing I thought was cool is that D Flock um actually by default shares um their s shares their sightings. And so uh they use a protocol called open street map. So I just have it kind of um you know pulling from the OpenStreetMap

I also have it to where if someone does see a camera, they can actually anonymously report it uh through you know through everything. You can upload a photo, put the location that you saw it at, and then submit it, and then it goes into my little admin panel. And then if it looks like you know it's a legit sighting, then I approve it. And what's cool is as soon as I approve it, it immediately goes on to

Flockwatch, but then it also goes into OpenStreetMap. So um that means anybody using D Flock will also um you know eventually see uh it on the D Flock map as well. Um there's also a ah on the Flockwatch, there's also a uh thing

That kind of shows you like what agencies near you has access to the flock cameras in your area. And then there's another page on there um where you where there's immigration searches. So uh and this uses you know audit logs that have been, you know, requested through um I think it's called FIOS uh

the in whatever the thing is where it's the transparency um requests. And so yeah, all the immigration searches I have pulled from um eyesonflock.com. And so eyesonflock.com lets you kind of pull the audit logs and you know see what they uh from the audit logs have searched.

So, you know, whether they search for immigration or, you know, uh ICE or HSI, it would um it shows in that, you know, audit log.

Ryan Koch (08:42)
let's talk infrastructure a little bit.

thinking about anti-freeze for a moment, let's walk through what happens from when a sighting gets submitted to someone actually getting a notification as you described. What's that through line and what infrastructure gets touched along it?

Josh (09:01)
the person who's reporting the sighting, um they, you know, enter the location or they can hit use my location, um, they can put in the notes um of what they saw if they want to, and then they can also optionally upload up to five photos. And then um so then, you know, they submit the report

then it goes to uh the Cloudflare Edge. Um so the the Cloudflare Edge is just pretty much just a little thing that sits in between ah you know the domain and my infrastructure, and that's just for DDoS protection.

So then once it goes to my server, you know, it checks to see if you're banned. Um, it checks to see if you're within that three sighting a day um rolling window. And then ah if you know everything checks out, um then it um then it goes to the photo then you know if you're uploading photos, it goes to the photo stuff storage. But first, um my app strips out all the exif data.

And um yeah, um all that good stuff. So all the excess data is um, you know, stripped out, it's re encoded and then uploaded. And then and then, you know, then it goes to, you know, then it goes into anti freeze, and then while while it goes in the anti freeze um uh network, then um then yeah, then it

If they have of assuming they have share with partner network still toggled on, it goes to all uh goes to the, you know, stop ice and defroster. Uh no reporter ID. It just sends the um you know, it just sends over the you know the location of the sighting, the notes of the sighting. And then yeah, and then basically uh my server then matches everybody within the five mile radius of that

Sighting and then sends out the alerts. Um and you know, the this the alerts go out through um, you know, Apple's push uh s you know, service or Google's push service.

Ryan Koch (11:21)
Cool. And the kind of system stuff in your server infrastructure, if you feel comfortable talking about

Josh (11:26)
Mm-hmm.

Ryan Koch (11:27)
it, is that um, you know, kind of your own kind of container setup that you have defined kind of somewhere with like a database service? Like what's the uh what's kind of the structure of that for the technically curious folks?

Josh (11:39)
Yeah, so like I said, so mainly the infrastructure, like most of the infrastructure lives on um my offshore uh Linux server.

So the only really third party um thing that we rely on is like I said, uh Cloudflare um for the DDoS protection, as well as that's where the photos get uploaded too. I didn't really want photos to be uploaded on my infrastructure because I've there's been vulnerabilities where people have figured out how to upload uh, you know, on any kind of like uploader type scripts.

Find vulnerabilities and upload something malicious. So it's all in my opinion, it's always best to go through like a third party, like uh Amazon S2. But I went through um Cloudflare R2, um, which is kind of like the Cloudflare's S3 protocol, kind of like Amazon S AWS. and it luckily it's not completely gatekeeped because if for whatever reason Cloudflare decides to shut me down, I can always find another uh S3.

but yeah all the data and everything are mine it goes on to a Postgres server on the server that that I rent offshore

Ryan Koch (12:56)
You started

to get into this a bit. So um you talked about using prog progressive web app tech to sidestep app

Josh (13:03)
Mm-hmm.

Ryan Koch (13:03)
stores. you mentioned trying to kind of have your storage be something that you can change if you need to, whether it's like uh the R2 service you're using now or something else in the f in the future. Um you do rely on some push services from the, you know, the Apple, Google, and Mozilla's the Cloudflare's of the world.

Josh (13:23)
Mm-hmm.

Ryan Koch (13:24)
use

cloud for f for photo storage and Flockwatch uses OpenStreetMap. So from

Josh (13:29)
Right.

Ryan Koch (13:30)
your perspective, what does it mean for apps like the one you're working on to be resilient to gatekeeping as as you kind of have as your goal?

Josh (13:38)
Yeah, so uh yeah, that's what I wanna kinda go um on about. So yeah, um so yeah, an an an app store is kind of a choke point. a pr a push service is just a pipe. So Apple pulled ice block with one decision. Antifreeze is a website, so there's no listing to pull. and then updates, you know, um, so anytime I do an update

It automatically you know goes to your phone. The next time you open it, you should see the latest version. Because like I said, it's just pretty much a website. Um it's just behaves kind of like an app. Um so push is the the real uh the only really real dependency on Apple and Google, but it's also the hardest to aim. It's a web standard and the messages are encrypted end to end. So um blocking it would pretty much be

the singling out one site, which um from what I've read, Apple and Google rarely um, you know, ban um ban push in points because it's it's just kinda hard to and and what they will they what they might do is they have banned if there's been like abuse, like spam and whatnot. Um but yeah, and even then, um

Like I said, it would it would require them to single out one site, but even then with it like being end to end encrypted, it it would just be kind of um uh but yeah, it but even if push were cut by God forbid, which I don't really see it happening, the map refreshes every time, every minute while it's open. So you would just lose the buzz in your pocket, but not the information.

Ryan Koch (15:23)
Yeah, since we're talking about kind of like possible failure modes, choke points, that sort of thing, uh

Josh (15:27)
Mm-hmm.

Ryan Koch (15:28)
we get we can do like a little bit of chaos monkey thinking, which is kind of that

Josh (15:31)
Right.

Ryan Koch (15:31)
old like Netflix kind of style of thinking about like how you manage risk with your infrastructure.

Josh (15:37)
Mm-hmm.

Ryan Koch (15:37)
Like if I go into your data center and I start yanking cables, will the app go down? Effectively.

Josh (15:41)
Mm-hmm.

Ryan Koch (15:42)
So if someone were to try to gatekeep either of these apps,

In your view, where are you expecting them to go first?

Josh (15:51)
so one of the strike points is the domain registrar. So somebody, you know

Um the administration could uh pressure Injala or whoever to um, you know, or even it's antifreeze.app. Uh, and so it's a TLD by Google. So they can either pressure pressure Injala or Google to take down the.app domain. So then antifreeze.app stops resolving. Um, but luckily I do have a backup domain. It's antifreeze.is. It is the Iceland TLD.

And uh.is or Iceland has been ah very known and and uh to you know be uh proponents of free speech. Um so I would just um get send a push notification to everybody because what even even if the app do goes down, I I can still send push notifications. I still have my data of all the push-in points. So I would send a push notification saying, hey everyone, antifreeze.app dot got pulled.

Um go to antifreeze.is and just remove the old antifreeze app and reinstall it on antifreeze.is. Um so if the um another strike point would be the hosting provider drops me. And so if that happens, everything does break until I move it. Um luckily I do keep backups, so all I would have to do is take my backups.

with the database and move it over to a new host. Um another strike point would be Cloudflare drops the account. And that would you know, hurt our attack protection as well as photo storage. So um so the photos use S3. So that can just move to another S three endpoint or even, you know, maybe even like a local uh upload script. But you know.

I'll just have to you know change how I do photos, uh sighting photos. And the site will just run without Cloudflare, so I'd have to find, you know, another way to protect myself from

DDoS. Um another strike point would be Apple or Google block push. Um but like I said, all that would break was, you know, alerts would stop buzzing on phones. But the app still works and refreshes every 60 seconds, so people can still manually go in and uh you know check the app.

Um so another strike point would be open street map or the deflock goes down. Um and what would break with that would be Flockwatch stops updating, you know, Flockwatch stops updating cameras. But um the last good copy stays in the database. so I also have uh, you know, so all the you know the deflock tiles, they're still up.

Um but yeah, um another strike point would be a flood of fake sightings, um, which would cause, you know, a no a lot of noise and false alarms. But like I said, um what I've done to prevent that is, you know, three reports. Um you know, you if if you're a regular user, you can only do three reports a day uh within a twenty-four hour window. And so all I'd have to do is just ban that device.

Um and delete the sightings. Um

But yeah, I would say probably the main strike point would be like legal pressure on me. Um and what would break would just depend on the demand and um

you know, all with sighting data, um the who reported it device ID is scrubbed after seventy two hours of the sighting. Um and there's no accounts, no names. So even if I do have legal pressure and I am subpoenaed, that there's just not really a whole lot to hand out in the first place, you know.

Even if I do hand over every source of data that I have, there's just nothing really of value to hand over.

Ryan Koch (20:04)
Have you have you run into any situations where you had to respond to folks trying to either act on one of those strikes you're worried about or like work around a mitigation? Like for example, you know, you limit to three reports per day, you have the ability to ban. Have you kind of hit something where someone was trying to work around that and therefore you had to like execute a bunch of bans or or with one of the other risks, a similar sort of incident?

Josh (20:27)
That's actually kind of inter that's actually an interesting question. Um, so you know what's been interesting about it is that um so far, even after um roughly over twelve thousand installs, um, it seems like everybody's been playing nice. Um I only have maybe two or three devices that I've had to ban out of the twelve out of the twelve, thirteen thousand installs.

One thing that I did notice is that um someone did figure out a way um to um submit a sighting without having to go through the, you know, is this a real device, is this a real fingerprint? And they were able to like kind of register a dummy account um with just hitting the API directly. They found a vulnerability basically. They didn't do anything with that vulnerability. I think they were just kind of poking around for fun.

But either way I was keeping an eye on it and uh I immediately patched that vulnerability after I noticed it. So yeah.

Ryan Koch (21:29)
if you're comfortable answering uh how did you wind up noticing that? It it it's I I find it particularly interesting when you when you kind of end up in a situation where you get to discover a vulnerability, whether it's through penetration testing or in this case some accidental free penetration testing, um, and then have

Josh (21:43)
Mm-hmm.

Ryan Koch (21:44)
the chance to respond. So like what what was that like and practice free on this one?

Josh (21:48)
Yeah, so actually I was actually it was kind of on accident. So I was looking at the database, right? And whenever a user installs the app, uh, it goes into a users table and that consists of their um, you know, a random user ID, right? It's nothing to really do with a device, it's just a random uh UUID for user ID, right? And then their device fingerprint.

their last location and then their settings like you know if they have something on or off. But anyways, one thing I noticed is there was a new user in there uh with a new user ID and their device ID was like zero zero zero or you know something definitely fake. It wasn't a real device fingerprint. And I was like, hmm. So I went in and uh fig you know I was trying to figure out how they did that. And then I realized okay this is how somebody could actually you know bypass

you know, bypass the actual device fingerprint. So yeah, now I have it set up to where um yeah, uh you i it has to be a real minted finger fingerprint um in order to um you know in order to actually get your device on the network. So yeah. So yeah, I I I've definitely, you know, um taken security seriously. Not only

to protect the people that have it installed, but also, you know, protect, you know, the the the data integrity, you know, make sure that nobody's out, you know, or try to mitigate as much as possible any fake sightings or, you know, people trying to just abuse the system. Um now of course there's, you know, and and by fake sightings I mean intentionally fake. Of course we get a lot of sightings where, you know, somebody might have thought that something was ice and it wasn't and

And like I said, it it is just an open, you know, thing where people can go on there and, you know, report. So, you know, it just because it is kind of an open network of event reporting, you know, i it it's also kind of, you know, expected for everybody to kind of use their own, you know, due dil diligence. And, you know, I always recommend people upload photos of what they saw and try to be, you know, as detailed as possible.

Ryan Koch (24:08)
I I think we've given listeners out there that are into advocating for observability a great anecdote to support support their case from your story. And I actually you

Josh (24:17)
Mm-hmm.

Ryan Koch (24:18)
mentioned uh fingerprints IDs there again, which I think is like a is a great segue into kind of some of the data privacy conversation stuff for for this

Josh (24:26)
Mm-hmm.

Ryan Koch (24:27)
for this episode. And but before we started, we talked a bit about uh your use of fingerprints and kind of the data that goes into forming those.

Uh, what should listeners take away about the kind of data that's collected and used for kind of anti freeze and in in these projects?

Josh (24:45)
you gotta have an email or password or sign in with Google or you know, enter your phone number and you confirm you know, text to your phone or whatever. So yeah, with mine there's no accounts, no email, no phone number. Uh but what we do have is I like to call uh pseudonymous uh pseudonymous, not anonymous.

And what happens is when you, you know, install it on your phone, y what's minted is like this little short device um ID or a browser fingerprint, which is used to block abuse. Um now that fingerprint is just um you know dedicated to antifreeze. So there's no way to, for example, use that device fingerprint to, you know, see what other sites they you've signed up for. It's just

before you know identifying you on anti-freeze, but there's no way to tie it back to anything identifiable. so yeah, the IP address is never stored. Um so there are uh the only time the closest thing to like I guess IP address storage would be I would say there's about less than one percent of users. For whatever reason the device can't mint a fingerprint.

and I still want to print a prevent abuse, but what we do store is a salted hash of an IP instead. but it's still not your IP address.

Uh I still can't figure out what your IP address is. It's just a salted hash. So we can still have, even if for whatever reason the device is not minting a fingerprint, we can still have something, you know, in there to kind of um you know prevent abuse. but the takeaway for listeners is, you know, everything stored is tied to a device, but none of it is tied to a name.

whenever you submit a sighting, that sighting does have your device fingerprint on it for up to 72 hours. After those 72 hours,

And it is just for, you know, abuse prevention. But after the seventy two hours, that device ID is scrubbed and then it just becomes archived. You know, you're so no so I don't you I don't even after seventy two hours, I have no clue what device submitted that, right? So it uh so the device ID on that sighting is now replaced um with just archive. So uh anybody who gets access to uh old sightings.

It points to a you know a street address, not a person. So a subpoena for the archive gets uh you know, addresses and description, but not who reported it.

Ryan Koch (27:25)
And you mentioned uh after seventy two hours, that's when it goes kinda to archive and it's a backup is effectively what exists.

Josh (27:32)
Mm-hmm.

Ryan Koch (27:33)
Uh what kind of retention policy do you apply to those backups and what's like the access control look like for that?

Josh (27:41)
So yeah, I do have a backup and or you know, I do have an auto backup. I make sure it gets back everything gets backed up once a day. Uh, but I do not keep um backups older than seventy-two hours. Uh so any any bac or three days act, you know. So I always keep like a rolling three day backup. So, you know, the latest being, you know, today, and then I also have a backup from yesterday and then the day before.

And the reason why I do it that way is just in case for whatever reason there was, you know, I have to restore a backup and for some whatever reason like the latest backup was corrupted or whatever, I always have, you know, at least three backups to work from. But yeah, just out of, you know, keeping everything private, I don't wanna keep an indefinite number of backups and there's just no reason to. And and you know, not only for is it for, you know, user privacy, but it's also, you know

If I just keep all the backups out of my storage, we get full. So yeah, uh, that's pretty much it. Um, but yeah, if if for whatever reason a subpoena landed within that 72 hour window or reached a backup, a device linked to that uh specific sighting would still exist. Um but you know, they won't be able to see, you know, likely

all the sightings that that device submitted. So, you know, the the the whole reason why I do archive it is just so where if they do get a subpoena, they won't be able to see, okay, well this device has, you know, submitted sightings here, here, here, and here, right? They'll just be able to see the sightings that they submitted within the last seventy two hours, which is usually just like maybe one or two sightings at the most. And they won't know who, you know, what sightings

before that, so the seventy two hours they submitted basically.

Ryan Koch (29:37)
the fingerprint IDs that you're building, are those a one-way function where, hey, like all the bits of data that come together to form it, like I can't figure out what those were after I've you know from just the fingerprint ID itself.

Josh (29:51)
Right, yeah. So I actually I'll let you know. I actually use it's an open source uh tool called it's called Thumbmark JS. And yeah, it's a open source um fingerprinting library. The fingerprint is minted uh in the browser. So yeah, like it uh it it it is pretty much just one way.

Uh and then what's cool about it is uh I I just I don't store the data that went into that fingerprint.

Ryan Koch (30:21)
okay, so kind of as the fingerprints minted, you like use the data to do to create it, but then poof after that function is done.

Josh (30:31)
Thumbmark.js has a uh an algorithm um that mints a fingerprint based on it and then the fingerprint gets minted within the browser. So yeah, it it all happens on the user's device. the only thing that goes to my server is the fingerprint itself. So which is like I said, pseudonymous.

Ryan Koch (30:50)
okay, that's a a useful distinction. So effectively that device information, you never physically have it to even be able to store it, is what I'm hearing.

Josh (31:00)
Correct. Yeah. I I I I don't. There there is a um if you look into Thumbmark JS, there is an option where you could collect that, but I I you know, I I uh I you know, I have it intentionally where I you know it do it that information does not go upstream to the server and if a user wants to they can, you know, audit the app to see what does um go to the server. And that's what's lovely about

PWA is is, you know, if someone wants to audit it and just fear figure out what data they want to get, you know, if if they're, you know, if they know how to use DevTools and um go into the network and, you know, see it, you know, they can go in and look. Whereas whereas, you know, native apps from the App Store or whatever, you have to figure out how to decompile it and all that stuff. Whereas uh what's cool about a PWA is it's way easier to audit.

Ryan Koch (31:55)
And I think we've talked about that uh sightings remain for for longer. I believe roughly or I think indefinitely if I remember from our prior conversation.

Um who has access to that archive of sightings and kinda what ends up being your plan if that subpoena does one day come to your mailbox?

Josh (32:14)
the public feed all they only see sightings for up to four you know, in the past forty eight hours and newer, right? But um I do have what's called a watchdog uh platform and that's you know um vetted users, often, you know, local ice watch groups, um, such as ah Icewatch SoCal was one of 'em. Um

Music City migra migra watch uh, you know, as one of 'em and yeah, they can go in and they can actually if they want to, you know, look at all the sightings if they want. Um and like I said, if you know, if a subpoena does come, um, like I said, if they do get access to my database,

All they would get is kind of a a list of sightings that have been submitted. Um they pretty much would just get everything that the watchdog would have access to, which is n really nothing uh identifiable. So you know, they would get of course get the access of users lists. so what's cool about the users list, I guess the only thing that I guess would be identifying is we

So we don't keep a location history. what happens is when you open up the app, we do get your um the last um the latest location and it's it's rolling. So whatever last you open up the app at, uh, we do, you know, I mean that does go to our server so we know who to submit the sightings to. but then a set the second you open up your app in another location, then we lose that location and it gets updated. So yeah, it's just your last known location.

But uh for the people that are extremely cautious,

You can turn off um use my current location And instead what you can do is you can just set a location manually and that can be like you can set it to like an intersection nearby you you can, you know, whatever. And then instead of getting

you know, sighting alerts based on your actual location. You would just get sighting alerts based on whatever location you put in manually. So there's a you know, I would say there's a good, you know, I think ten percent of people who like to opt out of current location to just use the manual you know, the manual location to get their sightings from.

Ryan Koch (34:38)
Okay. So I I think it sounds like that attack surface for lack or risk surface is a better way to put it for a person would be kind of whatever the most recent location was at the point of a backup. So then there I guess there could be up to three in your in your set of data that someone could subpoena. Three locations.

Josh (34:57)
Mm-hmm.

Ryan Koch (34:58)
Um and then but no more is what I'm hearing. Cause I I believe you said it was daily, right? Cause and you're overwriting constantly.

Josh (35:01)
Correct. Yes.

Yeah, it's I'm overriding. Um i yeah, a after the third day, um any backups older than three days get automatically purged. So it's, you know, one, two, three days and then the older ones get purged per you know, constantly. So yeah.

Ryan Koch (35:22)
you've also said that the Electronic Frontier Foundation has reviewed antifreeze specifically.

Josh (35:28)
Mm-hmm.

Ryan Koch (35:29)
Uh what did that entail and what were the findings that that came out of that?

Josh (35:34)
I reached out to EFF and they reached out back out to me. I went on a a a phone call and they pretty much just kind of advised me on what I could do to mitigate, you know, um to make it as legal as possible, right? So uh they recommended me, you know, uh before the EFF review, I didn't have uh

the disclaimer on the report page. And then now whenever you go to report a sighting, it actually says community guide there's actually community guidelines now to report. Uh if you can see that, but yeah, um basically it entails, you know, do not

Uh do not harass or threaten anyone. Uh do not post, you know, personal information about the officers and do not attempt to obstruct law enforcement. And any violating post will be removed and could result in a ban. So yeah, if uh luckily no one has done that so far, but if anybody did, you know, post a sighting on there and says, let's go get let's go, you know, tip an ice car or something like that, of I would you know, I would of course remove that sighting and possibly even ban that user. Because, you know, we're not we're not trying to start chaos here. We're just

Trying to keep people informed.

Ryan Koch (36:44)
That that does make a lot of sense. And I think that's a good segue into kind of like safety and and and data stuff. Um

Josh (36:50)
Mm-hmm.

Ryan Koch (36:51)
you're probably aware the the Justice Department and the Department of Homeland Security have an opinion about apps like these. And they say that showing real-time agent locations puts those agents at risk. And that was the thing Apple cited about their argument when they pulled IceBlock, as we mentioned the at the very be very beginning. Uh what's your response?

to that concern and did it shape any of your design decisions?

Josh (37:16)
Well yeah, I know uh the administration does say the app puts agent at risk. Um, but, you know, uh the thing is is reports in my opinion, reports about law enforcement activity in public places, um, these are things anybody on the street can see can already see. Um, and it works just like a neighborhood alert and it's not like a tracker on a person, you know, no one's putting, I don't know, air tags on

ICE agents vehicles and that and then that's getting tracked in real time through the app. I mean it's just their activity, you know, being tracked. I also have it to where, you know, there are, you know, design limit reach. so yeah, alerts only go out to people wi within about five miles and you know, the sightings do drop off the map after forty eight hours, but the

The aim is to let families prepare and know their rights not to interfere. And, you know, I even say in there, you know, don't interfere with law enforcement. And I do understand that I don't have control over what people do with the data, but as I said before, you know, these are reports about law enforcement activity in public pace places Waze, you know, offers, you know, um

police sightings, you know, uh police up ahead, it's kind of you know first amendment. but yeah, that you know you can't post officer names, you can't post an officer's home address. That's all banned.

activity going on in public, you know, is in my opinion, you know, people have the right to know that.

Ryan Koch (38:49)
What scenario, if if there even is one that that you've imagined, would push you to either like pause the app's service or or take it down if kind of things got to a place where they were like kind of beyond your ability to control it?

Josh (39:02)
the only way I'd really would take the app down myself, and there have been lines that I have drawn. um if there's just been an infl if there's like an influx of the app being used to target individuals and just a bunch of people trying to dox ice agents um with their home addresses or phone numbers and trying to harass and and it's done it such a

rate that um it's just hard for me to moderate. I can see myself, you know, taking it down. Because like I said, I'm not trying to start chaos. I'm not trying to get anybody hurt. You know, I just wanted, you know, information to be public of public activity. if for whatever reason I'm not able to protect users' data, um, so if there's like a big compromise or something and somehow something's done where they're

data you know is compromised in a significant way, I'd probably pull it off. Or um if for whatever reason, if a bunch if a bunch of communities and a bunch of big areas start, you know, messaging me and telling me that uh it's doing more harm than good, then you know, I might pull it down then.

Ryan Koch (40:16)
I'm curious, um, I guess maybe twofold. One, uh has an agency uh kind of reached out like with the wish like dispute asiding or a record like on Flockwatch? Um, if that has or hasn't happened, like what sort of process do you have in mind if that's something on the government and that they decide they want to reach out to you about?

Josh (40:39)
Um, well yeah, if anybody wants to dispute a sighting, whether it be a flock camera sighting or a nice sighting or whatever, you know, the the the contact and support of antifreeze is out there. You know, they can reach out to contact at antifreeze.app support at antifreeze.app. There's, you know, a uh signal number that we have on our support page. There's, you know, many ways of um reaching out. But

You know, primarily I would just say just email us, and you know, we'll kinda show you where the public record of the entry like came from. And if the record is wrong, uh we'll mark the entry as, you know, disputed or even, you know, maybe deleted if it's completely false. But, you know, I I I'm not the type to just, you know, delete a public record. So

Ryan Koch (41:37)
I'd like to talk a little on sustainability, uh, as as our

Josh (41:41)
Mm-hmm.

Ryan Koch (41:41)
conversation goes.

You're also doing quite a lot with this being a solo operation. You've got now

Josh (41:48)
Mm-hmm.

Ryan Koch (41:48)
kind of a main product, uh, an i a a product next to it, um, a day job, and you know, you're keeping the infrastructure funded, you know, kinda all the things that go to keeping a system up and serving real folks. What happens if one day you wake up and you're starting to get burnt out or kind of the donations that help you fund it slow down?

Josh (42:10)
Mm-hmm. Yeah, I thought about that. And what is real is, you know, I am just one person with a day job, um, you know, paying for servers out of pocket and through donations. a fiscal sponsor is in progress, but not done. Um, I'm still trying to like get look into that. But I would say what already lowers the risk is sightings, you know, are shared with stop ice and defroster and vice versa. So alerts keep flowing, you know, even if I don't have the time to upkeep it.

you know, backups are off site and you know, Project Galileo covers the uh cloud, you know, and edge costs. Um but what would help the most is a second maintainer like a finished spit fiscal pro sponsor a finished fiscal sponsorship and reoccurring small donations.

Just it like all these small donations, all the you know, support contact that I have, it it it does give me a meaning to keep go you know, it does give me a meaning to keep going and keep pushing.

Ryan Koch (43:14)
Uh, next I wanna talk about kind of lessons folks can take from our conversation, also the work you've been doing, right? So something we've been talking about though, I don't think we've n necessarily used this phrase, is if actually like alternative infrastructure. What

Josh (43:27)
Mm-hmm.

Ryan Koch (43:28)
does that mean in practice for kind of small organizations and nonprofits that are kind of doing work in their mission spaces and what's a first step they could take?

Josh (43:37)
Yeah, so I would say uh to me it means owning the parts that would hurt most to lose, you know? So like owning your domain, your contact list, and your way of reaching people. Um, rent everything else in a way you can replace. So yeah. Um list, you know, so I would say the first step or the first lesson of alternative infrastructure would be to list every company.

could switch you off, um, including your app store host, domain registrar, email provider, payment processor, social account, and then pick the riskiest one and uh plan a replacement for it you know this month. Um you know free tools worth naming, you know, Cloudflare, Project Galileo, um they pretty much will support uh at-risk nonprofits.

Um PWAs and web push in place of app stores and signal use like signal or whatever for a sensitive support conversation or or use, you know, Proton Mail for sensitive uh re support conversations.

Ryan Koch (44:54)
If a listener out there has been inspired by our conversation and they want to build their own tool, maybe in some other, you know, space for their sensitive concerns like the ones we've talked about today, what would you want to tell them?

Josh (45:07)
so yeah, here's you know just some advice I would give. I would say collect less data than you think you need. You know, uh data you never you know stored can't be subpoenaed. So try to keep the data you collect as low as possible. Um also make your privacy claims as precise as your code. So um

You know what I mean? Like when you write your privacy policy, make sure to kind of like look into your code, make sure that's you know accurate. Uh and I learned this firsthand. Uh the gap between the marketing line and the policy is the first thing a careful reader will find and scrutinize. Um step three would be to talk to lawyers before you launch. Um you know, maybe reach out to the EFF, a law school clinic, or the NLG.

uh not not days after the letter shows up so you know be prepared in that arena um build with organizations already doing the work you know share the data with them and you know don't reinvent what exists you know d flock is a good example and then you know also the big one is plan for your own absence from day one

So, you know, whether it be a dead man switch or whatnot, just yeah.

Ryan Koch (46:26)
And as our conversation comes to its close, uh, for the listeners out there that are curious and want to follow your work, where should they

Josh (46:33)
Mm-hmm.

Ryan Koch (46:34)
go and do that?

Josh (46:35)
Yeah. So my kind of portfolio, everything is you can go to wafflehacker.dev uh W A F F L E Waffle and then Hacker H A C K E R dot dev, no spaces or dashes or anything. And there you would see, you know, list of all my projects. Um there you can find, you know, go to writing. So, you know, my writing, I write mainly on

Substack at wafflehacker.substack.com. another place where I write though is at the Daily Kos which is Daily Kos Uh that's daily uh K-O-S dot com uh slash user slash Josh hacks J-O-S-H-H-A-C-K-S. those but those are the primary places you can reach out to me.

Read my stuff.

Ryan Koch (47:33)
And worry not, folks.

I'll also make sure those things are in the show notes so that if you just want a clickable thing, you'll have it on your app or on YouTube or wherever it is you happen to be hearing me through the fourth wall right now. Cool. And Josh, uh thank you so much for joining us here on Civic Tech Chat.

Josh (47:50)
Thank you. Thank you for having me.

Ryan Koch (47:52)
Uh of course, yeah, yeah, this was a really fun conversation, and I think folks will

Josh (47:55)
Mm-hmm.

Ryan Koch (47:56)
get some really interesting stuff to learn out of your approach to alternative infrastructure.

Josh (48:01)
Absolutely. Yeah. Thanks like I said, thanks for having me.