On a Tuesday morning in late March, a security researcher posted a single line of code on a public forum. It was a configuration file from a company called Flock Safety, a firm that sells surveillance cameras to police departments and homeowners associations across the United States. The line revealed that the underlying code for a product named 'OS Investigate' contained 69 preloaded AI prompts — prompts that turn ordinary cameras into a super-charged surveillance system capable of identifying people not by their faces, but by how they move. The system tracks gait, posture, the length of a stride, the swing of an arm. It doesn't need your face. It doesn't need your name. It needs only your body's unique signature, and it will follow you across parking lots, through city blocks, from one camera to the next, without your consent, without your knowledge, and without any meaningful oversight.
I read that forum post at 3 a.m. in my apartment in Shanghai, a city that knows something about surveillance. I have spent the last seven years building Web3 communities, auditing DAO governance models, and translating the philosophical promise of decentralization into code that people can trust. But this discovery — 69 prompts that turn a camera into a biometric tracker — is not a blockchain story. Or is it? Because the moment we accept that a private company can build a distributed network of cameras that identifies individuals by their movement patterns, we have crossed a threshold that makes every conversation about decentralized identity, zero-knowledge proofs, and self-sovereign data not just relevant, but urgent.
Let me be clear: Flock Safety is not a blockchain company. It is a surveillance company that sells hardware and software to law enforcement. But the underlying architecture of OS Investigate — a network of cameras, a central database of behavioral signatures, and a set of AI prompts that convert raw video into searchable profiles — is a perfect example of what happens when centralized systems achieve scale without accountability. And the Web3 community, which has spent years building tools for decentralized identity, has a moral obligation to respond.
This is not a polemic against police technology. This is a technical analysis of why the 69 prompts in OS Investigate represent a failure of system design that only a decentralized, blockchain-based identity layer can fix.
Context: The Architecture of OS Investigate
Flock Safety's OS Investigate is a cloud-based platform that aggregates video feeds from thousands of cameras installed in neighborhoods, businesses, and public spaces. The cameras are not traditional CCTV. They are AI-powered devices that capture license plates, vehicle makes and models, and now, according to the leaked code, human movement patterns. The 69 prompts are preloaded instructions that tell the AI what to look for: 'walking with a limp,' 'running with a backpack,' 'carrying an object,' 'pacing nervously,' 'loitering near a vehicle.' Each prompt is a classifier that converts a continuous stream of video into discrete data points — a person's gait signature, their posture profile, their habitual movement patterns.
From a technical perspective, this is impressive. Gait recognition is a biometric modality that has been studied for decades, but only recently has deep learning made it practical for real-time surveillance. The system does not require a clear view of the face. It works at a distance, in low light, from oblique angles. It can re-identify a person across multiple cameras even if they change clothes, obscure their face, or walk in a crowd. The 69 prompts are essentially a dictionary of behavioral signatures that the system uses to index every person it sees.
But here is the critical detail: the system is centralized. All video data is uploaded to Flock's cloud servers. The prompts are updated centrally. The database of movement signatures is owned and controlled by a single company. Local police departments that subscribe to the service do not run their own models. They query Flock's API. They do not own the data. They rent access to it.
This is where the blockchain analogy becomes unavoidable. Flock has built a distributed network of cameras — distributed in the sense that they are geographically dispersed — but the governance and data ownership are utterly centralized. It is a permissioned network where the node operators (camera owners) have no control over the protocol. They cannot audit the prompts. They cannot opt out of new features. They cannot see what data is being collected about themselves or their neighbors. The system is opaque by design.
Based on my experience auditing DeFi governance protocols, I can tell you that this architecture is a textbook example of the principal-agent problem. The cameras are the agents, but the principal is a single corporate entity with no public accountability. The 69 prompts are not disclosed to the communities being watched. The biometric signatures are not protected by zero-knowledge proofs. The system is designed to maximize data collection, not to minimize privacy intrusion.
Core Analysis: The 69 Prompts as a Mirror of Centralized Failure
Let me walk through the technical implications of those 69 prompts, because they reveal a deeper structural problem that the blockchain community is uniquely positioned to solve.
First, the prompts are proprietary. They are not open source. This means that neither the public nor independent researchers can verify what the AI is actually doing. A prompt that says 'identify a person walking with a limp' could be perfectly neutral, or it could be biased against people with disabilities. A prompt that says 'loitering near a vehicle' could be a crime prevention tool, or it could be a tool for racial profiling. Without transparency, we cannot know. And the company has no incentive to disclose, because the prompts are their competitive advantage.
In the blockchain world, we have a term for this: 'trusted third party.' And we have spent a decade proving that trust is not a security model.
Second, the system generates a single, immutable record of a person's movement patterns. Once your gait signature is captured and indexed, it is stored forever. There is no mechanism for consent, no right to deletion, no way to challenge the accuracy of the data. If the system misidentifies you — if it confuses your gait with someone else's — you have no recourse. The data is stored in a centralized database, and the database owner decides what is true.
This is the exact opposite of what decentralized identity systems aim to achieve. Projects like Ceramic, Idena, and the various DID (Decentralized Identifier) frameworks are building systems where identity data is owned by the individual, encrypted with their keys, and shared only with explicit consent. A zero-knowledge proof could allow a person to prove that they are a legitimate resident of a neighborhood without revealing their movement history. The 69 prompts, by contrast, are designed to extract as much information as possible without consent.
Third, the system is designed for scale without accountability. Flock claims to have cameras in over 4,000 communities. That means millions of people are being tracked by a system that has no governance framework, no elected oversight, no community vote on the prompts. If a DAO had a controversial proposal — say, to add a new biometric tracking feature — the community would vote, debate, and potentially fork. In Flock's system, the company just pushes an update. The users (camera owners) are not participants in governance. They are customers.
I have seen this exact pattern in the Web3 space. Projects that start with a noble mission — 'we want to make cities safer' — and then gradually centralize decision-making, because it's faster, because it's more efficient, because the founders 'know best.' The result is the opposite of the original intent.
Contrarian Angle: The Web3 Industry's Own Blind Spots
Before we congratulate ourselves on being the solution, let me be honest about the failures within our own industry. The 69 prompts of OS Investigate are a mirror, and what they reflect is not flattering for the blockchain community.
First, many so-called 'decentralized identity' projects are themselves centralized in practice. I have audited DAO grant committees that allocate funds for identity projects, and I have seen the same nepotism that plagues traditional venture capital. Projects that claim to be building 'self-sovereign identity' often rely on a single foundation to control the protocol, a single airdrop to distribute tokens, a single team to write the code. The 69 prompts are a reminder that centralization is a spectrum, not a binary. We are not immune.
Second, the blockchain community has a tendency to overpromise on privacy. Zero-knowledge proofs are powerful, but they are not magic. They can prove that a statement is true without revealing the underlying data, but they cannot prevent the system from collecting data in the first place. If a person walks past a Flock camera, the camera captures their gait. No amount of on-chain cryptography can undo that. The blockchain solution is not to fix the surveillance system after the fact, but to build a different kind of network — one where the cameras are owned by the community, where the data is encrypted at the edge, and where the prompts are voted on by the people being watched.
Third, there is a real risk that blockchain-based identity systems could be co-opted by surveillance states. Imagine a government that mandates a decentralized identity as a condition for accessing public services. The same technology that protects your privacy could be turned into a tool for control. The 69 prompts are a warning: any identity system, no matter how decentralized, must be designed with an explicit anti-surveillance bias. That means consent must be the default, not an option. Data must be ephemeral, not permanent. Governance must be local, not global.
I have written before about the collapse of FTX and how centralization of power led to moral hazard. The 69 prompts are a similar story, but on a different scale. The moral hazard is not about losing money; it is about losing the right to move through the world without being tracked.
Takeaway: The Verifiable Humanity Imperative
So what do we do? We cannot uninvent gait recognition. We cannot uninstall the 69 prompts. But we can build alternatives that are structurally better.
This is why I co-founded a community initiative called 'Verifiable Humanity' — a project that uses blockchain-based identities to distinguish human-generated content from AI-generated content, and to protect human authenticity in a world of deepfakes. The same logic applies to physical surveillance. We need a decentralized protocol for identity that is not based on biometrics, but on consent. A protocol where every interaction is recorded on a public ledger, but the data itself is encrypted and shared only with the individual's permission.
The 69 prompts are a wake-up call. They prove that centralized surveillance systems are not just a privacy issue. They are a governance issue. They are a trust issue. And they are a design issue that the blockchain community has been working on for years.
Here is the forward-looking thought: The next generation of Web3 applications will not be about DeFi or NFTs. They will be about identity. They will be about proving that you are a human without revealing your location, your gait, your face. They will be about building networks where the nodes are owned by the people, where the prompts are open source, and where the data belongs to the individual.
If the 69 prompts teach us anything, it is that the future is being built right now, and we have a choice. We can let centralized companies build the infrastructure of surveillance, or we can build the infrastructure of sovereignty. The code is already written. The prompts are already leaked. The question is whether we will use them to justify more control, or to inspire better alternatives.