The cameras signed the video. Nobody signed the search.

On August 26 a standards body most people have never heard of published something I have wanted for ten years. ONVIF, the group that makes cameras from different manufacturers talk to each other, released a candidate spec called Media Signing. A camera that supports it signs the video as it encodes it. Anyone with the public key can later prove the footage came from that camera and has not been altered since. The signing and verification code is open source. Video only for now, audio later, and ONVIF says the final version lands by the end of the year.

Nobody on X posted about it. I checked. The same week, the physical security world on X was consumed by one company's license plate readers, and for good reason. Flock Safety spent August getting audited in public. The Washington Post counted more than 50 officers charged with or accused of using the plate network to track people they had no business tracking. Flock answered on August 13 with a package of fixes, a case code on every search by year end and anomaly detection that flags odd search patterns among them. Nine days later Georgia investigators arrested three former Savannah officers and one former civilian employee for misusing the same system. The department found it because someone read the audit log. On September 9 an Albany County, New York sheriff's investigator was charged after more than 4,000 personal searches, most of them on an ex. That one started with an outside tip; the log only supplied the count. The same day a former Wrightsville Beach, North Carolina officer was indicted for misusing the same kind of system.

Then Wired pulled apart the public code behind a Flock product still in testing and found an AI investigator with dozens of ready-made prompts, fourteen of which needed no plate, no name, and no description to start a search. On September 7 the Pittsburgh Post-Gazette reported it was still in testing with a small group.

Put the two stories next to each other. We now have a standard for proving a piece of evidence is what it claims to be. We have nothing for proving a search was what it claimed to be. The video can testify. The search still needs a character witness.

Think about what a signed video actually gives a court. The camera vouches for the footage at the moment of capture, and the vouching cannot be forged or removed after the fact without the math showing it. The custody chain starts at the sensor.

An audit log gives a city council less. A row in a database that says an officer ran a plate on a date with a reason code. Lou Hayes Jr., a Chicago-area detective supervisor twenty years into these systems, has spent August arguing for that row in his own ALPR series: verified search purposes, audit trails, penalties for misuse, and a few extra clicks before older data opens. I agree with every word. The row is still the weak point. Who wrote the row? The same system the officer was using. Who holds it? The vendor. Who can change it? Ask them. Every one of the cities that walked away from their plate readers this month got there by reading those rows. Savannah's arrests came from those rows. A volunteer site that now lets anyone look up whether their plate has been searched works by pulling those rows out of public records requests. The log is the control that worked in August. Be honest about why. It worked because nobody had thought to touch it. Every officer, every vendor, every city attorney in the country now knows the log is what gets you caught. Controls that work by obscurity stop working the day they make the news. It is also a plain text record produced by the party being audited, and Senator Hawley's September 2 letters to Motorola, Verkada, and Axon asked, in so many words, for exactly that record back to January 2021.

Cities are landing in different places. Santa Barbara kept plate readers and switched vendors so the footage would live inside its own system. Tempe turned its cameras off and said it will not replace them with anyone. Dallas will lose the state-funded cameras this month and, in a nonbinding budget vote, signaled it will keep the ones it pays for itself. All three are defensible. None of them can prove a search record was never touched. They read it and hope.

I do not think that is a Flock problem. Flock is the company whose logs got read because Flock has more cameras than anyone else, more than 120,000 across 49 states by Senator Hawley's count. Every platform that lets an operator query a plate, a face, a trajectory, or a clip has the same shape: an action against evidence, and a record of that action written by the platform itself.

The ask is smaller than it sounds. The camera industry just agreed on how a device signs what it saw. The software industry should agree on how a system signs what it did. The record of a search should be produced by a component the searcher cannot reach, signed at the moment of the action, and verifiable by the city without the vendor's help. Nothing exotic about it. Same math ONVIF just shipped, pointed at a different file.

Three questions for the next contract, or the next council meeting.

One: who produces the search log, and can the person or process being logged write to it?

Two: can the city verify a log entry is unaltered without asking the vendor?

Three: when the log cannot be written, does the search fail, or does it proceed with a warning?

If the answer to the first is the vendor's application, the second is no, and the third is proceed, you do not have an audit trail. You have a diary the author keeps.

The objection I expect is that the logs are already immutable. Write-once storage, tamper-evident, the works. Good. Immutable storage stops a row from being edited after it lands. It says nothing about who wrote the row, whether the row was written at all, or whether the process that writes rows was running when the search happened. Savannah's audit caught officers who did not know the log existed. The next ones will know.

A note on my two hats. My day job is at a company that sells software to police departments, and I work independently on signed action records for exactly this problem. Read that as a bias if you like. I would rather you read it as why the ONVIF release made my week and nobody else seemed to notice.

So here is the question for this week, and it takes one word to answer. In your city, who holds the key that proves a search record is untouched: the vendor, the city, or nobody? Put the word in the comments. I will tally them Friday and publish the count, no names, no cities.

The cameras can sign the video now. Ask who signs the search.