No data breach but plenty we can do better.

I welcome the criticisms of Skydio raised by last week’s Wired article on Skydio and the San Francisco Police Department. When we sell to law enforcement, our ultimate customer is the community served by the public safety agency. Our products are purchased by tax dollars to provide a public good, and the public damn well has a right to scrutinize both Skydio and the agencies we serve. There is always something we can learn from critical inquiry, and in this case there is plenty we will improve on.

SFPD created a ReadyLink - a web url that gives access to the live video stream from one or multiple drones. ReadyLink is a life-saving feature we built in response to customer demand. Its most common use is for responding officers on the ground to see the drone footage so they know exactly what they’re heading in to, but it’s also frequently used for police and city leadership to keep tabs on major operations. It gives senior leaders the ability to redirect actions on the ground if things are heading south, and I believe it can play a meaningful role in better policing and realtime accountability.

ReadyLinks are usually set to expire in 24 hours, and you can also set a security pin to control access. In this instance the link was set to last a year and there was no pin. The link somehow made it to the open internet and was discovered by security researchers who recorded the livestreams and shared them with the press.

Nothing technically went wrong with our software - we weren’t hacked - and as SFPD said in a statement, the links were “improperly obtained and accessed by individuals without authorization.”

But in my view our product made it much too easy for this kind of long lived ReadyLink with no security protection to be created, and for our customers to have no insight into who was viewing it and if they had proper authorization.

While I might quibble with some of the framing of Wired and the security researchers, and I challenge all of our critics to do their own reckoning with the obvious, life-saving impact of drones for public safety, I thank them for calling attention to this issue. There is a lot we can do to make these links more secure and to give our customers better control and visibility into who is accessing the data. We are doing those things now. Ideally it wouldn’t have taken an incident like this for us to take these steps, but here we are. I apologize to SFPD and the San Francisco community for this.

One of the most interesting things about Drone as First Responder is how local news covers it. Journalists embedded in the communities these programs serve feel the impact firsthand. They know the neighborhoods, they talk to the families and first responders, and they see what faster response time and greater situational awareness actually mean when emergencies occur. That closeness to the community has come through in coverage throughout the country with rigorous firsthand reporting on what these programs deliver for the people they serve. As DFR becomes more commonplace, I expect we’ll also see more scrutiny and probably more negative press from national organizations and outlets who aren’t as close to the positive impact. I’m sure the quality of the criticisms will vary, but there is almost always something to learn and improve on - even from coverage we might view as unfair - and it’s the public’s right to question us since our stuff is bought with public dollars and is deployed on the public’s behalf.