This Shirt Is Designed to Poison Surveillance Databases Like Flock

This Shirt Is Designed to Poison Surveillance Databases

The camera sees clothing. The computer sees license plates.

Automatic License Plate Readers are supposed to recognize cars.

Point a camera toward traffic.

Identify a license plate.

Read the characters.

Record the location.

Record the time.

Store the result in a searchable database.

But cybersecurity professional and designer Kate Rose asked a very hacker-like question:

What happens if you give the machine exactly what it’s looking for—but put it somewhere it doesn’t belong?

Her answer was adversarial fashion: clothing covered with patterns designed to resemble license plates closely enough that some automated plate-reading systems could mistake the shirt itself for a collection of vehicles.

The goal isn’t to become invisible.

It’s almost the opposite.

Make the surveillance system see too much.

Your Shirt Becomes a Database-Pollution Device

Rose showcased the concept at DEF CON in 2019.

The garments use repeating rectangular designs containing alphanumeric characters resembling license plates.

That’s important because an Automatic License Plate Reader, or ALPR, isn’t looking at the world the way you do.

You see:

A person wearing a weird shirt.

A computer-vision system may instead be looking for features associated with its assigned task:

Rectangular region.

Plate-like proportions.

Characters.

Expected visual patterns.

Potential plate detected.

Read characters.

Record.

Rose’s experiment exploited that difference.

If the system incorrectly recognizes patterns on the clothing as plates, it could generate false detections.

Now the database contains information that shouldn’t exist.

That’s Much More Interesting Than Hiding Your Face

Most people’s instinct when thinking about defeating surveillance is concealment.

Hide your face.

Cover the plate.

Avoid the camera.

Rose’s approach demonstrates a completely different security concept:

Don’t hide from the sensor. Manipulate what the sensor believes.

In cybersecurity and machine learning, this broader concept is often associated with adversarial examples—inputs deliberately designed to cause automated systems to classify something incorrectly.

The human observer may immediately understand what’s happening.

The algorithm may not.

And that difference can become an attack surface.

Imagine One Shirt Creating Dozens of “Cars”

Consider the basic concept.

You walk past an ALPR camera wearing a pattern containing numerous fake plates.

The system correctly captures your physical location.

But instead of recording one legitimate vehicle plate, a vulnerable recognition system might generate multiple false plate readings associated with that location and time.

Those records could then become noise inside the larger dataset.

Rose described the project as a way of introducing junk data into surveillance systems.

That’s what makes the idea so clever.

The clothing isn’t attacking the camera.

It isn’t hacking the network.

It isn’t breaking into a server.

It’s attacking the assumption behind the data collection.

The system assumes:

If I recognize something as a license plate, a license plate was actually there.

Adversarial fashion asks:

What if that assumption is wrong?

Why ALPR Data Is So Powerful

License-plate readers don’t merely answer:

“What cars are driving past this camera right now?”

Their real power comes from retention and aggregation.

A plate observation can contain:

The plate number.

Date.

Time.

Location.

Potentially vehicle characteristics or associated imagery, depending on the system.

One observation isn’t necessarily remarkable.

But repeated observations can begin creating a history.

Car ABC123 was here Monday morning.

Here Tuesday evening.

Here Wednesday.

Here again Friday.

Now combine observations from many cameras.

The result can potentially reveal movement patterns.

That’s why privacy advocates are so interested in ALPR deployments.

The sensitivity isn’t necessarily contained in any single photograph.

It’s created by connecting thousands or millions of observations together.

Flock Safety Has Helped Scale This Model

Flock Safety⁠ is one of the best-known companies operating in this space today.

Its license-plate recognition technology is used by law-enforcement agencies and communities to help investigate crimes.

Supporters argue that these networks give investigators a powerful tool for identifying suspect vehicles, locating stolen cars and reconstructing events.

Privacy advocates see another side.

A sufficiently large network of cameras creates a searchable record of where vehicles have been observed.

And that creates an unavoidable cybersecurity and privacy question:

Who gets to search it?

Surveillance Databases Need Cybersecurity Too

This is where this story becomes relevant beyond a novelty shirt.

Whenever an organization builds an enormous database of sensitive information, cybersecurity professionals should ask:

Who can access it?

How is access authenticated?

Are searches logged?

How long is information retained?

Can employees misuse it?

Can accounts be compromised?

Can agencies share access?

Can inaccurate information be corrected?

Can the underlying sensor be manipulated?

That last question doesn’t get enough attention.

We spend tremendous effort securing databases against unauthorized access.

But a perfectly secured database filled with bad information is still a bad database.

Data integrity matters as much as data confidentiality.

Garbage In, Surveillance Out

This is one of the oldest principles in computing:

Garbage in, garbage out.

AI doesn’t magically eliminate that problem.

It can magnify it.

If an automated system incorrectly identifies an object and nobody catches the mistake, that incorrect observation can potentially become a permanent database record.

Now imagine millions of automated decisions.

Computer vision.

Facial recognition.

Fraud detection.

Security cameras.

License-plate recognition.

Medical imaging.

AI-generated threat alerts.

The question isn’t merely:

How accurate is the system?

It’s also:

What happens when somebody intentionally tries to make it wrong?

That’s adversarial thinking.

And every organization deploying AI needs people asking that question.

Your Business Probably Uses Computer Vision Already

This isn’t only about police cameras.

Businesses increasingly rely on automated recognition systems for:

Building access.

Warehouse monitoring.

Inventory.

Manufacturing.

Security cameras.

Package identification.

Vehicle access.

Fraud detection.

Document processing.

Schools and healthcare facilities are adopting increasingly sophisticated physical-security systems as well.

If an automated decision has security consequences, you need to understand how that decision can fail.

Can a badge reader be fooled?

Can an image-recognition system misclassify something?

Can somebody manipulate a QR code?

Can an AI document processor be given malicious instructions?

Can false information poison an automated workflow?

The more decisions we delegate to machines, the more valuable manipulating the machine’s perception becomes.

AI Security Isn’t Only About Protecting the AI

This distinction matters.

When businesses talk about AI cybersecurity, they often think about:

Someone stealing the model.

Someone stealing training data.

Employees uploading confidential information.

An attacker compromising the AI provider.

Those are legitimate concerns.

But there’s another category:

Making the AI confidently do the wrong thing.

That might involve adversarial images.

Poisoned training data.

Prompt injection.

Manipulated documents.

False sensor inputs.

Carefully constructed text.

The exact attack changes depending on the system.

The principle doesn’t.

An attacker doesn’t always need to break the machine. Sometimes they only need to control what the machine sees.

Humans Need to Remain Part of High-Stakes Decisions

Suppose an automated system reports:

Vehicle XYZ was at this location at 11:42 PM.

That information can be valuable investigative intelligence.

But automated recognition shouldn’t magically transform probability into certainty.

For high-consequence decisions, organizations need procedures for validation.

Review the underlying image.

Corroborate the location.

Check timestamps.

Look for additional evidence.

Understand the system’s error rates.

Preserve audit logs.

Know whether the detection was automated.

Because the computer saying:

“93% confidence”

doesn’t mean:

“This happened.”

It means the computer is 93% confident according to the way it was designed to calculate confidence.

Those are very different statements.

The Shirt Is Really a Cybersecurity Lesson

Rose’s clothing is funny.

It’s provocative.

And it’s visually brilliant.

But underneath the novelty is a serious security principle.

She didn’t need to compromise the database.

She challenged the input.

That’s exactly how cybersecurity professionals are supposed to think.

Don’t merely ask:

How is this system supposed to work?

Ask:

How could somebody abuse it?

What assumptions does it make?

What happens if those assumptions aren’t true?

What inputs does it trust?

Can those inputs be manipulated?

What happens downstream when they’re wrong?

Those questions apply to practically every emerging AI system businesses are deploying today.

The Machines Watching Us Can Be Fooled Too

We increasingly live surrounded by automated systems attempting to interpret reality.

They read:

Faces.

Voices.

License plates.

Documents.

Emails.

Transactions.

Behavior.

Network traffic.

And increasingly, businesses are trusting those interpretations enough to make decisions automatically.

That creates incredible efficiency.

It also creates a new attack surface.

Kate Rose’s adversarial fashion demonstrates the problem beautifully.

A human sees someone wearing a shirt covered in fake license plates and immediately understands:

Those aren’t cars.

The machine may see something completely different.

And once its mistake enters a database, that mistake can become part of the system’s version of reality.

The next generation of hacking won’t always attack computers.

Sometimes it will attack what computers think they’re seeing.

70% of all cyber attacks target small businesses, I can help protect yours.

#Cybersecurity #ArtificialIntelligence #DataPrivacy #ComputerVision #DataProtection

This shirt doesn’t hide you from surveillance. It tries to make the surveillance system hallucinate.