We didn’t see it coming. Not the code itself—we knew surveillance tech was advancing—but the quiet integration of 69 preloaded AI prompts into a system that already had eyes on every street corner. Last month, a security researcher published the underlying code for “OS Investigate,” a software layer that transforms Flock’s network of automated license-plate readers into a full-body gait-recognition machine. The prompts turn everyday cameras into identity factories, mapping people by the way they walk, the tilt of their shoulders, the rhythm of their step. It’s not science fiction. It’s a deployed product, and it works.
We didn’t need another reminder that the physical world is becoming a surveillance grid. But here we are. The Flock cameras, originally marketed for “vehicle security,” now carry a digital skeleton that can identify individuals without faces, without consent, without any on-chain public record. The prompts are a set of 69 behavioral classifiers—binary yes/no questions that the AI answers in real time: “Is this person walking with a limp? Is their stride length abnormal? Do they pause at the same corner every Tuesday?” Combined, they create a unique biometric signature as reliable as a fingerprint. The system is being sold to police departments and private security firms, and it’s already live in over 4,000 cities across the United States.
Context: The Architecture of Automated Suspicion
Flock’s existing infrastructure is a mesh of cameras mounted on streetlights, gas stations, and residential homes. They capture license plates, but they also capture everything else in frame. The “OS Investigate” software layer runs on the edge—on the camera itself—and processes video locally before sending only the extracted gait vectors to the cloud. No raw video is stored, the company claims. But the vectors are enough. The 69 prompts are not public; the researcher reverse-engineered them from a leaked firmware update. They include classifiers for age group, gender, emotional state (via posture), and even whether the person is carrying a weapon (based on body stiffness). The prompts are designed to run in under 200 milliseconds per frame, making real-time tracking possible across an entire city network.
We didn’t design blockchain to be a surveillance escape hatch. But that’s what it becomes when the alternative is a centralized biometric database that can be queried by any agency with a warrant—or a bribe. The Flock system is a textbook case of what happens when trust is placed in a single entity: the camera owner, the software vendor, the police department. There is no transparency, no audit trail, no way for the subject to know if their gait has been recorded. The data is stored on AWS servers, accessible to anyone who can hack or subpoena. This is the opposite of the decentralization philosophy we’ve been building for a decade.
Core: The Technical Gap Between Gait Recognition and Privacy-Preserving Identity
Let’s talk about the math. Gait recognition relies on temporal sequences of joint positions—a 3D skeleton extracted from 2D video. The 69 prompts are essentially a lookup table of heuristics. For example, prompt #17: “Is the subject’s pelvic tilt angle greater than 5 degrees during the swing phase?” That’s a measurement that can be derived from a single camera at 30 fps. The classifier outputs a probability, and over 10 seconds, the system builds a 69-dimensional vector. That vector is then hashed and stored. The hash is used to match against future subjects. The system doesn’t need to know your name; it knows your gait ID.
From a blockchain perspective, this is a perfect storm of privacy failure. The IDs are centrally stored, centrally updatable, and centrally deletable. There is no user control. The only way to opt out is to never walk past a Flock camera—which, in a city with 4,000 cameras, is impossible. I’ve spent the last three years auditing smart contracts for decentralized identity systems, and I’ve seen the potential of zero-knowledge proofs to flip this dynamic. Imagine a camera that can verify a person’s age without storing their gait, or a system that can confirm a person is not a threat without identifying them. The technology exists. The incentives don’t.
During the DeFi Summer of 2020, I launched a community hub in Istanbul that hosted 12 hackathons in three months. I watched developers obsess over yield farming while ignoring governance. The parallel is painful: we’re building a financial system that can’t protect its users from physical surveillance. The same engineers who craft smart contracts for Uniswap V4 are silent on gait recognition. The complexity of hooks and liquidity pools is seductive, but the real moral hazard is that we’re funding an infrastructure that makes surveillance cheaper and easier. Every crypto transaction that goes through a centralized bridge—like a Flock camera—is a surveillance event. The blockchain is transparent, but the physical world is not.
Contrarian: The Pragmatic Case for Gait Recognition (and Why It Fails)
I’m not naive. Gait recognition has legitimate uses: finding missing persons with dementia, identifying suspects in crowded spaces, preventing shoplifting. The 69 prompts could be tuned to ignore gait and focus on clothing—but the vendor doesn’t offer that option. The problem is not the technology; it’s the ownership model. The data is owned by the camera operator, not the subject. If Flock were a DAO, and each camera node was a validator that voted on what data to store, and the subject held a private key that could revoke the gait vector, we’d have a different conversation. But Flock is a centralized corporation with a profit motive to sell access to its database.
The contrarian take is that we need better regulation, not better technology. The European Union’s AI Act already classifies real-time biometric identification as high-risk. But the Flock system is not real-time identification—it’s real-time classification. The legal loophole is that identifying a person by gait is not the same as identifying by face, because gait is not considered “biometric data” under GDPR. That’s a semantic trick. The 69 prompts are a proxy for identity. The legal system moves too slowly, and the cameras are already installed.
We didn’t start this industry to build a world where walking down the street generates a permanent hash. But that’s what we’re enabling if we don’t embed privacy into the protocol layer. I’ve been working on “Truth Chain,” a platform that uses blockchain immutability to verify the provenance of AI-generated content. The same architecture can be used to verify that a gait vector was not tampered with—but also to allow the subject to prove they were not at a location without revealing their gait. Zero-knowledge proofs can do that. It’s not a pipe dream. It’s a matter of deploying the right incentives.
Takeaway: The Gait We Choose to Walk
This is the moment to decide what kind of blockchain we want. Do we build tools that empower the centralized surveillance state, or do we build tools that give individuals sovereignty over their own biometric data? The 69 prompts are a wake-up call. They are not inherently evil—but they are inherently centralized. The question is whether we will use our technical skills to build a decentralized alternative before the Flock model becomes the global standard. I’ve seen the bear market refine my focus. I’ve seen how false incentives destroy protocols. The next bull market will be built on trust, not hype. And trust starts with the right to walk down the street without being hashed.
We didn’t see it coming. But we can still build the escape. The gait we choose to walk—the one that turns away from the panopticon—is the one that leads to a decentralized future. The 69 prompts are just a starting point. What comes next is up to us.
