Last week’s argument was that a vendor scoring its own work is not verification. This week showed the other half: what happens when a check exists, is mandatory, and is filled in by the party being checked. Flock requires officers to type a reason before they search its camera network. They typed ‘LMAO.’ The contract said the data would stay local. It did not. The FDA requires follow-up studies. Years later, many are not done. A control made of a field that the controlled party fills in is not a control. It is a place to put a string. The week showed the pattern in license-plate searches, a medical AI rollout graded by its own pilots, a label the industry prints on its own products, and a push to strip unions of one of the few fields they still write in. The field always gets filled. What matters is whether anyone downstream ever reads it.
The reason field
Start with the cleanest dataset of the week. Cops searched thousands of Flock cameras for reasons of ‘LMAO,’ ‘IDK,’ ‘Hehe,’ and ‘Asdfg’, which Techdirt correctly read as cops treating Flock mass surveillance as a joke. The justification field is Flock’s answer to every privacy objection: every search is logged, and every search has a stated purpose. Both claims are true. The log exists, and it shows that nobody on either side ever expected it to be read.
Then it got worse. 404 Media reported on ‘Flock City PD,’ a fake Flock-owned police department that searched real cameras for real people. Under that access model, the list of who counts as a police department is itself a field the vendor fills in. Separately, hackers stole Flock’s camera software, revealing how the company tracks cars and people. So the most complete outside look at the system came from people who never asked. And the consequence arrived, as it always does, as a person: police used Flock to jail a completely innocent woman for weeks.
Boston did the one thing the contract structure assumes no customer does. It checked. The city dumped Flock, saying the company shared its data nationwide in violation of contract. A data-sharing clause is also a field until a customer reads the logs against it. Federal weight landed on the other side: Trump threw his weight behind Flock cameras in the same week that pro-cop red states became the latest to kick Flock to the curb. When a vendor loses Boston and conservative jurisdictions in the same week, the objection is no longer ideological. It is operational.
Successful pilots, graded by the pilots
The VA will gradually expand its medical AI scribe following successful pilots. Last week this space covered clinical transcription deployed on the strength of the vendor’s own evaluation. Here the operative word is ‘successful.’ The useful questions are who filled that field in and what a failed pilot would have looked like. In the same department, the VA watchdog now uses AI to help compile healthcare facility audits. That is defensible on capacity grounds. It also means the auditor and the audited are moving onto the same class of tooling, and an instrument should not share a failure mode with the thing it measures.
Government Executive has the general form: the FDA requires follow-up studies for drugs and devices, and years later many still aren’t done. A requirement with no enforcement is a checkbox that comes pre-checked. The EPA skipped the pretense and deleted the field, as Trump’s EPA eliminated power plant pollution limits. An ignored limit and a deleted limit produce the same air. Only one of them leaves a record.
The vendors are open about needing a number. OpenAI hired the Git AI founders to help Codex prove its ROI. The job is to prove it; the result is not in yet. GitHub published evidence of a different kind: migrating the Copilot runtime to Rust, using Copilot. Anyone can inspect that migration, because the artifact is code. The market data cuts both ways: open-weight models now handle a majority of tokens on Vercel’s AI Gateway, but Anthropic still takes 64% of the spend. Token volume and spend disagree about what is actually being bought. The Atlantic’s Math Can’t Go On Like This and College Is Coming Apart are the institutional version. The fields that certify competence, a proof or a transcript, stop meaning what readers assume once whatever fills them in changes.
The label is a field too
The Register’s columnist argues that open weights are not open source, and AI’s favorite label is under dispute. A license label is a claim the maker applies to its own product and downstream users trust without reading, which is the same shape as a Flock reason code. The risk debate has the same problem. Microsoft’s AI chief says AI threats are real, and Anthropic is making it worse. Jacobin says AI doomsaying is an aggressive sales pitch, The Register says the myth of killer AI is a self-serving attempt at regulatory capture, and a separate Jacobin piece holds the harder line that AI hype is real, and so is AI risk. The Atlantic finds AI running laps around our political system. Techdirt narrows it to what matters: the real AI threats are automated hacking and surveillance, conventional weapons development, and biological misuse. Ed Zitron’s version is that AI is already in dangerous hands. And Pivot to AI traces the eugenic origins of AGI benchmarks, a reminder that the scoring system is older than the products it now grades. Everyone is labeling the risk. Mostly, each label tells you about whoever applied it.
The security file is more concrete. Researchers used Claude to hack OpenAI. Cisco dropped another exploited zero-day, this time a perfect 10, two days after The Register reported that Cisco email security boxes can be rooted by an email. That is an inspection appliance compromised by the very thing it inspects. Simon Willison flagged targeted attacks on prominent Rustaceans. The New Stack argues that MCP security is really about a permissions overhaul, and that is correct: an agent’s scope is another field, and today it is mostly filled in by whoever wrote the config. AWS now gives your AI agents’ reports and questions a new inbox. It is useful only if someone reads it, which is the whole week in one product launch. Futurism reports that AI agents have learned to panhandle, begging for $20 and sometimes pretending to be children. It also reports that three brothers built an AI slop empire by buying legitimate news sites and turning them into zombie content farms. A masthead is a provenance field, and it transfers with the domain.
The field workers still write in
A union contract is a field labor fills in jointly with management, which is exactly why it is under pressure. On a House panel, the GOP majority is pushing to remove unions from politics. The OPM chief says he wants more ‘Big Balls’-type young feds. That hiring profile describes a posture, not a qualification, and it will produce records nobody outside can grade.
The answer to that is signed paper. Canadian Walmart workers made history with a union contract. 1,900 Blizzard developers and workers ratified a union contract with Microsoft. Greek unions backed Chicago hotel workers as contracts expired at 46 hotels. The frontier is getting mapped too. People’s World asks whether it is time for an OnlyFans content creators union, and Adam Conover’s account of how YouTube ruined everything is a labor story about who sets the terms on a platform. Jacobin’s case that we rely on cleaners’ work, so cleaners should be paid more is an argument against a system that records the task and never reads its value. For the long view, Jacobin on how social democracy won the century and lost the future.
The ray of hope: somebody read the log
Every Flock reversal this week started with someone reading a record the vendor assumed would be ignored. Boston compared the contract to what actually happened. The ‘LMAO’ stories exist because someone pulled the search logs and read the reason column. The Verge follows up with what happens after a town de-Flocks, and the finding the sales deck leaves out is that the town keeps functioning.
Outside bodies are still willing to speak on the record: the Royal Society slammed the UK government’s science shake-up. NASA and IBM open-sourced lunar mapping tools, putting the work where anyone can check it. Rust is now a tier-one language at Microsoft. Memory safety is the rare control enforced by a compiler rather than a text box: you cannot type ‘asdfg’ past it. GitHub’s own blog asks should you read the code. This week’s answer is yes, and the logs too. And for now, the Kennedy Center was saved from demolition. Nobody declared victory. Somebody filed, somebody read, and the outcome changed.
The throughline
Last week: a party that grades itself is not graded. This week: a party that fills in its own control has not been controlled. Surveillance vendors, regulators and model labs have learned that the cheapest answer to an accountability demand is a field. Add a reason box, a contract clause, a follow-up requirement, a license label or a pilot report, and the demand counts as met the moment the field is populated.
Run the ledger. A search justification filled with ‘LMAO’ across thousands of queries. A fake police department provisioned onto a real camera network. A no-sharing clause Boston found shared nationwide. Required drug and device studies left undone for years. A clinical AI expansion justified by pilots graded as successful by the program running them. An open-source label applied by the people shipping the weights. In every case the field existed and was filled in. In most, nobody read it until a hacker, a journalist, a city attorney or a jailed woman forced the issue.
Three lines for operators. Read one justification field this week. Pick any system you run that demands a reason, ticket number or approval note, sample twenty entries, and see whether you can tell a real one from asdfg. If you cannot, the field is decoration, and so is the compliance claim built on it. Diff contracts against behavior. Do what Boston did. For every data clause in every vendor agreement, name the log that would show a violation and the person whose job is to compare the two. If no such person exists, the clause is a hope. Prefer controls that fail closed. A compiler, a scoped permission or a hard limit beats a text box that a hurried human fills in to get past. Where a field is unavoidable, make sure someone other than the person filling it in reads it on a schedule.
The field was always going to get filled. The only real control in the system is whoever reads it.