404 Media Speaks on Surveillance Reporting

Launched less than a year ago by four journalists who left Vice, 404 Media has quickly become a widely-read technology publication that has published a variety of surveillance industry investigations.

IPVM interviewed 404 Media's four co-founders. In this report, we analyze their comments, their work on security and surveillance, and their business model.

Executive Summary

404 Media's investigations are raising important questions about the tradeoffs associated with security technology - for instance, the privacy implications of a city installing a Fusus system versus the safety benefits of doing so. Their goal is to publish information that will spur public awareness and debate about such issues, work they say has declined as local journalism has shrunk in the US.

While 404 media covers big tech like Google and TikTok, they emphasized there can be more room to generate impact by covering companies less familiar to the broader public. One focus, as mentioned, has been Fusus (other security companies they've investigated include Dahua, Evolv, and Flock). With Fusus, the publication is interested in the privacy implications of taking previously siloed systems - cameras - and connecting them in a manner that allows law enforcement to track individuals' movements.

404 Media approaches reporting with an "intersectional" focus. They aim to demonstrate the "social, cultural, and legal" impacts of technology on real people. While accepting advertising, the publication's business model is subscription-driven, with three tiers: free, "supporter" ($100/year), and "superfan" ($1000/year), with varying levels of access to articles and events.

Background

Launched in summer 2023, 404 Media describes itself as a:

journalist-founded digital media company exploring the ways technology is shaping - and is shaped by - our world.

Its four co-founders are journalists Jason Koebler, Samantha Cole, Joseph Cox, and Emanuel Maiberg. All previously worked at Motherboard, the tech wing of Vice Media. Vice went bankrupt in spring 2023. IPVM spoke with Koebler, Cole, Cox, and Maiberg in March 2024.

When asked about the founding of 404 Media, the co-founders said they are taking a similar journalistic perspective as they did at Motherboard, but are not trying to "carry Vice's torch":

Journalism was never the problem at Motherboard. It was a website that was always playing to people's strengths and interests. It was a daring site that had a perspective and a point of view. It often did experimental stories or stunty stories. That came not from Vice but from the people who worked there. We haven't changed who we are as people and journalists. We're not trying to carry Vice's torch. We have not significantly changed our perspective on how to do journalism. [emphasis added]

The name "404 Media" comes from the error message you receive when "you're 'lost' on the internet":

404 is obviously the error you get when you're "lost" on the internet or when something isn't found. We want to flip that on its head; we want to get lost on the internet, find stories in under-covered places, and tell stories from there.

Focusing on Companies Beyond Big Tech

Though 404 Media covers big tech, they see companies with lower public profiles (at least relative to mega-companies like Google, Meta, and TikTok) as "good targets for generating impact":

I think that there has been far too much fixation from journalism, writ large, on big tech surveillance. Everybody will write about Facebook, everybody will write about Google, and to some extent now everybody's just talking about Tik Tok ... So although we do cover Facebook, and we've written a fair bit about TikTok, I do personally want to focus on smaller companies that nobody's heard of. There's room there for reporting because nobody's talking about them. I do think they are good targets for generating impact.

That has led to a variety of reporting on the security industry, for instance. One focus has been Fusus. Other security companies they have written about include Dahua, Evolv, and Flock.

The Need for Reporting on Surveillance and Security

Asked about their work on surveillance, the co-founders spoke about the importance of public awareness and debate. The baseline, they said, is that the people "being surveilled" often are not even "aware that this is happening." There is typically no legal requirement in the US to disclose public surveillance.

Every surveillance company thinks that they're making their community safer. They think that they are helping law enforcement. They very might be, but they're largely doing this without the people who are being surveilled being aware that this is happening.

The co-founders said that it is typically "easy" to get city governments on board with new technologies, but that constituents are often not aware of the conversations:

It's very easy to get a city council to sign on to trying a new surveillance technology or to appropriate funds for a new surveillance technology, because people want to be safe. But very often the people who are being surveilled don't understand what is being proposed or rolled out.

One of 404 Media's goals is to explain to the public "what is happening" with surveillance so that people can "have the conversation" about whether they want a given surveillance technology deployed in their community:

These conversations kind of happen in public, to the extent they are talked about in city council meetings. But city council meetings are often four to five hours long. And people are often not aware that these things are happening. We're trying to explain what is happening. And people can then have the conversation about whether this is good or bad for society and whether they want it in their town.

The co-founders told us that the decline of local journalism in the US has contributed to reduced coverage of these issues:

Something I think about a lot is local newspapers and local journalism, which have been hollowed out even worse than the online publications that have lost jobs. With that, a lot of the watchdog perspective has been lost.

Without such oversight, emerging technology can spread rapidly between cities with little public awareness:

What we see over and over again is a company will get a city to test out its [technology] by essentially finding a police officer who is open to trying it. The police officer then becomes a quasi-lobbyist for the company. They go to police conferences, they email their police listservs, and they speak very highly of it. Without local journalism, without people paying attention to this, there is this very specific playbook where you can grow from one city, to five, to one hundred in just a few months. We want to document how this is happening, because there is not as much oversight as you might think. [emphasis added]

Work on Fusus

A company 404 Media spoke at length about was Fusus (which was recently acquired by Axon). Examples of 404 Media articles on the company include "AI Cameras Took Over One Small American Town. Now They're Everywhere" and "Are AI Cameras In Your Town?"

Explaining their interest, the co-founders said that companies like Fusus "qualitatively chang[e] what security cameras mean for ordinary people" by networking systems and enabling law enforcement tracking:

It has been the case for decades and decades that security cameras are siloed. And now, Fusus is bringing those together, where law enforcement agencies can track somebody from one camera to another. They can basically follow their movements. That is, of course, massively beneficial to law enforcement.

They pointed out that Fusus cameras can essentially "track you all throughout an entire town":

In the case of Fusus, this is cameras that can track you all throughout an entire town. And I don't know that people are aware of how these technologies are being used. That's what we're trying to do, make people aware of the capabilities of these systems beyond whatever marketing that says it's going to make the community safer. What does it look like on a day-to-day basis for a camera at 7/11 to be tied to a camera at city hall, to be tied to a camera at a local school, etc.

The co-founders did acknowledge that Fusus systems do not do "automatic" tracking - manual tracking is possible, though, because the cameras are aggregated.

404 Media's goal is not to necessarily dissuade the public from using Fusus and similar technologies, but to encourage conversations about their use:

I think there should be a conversation, at least on the individual, local, state, or even hyper-local level, about whether that's a technology people want. And maybe they have the conversation and it turns out that, "hey it's all great and we're happy to have it." But there should be coverage of it to at least have that conversation.

Target Audience is Real People Impacted by Technology

The co-founders said that they want politicians, decision-makers, and executives to read their work, but emphasized that their target audience is the people impacted by technology - which is to say, everyone:

We want decision-makers to read our stuff. We want politicians to read it. We want regulars to read it. We want people within the companies to read it. Of course. But our target audience is the people who are impacted by technology. It's everyone.

Focus on "Intersectional" Issues

404 Media told us that they approach their reporting from an "intersectional" angle, hoping to give context about the various "social, cultural, and legal aspects" of technology and how it impacts users:

Something we focused on a lot at Motherboard was the humans behind the technology. We're very interested in the human aspect of what we're reporting on. How does this affect real people? How does this impact the people actually reading the story? Especially because a lot of these topics can get pretty weedy. If you can explain to people, "this is why this affects you, this is why this is happening," it's useful.

One area they say exemplifies that approach is their work on deepfakes (see, for instance, "‘What Was She Supposed to Report?:’ Police Report Shows How a High School Deepfake Nightmare Unfolded" and "The Taylor Swift Deepfakes Disaster Threatens to Change the Internet As We Know It"):

With deepfakes, a lot has been written about policy, legislation, and technical fixes for how deep fakes could be prevented or detected. That's all super interesting and important. But it's already affecting real people in non-hypothetical situations. Being used for harassment and disinformation. A lot of the crux of what we do is bringing things back into the context of "this is the world we live in, we're not automatons using this technology." [emphasis added]

The co-founders said that trade publications, which tend to "take advertising money from the companies they cover," are usually not well-equipped to do that kind of reporting:

A lot of trade publications take advertising money from the companies they cover. A lot of them have industry trade shows, etc. Across the topics that we cover, I don't think that they're super well-informed. At the same time, we're trying to explain to people very intersectional issues. Here is how the surveillance industry works. Here's how AI works, but we're not talking specifically about the computing behind it. We're talking about the discourse, about the tools that are being released and who they're using them against.

As most IPVM subscribers know, we agree with that philosophy and refuse to take advertising and sponsorships so that we can report fairly, equally, and without bias on the security industry. (404 Media does take some advertising revenue, including from companies like Robinhood. We analyze their business model in greater depth below).

Publishing System Vulnerabilities

Asked how they deal with criticism over reporting system vulnerabilities, the co-founders emphasized that "security through obscurity is not real," that individuals and businesses cannot protect themselves if they do not know the risks they face, and that systems like electronic locks often protect valuable trade secrets:

As for systems like [electronic] locks, specifically, the public interest is that these systems are highly popular across the US. They're being used to protect US businesses, which likely contain US trade secrets, which can be of interest to foreign adversaries carrying out espionage. How are US businesses supposed to protect these trade secrets, both for the good of themselves and for the good of the country if they don't know about those backdoors? Security through obscurity is not real. The idea that, "well, if we just don't talk about it no hackers will find it," is ridiculous.

404 Media recently reported that "massively popular safe locks" made by companies like SECURAM "have secret backdoor codes."

Evolv has criticized IPVM for reporting on similar vulnerabilities, with Evolv claiming that:

Just as keeping people safe requires our customers and qualified prospects to be fully informed about Evolv Express’s capabilities, it also requires keeping potential threat actors in the dark about security measures.

We agree with 404 Media: keeping customers in the dark is no way to keep them safe. People and businesses cannot protect themselves if they do not understand the limitations of the systems they use.

Business Model is Subscriber-Driven

According to 404 Media, their business model turns on subscriptions:

It is majority subscriber-driven. Paying subscribers are the foundation for the entire business. We want to give them value. In return, they pay us to do journalism. It's that simple.

404 Media offers a variety of subscription tiers. For free, subscribers get access to an email newsletter and "a few specific members-only posts." At $100/year, subscribers get full access, with no ads. A "superfan" tier, at $1000/year, gives access to the 404 Media quarterly meeting and a "mascot t-shirt":

Their business model is not entirely subscription-driven. For instance, 404 Media receives some advertising revenue, but the co-founders said that other income streams are "auxiliary ... to our subscribers":

We do have multiple revenue streams. Maybe there's a downturn and people can't afford subscriptions anymore. We totally understand that. We have some programmatic ads - which bring in pennies, to be real with you. We also have ads, which are direct in the newsletter. Those are auxiliary income streams to our subscribers. Subscribers are the bedrock.

When asked about their Robinhood advertising, the co-founders said:

We've had ads since shortly after we launched 404 Media. We think it's important not to rely exclusively on any individual stream of revenue, because we've watched media outlets that rely exclusively on ads fail. We offer advertisers space in the free version of our newsletter, and we're happy that there's been a lot of interest so far. Paid subscribers do not see ads.

They also told us that they tend not to put FOIA-related work behind paywalls, saying it "goes against the spirit of getting public records":

We don't put FOIA-related stuff behind a paywall, at least in the majority of cases, because that kind of goes against the spirit of getting public records and giving them to people. But it's subject to change because the industry is in flux.

Tech Regulation and its Shortcomings

Asked about using legislation to regulate emerging tech, the co-founders expressed doubts about its ability to keep up:

Legislation is always slow and reactive. It's trying to keep up with stuff that has happened over the last six years. It's only gotten worse and more complicated. Legislation will always be a step behind. Because it's slow and reactive, it's generally overbroad and vague. It's trying to cover things that have already happened and things that haven't happened. The fallout of this legislation could be more censorship or more restrictive access to non-malicious AI or non-malicious uses of AI. So I'm skeptical of technical fixes and legislative fixes.

They did say, though, that:

[legislation] is often all we have to work with other than social education and related things

IPVM reported in March 2024 that Congress is unlikely to pass AI legislation in the short term.

Next Steps

Going forward, the co-founders didn't point to a specific financial goal, but said that they're focused on "growing sustainably and responsibly" while continuing to do strong journalism.