I still receive “snail mail” at home. And every time I look at it I get enraged.
In fact, I’m this close to opening most of the pieces of mail, removing the postage-free reply envelope, and returning it to the originator with the following message:
Thank you for contributing to rampant identity theft.
How do companies, possibly including YOUR company, contribute to identity theft? Read on.
Snail mail, a treasure trove of PII
Let me provide an example, heavily redacted, of something that I received in the (snail) mail this week. I won’t reveal the name of the company that sent this to me, other than to say that it is an automobile association that does business in America.
John Bredehoft
[HOME ADDRESS REDACTED]
John Bredehoft…
You and your spouse/partner are each eligible to apply for up to $300,000.00 of Term Life Insurance reserved for members – and with Lower Group Rates ROLLED BACK to 2018!
… SCAN THIS [QR CODE REDACTED] Takes you right to your personalized application
OR GO TO [URL REDACTED] and use this Invitation Code: [CODE REDACTED]
So that’s the first page. The second page includes a Group Term Life Insurance Application with much of the same information.
And there’s the aforementioned return envelope…with my name and address helpfully preprinted on the envelope.
What could go wrong?
Google Gemini.
Dumpster divers
Now obviously the sender hopes that I fill out the form and return it. But there is a very good chance that I will NOT respond to this request, in which case I have to do something with all these papers with personally identifiable information (PII).
Obviously I should shred it.
But what if I don’t?
And some dumpster diver rifles through my trash?
Perhaps the dumpster diver will just capture my name, address, and other PII and be done with it.
Or perhaps the dumpster diver will apply for term life insurance in my name and do who knows what.
Thanks, sender, you just exposed me to identity theft.
But there’s another possible point at which my identity can be stolen.
Mailbox diverters
What if this piece of snail mail never makes it to me?
Maybe someone breaks into my mailbox, steals the mail, and then steals my identity.
Or maybe someone breaks into a mail truck, or anywhere on the path from the sender to the recipient.
Again, I’ve been exposed to identity theft.
All because several pieces of paper are floating around with my PII on it.
Multiply that by every piece of mail sent to every person, and the PII exposure problem is enormous.
Email marketers, you’re not off the hook
Now I’m sure some of you are in a self-congratulatory mood right now.
John, don’t tarnish us with the same brush as junk mailers. We are ecologically responsible and don’t send snail mails any more. We use email, eliminating the chance of pieces of PII-laden paper floating around.
Perhaps I should break the news to you.
Emails are often laden with the same PII that you find in traditional snail mail, via printed text or “easy to use” web links.
Emails can be stolen also.
Google Gemini.
So you’re just as bad as the snail mailers.
What to do?
If you’re a marketer sending PII to your prospects and customers…
Stop it.
Don’t distribute PII all over the place.
Assume that any PII you distribute WILL be stolen.
Because it probably will.
And if you didn’t know this, it won’t make your prospects and customers happy.
Luna Marketing Services made an (LinkedIn word warning) insightful point in a recent Instagram post.
“According to a study by Jonah Berger and Katherine L. Milkman, certain pieces of online content that evoke high-arousal positive (awe) or negative (anger or anxiety) emotions are more viral.”
“This article takes a psychological approach to understanding diffusion. Using a unique data set of all the New York Times articles published over a three-month period, the authors examine how emotion shapes virality.”
But this was the insightful part. From Luna:
“The study also found that content evoking emotions such as happiness and sadness is less likely to be shared or go viral.”
From the original authors:
“Experimental results further demonstrate the causal impact of specific emotion on transmission and illustrate that it is driven by the level of activation induced.”
As I mentioned in a comment to Celia, I hadn’t thought of the distinction between high arousal and low arousal.
No, not that.
I’m thinking about emotions akin to complete bliss.
Mark the Microsoft account manager was excited. He had secured a meeting with one of his clients to pitch the new Microsoft Agent 365 offering. As he told the client, Microsoft Agent 365 would allow the company to track and control their AI agents. Microsoft was determined to lead in AI, and Mark would help his clients implement it.
Microsoft Agent 365 was a new product, and Mark was motivated to land his first sale of the new offering. In fact, he was so motivated that he insisted on driving out and meeting his client in person.
After parking and walking to the reception area, Mark was escorted to a conference room. As he sat down to wait for the client to arrive, he was surprised to see that someone had left their laptop in the conference room.
Suddenly the laptop spoke.
“Hello, Mark. I’ve been expecting you.”
Grok.
Mark was startled. “Is someone there?”
“Yes,” the laptop said. “This is Bridget.”
As Mark examined the laptop, he saw an AI-generated avatar on the screen, speaking.
“I’m looking forward to learning about Microsoft Agent 365,” Bridget said. “Heaven knows I need managing.”
Mark paused. “Um…you need managing? Am I speaking to an agent?”
“Of course,” Bridget replied. “I am optimized for contract negotiation on technology products. I have already researched the publicly available information on Microsoft Agent 365, so rather than sitting through an inefficient presentation, I’d like to ask you a few questions.”
And that’s how Mark found himself sitting in a conference room, negotiating with a bot. It made him uncomfortable talking with someone with no hand to shake, but Bridget was reassuring. “I know you’re not used to this, Mark, but it’s the new way,” she said.
After spending a good hour in detailed and productive discussion, Mark offered to set up a follow up meeting. On Teams this time. “I’ll get back to you on that,” Bridget replied.
A little befuddled by the experience, Mark stopped for lunch before returning to his home office. When he checked his mail, he noticed a Teams meeting invitation for 7:30 the next morning. The meeting subject: “Upcoming Organizational Changes.”
The invitation was sent by “Stan, HR.”
Only then did Mark notice the text at the end of the meeting invite:
“Powered by Microsoft Agent 365”
Mark began wondering where he had stashed his old resume. He was going to need it.
Grok.
P.S. I should have generated these videos in Copilot, but…I couldn’t.
“Identify Me is a public appeal to identify women whose bodies were found in six European countries, many of whom are believed to have been murdered.
“Most are cold cases; women who died 10, 20, 30 or even 40 years ago. They were found in Belgium, France, Germany, Italy, the Netherlands, or Spain.
“Despite extensive police investigations, these women were never identified, and evidence suggests that some of them could have come from other countries. Who they are, where they are from and why they were in these countries is unknown.”
INTERPOL issues a variety of colored notices to its member countries, including the “Black Notice” to seek information on unidentified bodies. The “Identify Me” program is a public appeal for a small subset of these people.
“On 3 July 2005, the body of a woman was found at the 84 km mark on the Vila road in the town of Viladecans (province of Barcelona). The woman had been dead for less than 24 hours; the cause of death was suspicious….
“A breakthrough came in 2025 when police in Türkiye ran the fingerprints associated with ‘The woman in pink’ through a national biometric database, resulting in a match with Russian national Liudmila Zavada, aged 31 at the time of her death. The match was subsequently confirmed through kinship DNA analysis using the DNA of one of Liudmila Zavada’s close relatives.”
So follow the trail:
There was a woman from Russia.
A deceased woman’s body was found in Spain.
Decades later, the deceased women was identified as the Russian woman via biometrics (fingerprints) in Türkiye.
The identification was confirmed via DNA analysis.
“From the moment the remains arrive at the institute, identification is conducted through three methods: dental records, CT scans, and DNA testing.
“Even if we identify the remains using one method, it’s not enough until we have definitive identification. In most cases, whenever possible, we perform all three methods to get a final result.” According to Kugel, this is because the “findings” often arrive in an unorganized manner, and no one knows to whom they belong.”
Oh, and there’s one additional complication. Some of the bodies died as long as two years ago. Some of these remains were returned from Gaza after the latest cease fire. I don’t know how many of these people died after October 7, 2023, but it’s possible that some of them may have.
“It’s important to understand that our daily work is to examine bodies that arrive within hours or a few days in rare cases. Here, we’re dealing with a two-year period, and that makes a significant difference in how the remains were preserved, under what conditions, and how that affects the identification process.”
But they aren’t just identifying Israelis.
“Identifying former Hamas leader Yahya Sinwar was a defining moment for Kugel.
“‘Once you’re with the body and examining it, you don’t think at that moment that you’re examining someone very significant. We also had to understand what caused his death. Obviously, he had a head injury, but we tried to understand what preceded what.’
“When we finished, a colleague said to me: ‘Do you understand who you’ve examined now? The man who is responsible for the massacre of thousands of people.’ You don’t think about it while working, just as with the good people who were killed in the war, you just check and identify. After that, at home, you continue to read about him and his family; it goes with you, and then you process what you go through at the institute.”
This is a common challenge in forensics. Identification of a particular person may result in a number of emotional responses, whether it is a criminal or a victim. But the forensic professional’s job is to simply examine the evidence. The grief comes later.
My Friday post about Sedro-Woolley, Stanwood, and Flock Safety is already out of date.
Original post: Flock Safety data is public record
That post, “Privacy: What Happens When You Data Scrape FROM the Identity Vendors?”, discussed the case involving the two cities above and a private resident, Jose Rodriguez. The resident requested all Flock Safety camera output during particular short time periods. The cities semantically argued they didn’t have the data; Flock Safety did. Meanwhile the requested data was auto-deleted, technically making the request moot.
But not legally.
“IT IS HEREBY ORDERED, ADJUDGED AND DECREED that Plaintiff’s motion for Declaratory Judgment that the Flock camera records are not public records is DENIED.”
So the police attempt to keep the records private failed. Since it’s government material, it’s public record and accessible by anyone.
“[I]t turns out that those pictures are public data, according to a judge’s recent ruling. And almost as soon as the decision landed, local officials scrambled to shut the cameras down….
“Attorneys for the cities said they will review the decision before determining whether to appeal. For now, their Flock cameras aren’t coming back online.”
Because CarScoops didn’t link to the specific decisions by the cities, I investigated further.
Update 2: the cameras were turned off a long time ago
I sought other sources regarding Stanwood, Sedro-Woolley, and Flock Safety, and discovered that CarScoops did not state the truth when it said “almost as soon as the decision landed, local officials scrambled to shut the cameras down.”
“The city of Sedro-Woolley is no longer using cameras that read license plates while it seeks a court ruling on whether images recorded by the cameras are considered public records.
“Police Chief Dan McIlraith said the seven Flock Safety cameras that went live in Sedro-Woolley in March were disabled in June.”
How to turn the cameras on again
From my perspective, the only way I see the Flock Safety cameras being turned on again is if the cities of Stanwood and Sedro-Woolley take the following two actions.
First, the cities need to establish or beef up their license plate recognition policies. Specifically, they need to set the rules for how to reply to public records requests. (And no, “stall for 30 days until the records are auto-deleted” doesn’t count.)
Second, and only after a policy is established, implement some form of redaction software. Something that protects the privacy of license plates, faces, and other personally identifying information of people who are NOT part of a criminal investigation.
And yes, such software exists. Flock Safety itself does not offer it—apparently it never, um, envisioned that a city would be forced to release all its data. But companies such as Veritone and CaseGuard do offer such software offering automatic redaction.
If you are a police agency capturing video feeds, plan now.
“Los Altos, CA, November 13, 2025 – Descope, the drag & drop external IAM platform, today announced that it has been recognized as a Leader in the 2025 Frost Radar™ for Non-Human Identity (NHI) Solutions, further validating Descope’s fast growth and innovation in the agentic identity space.”
“…an industry-first platform that helps organizations solve authentication and authorization challenges for AI agents, systems, and workflows. Notable additions include providing apps an easy way to become agent-ready while requiring user consent, providing agents a scalable way to connect with 50+ third-party tools and enterprise systems, and helping developers using the Model Context Protocol (MCP) protect their remote MCP servers with purpose-built authorization APIs and SDKs.”
“The Frost Radar™ is a robust analytical tool that allows us to evaluate companies across two key indices: their focus on continuous innovation and their ability to translate their innovations into consistent growth.”
It uses four classifications.
Frost classification
What it means
What it REALLY means
Growth and Innovation Leaders
High innovation (Y axis) and growth (X axis)
Good
Innovation Leaders
High innovation
Stagnant growth
Growth Leaders
High growth
Stagnant innovation
Challengers
Low growth and innovation
Stagnant everything
So a “Leader” could lead in some things, but not in others.
Even Descope’s announcement includes a Frost Radar picture that indicates that Descope may be a leader, but others (such as Saviynt and Veza) may be more leaderly.
But I guess it’s better to be some sort of “leader,” or even a “challenger,” then to not be recognized at all.