A native Android app that passively detects surveillance around you. Open it, hit START, and a ring turns green → yellow → orange → red as the engine gets more sure there's a Flock Safety ALPR, an Axon body camera, or active police nearby. It only listens. It never transmits, probes, or jams.
Passive defense only. Debug-signed APK — sideload; no Play Store. Read the README.
While scanning, the circle becomes an OpenStreetMap centered on you, wrapped in a threat-color ring for the current tier and marked with a ⌖ crosshair. Every detection is a dot, color-coded by source — so each mark is self-explanatory. Lock the screen and the foreground notification keeps the tier live; the phone vibrates only when the threat escalates.
The map is wrapped in the current tier's color — green, yellow, orange, or red — so you read your situation at a glance without opening anything.
Flock / DeFlock cameras red · Waze police blue · Citizen incidents purple. Tap any row for coordinates + a Maps deep-link.
Rebuilt on every tier change — OVERWATCH • RED with
the top detection's score. Priority bumps to HIGH on RED so the
system surfaces it as a heads-up, screen locked or not.
A short pulse for YELLOW, double for ORANGE, escalating triple for RED — but only on upward transitions, so it never nags you while a threat lingers.
Every observation is scored 0–100 by the confidence engine; the on-screen tier is the max live score across all sources. Cross-source corroboration — a BLE hit and a DeFlock map match in the same spot — naturally pushes the tier higher than either alone.
Vendor MAC OUIs (Axon, Flock Penguin / Raven, XUNTONG mfg id
0x09C8, "TN" serial pattern), Raven service UUIDs, and
device-name patterns. Iterates every manufacturer-data entry
per advert — not just the first — so it doesn't miss a buried match.
BSSID OUI prefixes for Flock infrastructure (31-prefix superset) and
Flock-XXXX SSID patterns, polled every 35 s — just under
the Android 11+ scan throttle.
Crowdsourced ALPR camera locations within range (200 m default) via
the Overpass API (overpass.deflock.org → fallback
overpass-api.de), with a 24 h on-disk cache and failure
backoff. Refetches when you move > 1.5 km.
Real-time public-safety incidents — police-relevant only, fire/medical filtered out — within range and under 30 min old, polled every 60 s from the Citizen trending feed.
Live user-reported POLICE alerts (default 500 m,
~45 min freshness). Waze reCAPTCHA-gated its map endpoint, so
OVERWATCH reads a key-protected feed through a Caddy proxy at
api.blackflagintel.com that injects the key
server-side — the paid key never ships in the APK.
The app authenticates with a scoped, revocable X-App-Token
stored encrypted in the Android Keystore.
Nearby consumer smart-home gear (Nest, Ring, Echo, hidden cams) as a secondary situational signal, riding the BLE + WiFi scans. Score-capped at ORANGE so a cluster of doorbells never reads as ALPR-grade certainty.
Nothing credible. Idle shows a muted gray ring so "all clear" reads differently from "not scanning."
A single weak indicator. Short vibration pulse on the way up.
High confidence — usually a hard radio hit or a close map match. Double pulse.
Certain. Notification jumps to HIGH priority; escalating triple pulse.
OVERWATCH only listens — it never transmits, probes, jams, or interferes with any device or network. The Axon advertise/fuzz code from one of the reference projects is intentionally excluded. It reads the airwaves and public feeds; that's it.
The same threat-ring map renders in a small draggable bubble over other apps (Settings → Display over other apps), so it stays with you while you use your phone.
The paid Waze feed key lives server-side behind the proxy; the app holds only a scoped, revocable token, encrypted via the Android Keystore. No secrets in the APK.
The drill-down marks a source Source unreachable when
its scanner couldn't reach its feed — a silent empty result and a
real failure look different.
Location drives the proximity checks and the map on-device. No account, no telemetry, no analytics — the scans and feeds run and the results stay on your phone.
OVERWATCH is a defensive, receive-only tool for knowing what's watching you — Flock ALPRs, Axon body cameras, and police presence — in the space you're already in. It does not touch, spoof, or disrupt anything. Know your local laws; use it responsibly.
Build from source, file issues, or read the internals: github.com/KaraZajac/OVERWATCH