There’s a sentence you can say about almost any camera pointed at a street, and it decides everything about what that camera is. The sentence is: it knows who that is. A traffic cam that counts cars and a surveillance system that follows people can look identical from the outside — same lens, same frame, same little boxes drawn around whatever moves. What separates them isn’t the picture. It’s whether the thing behind the lens turns a shape in the frame into a name. One counts. The other identifies. And the whole moral weight of the machine sits on that single step.
Thyseus is built from public cameras — traffic feeds anyone can already open in a browser tab. Which means it lives one short step away from that line the entire time. The same pipeline that turns a pixel into a place could, with a few more models bolted on, turn a face into an identity and a plate into a registration. Nobody would have to invent anything. The parts are on the shelf. So the interesting decision in Thyseus was never can we — it was where do we stop, and then making the stopping load-bearing instead of aspirational.
Presence is not identity
Start with what the map actually needs, because it’s less than you’d think. To be useful — to say there are eleven cars on this block right now or someone is standing at that crossing — the map needs presence: a thing, a type, a place, a time. It does not need to know that the sedan is registered to a particular person, or that the pedestrian is a particular pedestrian. Those are two completely different quantities that happen to arrive in the same frame, and the trap is treating them as one because the camera can’t tell them apart. The camera can’t. The pipeline can, and must.
So Thyseus reads presence and deliberately drops identity. A detection carries a class and a box; the box becomes a coordinate on the shared map; the coordinate is what streams to everyone. What doesn’t get computed is the next step nobody asked for: the face crop fed to a recognizer, the plate region run through OCR, the little dossier that stitches this sighting to that one into a track with a person’s name on the end. That step is missing not by accident, not because the budget ran out — it’s missing the way a wall is missing a door you decided not to cut.
The useful question a live map answers is is something there. The dangerous one is who. They arrive in the same frame, through the same lens, and the entire design job is refusing to let the first question smuggle in the second.
A blind spot you build on purpose
We’ve written before about Thyseus drawing its blind spots as blind spots — refusing to paint an unwatched street as a clear one. This is the same instinct pointed inward. There’s the blind spot the map has because no one is looking, and there’s the blind spot the map keeps because looking would cross a line. The first is honesty about coverage. The second is honesty about power. A system that runs in thousands of volunteers’ browsers, watching public roads, is exactly the kind of thing that should be able to explain — precisely, at the level of what code runs on what frame — the things it has chosen not to be able to do.
And “chosen not to be able to” is the important phrasing, because a promise is cheap and an absence is expensive. Anyone can write we respect your privacy in a footer. What’s worth something is a pipeline where the identifying step simply isn’t wired in — where the face never leaves the frame as anything but an anonymous box, where there is no model on the path that maps pixels to people, so there’s nothing to misconfigure, leak, subpoena, or quietly switch on later. You can’t turn off a capability you built. You can decline to build it, and then the “off” is structural. That’s the version worth trusting, because it doesn’t depend on anyone’s good behavior tomorrow.
Counting is a different act than watching
The nice thing about stopping at presence is that it doesn’t cost the product anything real. Everything Thyseus is for lives on the near side of the line. How busy is this corridor. Where are the cameras even pointed. Is the same car being counted twice across two overlapping feeds — a genuinely hard problem, and notice it’s about sameness of a thing, not identity of a person; you can merge two detections of one car without ever knowing whose car it is. None of the map’s real work needs a name attached. The name is pure downside: all of the risk, none of the utility, sitting there tempting the system to become the other kind of camera.
Which is why the discipline has to be a design rule and not a preference. Preferences drift. Under a little pressure — a feature request, a partnership, a “wouldn’t it be useful if” — a preference to not identify people quietly becomes a plan to identify people just this once. A rule that the identifying models are not on the path, and the anonymized detection is the only artifact that exists, doesn’t drift, because there’s no dial to turn. The most reliable way to not do a thing is to not have the thing.
Why a studio this small draws this line
We build and run our own products, which is the one rule the studio runs on, and it means the values aren’t a document handed to a vendor — they’re the code, written by the people whose names are on it. When you both build and operate a thing that watches public space, you feel the weight of the identifying step personally, because you’re the one who’d have to stand behind it. It’s a lot easier to decline to build a capability than to build it and swear you’ll never misuse it. So we declined.
A live map of the street is a genuinely useful thing to have and a genuinely dangerous thing to build, and the whole difference between the two is one step in a pipeline. Thyseus counts the car and places the person and then stops — not at the edge of what’s possible, but well short of it, on purpose. Seen, not identified. That gap isn’t a limitation we’re apologizing for. It’s the product.