Live capture — TT Festival kill-switch ON, 60 km zone armed (2026-06-26)

Journalist/judge-grade snapshot proving the TT Festival CrowdConnected pipeline was live and armed on 26 June 2026, with the device sitting at home in NL (~150 km from Assen). Reads the app’s own server-pushed config out of its private database (root) and corroborates with a same-session logcat showing actual transmission to AWS. Methodology: see ../methodology-and-reproduction.md §2.3.

Evidence header

=== EVIDENCE CAPTURE HEADER ===
Captured by:        on-device adb logcat, Pixel 10a (stallion), Magisk root
Host wall-clock:    2026-06-26T23:00:51.2794753+02:00
Device time:        Fri Jun 26 23:00:49 CEST 2026
Device build:       google/stallion/stallion:16/CP1A.260505.005/15081906:user/release-keys
App version:        com.appmiral.ttfestival versionName=2.0.1

Artifacts (session-private, not committed — contain device/account identifiers): cc_live_db/CrowdConnected-RoomDatabase (57 KB), cc_live_db/evidence_header.txt, cc_live_db/live_logcat_2026-06-26.log (547 KB), cc_live_db/dump.py.

Live config (decoded from the app’s CrowdConnected Room DB)

The config below is server-pushed (the SDK fetched it from mobile.crowdconnected.com/prod/settings/dd54d39d/... during its normal poll) — we only read the cached result locally with root, never contacting the backend.

Settings — the kill-switch is ON

Field Value Meaning
appKey dd54d39d TT Festival tenant key (v2.0.1 build)
active 1 Kill-switch ON — collection is live
geoEnabled 1 Geofence tracking enabled
sendPositionData 1 Position upload enabled
pollingFrequency 120 Base poll cadence (s)
geoHighFrequency 30 Inner-ring poll cadence (s)
geoMediumFrequency 1800 Outer-ring poll cadence (s)
debugEnabled 0 Production config
sendRawData 0 —

GeoZone — the 60 km ring around Assen

Field Value
appKey dd54d39d
centre lat,lng 52.994439, 6.563694 (Assen)
radius1 (inner, high-freq 30 s) 820 m
radius2 (outer, collection boundary) 60000 m = 60 km

A 60 km circle around Assen covers most of the north-east Netherlands — the upload gate is far wider than “the festival grounds.”

SDKStatus — identity + capability

Transmission evidence (same-session logcat, 26 Jun 22:43)

With the app freshly launched at home (NL), the SDK did not stay dormant:

22:43:30.436 CORE         : Setting alias app_user_id,13d4adf7-13d6-4352-a4c8-df05f4d23fac
22:43:30.436 CORE         : Sending alias immediately app_user_id,13d4adf7-...
22:43:30.547 GEO_OBSERVER : Setting Zones
22:43:30.548 GEO_OBSERVER : Started geo observer with frequency: 900 seconds
22:43:30.577 GEO_OBSERVER : Transitioning to high settings
22:43:30.577 GEO_OBSERVER : Started geo observer with frequency: 30 seconds
22:43:30.577 KINESIS      : Sending batch of positions via kinesis
22:43:30.577 KINESIS      : 281 Bytes stored on disk
22:43:30.456 AWS4Signer   : host:sns.eu-west-1.amazonaws.com
22:43:31.277 AWS4Signer   : host:firehose.us-east-1.amazonaws.com
22:43:31.277 AWS4Signer   : x-amz-target:Firehose_20150804.PutRecordBatch
22:43:31.277 AWS4Signer   : 20260626/us-east-1/firehose/aws4_request

What this proves, end to end:

  1. Kill-switch is live (active=1) — not the static-analysis active=false seen earlier in June. The server flips it.
  2. Identity linkage — the CC device ID is aliased to app_user_id (13d4adf7-...), so uploaded positions are not anonymous.
  3. Active collection at 30 s — it transitioned straight to “high settings”.
  4. US data transfer — positions are PutRecordBatch‘d to firehose.us-east-1.amazonaws.com (Virginia, US), contradicting the privacy policy’s “all personal data stored in EU (eu-west-1)” claim. (Push registration does use sns.eu-west-1.)
  5. Far from the venue — the device was ~150 km from Assen, yet inside the 60 km radius2 gate the SDK still armed and uploaded.

How to re-verify (root, ~2 min)

adb shell su -c 'cp /data/data/com.appmiral.ttfestival/databases/CrowdConnected-RoomDatabase /sdcard/cc.db'
adb pull /sdcard/cc.db
python -c "import sqlite3;c=sqlite3.connect('cc.db');[print(r) for r in c.execute('select active,geoEnabled,sendPositionData from Settings')];[print(r) for r in c.execute('select lat,lng,radius1,radius2 from GeoZone')]"
# live tracking markers:
adb logcat -c; adb logcat -v threadtime | Select-String 'GEO_OBSERVER|KINESIS|firehose|PutRecordBatch'

See crowd-connected-endpoints.md for the full re-check runbook and per-app keys.