Evidence capture — www.assen.nl (Gemeente Assen)

Forensic snapshot of three pages on the municipal website of Gemeente Assen, captured as evidence for the TT Festival privacy investigation. Assen is the municipality that hosts the TT Festival, and these pages link the public to the official TT Festival App (app.ttfestival.nl).

The capture is self-contained and reproducible: it includes the exact raw server responses, the fully JavaScript-rendered DOM, full-page screenshots, all referenced photos, response headers, tool logs, and SHA-256 checksums of every file. The bulky browsable offline wget mirror lives in the companion private repo GraafG/tt-festival-app-evidence; its byte-for-byte integrity is recorded here in mirror-manifest.sha256.

Reason for capture

The decisive line is on /heeft-u-nog-vragen (captured verbatim, see screenshots/03_heeft-u-nog-vragen_fullpage.png and the rendered DOM):

“Meer weten over het TT Festival? Download de officiële TT Festival App via app.ttfestival.nl (externe link) of neem contact op met de organisatie via info@ttfestival.nl.”

Why this matters as evidence against Gemeente Assen (not only the app vendor):

  1. The municipality calls it “de officiële TT Festival App” and hands out the download link itself. On an official www.assen.nl government page, this reads as a municipal endorsement of the app.
  2. The lines are blurred about who actually runs it. Even reading carefully it is hard to tell that the app is not operated by Gemeente Assen but by a separate party (the organising stichting / the commercial platform Appmiral). The app.ttfestival.nl link 301-redirects to ttfestival2026.deeplink.appmiral.com — third-party Appmiral/AWS infrastructure — yet it is presented under the municipality’s own banner and wording. (That redirect and the app’s pages are captured in the sibling snapshot ../appmiral.com_2026-06-26_232241/.)
  3. The municipality is on notice. Given that Gemeente Assen is aware of the privacy/tracking concerns documented in this repository, actively steering residents and visitors to “the official app” while obscuring the third-party operator and its data processing is evidence relevant to the municipality’s own responsibility — not just the app maker’s.

This snapshot freezes that municipal endorsement at a fixed point in time so it can be cited and reproduced even if the page is later edited.

Snapshot summary

Field Value
Captured (local) 2026-06-26 23:12:42 CEST (UTC+02:00)
Captured (UTC) 2026-06-26 21:12:42Z
Capture host Microsoft Windows 11 Pro (build 10.0.26200)
Server Date header Fri, 26 Jun 2026 21:13:24 GMT
Platform observed Next.js (SSR) behind Varnish 7.4 + Azure Front Door
Pages captured 3 (all HTTP/1.1 200 OK)
Total size ~13.4 MB
User-Agent used Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

The capture timestamp is encoded in the folder name (assen.nl_2026-06-26_231242, format YYYY-MM-DD_HHmmss local time) and stored in .capture-timestamp. Re-running the capture creates a new timestamped folder rather than overwriting this one.

Pages captured

# URL Page title HTTP HTML bytes (Content-Length)
1 https://www.assen.nl/ Home | Gemeente Assen 200 237017
2 https://www.assen.nl/tt TT | Gemeente Assen 200 210254
3 https://www.assen.nl/heeft-u-nog-vragen Heeft u nog vragen? | Gemeente Assen 200 133578

Why these pages matter

Folder layout

assen.nl_2026-06-26_231242/
├── README.md                 ← this capture log
├── SHA256SUMS.txt            ← SHA-256 of every file in THIS (public) folder
├── mirror-manifest.sha256    ← SHA-256 of every file in the offline mirror,
│                               which lives in the private companion repo
├── .capture-timestamp        ← machine-readable capture timestamp
├── raw/                      ← EXACT unmodified server responses (curl)
│   ├── home.html / .headers.txt
│   ├── tt.html / .headers.txt
│   └── heeft-u-nog-vragen.html / .headers.txt
├── rendered-dom/             ← fully JS-rendered DOM after hydration (Chrome)
│   ├── home.dom.html
│   ├── tt.dom.html
│   └── heeft-u-nog-vragen.dom.html
├── screenshots/              ← PNG screenshots @1440×900, desktop
│   ├── 01_home_*_fullpage.png / _viewport.png
│   ├── 02_tt_*_fullpage.png / _viewport.png
│   └── 03_heeft-u-nog-vragen_fullpage.png / _viewport.png
├── mirror/  → MOVED to private repo GraafG/tt-festival-app-evidence
│              (browsable offline wget clone; links converted. Integrity of
│               every file is recorded above in mirror-manifest.sha256.)
│   └── www.assen.nl/...      ← HTML + JS + CSS + fonts + SVG/icon assets
├── assets-extra/             ← the 14 distinct Next.js-proxied photos (see note)
│   ├── img-001.jpg … img-014.jpg
│   └── manifest.tsv          ← filename ↔ source image ↔ sha256 ↔ original URL
└── logs/
    ├── wget-home.log / wget-tt.log / wget-heeft-u-nog-vragen.log
    └── tool-versions.txt

Note on assets-extra/ and the wget mirror

The site serves photos through the Next.js image optimizer (/_next/image?url=...&w=...&q=75). Those proxy URLs decode to filenames longer than the Windows 260-character path limit, so wget could not write the photo files (logged as Bad file descriptor in the wget logs; this is the only reason wget exited non-zero for the home and TT pages — all HTML, JS, CSS, fonts and SVGs were saved fine).

To make the evidence complete, every distinct source photo referenced by the three pages was downloaded separately at its largest width into assets-extra/ with short filenames. assets-extra/manifest.tsv maps each img-NNN.jpg back to its original /_next/image URL, the decoded backend source path, byte size and SHA-256.

Response headers (captured)

Full headers per page are in raw/<page>.headers.txt. Common to all three:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Security-Policy: frame-ancestors 'none';
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Strict-Transport-Security: max-age=31622400; includeSubDomains
x-nextjs-cache: ...            (Next.js incremental cache)
Via: 1.1 varnish-assen-... (Varnish/7.4)
X-Varnish-Backend: dvg-frontend-assen:3000
x-azure-ref: ...               (Azure Front Door)
Set-Cookie: oo-session=...; Path=/; Secure; HttpOnly

No cookie-consent wall blocked access; pages render server-side without interaction.

How this was captured

All commands were run from the capture host on 2026-06-26. Tool versions are recorded in logs/tool-versions.txt:

How to verify integrity

From inside this folder:

# Linux / macOS
sha256sum -c SHA256SUMS.txt

# Windows PowerShell
Get-Content SHA256SUMS.txt | ForEach-Object {
  $h,$p = $_ -split '  ',2
  if ((Get-FileHash -Algorithm SHA256 -LiteralPath $p).Hash.ToLower() -ne $h) { "MISMATCH: $p" }
}

How to reproduce what we saw