Civic Tech Chat

 Ryan Koch speaks with Josh, the independent developer behind Antifreeze and Flockwatch, about building civic-tech tools that help people see public law-enforcement activity. Josh explains how progressive web apps, replaceable infrastructure, restrained data collection, and clear moderation boundaries can improve resilience while protecting users and maintaining safety.

Key topics

• Civic tech projects: Anti-Freeze and Flockwatch
• Technical infrastructure and resilience strategies
• Data privacy and minimal data collection
• Open web and progressive web apps as alternatives to app stores
• Partnerships and data sharing in civic tech
• Legal considerations and community guidelines
• Handling potential shutdowns and attack vectors
• Lessons for small organizations building resilient tech

Chapters

00:00 Josh’s civic-tech work and why public visibility matters
02:01 Why app-store removals led to Antifreeze
04:02 How Antifreeze alerts work and what Flockwatch maps
08:42 The reporting, photo-processing, and notification pipeline
11:21 Offshore hosting and replaceable infrastructure
13:30 Resilience: what breaks if a provider blocks access
18:24 Failure scenarios, fake reports, and legal pressure
20:04 12,000 installs, abuse controls, and a patched vulnerability
24:18 Device fingerprints, data minimization, and 72-hour retention
32:04 Location controls, watchdog access, and data backups
35:22 EFF guidance, moderation rules, and public-safety boundaries
40:16 Disputes, sustainability, and advice for mission-driven teams
46:26 Where to follow Josh’s work

Sound Bites

• "I believe people have the right to know when law enforcement is operating around them"
• "I wanted to build a censorship resistant app that exists on the open web"
• "Partnering instead of competing benefits the civic tech community"

Links

• https://www.dailykos.com/user/joshhacks/
• https://antifreeze.app/
• https://flock.antifreeze.app/
• https://wafflehacker.substack.com/

Ryan Koch explores the parallels between historical railroad gauge conflicts and modern data infrastructure challenges, emphasizing the importance of standardization and network effects in overcoming systemic friction.

Key Topics

• Historical railroad gauge conflicts and their modern parallels
• The role of standardization and network effects in overcoming systemic friction
• The challenges of web scraping and data integration across states and agencies
• The concept of coordination traps and how to overcome them
• Case studies including GTFS, health data, and railroad gauge changes

Chapters

00:00 Introduction: What Railroad Gauges Teach Us About Data Infrastructure
02:00 Historical Overview of Railroad Gauges in America
03:55 The Economics and Politics Behind Gauge Choices
05:52 Coordination Traps and the Power of Standardization
07:03 The Webcomic XKCD and the Universality of Standards
08:11 Modern Data Challenges: Inconsistent APIs and Data Shapes
10:02 Web Scraping and the Complexity of State Data Portals
11:57 The Risks and Frustrations of Maintaining Web Scrapers
12:55 The Incentive Structures in Data Standardization
15:11 The Erie Gauge War and Its Lessons on Local Resistance
17:06 Health Data and the Monopoly of Epic Systems
19:59 The 1886 Gauge Change in the American South
21:51 The Emergence of GTFS and Its Impact on Transit Data
23:49 Network Effects and the Power of Standardization
26:00 Identifying Your Own Hoisting Machines and Frictions
27:58 Strategies for Overcoming Systemic Friction
29:52 The Moral of the Railroad and Data Standardization Stories
31:13 Conclusion: Moving Forward with Awareness and Cooperation

Music credit: Tumbleweeds by Monkey Warhol

Summary

When H.R. 1 put new pressure on states to cut SNAP payment error rates, Nava PBC had six weeks to help Pennsylvania stand up a way to catch bad document uploads before they reached a caseworker. That rapid-response build became Document AI, an open-source service that checks whether an uploaded document is legible and the right type, then extracts key fields for review.

Product manager Sophia Philip and senior software engineer Laurence Goolsby of Nava Labs join Ryan to talk about the project, which has since been adapted for a Maryland pilot that's set to scale statewide by December. They cover:

- Why the tool is deliberately kept out of eligibility decisions, with no policy coded into it
- How applicants can opt in, opt out, or proceed anyway when a document is flagged
- How it handles gig-work and handwritten invoices, plus Spanish-language documents
- Why a confidence score is not the same as accuracy
- How they're approaching AWS dependence and data security
- How other agencies can fork the repo and adapt it to their own needs

This episode is sponsored by Nava PBC.

Keywords

Document AI, intelligent document processing, Nava PBC, Nava Labs, open source, SNAP, H.R. 1, payment error rates, Maryland, Pennsylvania, benefits delivery, administrative burden, human-in-the-loop, consent, Amazon Bedrock, government technology, civic tech

Key Topics

- How AI-assisted prototyping ("demos over memos") is changing collaboration between product and engineering
- Document processing as a shared problem across benefits, licensing, permits, and more
- Building a six-week rapid response to H.R. 1 in Pennsylvania, then adapting it for Maryland
- Why open source: avoiding vendor lock-in while keeping PII inside each agency's environment
- The three users: applicants, caseworkers, and the people who administer the service
- Consent that is plain-language, just-in-time, and reversible
- Supporting nonstandard documents like handwritten invoices from gig and informal work
- Guarding against caseworker over-reliance: confidence scores, and no determinations made by the tool
- Under the hood: Amazon Bedrock and Bedrock Data Automation, plain-language document schemas, and Textract
- Meeting states on the infrastructure they already use, and the path to being cloud-agnostic
- Security by default: data that never leaves the agency, and extracted values that aren't returned unless requested
- How to contribute, deploy, or request demo access

Sound Bites

- "Confidence does not mean accuracy."
- "Fundamentals are the building blocks of fun."
- "Document AI isn't making any decisions about whether the document should be uploaded. That lives with the person who's uploading it."
- "It's not the person who uploads it's fault that we haven't defined it."
- "You are not in a vacuum."

Chapters

00:00 Intro 
00:21 Meet Sophia Philip and Laurence Goolsby of Nava Labs 
00:49 Their personal "why" 
02:16 What's changed, and what hasn't, in product management and engineering 
05:59 How AI prototyping changes collaboration across practices 
08:33 Why document processing is a problem worth solving 
12:38 Designing around burdens imposed by policy, and building reversible consent 
15:15 What is Document AI? 
16:26 Origin story: a six-week rapid response to H.R. 1 in Pennsylvania 
20:10 Did it move payment error rates? 
21:21 What "open source" means here, and why it matters 
24:25 The three user personas 
26:23 The applicant experience and opt-out fallback 
28:41 The caseworker experience, gig-work invoices, and multilingual documents 
33:26 Avoiding rubber-stamping: human-in-the-loop and no automated determinations 
37:36 Shaping the product vision, from Postman demos to a management layer 
41:32 Handling surprises: agile delivery and the Maryland pilot timeline 
46:04 Under the hood: how Document AI uses AI 
50:12 Why confidence isn't accuracy 
51:13 Unsupported languages and undefined document types 
54:07 AWS dependence and the path to cloud-agnostic 
58:39 Security, privacy, and keeping data inside the agency 
1:01:37 Governing Document AI after adoption 
1:02:26 How to contribute 
1:04:10 Final takeaways

Links

- Document AI open-source GitHub repository
- Nava demo day

Rebecca Woodbury and Luke Fretwell discuss their collaborative process in writing 'Proudly Serving,' a book aimed at making civic tech and government more accessible, responsive, and effective. They share insights on open source principles, the importance of plain language, and fostering a culture of transparency and public service.

The Book: https://proudlyservingbook.com

Key Topics

• The origin story of civic tech and government responsiveness
• The collaborative process of writing 'Proudly Serving' with over thirty contributors
• The importance of working in the open and transparency in government projects
• The role of plain language in improving government communication
• The concept of everyone being a public servant and fostering collective responsibility
• The challenges and lessons learned in remote, asynchronous collaboration
• The significance of guiding principles and shared values in public organizations
• Strategies for balancing innovation with accountability in civic tech

Chapters 

• 00:00 Introduction to Civic Tech and Public Service
• 00:22 Rebecca's Origin Story in Civic Tech
• 04:04 Luke's Path to Civic Tech and Digital Government
• 07:06 Personal Why: Making Government Better
• 08:03 The Inspiration Behind 'Proudly Serving'
• 12:29 Target Audience for the Book
• 16:05 Writing the Book Like an Open Source Project
• 19:23 Collaborative Process and Contributor Engagement
• 23:40 Design and Accessibility in the Book
• 26:45 Working Remotely and Asynchronously
• 33:57 Chapter Review and Quality Gates
• 40:12 Reflections on Personal Challenges and Growth
• 42:14 Plain Language and Clear Communication
• 47:31 Everyone as a Public Servant
• 55:36 Living Up to the 'Why' in Civic Tech
• 01:00:37 Key Message: Default to Open and Say Yes
• 01:02:51 How to Access the Book and Final Thoughts

AI tools have quietly moved out of isolated dev environments and into the middle of how real work gets done. That shift is genuinely exciting, and it brings a fresh set of risks worth sitting with. In this solo episode, Ryan works through what it takes to govern AI well, all of it anchored on one idea he keeps coming back to: a human has to stay accountable for the decisions that matter. He gets into why AI strains the governance habits IT already leans on, how to weigh centralized, decentralized, and hybrid approaches against your own risk tolerance, what ISO 42001 and the NIST AI RMF actually ask of you, and where the law is heading. He closes with a practical playbook for pulling shadow AI into the open while keeping the room for creativity that made folks reach for these tools in the first place.

In this episode

• Why AI puts pressure on the governance habits IT already has, from non-determinism to data drift and concept drift, and the blind spots those quietly create
• Splitting your governance model (who holds the decision rights) from your operating model (how the work actually gets run)
• The three big archetypes: the fortress-style centralized model, the fast and messy decentralized model, and the hybrid in between, plus how to match one to your risk tolerance and threat model
• A few examples from Ryan's own teams — engineers getting their bearings in old repos in about twenty minutes instead of a full day, designers prototyping fast enough to have a richer discovery conversation
• What ISO 42001 and the NIST AI Risk Management Framework actually require, including named human owners and a real kill switch
• The principle the whole episode hangs on: an AI tool can't be the one held accountable, since a machine isn't a legal or moral agent
• Where regulation is going, including EU GDPR Article 22, California's coming CCPA automated-decision rules, EU NIS2, and a White House executive order on AI and national security
• The frontier-developer laws worth knowing about even if they never regulate you directly
• Why these efforts stall out, and a grounded playbook: sanctioned tools folks will actually use, a living AI inventory, cross-functional discovery, and metrics anchored in real value

Key takeaways

• Lower the barrier to secure tools so people stop quietly routing around you
• Keep a human clearly accountable on every RACI chart
• Get real value to real people fast, then learn from how they actually use the tools
• Treat the AI in your stack as something to govern, not just something you installed

Resources and shoutouts

• ISO/IEC 42001, the AI management system standard
• NIST AI Risk Management Framework
• EU GDPR, Article 22 (solely automated decisions)
• California's CCPA automated decision-making technology (ADMT) rules, enforced by the CPPA, in effect Jan 1, 2027
• EU NIS2 Directive
• California's frontier-model transparency law, plus the state's AI content-transparency and watermarking rules
• The June 2026 White House executive order on AI and national security
• Related episodes: 
  • SpecOps → https://civictech.chat/episodes/the-specops-method 
  • AI Readiness with Brian Chidester of Adobe → https://civictech.chat/episodes/what-is-ai-readiness
  • Legacy Lockpicks with David D'Silva of Nava, the one that ran just ahead of this → https://civictech.chat/episodes/legacy-lockpicks
• Music credit: Tumbleweeds by Monkey Warhol

We're joined by David D'Silva, Principal Product Manager at Nava, for a conversation about legacy lockpicks: the reusable tools, playbooks, and patterns that help government teams move out of legacy systems faster and with less risk. We talk about why trust is the real currency of modernization work, why so many efforts stall at the data layer, and how to choose between patterns like strangler fig and lift and shift. We also dig into where AI is genuinely useful in modernization today and where it's mostly hype.

- David’s LinkedIn: https://www.linkedin.com/in/daviddsilva/
- Prior episode on Strata: https://civictech.chat/episodes/nava-strata-open-source-government-technology
- Strata page: https://www.navapbc.com/strata
- Legacy modernization page: https://www.navapbc.com/legacy-modernization
- Our prior episode covering the strangler fig pattern: https://civictech.chat/episodes/the-specops-method

In this interview, Brian Chidester from Adobe discusses the importance of AI readiness in government, data governance, and the future of AI in public sector transformation. Learn how organizations can start small, build trust, and leverage AI to improve citizen services and drive mission outcomes.

Music Credit: Tumbleweeds by Monkey Warhol

Christian Martinez shares his journey from cognitive neuroscience to civic tech, highlighting the importance of open data, reproducible research, and building accessible tools like R packages. Discover how relevance drives rigor in education and data projects, and learn practical tips for getting started with open data and open source development.

Resources and Shoutouts
NYC Open Data Portal: https://opendata.cityofnewyork.us/

NYS Open Data Portal (MTA data also lives here): https://data.ny.gov/

NYC Open Data Student Gallery Book: https://martinezc1-nyc-open-data-student-gallery.share.connect.posit.cloud/

Music Credit: Tumbleweeds by Monkey Warhol

Ryan Koch discusses the importance of understanding supply chain attacks in cybersecurity, illustrating how they exploit trust in software components and build systems, and offering practical strategies to mitigate these risks.

Resources and Shoutouts:
- GRC Engineering Presentation by AJ Yawn: https://engage.isaca.org/events/event-description?CalendarEventKey=bd0c09c0-662f-4fe8-a0d2-019adaab6cc4&Home=%2fevents%2fcalendar 

We're joined by Mark Headd author The SpecOps Method: A New Approach to Modernizing Legacy Technology Systems. We talk about good modernization practices like the strangler fig pattern as well as ways teams can use artificial intelligence to develop specifications that can be understood and validated across both technical and programmatic teams. 

Music Credit: Tumbleweeds by Monkey Warhol