Sixteen Inboxes: Asking Researchers to Audit a Jail App
Sixteen inboxes, four kinds of expertise — the routing decision behind a public-interest audit request.
Sixteen inboxes, four kinds of expertise — the routing decision behind a public-interest audit request.
On 15 December 2025, a public-interest review request went out to sixteen organizations — asking each to examine one jail communication platform and its mobile application. It was addressed not to a regulator and not to the vendor, but to the people who test software for a living and the newsrooms that publish what they find. The list is the first interesting thing about it: not a complaint sent into a void, but a routing decision made by someone who understood which kind of organization could answer which part of the question.
Sixteen inboxes, four kinds of expertise:
What was actually asked — the narrow scope:
The request asks four questions in writing about the application and the services behind it — deliberately narrow:
1. Whether data collection is limited to what is legally authorized 2. Whether permissions are proportional and transparent 3. Whether third-party SDKs, analytics, or AI tooling are used to profile or surveil people who are not incarcerated 4. Whether data is repurposed beyond the correctional and billing functions the platform advertises
“It is not a complaint sent into a void. It is a routing decision.”
Why the outside person is the installed base:
The incarcerated user does not install anything — he uses a wall handset or a kiosk. The application is installed by the person on the outside — a mother, a sister, a defense investigator, a friend — on her own phone, with her own money, in her own name. Most of those people are not accused of anything. Many are contacting a pretrial detainee — who under American law is presumed innocent and has not been convicted of the offense he is held on. A platform that profiles the caller is therefore profiling a population with no custodial status at all — and the consent it relies on was obtained by making contact conditional on installation.
Why the vendor cannot be the one who checks:
Every jail communication contract contains a security representation. The vendor says the system is secure; the county accepts the representation; nobody independent tests it. That arrangement works until it does not — and when it fails, there is usually no record of what the failure looked like from outside. Independent review changes the evidence base rather than the marketing: a permissions manifest can be read by anyone; network traffic can be observed; an SDK that ships an advertising identifier announces itself in the package. None of this requires breaking anything — and all of it produces findings a county could act on.
What would count as an answer:
Three outcomes are possible, and all three are informative: an organization reviews and publishes; an organization reviews and finds nothing — which is a result and should be said out loud; or nobody reviews — and the record then shows that a documented, specific, good-faith request to sixteen capable institutions produced no examination of a system that handles the calls of people in custody.
What the Record Shows:
The outreach joins a records demand against the same platform, an analysis of consent in jail calling, and a detention timeline that runs from 2019 — each document naming the thing it wants and the body that could supply it. A county can ignore an accusation. It has a harder time explaining why sixteen qualified organizations were asked to look, and the answer was silence.