← all projects
// 0VΣЯW4TCH Android · Kotlin v0.1.7

OVERWATCH

A native Android app for passive surveillance detection. Open it, hit START, and a circle turns green / yellow / orange / red depending on how confident the engine is that there's a Flock Safety ALPR, an Axon body camera, or active police presence near you.

Download APK git.thecoven github
platformAndroid (API 31+)
languageKotlin · Compose
sources5 (BLE · WiFi · DEFLOCK · CITIZEN · fusion)
latestv0.1.7
Passive defense only. OVERWATCH only listens — it does not transmit, probe, jam, or interfere with any device or network. Axon advertise/fuzz code from upstream reference projects is intentionally excluded.

What it detects

Five independent sensors. Each one feeds the same scoring engine, and cross-source corroboration pushes the global tier upward — a BLE OUI hit and a DeFlock map match in the same area produce a higher tier than either alone.

BLE

Bluetooth-LE advertisements

Vendor MAC OUIs (Axon, Flock Penguin / Raven, XUNTONG mfg id 0x09C8, "TN" serial pattern), Raven service UUIDs, device-name patterns. Iterates every manufacturer-specific data entry, not just the first.

WIFI

BSSIDs + SSID patterns

31-prefix Flock OUI superset and Flock-XXXX name patterns. WifiManager.getScanResults() polled every 35 s — just under the Android 11+ 4-scans/2-min throttle.

DEFLOCK

Crowdsourced ALPR map

Direct Overpass POSTs (overpass.deflock.org → fallback overpass-api.de) for man_made=surveillance · surveillance:type=ALPR in a 5 km bbox. 24 h on-disk cache by 0.05° grid cell; refetches when the user moves > 1.5 km from the last fetch center.

CITIZEN

Real-time police incidents

citizen.com/api/incident/trending bbox poll every 60 s, then per-incident detail via /api/incident/{id} with an in-memory cache. Fire- and medical-only events filtered out. First poll fires immediately on the first location fix.

FUSION

Confidence engine

Every observation scored 0–100 by ConfidenceEngine. The on-screen tier is the maximum live score across all sources, with an RSSI rise-peak-fall detector for stationary signals.

Why no Waze? Waze added reCAPTCHA gating to live-map/api/georss in 2025/2026. Mobile clients receive HTTP 403 and the only known workarounds (Selenium proxy on a home server, Waze-for-Cities partner program) aren't viable for a phone-deployed app. Citizen replaces it as the police-presence source.

Threat tiers

Score 0–100. The user-facing circle uses the 4-tier mapping. When idle, the circle shows muted gray with IDLE so it's distinguishable at a glance from "scanning, all clear."

GREEN< 40 · nothing credible
YELLOW40 – 69 · single weak indicator
ORANGE70 – 84 · high confidence
RED85 + · certain

How alerts work

Architecture

One foreground service owns all scanners, the notification, and the vibrator. No detection-history database — all state is in-memory and clears on stop, by design. Service uses START_NOT_STICKY so a system kill doesn't auto-restart into a stuck state.

ui/MainScreen.kt                   circle + START/STOP + tap-to-open bottom sheet
ui/SettingsScreen.kt               source toggles, distance sliders, vibrate, theme
ui/theme/Theme.kt                  Material 3 dark/light + threat colors
service/DetectionService.kt        foreground service — owns scanners, notif, vibration
scan/BleScanner.kt                 BLE callback scanner
scan/WifiScanner.kt                WifiManager poller + SCAN_RESULTS receiver
scan/DeflockClient.kt              Overpass POST + 24 h on-disk cache
scan/DeflockScanner.kt             location-driven proximity check + backoff
scan/CitizenClient.kt              GET /trending + /incident/{id}
scan/CitizenScanner.kt             60 s poller, fire/medical filter, per-id cache
fusion/ConfidenceEngine.kt         scoring (one place — BLE / WiFi / DeFlock / Citizen)
fusion/RssiTracker.kt              rise-peak-fall stationary-signal detector
fusion/DetectionStore.kt           in-memory dedup, 5-min retention, max-tier flow
fusion/SourceHealth.kt             per-source OK/FAILED registry for drill-down
fusion/ThreatLevel.kt              4-tier enum + DetectionSource enum
data/location/LocationProvider.kt  FusedLocationProviderClient wrapper
data/settings/Settings.kt          SharedPreferences-backed StateFlow settings
data/targets/                      BleOuis, WifiOuis, RavenUuids, Patterns, Manufacturers

Permissions

Requested at runtime when you press START for the first time. If you permanently deny a required permission ("don't ask again"), the START button swaps to Open app settings which fires the per-app system-settings page so you can grant manually.

PermissionWhy
BLUETOOTH_SCAN, BLUETOOTH_CONNECT (API 31+)BLE scanning
BLUETOOTH, BLUETOOTH_ADMIN (≤ API 30)BLE scanning, legacy
ACCESS_FINE_LOCATIONRequired for BLE pre-S, WiFi pre-T, and DeFlock/Citizen proximity
NEARBY_WIFI_DEVICES (API 33+)WiFi scan results without using location
ACCESS_WIFI_STATE, CHANGE_WIFI_STATETrigger and read scan results
INTERNET, ACCESS_NETWORK_STATEDeFlock Overpass + Citizen API
FOREGROUND_SERVICE_*Keep scanning with the screen off
POST_NOTIFICATIONS (API 33+)Foreground-service notification
VIBRATEHaptic alert on threat-tier escalation

Build & install

Requires JDK 21 (Android Gradle Plugin 8.7.x rejects JDK 26), Android Studio with SDK Platform 34 + Build-Tools 34.x + Platform-Tools.

# 1) Copy the example local.properties and point sdk.dir at your install
$ cp local.properties.example local.properties
# edit local.properties → sdk.dir=/Users/<you>/Library/Android/sdk

# 2) Make sure JAVA_HOME is JDK 21
$ export JAVA_HOME=/usr/local/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home

# 3) Build & install on a connected device with USB debugging
$ ./gradlew :app:installDebug

Or download the latest debug-signed APK from Releases and sideload.

Settings

Release history

Phases 1–5 (skeleton, BLE, WiFi, DEFLOCK, CITIZEN, polish) complete and field-tested. Current release v0.1.7 addresses two full audit passes.

v0.1.7System back from Settings returns to MAIN instead of exiting.
v0.1.6Dynamic notification with tier + label, haptic alerts on escalation, Open-in-Maps for geo events, idle visual differentiated, permanent-deny recovery via Open Settings.
v0.1.5Waze removed (reCAPTCHA-gated; no clean mobile workaround).
v0.1.4Citizen.com added as 5th source, per-source health registry.
v0.1.3DeFlock CDN replaced by direct Overpass calls (Cloudflare-blocked).
v0.1.2Android 14+ foreground service type fix (location was being silently revoked); NaN-coordinate filter on map data.

Disclaimer

Tool for situational awareness about deployed surveillance infrastructure in public spaces. Local laws regarding electronic surveillance, RF monitoring, and police-tracking apps vary — your responsibility to know what's legal where you are. Personal-use license; reference repos under REFERENCES/ retain their own licenses and are not redistributed as part of this project.