Riley Walz built a real-time parking cop tracker using SF's public ticket database — the city killed it in four hours

Summary

Riley Walz built a real-time parking enforcement tracker for San Francisco by exploiting a structural vulnerability in the city's public ticketing system. SF's ticket payment portal assigns sequential, predictable IDs to citations, meaning Walz could poll for new ticket numbers as they were issued and surface live officer locations on a map. The site went globally viral within hours of launch. The SF government identified and patched the data access method in under four hours, rendering the tool inoperable.

The episode illustrates a recurring pattern in civic data infrastructure. Public records obligations force cities to expose transactional data, but the access mechanisms are rarely designed with scraping in mind. Predictable ID schemes are a known vulnerability class, and Walz has built an entire creative practice around them.

A Pattern of Public Data Exploitation

The parking tracker is one of several projects Walz has shipped using publicly accessible but overlooked datasets.

• Panama Playlist scraped the public Spotify listening data of notable figures including Mike Johnson, JD Vance, and Sam Walton. Spotify playlists are public by default, and Walz located profiles simply by searching real names. Many users took their playlists private after the project surfaced. Spotify has not yet changed default playlist visibility settings.
• A Google Maps attractiveness and demographics tool ran profile photos of restaurant reviewers in New York, SF, and LA through an attractiveness model, then aggregated results by location to produce demographic heat maps. Smaller mapping platforms have expressed interest; Google has not engaged directly.
• Walz separately scraped approximately 500,000 police photographs of graffiti from SF vandalism citations, which use a data structure similar to the parking ticket system. He is considering publishing the archive as an art project framed through the perspective of law enforcement documentation.

Background and Economics

Walz holds a full-time data role for commercial income and treats these projects as a creative outlet. He interned at Mischief, the stunt marketing agency founded by Gabe Whaley, in 2020, an experience he credits as a direct influence on the format and framing of his work.

His most operationally complex project to date was Mehran Steakhouse, a fake New York restaurant built on a Google Maps listing seeded with absurdist five-star reviews. After accumulating a substantial waitlist over two years, Walz and co-conspirator Mehran obtained proper permits, opened for a single fully licensed night, and served 120 guests who believed the restaurant was real. The event cost $16,000, generated $13,000 in revenue, and was covered by the New York Times. The $3,000 loss was, by Walz's account, well spent.

Walz has disclosed he needs $33,000 to fund an unnamed stunt planned for San Francisco in May 2026.