Yves here. The article sheds light on the alarming misuse of Flock’s automated license plate recognition (ALPR) system, revealing how it has been exploited not only by law enforcement agencies but also through unwarranted collaborations with external parties, particularly ICE. Given that law enforcement constitutes Flock’s primary clientele, it’s unrealistic to expect the company to adhere to any form of self-regulation. In light of these abuses, Congress is exploring possible restrictions, one of which is covered in this piece from The Texan titled Texas Congressman Introduces Bill to Restrict Flock Cameras, Other Surveillance Technologies:
By Henry F. Fradella, Professor of Criminology and Criminal Justice, Arizona State University. Originally published at The Conversation
Marci Bakely found herself under constant surveillance by her ex-boyfriend, who seemed to know her every move. Whenever Bakely, a single mother from Georgia, went to the grocery store or out on a date, her former partner would often text her within minutes.
The Washington Post investigation revealed that Bakely’s ex-boyfriend, who served as the Police Chief of Braselton, Michael Steffman, looked up her and her teenage daughter’s license plates around 600 times using Flock Safety, a company specializing in networks of automated license plate readers (ALPRs).
In November 2025, the Georgia Bureau of Investigation arrested Steffman on charges of stalking, harassment, and misuse of ALPR technology. Tragically, he was found dead before the trial could take place.
Bakely’s story is not an isolated incident. The Washington Post documented at least 50 law enforcement officers accused of abusing their access to ALPRs, including 26 individuals who used Flock’s cameras to monitor current or former partners or potential romantic interests. Further investigations have uncovered over 100 police department employees facing allegations of misuse.
While Flock contends that these incidents represent a minuscule fraction of its 140,000 monthly users, the fact remains that these abuses did not require hacking or theft of credentials. Each offender entered through the front door.
As a scholar in criminal procedure, I direct a school dedicated to forensics and assert that the issues surrounding ALPR systems highlight a flaw in the architecture of surveillance systems, rather than simply indicating the wrongdoing of select users.
A Search Engine for Movements
Flock’s cameras capture essential data such as a vehicle’s license plate, location, and unique identifiers, including physical damages or bumper stickers. The system employs AI to categorize license plate images by date taken, enabling police departments across the network to conduct searches without requiring warrants or supervisory oversight.
In September 2026, an investigative report by Wired and 404 Media analyzed data obtained from a compromised Flock camera. This log consisted of about 21 days’ worth of data, involving roughly 50,200 vehicles and 1.6 million images. Surprisingly, the software also identified people and bicycles, even isolating an American flag patch on a motorcyclist’s saddlebag. While Flock stated that they lacked sufficient information to validate claims regarding security vulnerabilities, the implications are unsettling.
Flock insists that customers control their own data, yet agencies that keep sharing enabled might be unaware of who accesses their information. For instance, in 2025, U.S. Customs and Border Protection accessed over 80,000 cameras during a secret nationwide vehicle-tracking pilot, which included cameras belonging to local police departments without their awareness.
Audit logs only capture misuse after it occurs, and only if someone bothers to review them. Indianapolis law enforcement did not routinely audit Flock searches until The Washington Post brought to light thousands of dubious inquiries made by a single officer. A subsequent systemwide audit revealed alleged misconduct by four additional officers. Other police departments discovered misconduct through media reports as well.
The adjustments made by Flock in August 2026 aimed to shorten data retention from 30 to seven days while requiring misuse detection and case codes to document all searches. However, customers are still allowed to retain data for extended periods, and emergencies may bypass case codes, which can be entered without judicial approval.
Furthermore, Flock’s architecture effectively transforms local cameras into a cross-jurisdictional surveillance network accessible to agencies that never procured the equipment they query.
Public records from Danville, Illinois, revealed that federal agencies conducted more than 4,000 searches through this network, some of which appeared to be related to immigration enforcement, despite the lack of a contract between U.S. Immigration and Customs Enforcement and Flock.
A similar analysis in 2026 uncovered that 11,935 immigration-related searches were made using partial records from eight college police departments, demonstrating that federal immigration agencies sometimes accessed campus camera data without the awareness of campus officials.
This system also facilitates searches in legally disputed contexts. In May 2025, a Texas sheriff’s office queried over 83,000 cameras to locate a woman who had undergone a self-managed abortion. The logged purpose for the search was recorded as “had an abortion, search for female.” This search extended even into Illinois, where state law prohibits sharing license plate data to enforce another state’s abortion ban. The sheriff described it as a welfare check. Regardless of intent, one deputy initiated a nationwide dragnet without any independent oversight.
These instances illustrate not only individual misconduct but also a systemic flaw. The platform’s design makes it easy for secondary parties to utilize the cameras, challenging effective oversight and control once local cameras are interconnected.
The legal framework surrounding ALPR usage remains uncertain.
In October 2025, a Virginia appeals court ruled that officers did not require a warrant to retrieve three images spanning seven minutes from Norfolk’s extensive network of 172 cameras because the images captured vehicles, not individuals. However, subsequent findings regarding Flock’s capacity to detect people complicate this distinction. Analysis of the hacked camera indicated that its software could identify individuals and capture their locations within an image.
In January 2026, a federal judge ruled that Norfolk’s camera network did not violate Fourth Amendment protections, reasoning that the system did not record anyone’s complete movements, even though it photographed two plaintiffs’ vehicles 475 and 325 times over a span of four and a half months. This ruling is currently under appeal.
The Supreme Court’s 2018 decision in Carpenter v. United States held that accessing seven days’ worth of historical cellphone location data typically mandates a warrant because such data can reconstruct an individual’s past movements. Flock’s architecture raises similar but unsettled legal questions: its database, while capable of reconstructing movements, is searchable by police without a warrant.
Both rulings from Norfolk occurred before the Supreme Court’s June 2026 decision in Chatrie v. United States, which determined that police conducted a search under the Fourth Amendment when they obtained two hours of stored Google location data. The court did not determine the lawfulness of the search but remanded it to the lower court to evaluate whether the warrant met the Fourth Amendment’s requirements.
This does not render the access automatically unconstitutional; the Fourth Amendment prohibits unreasonable searches, not all searches. Typically, police require a warrant supported by probable cause once their actions are classified as searches.
The Chatrie decision acknowledged the differentiation between vehicles in public view and phone-location data that can intrude into private spaces. However, it also raised concerns regarding comprehensive databases that can be searched retroactively. A license plate reader network has the potential to create similar archives of a driver’s public movements.
Thus, the constitutional debate in Norfolk concerns not only the seven minutes of data retrieved but also the extent of surveillance enabled by the 172-camera network.
Enforceable Limits
The cases from Indianapolis reveal the shortcomings of Flock’s internal controls. Marion County Prosecutor Ryan Mears noted that many proposed safeguards would not have prevented the observed misconduct, emphasizing the necessity for independent or judicial scrutiny.
To protect the advantages of Flock while minimizing the potential for misuse, I advocate for five essential safeguards:
- Judicial authorization for retrospective regional or national searches based on individualized suspicion, best accomplished with a warrant based on probable cause, accompanied by an emergency exception.
- Technical access controls to limit immigration and reproductive health-related searches.
- Automatic deletion of data after a short time frame.
- Opt-in interstate data sharing, rather than making it the default.
- Independent audits of search logs and overall device security.
The recent safeguards implemented by Flock indicate an acknowledgment of the importance of design, but private mechanisms cannot replace the need for robust legal frameworks. It’s not merely about ensuring officers comply with regulations; it’s imperative to establish enforceable boundaries.
