A police officer was dating a woman and he wanted to know where she went when she wasn't with him. He wanted to know where her ex-partner went, too. So he opened the department's Flock Safety dashboard, typed in their license plate numbers, and ran them. He did this more than 170 times in two months. Every query generated a timestamped map of their movements: where they drove, when they arrived, how long they stayed, which direction they left. The system was designed to find stolen cars and wanted felons. He used it to monitor the daily lives of two people who had committed no crime.
When the department discovered the abuse, they assigned a veteran detective to investigate. That detective was subsequently found to have used the same system 17 times to stalk a completely different woman. He logged his queries under the justification code "training." He also planted a physical GPS tracker under her car.
This was not an outlier. It was a preview. It's happening everywhere.
700 Searches in Three Months
In Idaho, a county sheriff ran his own wife's license plate through the Flock system more than 700 times over a three-month period. Every query was logged under the justification code "test." The system accepted the code without challenge. No supervisor reviewed the searches. No automated flag triggered an alert. When the pattern was finally discovered, the sheriff retired. He was not charged. He was not disciplined. He left on his own terms.
In Georgia, the scale of abuse within a single department was staggering. Five officers were fired and arrested for using the ALPR database to stalk and harass multiple victims. One of the five faced 11 separate felony counts. The cases were not connected to each other. Five officers in one department, each independently deciding that a nationwide surveillance database was a tool for personal control, and each operating for months without detection.
The Institute for Justice and independent researchers have documented dozens of similar cases across the country. The pattern is always the same: an officer with authorized access uses the system for personal reasons, the system provides the data without friction, and the abuse continues until someone outside the system notices.
The Corporate Employees Who Watched the Daycare
The insider threat does not stop at the badge. Public records audit logs obtained by independent researcher Jason Hunar revealed that Flock Safety's own Vice President of Business Development searched a city's ALPR database 63 times. The executive held no sworn law enforcement authority. No warrant authorized the searches. No criminal investigation justified them. He was a corporate employee with a sales quota, and the system gave him the same access it gave the officers.
The access extended to live video. Multiple Flock corporate employees were caught using live-view feeds from Condor PTZ cameras that had been installed inside a community gym. The cameras provided real-time views of the pool area, the fitness studio, and the preschool daycare. The employees accessed these feeds over multiple days. The stated justification was "sales demos."
The fundamental architecture of the system makes this inevitable. Flock operates on a Hardware-as-a-Service model in which the company retains ownership of all deployed hardware. The cameras are Flock's property. The data flows through Flock's servers. The access controls are Flock's to configure. When a municipality signs a contract, it is not purchasing a surveillance system and governing it. It is renting access to a surveillance system governed by a private corporation whose employees retain backend privileges that no city council ever voted to authorize.
The Sanctuary City That Wasn't
The database abuse extends far beyond personal stalking. It is structural, institutional, and ongoing at the federal level.
Across the United States, dozens of municipalities have enacted sanctuary city ordinances that explicitly prohibit local law enforcement from cooperating with federal immigration authorities. These ordinances reflect democratic decisions made by elected city councils responding to their constituents. Flock Safety's nationwide data-sharing network renders those decisions meaningless.
Independent audits have revealed that Immigration and Customs Enforcement and Customs and Border Protection agents have heavily utilized Flock's cross-jurisdictional sharing infrastructure to track undocumented immigrants in sanctuary cities. The mechanism is straightforward. When a municipality joins the Flock network and opts into data sharing, its camera feeds become accessible to thousands of other agencies through Flock's "National Lookup" feature. Federal agencies that have joined the network through other participating jurisdictions can search the shared pool. The sanctuary city's cameras feed data into a system that the sanctuary city's own ordinance was designed to prevent from being used for exactly this purpose.
Federal agencies including the Secret Service and the Naval Criminal Investigative Service have continually accessed the data pool despite Flock's ongoing assurances to local municipalities that such federal access did not exist. The company told cities one thing. The audit logs showed another.
In Denver, Colorado, independent audits discovered that over 1,400 immigration-related searches had been conducted on the city's Flock cameras. The city council overwhelmingly opposed the Mayor's attempt to renew the contract. In Evanston, Illinois, an audit by the Illinois Secretary of State found that Flock had violated state law by sharing local ALPR data with federal border protection agencies. The city terminated its contract and physically covered the cameras with plastic sheeting. In Santa Cruz and Mountain View, California, both municipalities deactivated their camera networks after discovering that hundreds of unauthorized federal agencies, including the ATF and various inspector generals, had run hundreds of thousands of searches on local citizens without approval.
Tracking Women Across State Lines
The implications extend into reproductive healthcare. The Electronic Frontier Foundation and the ACLU have documented instances where out-of-state law enforcement agencies utilized ALPR data to track women crossing state borders to obtain abortions. In Johnson County, Texas, authorities explicitly utilized the Flock network to monitor a woman suspected of obtaining reproductive healthcare.
The system's capabilities make this kind of tracking trivially easy. An investigator does not need a plate number. Flock's FreeForm search tool allows natural language queries: "vehicles parked at health clinics." The Convoy detection algorithm can identify which vehicles are regularly associated with a target vehicle, mapping an individual's social network through nothing more than parking proximity. An officer in one state can query the cameras in another state. No warrant is required. No notification is sent to the jurisdiction where the cameras are physically located.
The ability to track Americans to addiction recovery meetings, houses of worship, political rallies, gun stores, divorce attorneys, and reproductive health providers using a private company's nationwide camera network exists today. It requires nothing more than an authorized login and a typed description.
The Audit That Audits Itself
Flock Safety markets what it calls a "Transparency Portal," a system that purportedly allows municipalities to monitor how officers use the platform. The company cites this feature as evidence that its system is subject to meaningful oversight.
The reality, documented by researchers and confirmed by the Wyden-Krishnamoorthi letter to the FTC, is that the system's audit infrastructure is fundamentally broken. The web portals used by law enforcement to access the nationwide database did not require mandatory multi-factor authentication. Hackers successfully breached and stole at least 35 Flock customer accounts, which were subsequently sold on dark web marketplaces. The MFA methods that Flock did support relied on highly insecure SMS text messages rather than the phishing-resistant, hardware-token MFA mandated by CISA for federal operations.
Senator Ron Wyden and Representative Raja Krishnamoorthi pointed out a devastating consequence of this failure: because officers could access the system using other users' credentials without detection, the audit logs themselves are unreliable. The "Transparency Portal" cannot distinguish between an officer running a legitimate query under their own account and a hacker, a federal agent, or a colleague running an unauthorized query under a stolen login. The system that is supposed to audit the abuse is itself compromised.
When the tool designed to detect stalking cannot reliably identify who is conducting the searches, the word "transparency" becomes a marketing term, not a security control.
The Question the System Cannot Answer
Every case documented in this article shares one characteristic. The abuse was discovered not by Flock Safety's internal controls, not by the Transparency Portal, not by automated anomaly detection, and not by supervisory review. It was discovered by accident, by victims, by journalists filing public records requests, or by researchers auditing logs that the company never expected anyone to read.
The Milwaukee officer ran 170 searches before anyone noticed. The Idaho sheriff ran 700. The Georgia officers operated for months. The Flock VP searched a city's database 63 times. The corporate employees watched the daycare camera for days. In every case, the system processed the request, returned the data, and asked no questions.
The question Flock Safety has never answered is not whether its system can be abused. The documented record makes that obvious. The question is whether the system, as designed, is capable of preventing abuse at all, or whether frictionless, borderless access to the movement histories of hundreds of millions of Americans is itself the product.
Next in this series: The security researcher who found 51 vulnerabilities in the nation's largest police surveillance network, including live camera feeds streaming on the open internet with no password. Flock told him to stop looking. A United States Senator told the FTC to start.
Disclaimer: This article is for informational and journalistic purposes only and does not constitute legal advice. References to law enforcement misconduct, federal agency access, and corporate practices are based on public records, published audit findings, and congressional correspondence. All individuals referenced are presumed innocent unless and until proven otherwise in a court of law. Guerrilla News is an independent journalism outlet and is not affiliated with any company, government agency, or legal proceeding discussed in this report.
Sources
- "The Case Against Flock Safety," DeFlockOKC
- "How a $7.5 Billion Surveillance Company Built America's Largest Warrantless Tracking Network," MyPrivacy Blog
- "What the Police Actually See When They Run a Flock Search," DeFlockILM
- BCOS Resolution 2026-02 DRAFT with Memo, City of Bloomington, Indiana
- "License Plate Surveillance Logs Reveal Racist Policing Against Romani People," Electronic Frontier Foundation
- "The Nationwide Resistance Against Flock Surveillance Cameras Is Gaining Steam," Truthout
- "Lawmakers Ask FTC to Probe Flock Safety's Cybersecurity Practices," Recorded Future News
- "US Lawmakers Call for FTC Probe Into Flock Safety," Biometric Update
- "Santa Barbara County Sheriff's Office Provides Update on ALPR Information Sharing"
- "Surveillance Technologies and Constitutional Law," National Institutes of Health / PMC
Everyone can join the discussion with a free account. Members get a badge, their comments stand out, and they are eligible for the pinned Top Comment. Join from $7 a month.