Flock Camera Architecture Enables Misuse, Not Just Bad Actors

Flock Safety's automated license plate reader (ALPR) systems demonstrate significant architectural flaws that facilitate widespread misuse, extending beyond individual bad actors. A broad investigation by The Washington Post uncovered multiple instances where police officers exploited Flock's cameras for personal surveillance and harassment. In one prominent case, a police chief in Georgia used the system to search his ex-partner's and her daughter's license plates nearly 600 times.

These abuses do not require hacking or stolen credentials, but rather exploit the system's inherent functionalities. Flock cameras capture vehicle license plates, locations, and identifying marks that law enforcement can search without warrants or supervisory approval. While Flock maintains that permanent audit logs help uncover misconduct, these logs record transgressions only after they occur and require active auditing, which is often neglected.

The system's architecture transforms local cameras into a nationwide surveillance network, allowing agencies that did not purchase the cameras to query data. For example, U.S. Customs and Border Protection accessed thousands of cameras in a nationwide vehicle-tracking pilot, sometimes without the knowledge of local authorities. Furthermore, individual searches, such as tracking a woman in another state following an abortion, have highlighted the system's potential to be used to circumvent laws.

Flock has implemented measures, such as reducing data retention periods and requiring search codes, to address these issues. However, these changes do not resolve the fundamental architectural problems. The system's extensive interconnectedness and insufficient tracking of data usage make surveillance difficult to control and manage, raising concerns about constitutional rights and privacy under the Fourth Amendment in the United States.