Loading story…
Flock Safety announced changes to its automated license plate reader platform after sustained criticism over police misuse of its system, including allegations of stalking and improper searches. The company said it will recommend a 7-day default retention period instead of 30 days, add offense-based sharing filters, require search-reason logging and Audit Assistance for law-enforcement customers, implement proactive account lockouts for abnormal activity, mandate multi-factor authentication, commission an independent security review by Bishop Fox, and launch a coordinated vulnerability disclosure program.
Civil-liberties advocates said the measures do not resolve broader risks posed by Flock’s surveillance network, which spans more than 120,000 ALPRs across at least 6,000 U.S. cities. Critics argued that exceptions such as Evidence Mode could still allow indefinite retention, that prior search-purpose controls were reportedly easy to bypass, and that there is no independent proof the audit tooling reliably detects abuse. The backlash follows reports of at least 46 cases of alleged improper access and adds to concerns about data sharing, wrongful stops, non-law-enforcement use, and the continued expansion of camera deployments.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
Social media users promoted a 'De-Flock America' Halloween 2026 night of action encouraging participants to disable nearby Flock ALPR cameras while concealing their identities. X grouped the posts into a trending story that logged more than 36,500 posts over two days.
The ACLU launched its Get the Flock Out campaign to coordinate litigation, advocacy, and legislative efforts by affiliates against the spread of Flock Safety and other license plate readers.
The ACLU published an analysis arguing that Flock Safety's newly announced updates were largely public-relations driven and did not meaningfully address the civil-liberties and misuse risks of its ALPR network.
Flock Safety announced changes including a default 7-day retention recommendation, Evidence Mode, offense-based sharing filters, required search reasons and Audit Assistance, proactive lockouts, mandatory MFA, an independent Bishop Fox security review, and a coordinated vulnerability disclosure program.
Flock Safety said recent Audit Assistance reviews were associated with the arrests of several law enforcement officers who allegedly abused the system.
Flock Safety CEO Garrett Langley apologized in an interview with CBS News after hearing one woman's account of alleged abuse involving the company's system.
Reporting cited in the references said police officers were accused in 46 cases of improperly using access to Flock Safety's license plate reader network, including alleged stalking and other personal misuse.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
techdirt.com
Open sourcetheregister.com
Open sourcetechdirt.com
Open sourceaclu.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flock Safety announced privacy and security reforms for its automated license plate reader network after backlash over law enforcement misuse of the platform. The company said it will reduce its standard data retention period from 30 days to seven days, require officers to enter a reason or case code for searches except in genuine emergencies, and let agencies restrict what offense categories can be shared with other municipalities. Flock also introduced **Evidence Mode**, which allows longer preservation of data when permitted by local policy and tied to an investigation. The company said its **Audit Assistance** feature, which flags unusual search behavior for administrator review and can automatically lock out users, will become mandatory for all law enforcement customers by the end of the year. The changes follow reports that officers used Flock systems to stalk romantic partners and other individuals, including a Georgia case involving former sheriff’s deputies, while privacy advocates and researchers have questioned the tool’s transparency and whether independent auditing is needed. Flock defended the changes by saying most searches occur within a week and that its cameras were used in about 1 million investigations last year, including cases that helped locate roughly 10,000 missing people.
Aug 14, 2026
New York advocacy groups allege that state and local police searched **Flock Safety** automated license-plate-reader (ALPR) data for ICE and CBP-related purposes, sometimes logging the requests under generic investigative labels. Separately, reporting has identified dozens of U.S. officers accused, investigated, fired, or arrested for unauthorized ALPR searches, including alleged personal surveillance of romantic partners. The allegations have renewed calls for stricter audit reviews, access controls, retention limits, and restrictions on sharing vehicle-location data with immigration authorities. Scrutiny also extends to the scale of Flock’s network and the wider ALPR market. Flock reportedly explored using Nexar dashcams in rideshare and delivery vehicles to expand law-enforcement-accessible plate collection, though the company said the partnership did not materialize. Flock has reduced default retention from 30 days to one week and added safeguards, but agencies may be able to change those settings. Municipalities are reconsidering deployments: Manchester, Vermont, tabled a decision on its five cameras amid privacy and AI false-positive concerns, while other cities have disabled systems and opposition has included alleged camera vandalism. Civil-liberties advocates warn that alternative providers, including Motorola Solutions/Vigilant and Axon, create comparable mass-surveillance risks.
Sep 4, 2026
Senator Ron Wyden and Representative Raja Krishnamoorthi have called for a federal investigation into Flock Safety, a company operating the largest network of automated license plate readers (ALPRs) in the United States, citing concerns over negligent handling of Americans’ personal data and inadequate cybersecurity measures. The lawmakers allege that Flock Safety fails to enforce cybersecurity best practices, such as mandatory multi-factor authentication (MFA), leaving customer accounts vulnerable to compromise. Reports indicate that at least 35 Flock customer accounts have been stolen by hackers, and the company’s voluntary authentication does not natively support phishing-resistant MFA. These security lapses have raised fears that hackers or foreign actors could gain access to sensitive location data on millions of Americans, and that law enforcement agencies can improperly share access to Flock’s systems. The controversy surrounding Flock Safety extends beyond cybersecurity, as privacy advocates and local communities have raised alarms about the potential for abuse and invasive tracking through the company’s ALPR network. Some communities have already succeeded in removing Flock cameras, motivated by concerns over wrongful detentions, privacy violations, and the use of Flock data in sensitive investigations, such as those involving abortion patients and undocumented immigrants. Lawmakers argue that Flock’s practices expose Americans to significant risks and have urged the Federal Trade Commission (FTC) to investigate, referencing previous FTC enforcement actions against companies that failed to implement adequate authentication controls.
Jun 29, 2026