Loading story…
Bipartisan congressional proposals would restrict automatic license plate recognition (ALPR) networks amid reports of police misuse, inaccurate matches and security weaknesses. Sen. Josh Hawley’s proposed Stop Flock Abuse Act would require access controls, encryption, shorter data retention and limits on sharing. A broader Democratic proposal would prohibit federal ALPR use and withhold federal funding from states deploying the technology. The proposals extend beyond Flock Safety to providers including Motorola and Axon, but their prospects for congressional votes remain uncertain. Scrutiny follows a wrongful arrest linked to incorrect Flock data, arrests of Indianapolis officers accused of improper searches and reports of unpermitted cameras in Florida.
Flock said it replaced free-text search justifications with standardized categories and would require case numbers for law-enforcement searches by the end of 2026, while allowing an emergency bypass. It previously promised a default seven-day retention period and an Audit Assistance feature. Separately, cybersecurity researcher Joshua Michael reported finding an exposed Flock access token that allegedly enabled retrieval of camera-location data without further authentication; he used the data to publish a nationwide surveillance map. Critics argue the announced controls remain inadequate without case-number validation, geographic search restrictions and regular log reviews—highlighting the need for agencies using ALPR services to verify credential protections, enforce retention and sharing limits, and audit searches for abuse.
See the reporting duties and controls this puts on the clock.
12 events from the most recent confirmed update back to the earliest known activity.
Five Indianapolis police officers were arrested for allegedly conducting dozens or hundreds of Flock searches to track personal contacts.
Joshua Michael published a surveillance map showing approximately 300,000 Flock-connected devices nationwide, including more than 170,000 Flock cameras in use. His camera count exceeded Flock’s stated deployment of 120,000 cameras.
Cybersecurity researcher Joshua Michael said he discovered an exposed access token on Flock’s website that worked without logging in. The token allegedly allowed queries to a Flock geographic information system to retrieve camera location data.
Senators Bernie Sanders and Jeff Merkley and Representative Alexandria Ocasio-Cortez introduced a proposal to prohibit federal ALPR use and withhold federal funding from states deploying the technology. It would also allow Americans to sue the federal government over rights violations resulting from ALPR deployment.
Hawley introduced legislation requiring written approval for ALPR searches, supervisory audits, encryption, and a 10-day retention limit. The proposal would also restrict driver-data sharing and prohibit adding facial recognition to ALPR cameras.
In a letter to Hawley, Flock’s chief legal officer described replacing free-text search justifications with standardized categories modeled on the FBI’s data-reporting system. Flock also said law-enforcement searches would require case numbers by the end of 2026, with an emergency bypass.
Lindsey Isaacs testified at Senator Josh Hawley’s hearing about her arrest and incarceration associated with incorrect Flock data. Hawley also cited Joshua Michael’s surveillance mapping work.
Michael said a reporter informed him that Flock had emailed customers describing him as a malicious actor and stating that it had notified law enforcement.
Flock allegedly filed a trademark infringement complaint against Joshua Michael. Michael also reported receiving a cease-and-desist letter threatening litigation.
Flock announced a default seven-day data-retention period and an Audit Assistance feature intended to improve agencies’ oversight of officers’ searches. These were earlier commitments to enable certain optional safeguards by default.
Officials in St. Lucie County, Florida, discovered 14 Flock cameras they had not known about and had not permitted, according to Washington Post reporting cited by The Record.
Lindsey Isaacs reported that incorrect Flock ALPR data led to her arrest and 13-day incarceration, including more than three days in solitary confinement. Her vehicle matched the model of a vehicle whose occupants were suspected of a crime several miles away.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcetechdirt.com
Open sourcehawley.senate.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New York advocacy groups allege that state and local police searched **Flock Safety** automated license-plate-reader (ALPR) data for ICE and CBP-related purposes, sometimes logging the requests under generic investigative labels. Separately, reporting has identified dozens of U.S. officers accused, investigated, fired, or arrested for unauthorized ALPR searches, including alleged personal surveillance of romantic partners. The allegations have renewed calls for stricter audit reviews, access controls, retention limits, and restrictions on sharing vehicle-location data with immigration authorities. Scrutiny also extends to the scale of Flock’s network and the wider ALPR market. Flock reportedly explored using Nexar dashcams in rideshare and delivery vehicles to expand law-enforcement-accessible plate collection, though the company said the partnership did not materialize. Flock has reduced default retention from 30 days to one week and added safeguards, but agencies may be able to change those settings. Municipalities are reconsidering deployments: Manchester, Vermont, tabled a decision on its five cameras amid privacy and AI false-positive concerns, while other cities have disabled systems and opposition has included alleged camera vandalism. Civil-liberties advocates warn that alternative providers, including Motorola Solutions/Vigilant and Axon, create comparable mass-surveillance risks.
Sep 4, 2026
Flock Safety announced changes to its automated license plate reader platform after sustained criticism over police misuse of its system, including allegations of stalking and improper searches. The company said it will recommend a **7-day default retention period** instead of 30 days, add offense-based sharing filters, require search-reason logging and Audit Assistance for law-enforcement customers, implement proactive account lockouts for abnormal activity, mandate multi-factor authentication, commission an independent security review by **Bishop Fox**, and launch a coordinated vulnerability disclosure program. Civil-liberties advocates said the measures do not resolve broader risks posed by Flock’s surveillance network, which spans more than **120,000 ALPRs** across at least **6,000 U.S. cities**. Critics argued that exceptions such as **Evidence Mode** could still allow indefinite retention, that prior search-purpose controls were reportedly easy to bypass, and that there is no independent proof the audit tooling reliably detects abuse. The backlash follows reports of at least **46 cases** of alleged improper access and adds to concerns about data sharing, wrongful stops, non-law-enforcement use, and the continued expansion of camera deployments.
Aug 20, 2026
Flock Safety announced privacy and security reforms for its automated license plate reader network after backlash over law enforcement misuse of the platform. The company said it will reduce its standard data retention period from 30 days to seven days, require officers to enter a reason or case code for searches except in genuine emergencies, and let agencies restrict what offense categories can be shared with other municipalities. Flock also introduced **Evidence Mode**, which allows longer preservation of data when permitted by local policy and tied to an investigation. The company said its **Audit Assistance** feature, which flags unusual search behavior for administrator review and can automatically lock out users, will become mandatory for all law enforcement customers by the end of the year. The changes follow reports that officers used Flock systems to stalk romantic partners and other individuals, including a Georgia case involving former sheriff’s deputies, while privacy advocates and researchers have questioned the tool’s transparency and whether independent auditing is needed. Flock defended the changes by saying most searches occur within a week and that its cameras were used in about 1 million investigations last year, including cases that helped locate roughly 10,000 missing people.
Aug 14, 2026