Flock Police Misuse: What You Need to Know About Authorized Access

I. The Person Whose Password Works

A stalker does not need to break into Flock’s network. In dozens of documented cases, the access already worked. A Washington Post investigation identified at least 46 instances in which officers were accused of using Flock’s automated license plate reader system for personal reasons, including tracking former partners, current partners, and people they had no legitimate investigative reason to locate. Follow-up reporting pushed the confirmed count past 50. One former Milwaukee officer, court records show, used the system to search a romantic partner’s location 124 times. In Texas, an officer was accused of tracking a woman across state lines who was suspected of having self-administered an abortion.

These were not outside hackers forcing their way into the network. The alleged misuse came from people with authorized law-enforcement access. Nothing in the login process distinguished a legitimate investigation from an obsession.

That is the uncomfortable starting point for anything Flock announces this week. The company’s cameras did not fail. Its authentication did not fail. The people using the system exactly as designed are, in a small but recurring number of cases, the problem the system was never built to see on its own.

II. Flock Finally Built the Guardrail

On Thursday, Flock announced a real set of changes. Every law enforcement customer must activate Audit Assistance, a tool that flags abnormal searches and locks the user out pending review, by the end of the year. Roughly a third of agencies had already turned it on voluntarily, and the company says the tool has already surfaced some of the incidents now under scrutiny, including cases investigators uncovered in Bibb County, Georgia.

Default data retention is shrinking from thirty days to seven, with a new “Evidence Mode” allowing investigators to move specific records tied to active cases into longer-term storage. Officers will also be prompted to attach a case number and offense type to searches, and agencies will gain new filters on what categories of searches outside departments are permitted to see.

CEO Garrett Langley did not hide from the moment. “I apologize,” he told CBS News, addressing one woman’s account of being tracked using the network. “It kills me that she went through that.” Asked whether the company had acted quickly enough, he did not deflect: “Hindsight tends to be very clear … I think, of course, we could have done more earlier.” Those are not the words of a company pretending nothing happened. At the same time, Flock built something real this week, and it deserves to be described accurately rather than dismissed outright as theater.

III. Flock Police Misuse: Detection Is Not Accountability

But a flagged search is an event, not a resolution. Once Audit Assistance locks an account and an administrator reviews it, everything that determines whether misuse actually stops happens outside Flock’s software entirely. Does the reviewing supervisor take the flag seriously, or quietly clear a colleague? The next question belongs to the department: does discipline follow, or does the incident end as an informal conversation? And for the person who was searched, the most consequential question is whether they ever find out. Experts told Ars Technica that Flock “can’t tech its way out of the stalker cop problem” — not because the tool is worthless, but because detection and governance are performed by different actors operating under different incentives. ACLU senior policy counsel Chad Marlow raised a related concern: without knowing the true scale of misuse, no one outside Flock can say whether Audit Assistance is catching most violations or only a few.

IV. A Case Number Is Not a Conscience

The case-number requirement illustrates the same limit from a different angle. A field in a database can require an explanation. It cannot require honesty. An officer determined to misuse the system can attach a real case number tied to an unrelated matter, or write a justification that sounds procedurally sound to a reviewer with limited time and loyalty toward a colleague. The requirement raises the cost of casual, undocumented misuse. In practice, it does little to stop a determined one, and it does nothing about the supervisor at the other end of the review who ultimately has to decide whether to act on what the software surfaces — or to let it go.

V. Local Control Cuts Both Ways

Flock has repeatedly emphasized that individual agencies, not the company, control their own data and retention choices, and this week’s announcement preserves that structure: existing customers keep their current, locally approved retention periods unless they opt into the new seven-day standard. That local control is defensible as a matter of democratic accountability — a community’s elected officials setting policy for a tool deployed in that community. It is also precisely why a single national narrative about “Flock’s safeguards” oversimplifies what is actually happening. Flock police misuse, in other words, is not one national story — it is thousands of local ones. A seven-day default retention period changes nothing for a department that keeps its existing thirty-day policy. An audit tool changes little if the administrator reviewing a flagged search reports through the same chain of command as the officer being flagged. Flock standardizes the software nationwide. The governance sitting on top of it is not, and will not be, without thousands of separate local decisions Flock’s own dashboard cannot make for them.

VI. The Scale Changes the Stakes

None of this is happening at a small scale. Flock’s network now spans more than 120,000 cameras across roughly 6,000 to 7,000 communities in nearly every state. KMOB1003 has followed this infrastructure’s growth since June, when we examined how ordinary driving was becoming a searchable database of American movement, and again when we examined the constitutional gap between phone location privacy and license-plate records. Flock police misuse matters more as the network scales, since every credential carries greater reach. The more interconnected and useful that database becomes to legitimate investigations, the more consequential every single valid credential inside it becomes — because scale does not only multiply the benefit the system provides to public safety. As a result, it multiplies the potential damage available to whoever is sitting at a terminal with permission and bad intent, and it multiplies the number of communities depending on a governance structure that still varies from one department to the next.

VII. The Software Found Something. Now What?

Flock’s changes this week are not nothing, and they are not everything. They narrow the opportunity for casual misuse and create a paper trail that did not exist before. What they cannot do is stand in for a supervisor willing to act on a flag, a department willing to discipline its own, or a public willing to demand disclosure when misuse is confirmed. Langley himself drew the distinction plainly: “We’re not going to change humans, and humans make bad decisions. What we can do is make sure that they know if you use this tool, you will be held accountable.” However, that is a fair description of what software can promise. The real test of Flock’s new safeguards will not be whether the software notices more suspicious searches. It will be what institutions do after it notices them.

The Operator’s Bookshelf

KMOB1003 Reads

Attack from Within: How Disinformation Is Sabotaging America

Barbara McQuade

McQuade examines what happens when institutions are weakened from inside by people, incentives and systems that exploit trust. It belongs beside this article because Flock’s hardest problem is not an unknown outsider breaching the network. It is what institutions do when misuse comes from someone already authorized to enter.

Read Attack From Within →

Nexus: A Brief History of Information Networks from the Stone Age to AI

Yuval Noah Harari

Harari’s larger question is how information networks create power, coordination and risk. Flock is ultimately not just a camera system. It is a network that transforms observations into searchable institutional knowledge — and makes governance of that network consequential.

Read Nexus →

As an Amazon Associate, KMOB1003 may earn from qualifying purchases.

Disclosure: KMOB1003 may earn a commission from qualifying purchases through select partner links. Editorial coverage is produced independently.