The trouble with Flock cameras is the surveillance system’s architecture, not just some of its users

Wherever Marci Bakely went, her ex-boyfriend seemed to know. When the Georgia single mother drove to the grocery store or a date, he often texted within minutes.

According to a Washington Post investigation, Bakely’s ex-boyfriend, Braselton Police Chief Michael Steffman, searched her license plates and those of her teenage daughter roughly 600 times through Flock Safety, a company that makes and operates networks of automated license plate readers, or ALPRs.

The Georgia Bureau of Investigation arrested Steffman in November 2025 on charges of stalking, harassment and misuse of an ALPR. He was found dead before trial.

Bakely’s case is not unique. The Post identified at least 50 officers accused of misusing ALPRs, including 26 who used Flock’s cameras to spy on current or former partners or people they hoped to meet. Its investigation has since identified at least 100 police department employees charged with or accused of misuse.

Flock says these people represent a tiny share of its more than 140,000 monthly users and that permanent audit logs help uncover misconduct.

But these abuses required no hacking or stolen credentials. Each user walked through the front door.

I’m a criminal procedure scholar and I direct a school devoted to forensics. I believe the controversy over ALPRs points to a defect in the surveillance system’s architecture, not just the criminality of some of its users.

A search engine for movements

Flock cameras capture a vehicle’s plate, location and distinguishing marks down to dents or a bumper sticker. AI can sort license plate photographs by date taken. Police departments across the network can then conduct searches without warrants or supervisory approval.

In September 2026, news outlets Wired and 404 Media analyzed data that hackers had copied from one Flock camera. About 21 days of logs contained roughly 50,200 vehicles and 1.6 million images. The software detected people and bicycles, and it even isolated an American flag patch on a motorcyclist’s saddlebag. Flock said it lacked enough information to assess the hackers’ technical claims about security vulnerabilities in the camera.

Flock says customers control their data, yet a department that leaves sharing enabled may not know who is looking. In 2025, U.S. Customs and Border Protection accessed more than 80,000 cameras during an undisclosed nationwide vehicle-tracking pilot, including one police department’s cameras without its knowledge.

Logs record misconduct only after it happens, and only if someone reads them. Indianapolis police did not regularly audit Flock searches until The Washington Post flagged thousands of questionable inquiries by one officer. A systemwide audit found alleged misuse by four more officers. Other police departments likewise learned of officers’ misuse from reporters.

Flock’s August 2026 changes shorten recommended data retention from 30 to seven days and require misuse detection and case codes to document searches. But customers may retain data longer, emergencies may bypass case codes, and entering a case number can be done without judicial approval.

Examples of user overreach

Flock’s architecture turns local cameras into a cross-jurisdictional surveillance network that agencies that never purchased the cameras may query.

Public records from Danville, Illinois, revealed more than 4,000 searches by federal agencies, including some with a potential immigration-enforcement focus, although U.S. Immigration and Customs Enforcement had no Flock contract.

A 2026 study similarly found 11,935 immigration-related searches in partial records from eight college police departments. Federal immigration agencies sometimes accessed campus camera data without campus officials’ knowledge.

The network also enables searches in other legally contested areas. In May 2025, a Texas sheriff’s office searched more than 83,000 cameras for a woman who had self-managed an abortion. The logged reason was “had an abortion, search for female.” The search reached Illinois, where state law forbids sharing plate data to enforce another state’s abortion ban. The sheriff called it a welfare check. Whatever the motive, one deputy triggered a national dragnet without independent review.

These examples reflect more than individual misuse. The platform makes the cameras easy to use by a second party, difficult to monitor and hard to control once local cameras are connected.

Why the Fourth Amendment matters

The law remains unsettled on ALPR use.

In October 2025 a Virginia appeals court held that police officers needed no warrant to retrieve three images spanning seven minutes from Norfolk’s 172-camera network because they showed vehicles, not people. But later findings about Flock’s people-detection capabilities weaken that distinction. Analysis of the hacked camera showed that its software could identify a person and record that person’s location within an image.

In January 2026 a federal judge held that Norfolk’s then-176-camera network did not violate Fourth Amendment protections. The system did not capture anyone’s entire movements, the court reasoned, although it photographed two plaintiffs’ vehicles 475 and 325 times over four and a half months. The ruling is being appealed.

In 2018 the Supreme Court held in Carpenter v. United States that acquiring seven days of historical cellphone location records generally requires a warrant because they can reconstruct someone’s past movements. Flock’s architecture raises a related but unresolved question: Its database can also reconstruct movements, yet police officers may search it without a warrant.

Both Norfolk rulings predate the Supreme Court’s June 2026 decision in Chatrie v. United States, which held that police conducted a search under the Fourth Amendment when they obtained two hours of stored Google location history. The court did not decide whether the search was lawful. Instead, it returned the case to the lower court to determine whether the warrant satisfied the Fourth Amendment’s requirements.

That did not make the access automatically unconstitutional: The Fourth Amendment prohibits unreasonable searches, not all searches. But the police generally need a warrant supported by probable cause once their conduct is classified as a search.

The Chatrie decision distinguished vehicles exposed to public view from phone-location data that can follow someone into a home or other sensitive place. But it also expressed concern about comprehensive archives that can be searched retroactively. A license plate reader network can create a similar archive of a driver’s public movements.

The constitutional question in Norfolk, therefore, turns not only on the seven minutes retrieved, but also on the surveillance power of the 172-camera network.

Enforceable limits

The Indianapolis cases expose the limits of internal controls in Flock’s system. Marion County Prosecutor Ryan Mears said many proposed guardrails would not have prevented the conduct. He pointed to the need for independent or judicial oversight.

I believe five safeguards could preserve Flock’s benefits while curbing abuse:

1. Judicial authorization for retrospective regional or national searches based on individualized suspicion, preferably a probable-cause warrant, with an emergency exception.

2. Technical access controls restricting immigration and reproductive-health searches.

3. Deletion of data after a short period.

4. Opt-in interstate data sharing, rather than by default.

5. Independent audits of search logs and device security.

Flock’s new safeguards show that the company concedes that design matters, but private settings cannot substitute for laws. It’s not a matter of making sure officers follow the rules. It’s about creating enforceable limits.