Flock: the surveillance
you already paid for.
Flock Safety cameras sit on poles at intersections and neighborhood entrances across the country. They photograph every vehicle that passes and build a searchable, shareable record of where you have been. You did not consent to it, you cannot opt out of it, and in most places it was bought with your tax dollars without a vote.
What they actually capture
An automated license plate reader (ALPR) works nothing like a red-light camera. A red-light camera fires when someone runs the light. An ALPR records every vehicle that drives past, not just suspects, not just cars flagged for anything. If you drove past one today, you are in the database.
- Every passing vehicle, photographed automatically, day and night.
- The plate text, read by optical character recognition, including temporary and paper plates.
- A timestamp and GPS coordinates: exactly where you were, and exactly when.
- A "vehicle fingerprint": make, model, and color, plus distinguishing details (dents, bumper stickers, roof racks, ladders) so a vehicle can be tracked even with no readable plate.
- Uploaded to Flock's cloud, where it becomes searchable and shareable across thousands of participating agencies nationwide.
Flock Safety is one vendor among several building this infrastructure. Others include Motorola Solutions (Vigilant), Rekor, Genetec, and Axon. The pattern is the same across all of them: capture everyone, store it in the cloud, make it searchable.
Why "I have nothing to hide" fails here
This has nothing to do with getting caught doing something wrong. It is that a durable, searchable record of your movements now exists (where you sleep, worship, protest, seek medical care, and who you visit), and you have no control over who queries it, or why.
You are trusting not only your local department, but every agency it shares the network with, forever. Reporting has documented Flock data being accessed by federal agencies including ICE and CBP, in some cases without the local department that owns the camera even knowing its data had been searched.
The record so far
Everything above is about what the system makes possible. Here is what has already been done with it. Most of what follows comes from criminal complaints and court opinions. Where a claim rests on reporting instead, it says so.
When the camera goes looking for a crime
The usual defence of ALPR is that it is a lookup tool. A crime happens, police have a plate, they go and find the plate. Wisconsin ran it backwards.
Wisconsin police were looking for Edward Abrams-Phillips on a bail-jumping charge. Along the way they ran his plate through Flock and found a pattern: repeated trips to Michigan, where cannabis is legal, and back to Wisconsin, where it is not. That pattern went into the complaint as grounds for suspicion. When a camera logged him heading home, officers "made a coordinated effort to intercept" the car. The arresting officer said he smelled raw marijuana. That got him into the car without a warrant, and in the car was the marijuana.
The bail-jumping charge that started all of it was dismissed. He was convicted of possession.
Nobody searched Flock to identify a suspect, because there was no crime yet to have a suspect in. Police read a travel history, decided what it probably meant, and went looking for something that would match. What made him worth stopping was driving to a state where the thing is legal.
When the operator goes looking for a person
The second pattern is older and far better documented. No department decided to misuse anything. Every one of these was a single person with a valid login.
- Victor Heiar, Kechi Police Department, Kansas. A lieutenant who used Wichita's Flock system to follow his estranged wife, who had already told a friend she believed she was being tracked and did not know how. He pleaded guilty to computer crime and stalking, both misdemeanours, and was sentenced in April 2023 to 24 months in jail, suspended to 18 months' probation. Kansas revoked his law enforcement certification.
- Alexander Vanny, Riverside County Sheriff's Office, California. Photographed the plate of a friend of his former fiancée and ran it through the department's Flock system to find her. A jury convicted him on ten counts, including stalking and unauthorised access of electronic data, and he is serving six years.
- Michael Steffman, chief of police, Braselton, Georgia. Roughly 600 lookups on his former partner and her teenage daughter across eight months. She told a judge in August 2025 that he was using the cameras to track her; her request for a restraining order was denied for want of evidence. The Georgia Bureau of Investigation charged him that November with stalking, harassing communications, misuse of automated license plate recognition and violating his oath of office. He died before the case reached trial.
- Cristian Morales, Menasha Police Department, Wisconsin. Sentenced in August 2026 to six months in jail and three years' probation for targeted surveillance through Flock.
- Emily Pacheco, New Bedford Police Department, Massachusetts. Pending. Her former partner testified in court that Pacheco had been tracking her. City records put Pacheco among the heaviest users of the city's system, with her search volume climbing sharply after the breakup. A judge found she posed a credible threat and suspended her firearms licence. The department suspended its Flock system.
These are not the whole list. The Washington Post counted more than fifty officers across a dozen states accused of this, over half of them tracking a partner or an ex, and the Institute for Justice maintains a running database of the cases.
Heiar's case is the one that should worry people, because nothing about it was a breach. He was an authorised user running ordinary queries on a system his own department had paid for. There was no lock to pick. The audit log did not stop him; it is only how anyone found out afterwards.
What the courts have said
Less than you would hope, and so far mostly against you.
Lee Schmidt and Crystal Arrington sued Norfolk, Virginia over a network of roughly 175 camera clusters that had logged each of their cars hundreds of times in about four months. Neither had been accused of anything. On 27 January 2026 Chief Judge Mark Davis granted summary judgment to the city. Norfolk's coverage has gaps, he reasoned, and Virginia caps retention at 21 days, so the network does not yet capture "the whole of a person's movements" in the way Carpenter forbids. The case is on appeal to the Fourth Circuit.
Two days later Washington's Court of Appeals got to the same place by another route. A man there had asked a trial court to throw out the Flock data that led police to him.
Everything turns on that sentence. If one photograph of a plate on a public road is harmless, then no number of them ever adds up to a search, and the size of the network never becomes a legal fact at all. The opinion is unpublished, and Simonson has petitioned the Washington Supreme Court to review it.
Take one detail from that record to your own city council. The court noted that law enforcement keeps ALPR audit logs indefinitely, showing every query run and the reason the user gave for running it. In Simonson's case the State never produced them.
Then the ground moved. On 29 June 2026 the Supreme Court decided Chatrie v. United States six to three. It is not an ALPR case; it is about a geofence warrant served on Google. But the Court held that people keep a reasonable expectation of privacy in their digital location data even when a third party is the one holding it, and even over short stretches of time. It also weighed what the technology can do, rather than only what these particular police did with it on the day. That is the argument the Fourth Circuit now has in front of it. Flock's public position is that geofence warrants are "categorically different from license plate recognition technology."
Statutes have done better than the Constitution here. In August 2025 an audit by the Illinois Secretary of State found Flock in breach of state law for letting Customs and Border Protection reach data from Illinois cameras. A 2023 Illinois statute bars sharing plate data for immigration enforcement or for out-of-state abortion investigations. What prompted the audit was a Texas sheriff's office running a nationwide Flock search for a woman who had ended her own pregnancy. Forty-seven agencies lost access to Illinois data, and Flock paused its pilots with the Department of Homeland Security. Two suits are still open: a class action in San Francisco over out-of-state sharing under California's ALPR Privacy Act, and one filed against Wichita in August 2026 that cites Heiar by name.
The constitutional challenges have mostly lost, and they lost on facts a city picks for itself: how many cameras it buys, how long it keeps the data, who else it lets in. The statutory challenges have mostly won, and those statutes came out of legislatures. Both of those are decided in rooms you can walk into.
When it worked
One case from this summer went the other way, and it never reached a courtroom.
Idaho Code § 49-1432 took effect on 1 July 2025. Plate data may be used to investigate crimes, work traffic accidents and search for missing or endangered people, and it "shall not be used for any non-law enforcement purpose." Every query has to be logged with the user's identity and the reason they gave for running it, and agencies have to audit those logs.
Brian McKellar, an Idaho Falls resident organising with DeFlock Idaho, went and read what his city had actually signed. The contract let Flock "use customer data to support and improve Flock's products and services", which in practice meant training the company's recognition models on photographs of his neighbours' cars. Idaho Falls signed that contract in February 2025 and signed a second one in July 2025, after the statute was already in force.
He raised it at council meetings on 25 June and 9 July 2026 and told the council to cover the cameras or face a claim. When his deadline passed he filed a notice of tort claim on 29 July. Two days later the council voted unanimously to amend the contract.
The amendment does three things. It bars Flock from training machine learning models on Idaho Falls footage, leaving the company only non-footage hardware data, so it can still work out why a camera stopped responding. It narrows the contract's permitted purpose to law enforcement uses authorised by § 49-1432, which binds every outside agency the city shares with to Idaho's rules rather than their own. And the police department now makes officers record why they ran a query and cite the statute that allows it, with audits moved from twice a year to at least twice a month.
Notice what the chief did not concede. The city's position is still that it was compliant the whole time, and the statute says nothing explicit about vendors, so whether that first contract actually broke the law was never tested and now never will be. It did not have to be. Reading it out loud in a public room was enough.
The claim itself is still pending, and so is a second one against Twin Falls on a different theory. Neither has produced a dollar. What changed the contract was a resident who read it, read the statute next to it, and turned up to say so out loud.
Filing a claim against a government is a legal step with deadlines and requirements that differ in every state, and none of this is legal advice. The part you can copy without a lawyer is the first part: get the contract, get your state's statute, and read them next to each other.
You cannot opt out
There is no consumer-facing exit from this system. The usual privacy playbook (adjust a setting, submit a deletion request) does not apply.
- No national opt-out registry. Unlike data brokers, there is no central place to remove yourself.
- No consumer deletion path. You cannot ask Flock to delete your vehicle from its records.
- Flock calls itself a data processor, not the data owner. It redirects deletion requests to the law enforcement agency that owns the camera, an agency that has no obligation, and often no interest, in honoring them.
The only lever that actually works is local: the contracts your city or county signs, the councils that approve them, and the records requests that expose how the system is used.
Find the cameras near you
Volunteers have mapped ALPR locations across the country. Start with DeFlock. It is the primary community project and feeds its data into OpenStreetMap. The other map below largely renders that same OpenStreetMap-sourced data.
A community project that maps ALPR cameras and feeds the data into OpenStreetMap. No login required. States plainly: no tracking, no analytics, no ads.
Another map of ALPR locations. It largely renders the same OpenStreetMap-sourced data that DeFlock feeds.
These maps are crowdsourced and incomplete. Absence from a map is not evidence of absence. A camera you cannot see on the map may still be on your street.
What actually changes things
Because the lever is local, so is the work. Hardening your own devices does nothing here. This gets decided in public meetings and public contracts, which means it can be changed there too.
- File a public records request with your city or county for the Flock contract and the audit logs. Audit logs show which agency searched the system and the reason they stated for each search.
- Check for a Flock "transparency portal" for your city. Some jurisdictions publish search counts and policies online.
- Show up at council meetings. These contracts come up for renewal, and renewal is the moment a community can say no.
- Frame it as a budget question as well as a rights question. This is public money spent on ongoing surveillance of everyone who drives through town. Ask what it costs, what it is for, and what it caught that justifies the price.