A Flock of Problems with Mass Surveillance

Michael De Dora is the US Advocacy Manager for Access Now. Maria Villegas Bravo is Counsel at the Electronic Privacy Information Center (EPIC).

Today, the United States Senate Judiciary Subcommittee on Crime and Counterterrorism will host a hearing titled “Always Watching: Flock’s Nationwide AI Surveillance Network.” The hearing comes as Americans are pushing back against the growing appearance of Flock Safety cameras in communities across the country. Under public pressure, more than 130 cities across 20 states have ended their contracts with the private surveillance company. Citizens have also taken matters into their own hands: in one viral case, a Florida man with a homemade sign has sat himself next to a local Flock camera to block its view.

Flock’s automatic license plate readers (ALPRs) are perhaps the most visible manifestation of a transformational expansion of the use of private surveillance technology by law enforcement in the United States. The backlash — in this case against a visible AI-boosted mass surveillance tool — has created an opportunity for real change. But it requires understanding Flock itself, as well as how it fits in the broader context of surveillance in the US.

How Flock works

Founded in 2017 and headquartered in Georgia, Flock markets a range of technologies — automated license plate readers (ALPRs), mass video surveillance, and gunfire locator systems — to law enforcement and homeowners associations. The company has more than 120,000 cameras operating in 49 states. These cameras are capable of still photos, video recording, audio capture, and livestreaming.

Flock is not like the CCTV networks you find at corner bodegas or electronic car tolling. Flock cameras take photos of cars and their surroundings, then collect and upload the data into a cloud-based system that law enforcement customers can search. Flock’s proprietary algorithm then creates a “vehicle signature” by cataloguing make, model, color, and any other distinguishing features like bike racks and bumper stickers. Law enforcement can also upload hotlists of license plates of interest that Flock flags whenever the car at issue passes by the camera. It also allows for safe lists, meaning cars that should not be flagged.

Flock also allows third-party footage to be added to the database and analyzed with its vehicle fingerprinting through its Flock Safety Wing Suite. Customers can opt for AI analysis integrations that link license plate numbers directly to other information in the agency’s records systems. The AI-powered integrations can also create connections between particular vehicles and a vehicle’s location history pattern.

Flock says camera data is stored for a default of seven days (previously 30), though law enforcement can export data and thus effectively nullify retention limitations. The Flock database is searchable by law enforcement, both by inputting specific license plate numbers or with natural language search terms such as “red pick up truck.”

Flock says there isn't one giant national database into which everyone's Flock data flows. Instead, individual customers own and control their data and decide whether to participate in sharing. However, customers can choose to pool their Flock data with other agencies without any legal notification or authorization to the data subjects. In other words: local police departments can decide to share with each other, or with a federal agency, without telling the public.

Notably, Flock has claimed for years that it does not use facial recognition on its cameras or its software suite. However, its Condor suite can zoom in on people and track motion. Flock’s new software, called OS Investigate, reportedly uses an artificial intelligence system to identify drivers and track vehicles by their patterns of movement. Furthermore, once police officers download the raw data from the Flock system, they can run the videos through their own separate facial recognition systems.

The case against Flock

The case against Flock and its vision for a surveilled society is three-fold. First, the technology itself is flawed. Second, even if the technology was flawless, a retroactive, searchable, and shareable location history of Americans’ whereabouts seriously undermines Americans' right to privacy in public. Third, allowing private mass surveillance firms like Flock to take over law enforcement activities presents serious abuse and security risks.

While Flock and police departments that partner with the company claim that Flock helps solve crimes — by reportedly helping police locate stolen cars, missing children, and criminals — recent data and cases have emerged casting doubt on the overall accuracy of these tools, especially in relation to the risks it poses to privacy and security.

Flock claims its cameras are 96% accurate, but that percentage only applies to counting the number of vehicles passing by a camera. Flock also claims about 90% accuracy for identifying the class of vehicle, meaning whether a car is an SUV or sedan. As to the accuracy of Flock's license-plate-reading technology, an analysis by the Roseville, California police department found that 71% of the 1,427 stolen-vehicle and felony alerts generated by Flock's cameras in 2023 and 2024 contained a misread license plate. The LAPD recently allowed its contract to expire, noting in an audit of its ALPR system that the hotlists were frequently inaccurate and that over 150 cars were pulled over despite not being stolen. Even if the Flock’s accuracy claims applied to actual vehicle identifications, their cameras capture over twenty billion license plate readings per month. Applied at a scale, even a low error rate could produce a substantial number of dangerous false stops and arrests.

Beyond mere error, the Institute for Justice has cataloged more than 170 incidents of ALPR abuse. Some of these cases involve vehicle stops and arrests based on misidentifications where police had guns drawn. In one case, a woman was visited by a police officer claiming with certainty that she was responsible for stealing a package, thanks to Flock footage of her car. During the visit the officer said "You can't get a breath of fresh air in or out of that place without us knowing, correct?" The woman then spent weeks retracing her steps and — with the aid of video from her own vehicle — proved her innocence.

While there are different expectations of privacy in public and private spaces, there is no justification for police across the country tracking people's every move without cause. These cases exemplify the challenge Flock poses to rights: a private mass surveillance company is contracting with public entities to erect continuous camera surveillance that collects, stores, and shares data with police departments and federal agencies regardless of whether people are involved in any criminal activity. This presents serious threats to the exercise of constitutional rights including unreasonable search and seizure, interstate travel, and freedom of association.

Flock-type cameras also put both Americans and sensitive police operations at serious risk. In many cases, Flock has been long abused without anyone noticing. Many officers have used the technology to engage in stalking, an issue that has mostly targeted women. One police officer is accused of using Flock to track his estranged wife’s vehicle 717 times. He allegedly falsified justifications for the searches, which took place over a period of 21 months. Another officer is under investigation — and may avoid prison time — for using Flock to track and harass a woman he met on a TV set while working security. Yet another was sentenced to prison for using Flock to stalk an ex-girlfriend.

The security and privacy implications of abuse are also troubling. At least one police department is ending its relationship with Flock after thousands of the department’s Flock searches were leaked online. Hackers also recently were able to access Flock software and the reams of data it stores simply by physically removing a camera. A joint analysis of the recovered data by the hackers and 404 Media “shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles.”

The dangers of Flock also go beyond just ALPRs or its use on public roads. One technologist discovered Flock cameras that recorded children’s playgrounds were exposed online. In another case, Flock employees trying to show off their surveillance capabilities in a sales pitch to a Georgia school accessed video of a children’s gymnastic rooms.

Flock in context

Flock is a visible manifestation of a much larger transformation in American surveillance that should alarm Americans. Much of this surveillance power exists at the federal level, where there is sufficient money to purchase the most powerful technology. For example, the Department of Homeland Security and Immigration and Customs Enforcement pay for access to the following: personal data obtained from data brokers, AI target generation, facial recognition technology, digital forensic extraction tools, automatic license plate readers, secret databases, cell site simulators, cell phone tracing, social media monitoring, and even spyware.

Installing Flock cameras is part of a larger problem whereby governments have deputized private companies to surveil the populace. Flock acts as a force multiplier for other law enforcement technology, and conveniently lacks a warrant authorization process.

What policymakers can do

While opposition to Flock continues to succeed at the local level, members of Congress have not been idle.

Earlier this year, Reps. Scott Perry (R-Penn.) and Chuy García (D-Calif.) introduced an amendment to a highway bill during committee markup that would ban the use of automatic license plate readers except for tolling purposes. Rep. Andrew Clyde (R-Ga.) introduced a similar provision during another committee markup. Both failed.

Rep. Thomas Massie (R-Ky.) proposed a bill to prohibit federal funding for local law enforcement and municipal entities that contract with Flock and Rep. Keith Self (R-Texas) has introduced legislation requiring federal agencies to obtain a warrant before accessing data collected by surveillance camera systems like Flock.

More recently Sen. Josh Hawley (R-Mo.) wrote a letter to the company requesting the production of documents about how Flock handles the data it collects; Sens. Ron Wyden (D-Ore.) and Adam Schiff (D-Calif.) have since sent a similar letter. Flock confirmed receipt of Hawley’s letter but said it would respond directly rather than publicly. When Hawley invited Flock’s CEO Garrett Langley and other industry executives to testify before the subcommittee today, they declined; the hearing will instead feature law enforcement, technical and legal experts, and one wrongfully accused driver.

In view of these efforts, the record of Flock abuse, and the need for accountability, we believe a few things must be done.

First, law enforcement agencies and communities should cancel existing contracts with Flock and similar technologies. The record of inaccuracy and abuse is too deep to justify continued governmental contracts.

Second, to the extent that law enforcement continues to use these technologies, policymakers should set strict data retention and deletion policies, including for data that is stored by law enforcement on third party databases.

Third, policymakers should require a search warrant for any query of an ALPR system. The Supreme Court ruled in Carpenter v. United States that the government generally needs a search warrant supported by probable cause to obtain historical cell-site location information (CSLI) because of the reasonable expectation Americans have in their long-term location information. Allowing law enforcement unfettered access to Flock systems — which similarly enable long-term, wide-ranging tracking — without a search warrant violates Carpenter and Fourth Amendment protections.

Perhaps more importantly, policymakers should take the groundswell of local opposition to Flock and other surveillance systems as a cue: mass surveillance is not welcome in our neighborhoods. Authorities should use this opportunity to review the government’s use of all private surveillance technologies at every level — through outreach, hearings and investigations — to ensure the protection of constitutional rights and that individuals feel safe in their neighborhoods from government overreach.