❌

Normal view

Received — 21 September 2026 ⏭
Received — 17 September 2026 ⏭

Flock cameras are tracking people as well as cars

✇Malwarebytes Labs
17 September 2026 at 14:46

Flock Safety’s cameras are automated license plate readers (ALPRs) designed to help police find stolen cars or wanted suspects.

A joint investigation by 404 Media and WIRED, based on data recovered from a physically removed Flock camera, found that its on-device software explicitly detects people as well as vehicles, bicycles, and license plates.

Separately, Washington DC’s police union says the Metropolitan Police Department used Flock data to track officers under Internal Affairs investigation without their knowledge.

Together, these reports illustrate a privacy problem: A network built to record the movements of vehicles can readily be used to follow almost anyone.

The latest reporting adds an important technical detail to that debate.

What Flock cameras collect

A group of hackers reportedly removed a Flock camera from a roadway, copied its storage, and recovered an encryption key stored on the device. That allowed them to unlock videos of thousands of vehicle detections despite Flock’s claim that its devices are protected by on-device encryption. Flock said it could not assess the claims without more detail.

The recovered camera files reportedly contained software models that detect people, even though public discussion of Flock has usually focused on cars and license plates. The researchers found no evidence that face-recognition features were actively used. Reassuring, but it should not be mistaken for a clean privacy bill of health.

Even without facial recognition, a system that records repeated sightings can potentially reveal sensitive patterns of movement, including where someone lives, works, worships, seeks healthcare, attends protests, visits family, or spends time with other people. When a person is matched to a vehicle, vehicle-based tracking can become person-based tracking in practice.

As an example of how widely the data can be shared, WIRED found that records from the city of Alpharetta, Georgia:

“were accessible to more than 2,000 agencies, including police departments, colleges, airports, and, inexplicably, the Office of Inspector General for the federal General Services Administration.”

Targeted tracking of people

The Washington DC dispute shows what happens when the power to follow people is turned inward.

The DC Police Union says it learned in July that MPD’s Internal Affairs investigators had used Flock license-plate-reader data to track sworn officers under investigation without their knowledge. The union filed a complaint and asked the department to stop, arguing that MPD lacked adequate controls for a system with such extensive surveillance capabilities.

MPD defended the use, saying its position is that the use of license-plate-reader data in the misconduct investigation was appropriate. It said the labor dispute is headed to arbitration.

If police officers themselves are concerned that the system can be used to monitor them without transparent rules, the public should ask an obvious follow-up question: What prevents the same tools from being used to follow residents, employees, journalists, activists, former partners, or other people with no meaningful ability to challenge the search?

Even when Flock wants privacy to meet surveillance halfway, its measures do not eliminate the underlying civil-liberties issue.

The recovered camera software and the DC dispute make the same point from different directions. Flock’s network is not merely a collection of roadside plate readers. It is a distributed system for recording movement, identifying patterns, and making those records available for search.

Meaningful safeguards should include:

  • Public approval before cameras are deployed, with clear maps showing their locations and stated purposes.
  • Strict limits on collection, retention, searches, and cross-jurisdictional sharing.
  • A requirement for documented investigative justification before a search, with elevated approval for sensitive investigations.
  • Independently reviewable audit logs, regular public transparency reports, and meaningful penalties for misuse.
  • Clear bans on searches related to protected activity, immigration enforcement where local law forbids cooperation, abortion-related investigations, political surveillance, and personal purposes.
  • Independent security assessments covering the cameras, cloud services, identity controls, key management, and third-party integrations.
  • Automatic deletion that cannot be overridden merely because data could someday be useful.

Privacy cannot depend on authorized users always following rules, vendors configuring every setting correctly, or abuses being discovered the hard way. The first safeguard should be limiting the system’s ability to build a searchable record of ordinary people’s lives at all.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Received — 27 August 2026 ⏭

Flock wants privacy to meet surveillance halfway

✇Malwarebytes Labs
27 August 2026 at 11:15

Flock Safety CEO Garrett Langley says the United States needs a “compromise” between privacy and public safety.

It’s a neat phrase, except I don’t like to see “compromise” and “privacy” that close together.

“When people talk about just one of these, privacy or safety, they’re prioritizing the wrong thing, and what we have to prioritize as a country is compromise.”

Langley call for compromise comes as the company faces intensifying resistance to its automated license plate reader (ALPR) network. The opposition has begun to affect Flock commercially and operationally, with agencies disabling cameras or canceling contracts.

The problem is that the public has already been doing the compromising: People’s movements have been routinely captured, stored, searched, and, in some cases, shared far beyond the communities that installed the cameras.

Flock’s ALPRs collect detailed records of where vehicles travel, then make that data available to law enforcement for investigations. Langley now says the company wants more regulation and accountability. Flock says it’s reducing its recommended default retention period to seven days and will require case codes for law enforcement and an audit tool designed to flag suspicious access by the end of the year.

Those are welcome concessions, but they do not resolve the underlying concern: A rapidly expanding, privately operated surveillance network can turn ordinary travel into searchable historical data.

The opposition has not faded; it has intensified. NPR reports that cameras have been vandalized in at least 36 states. Vandalism is neither a productive nor lawful answer, but its spread offers a useful measure of how profoundly many people feel excluded from decisions about surveillance in their communities.

A genuine compromise would not start with the assumption that widespread collection is inevitable and then negotiate the retention period. It would begin with democratic consent, strict limits on how the data can be used, independently enforceable access controls, public reporting, meaningful opt-outs where possible, and a clear requirement that surveillance be necessary and proportionate.

Calls to meet halfway are also harder to take seriously when the CEO has been accused by 404 Media of misleading police about the outlet’s reporting on an abortion-related case. According to 404 Media, his account is contradicted by court records and police reports. That accusation makes his public calls for compromise much harder to accept.

Flock is right about one thing: There needs to be accountability. But calling for “compromise” after the cameras are already up sharply limits the choices left to communities. Privacy is not a bargaining chip to be surrendered whenever surveillance vendors promise safety.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Received — 20 July 2026 ⏭
Received — 16 July 2026 ⏭

The backlash against Flock cameras is spreading

✇Malwarebytes Labs
16 July 2026 at 09:56

Flock-style ALPR systems carry serious privacy and civil-liberties risks, and the backlash is now starting to show up in agency decisions too.

For those not yet familiar with Flock, Flock Safety operates an automated license plate recognition (ALPR) system that uses cameras and computer vision to identify and log vehicle license plates.

According to ACLU.org, in the US there are currently:

“80,000–100,000 Flock cameras in both urban and rural areas on highways, in neighborhoods, and outside your local hardware store.”

Automated license plate readers were sold as a crime-fighting tool, but growing evidence suggests the privacy and accountability problems surrounding Flock are becoming increasingly difficult to dismiss. A growing number of incidents now show the same pattern: broad surveillance, shaky oversight, and enough operational risk to create real harm for ordinary people.

ALPR systems create durable location records about people who are not suspected of anything. Every scan can become part of a searchable trail, and once that data is collected, the risks expand through misuse, unauthorized sharing, vendor practices, and simple errors.

Abuse and errors

One of the most troubling aspects is how easily this technology can be misused. Straight Arrow News (SAN) reported that another police officer was charged after allegedly abusing Flock surveillance tools, adding to a growing list of cases in which officers have allegedly misused license plate reader systems for personal reasons, including stalking and monitoring ex-partners or protesters. An Institute for Justice analysis identified at least 22 cases nationwide in which officers allegedly abused ALPR to keep tabs on their romantic interests, with the bulk of those incidents happening since 2024.

That misuse problem is amplified by how widely the data can spread once it enters the system. Earlier this year, we reported that Mountain View disabled its Flock cameras after discovering that Flock had shared license plate data with hundreds of agencies, including federal entities, without permission, and that some lookup features had been activated without the city’s intent or knowledge. That kind of unauthorized sharing turns a local surveillance tool into a much broader data-exchange network with far weaker public visibility than most residents would expect.

Then there is the accuracy problem. SAN also reported that the Los Angeles Police Department (LAPD) allowed its Flock pilot contract to expire after an inspector general audit found 161 vehicles were falsely flagged as stolen over a two-month period. The audit concluded that 32.3% of the alerts it reviewed were inaccurate. When the system gets it wrong that often, the result is not just inconvenience. It can lead to unnecessary stops, detentions, and avoidable confrontations with law enforcement.

As the audit by the department’s inspector general stated:

“When a license plate matches with a vehicle of interest on a Hot List, an alert will appear on the police vehicle’s Mobile Digital Computer. Often, officers will approach the vehicle with extreme caution or conduct a ‘high-risk’ stop. This involves calling for back up, air support and a supervisor and ordering the suspect out of their vehicle.”

What makes this notable is that the criticism is no longer limited to privacy advocates and researchers. Some agencies are now acting on the concerns themselves, whether by ending contracts, disabling camera networks, or pausing renewals until privacy and oversight rules improve.

Flock is still marketed as a public-safety tool, but the latest reporting shows its real-world impact is increasingly defined by privacy concerns, weak oversight, and growing institutional skepticism. That skepticism is beginning to influence agency decisions. Once law enforcement itself begins pulling back, it suggests the debate has moved well beyond criticism from privacy advocates alone.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

❌