The latest available information indicates the department holds a contract with Flock for a single LPR camera, one PTZ camera, and twenty-nine Raven “gunshot” detectors.^[1]

HaveIBeenFlocked.com typically limits itself to analyzing LPR logs and license plate queries — not because the other logs the system produces aren’t interesting, but because the site wasn’t built to ingest them automatically. When one resident examined Dunwoody’s event logs, his analysis showed Flock employees were watching children inside a community center. Thousands of other, unexamined logs exist.

The event log analyzed here was obtained from New Castle PD through a Pennsylvania Right-to-Know request; the request and released files are on MuckRock. It runs from June 28, 2023 through April 27, 2026 — nearly three years — and includes detailed hotlist entries, network sharing, and configuration updates.

The Hardware

New Castle PD’s Flock account includes 31 active devices. Most of them — 29 — are Raven units, Flock’s acoustic detection sensors.

All 31 devices — the ALPR, the surveillance camera, and all 29 gunshot detectors — are located in or immediately adjacent to census tract 42073000400.

That tract has a population of 1,776. It is the only census tract in New Castle where white residents are not a majority. Its demographic profile compared to the rest of the city:

Tract 42073000400 has the highest Black population share in Lawrence County by a wide margin. The next-highest tract in New Castle is at 18.9%. The city’s whiter, more suburban tracts — most with Black populations under 5% — have no Flock devices at all.

The other two devices are:

• One Falcon (ALPR): #01 Lowery St @ W Falls St SB — the department’s only license plate reader, with live video and vehicle description alert capability.
• One PTZ (connected via Wing): C001 W North St Park PTZ — a pan-tilt-zoom surveillance camera at W North Street Park, capable of live streaming and free-form visual search of people.

Both face the same basketball court.

The watchlists: private, undocumented, and tracking individuals

Flock’s event log records when anyone creates or modifies a custom hotlist. These hotlists — which can be “personal” to a single Flock user or shared among many agencies — generate an alert whenever a tracked plate is spotted by any camera on the Flock network.

New Castle PD officers maintain two categories of hotlists. One category is lists of plates tied to active cases, with case numbers, defined expiration dates, and organization-wide visibility. Several officers — Hailey Houk, Branddon Hallowich, Eric Kerr, Peter Mendicino — use the system this way.

The second category is different. Seven officers — Amanda Ventura, Justin Manns, Lawrence Krauss, Devin Murphey, Benjamin Cunningham, Theo Weaver, and Mark Workman — each operate a private hotlist, several of them shared among the group rather than with the department. The lists carry their operators’ own names: Ventura, Manns, KRAUSS, NCPD#23 (Murphey), cunningham, Weaver, and Workman.

Across the log, officers added 99 plate entries to those seven lists. Just four carry a case number. The other 95 do not. Twenty-eight are set never to expire.

The Ventura list is the most extensively documented: 31 entries added between March 2024 and April 2026, and not one of them carries a case number. Many give a person’s name as the sole stated reason for surveillance — entries reading Narcotics. [name] set to expire never, or narcotics, [name], also never. Others name an individual with no stated reason at all. One entry’s reason is simply Picking up kids, expiry never; another is the street address 707 S Cascade.

The expiry field is where the absence of process becomes concrete. A plate tied to an active case expires when the case closes. An entry that names a private individual and is set to expire never is a permanent surveillance designation, attached to a person, that no one is scheduled to review.

Two Ventura entries are worth quoting in full. One gives its reason as High theft probably — surveillance premised, by the officer’s own notation, on a hunch. Another gives its reason as welfare. Neither carries a case number.

The Manns list holds 34 entries over a similar period — 33 with no case number — tagged with names and terse notes such as narc complaint, Fbi narc, and homicide. It is shared with Ventura. One Manns entry inverts the form entirely: a string that looks like a case number, 24-0000082, is typed into the reason field, while the actual case field sits empty — a small sign of how loosely the structured fields are treated.

The cunningham list is the starkest: seven entries, every one with the reason narcotics, six of the seven set to expire never, and not a case number among them.

NCPD#23, Murphey’s list, tracks two Ohio plates under the reason Nephew. Richard Conti added the same two Ohio plates to a group list named Fitty a short time later — that time with a narcotics case number attached. Conti also created a vehicle description alert — a Flock feature that generates real-time notifications when a specific vehicle appears on a camera — named Nephew, targeting a blue Mazda sedan on the Lowery St ALPR during evening and overnight hours. He deleted the alert less than a minute after creating it.

Late-night camera access

The event log also records when officers opened a live view of the park PTZ camera. Of the 77 recorded accesses, the great majority fall in ordinary business and evening hours, by administrators. Every access in the small hours of the morning belongs to one of two officers: Amanda Ventura or Lawrence Krauss.

The pattern is tight. Late on December 30, 2025, Krauss opened the camera four times in roughly nine minutes, beginning at 11:47pm. Five days later, just after midnight on January 4, 2026, Ventura opened it eleven times in forty-five seconds: 12:19:01am to 12:19:46am.

The log shows what preceded that burst: at 12:04am, Krauss had added a plate, MWR4095, to his KRAUSS list, reason “Stolen”; at 12:11am, Ventura added the same plate to the department’s shared list, reason “Stolen out of NCPD”; eight minutes later she was hammering the live camera. Two officers and one vehicle, inside twenty minutes after midnight.

The pattern recurs on April 22, 2026, when Ventura accessed the camera three times between 3:52am and 4:32am. Krauss, for his part, has also shared plates into Ventura’s personal watchlist, tracking some of the same individuals.

What the department shares — and with whom

New Castle PD operates a single Flock network, “New Castle PA PD,” and its administrator, Anthony Lagnese, is responsible for the bulk of the department’s sharing of it. The log records more than 300 network shares of New Castle’s camera data, extending feed and hotlist access to over 100 named law enforcement agencies across Pennsylvania and Ohio. Recipients include the Lawrence County District Attorney, the Allegheny County District Attorney, the Montgomery County Detective Bureau, “Pennsylvania State PD,” and dozens of municipal departments as far afield as Pittsburgh, Bethel Park, and a string of eastern Ohio agencies.

In March 2026, the department’s live stream interface also surfaced a camera it had no obvious connection to: a camera that appears to be a RedSpeed automated speed enforcement camera, located on a highway in central Georgia, hundreds of miles from New Castle.

Why a Pennsylvania department’s interface surfaced a Georgia speed camera is not explained anywhere in the log. The most benign reading is also the most damning one: that Flock’s network sharing is indiscriminate enough to put an unrelated camera, in another state, into a small-city police department’s live feed by default.

This website previously documented that RedSpeed has a Flock integration. New Castle’s log entries seemingly confirm that traffic enforcement cameras can be, and are, used for live-streaming video.

What wasn’t answered

The event log does not record what happened when a tracked plate was spotted. It does not show whether the named individuals on the Ventura and Manns lists were ever stopped, arrested, or surveilled in person. It does not show whether any supervisor reviewed or approved any of the private hotlists.

That last gap is the point. Oversight of a watchlist depends on two things: a case number that ties an entry to a documented investigation, and an expiration date that forces the entry to be revisited.

Ninety-five of the ninety-nine entries on these seven lists have no case number; twenty-eight have no expiration. Even if the department wanted to audit its own use of the system — and even if it would disclose basic case information to the public — there is nothing to audit against. An entry reading welfare, attached to a named person, set to expire never, is unreviewable by design. The absence of case numbers makes oversight structurally impossible.

The only thing the logs do show is that New Castle PD pointed its only two cameras at a single basketball court, and that for nearly three years, officers have been adding entries — most of them permanent, almost none documented — to private watchlists connected to a national surveillance network, in the one neighborhood that is, by a wide margin, the most heavily Black in the county.

Through its blog, Flock says it “aims to advance both safety and equity together” through “data-driven responses.” This is what that looks like in Pennsylvania.

The Search IDs

Around the time Flock made heavy-handed edits to existing government records, it added, or started to expose, an “id” field along with search results. From the outset, haveibeenflocked.com has ignored that field because Flock can’t be trusted to keep anything stable. As we’ll see here.

I don’t use Flock’s IDs and instead rely on other methods to handle duplicate entries, so I mostly ignore them. Then I received an email from someone who paid more attention. He had been manually downloading audit logs from transparency portals and comparing the files, noticing that entries change more than they should.

To be honest, I didn’t really believe him at first. It sounded implausible even for Flock to do something so technically terrible. Egg on my face.

Transparency portal search logs now typically look something like this:

e71b39a6-3cc8-4161-b4ec-e62c6e1cd135,***,2026-03-04T20:37:04.924Z,6050,invest

Because cops can’t be trusted with cop data, Flock’s network logs look about the same. In addition to the ID, they have a name of an agency. The idea is that an auditing PD will pick up the phone, relay the ID in their network log to the named agency, and verify that “invest” was a legitimate search.

With about 6,000 agencies doing 10,000+ searches per day, that’s a lot of phone calls.

This idea is obviously completely divorced from reality to begin with, but it’s being used — to great effect — to convince uncritical elected officials of the existence of accountability.

Now, I’m not sure what cops are supposed to do.

The Time and ID Changes

The transparency portal logs are produced on a 30 day rolling basis. So, if you downloaded the same log a day apart, you’d expect to see 29 days worth of identical records with one day trimmed and one day added. However …

On March 23, 2026, West Des Moines’ log showed these two searches:

e71b39a6-3cc8-4161-b4ec-e62c6e1cd135,***,2026-03-04T20:37:04.924Z,6050,invest
bc377b4b-2261-4fe1-a96c-ebb59217c061,***,2026-03-04T21:00:31.190Z,6051,invest

Two searches on March 4, both labeled “invest,” one at 8:37pm (UTC), and one at 9pm (UTC).

On March 24, 2026, they are both gone. In their place are two new searches:

9c685baa-cf80-478c-acf1-2df174a1d686,***,2026-03-04T20:26:48.972Z,6050,invest
ec162dff-51b1-4de6-be2d-16a2b2cd8411,***,2026-03-04T21:39:47.263Z,6051,invest

The also both happened on March 4, and are both labeled “invest,” but now one happened at 8:26pm (UTC) and the other at 9:39pm (UTC). That’s a significant difference.

If the same change happened in network logs, and if anyone had made that phone call about search ID e71b39a6-3cc8-4161-b4ec-e62c6e1cd135, they would have to make another phone call about the search that replaced it: 9c685baa-cf80-478c-acf1-2df174a1d686.

The problem appears broad. In the March 23 – 24 comparison alone (about 200 lines total) there were multiple changes:

-b76afd28-1246-4b3d-91d7-5f14642dd191,***,2026-02-25T20:56:59.751Z,2,Windsor Heights Fresh Stolen
+72db34f8-dd39-4d5d-814c-c968cb5e58b2,***,2026-02-25T20:52:17.101Z,2,Windsor Heights Fresh Stolen

-e71b39a6-3cc8-4161-b4ec-e62c6e1cd135,***,2026-03-04T20:37:04.924Z,6050,invest
-bc377b4b-2261-4fe1-a96c-ebb59217c061,***,2026-03-04T21:00:31.190Z,6051,invest
+9c685baa-cf80-478c-acf1-2df174a1d686,***,2026-03-04T20:26:48.972Z,6050,invest
+ec162dff-51b1-4de6-be2d-16a2b2cd8411,***,2026-03-04T21:39:47.263Z,6051,invest

-b8afc2dc-434c-41e3-8614-92134e713de8,***,2026-03-05T07:58:19.466Z,1169,
+3c652fad-db99-472f-bf7a-16430beb949d,***,2026-03-05T07:01:14.526Z,1169,

+8e10d1fb-2b66-4a0a-b4a8-2ef4b4f33899,***,2026-03-15T05:12:16.454Z,1,invest
-95134732-9341-420e-b830-901856bd4a75,***,2026-03-15T05:39:30.257Z,1167,invest

-e6941d9c-fbf2-4cbb-a54b-7c5d1fd391cb,***,2026-03-19T18:49:41.776Z,1166,
-d277a79e-0a14-4ccd-a561-8df2cfb7ca10,***,2026-03-19T19:00:37.487Z,1166,
+6f9738b1-1fbf-498a-b026-c8eda3d3aece,***,2026-03-19T18:22:11.557Z,2,
+18bf73c6-e37c-4246-ab1c-f98aae2849a6,***,2026-03-19T19:14:27.501Z,1166,

In this one file, about 7% of records changed within 24 hours.

Clanker Analysis

Asking the clanker to analyze the changes over multiple files it wrote a little Python script and produced:

WDM (8 snapshots, Mar 16 - Apr 4)

Non-rolling change rate per snapshot pair: 2.6% - 7.1% (avg ~5%)

Key patterns:

• Removals always equal additions — records are being swapped, not just deleted or added. This is highly suspicious and suggests some kind of rotation/replacement mechanism.
• No field modifications — records are never edited in place; they vanish and a different record with the same date appears.
• 17 “flickering” records that disappear and reappear across snapshots. Example: 95134732... (date 03-15) appears in only the 03-23 and 03-25 snapshots out of 8 — pattern ..Y.Y...

Johnston (3 snapshots)

Similar pattern: 3.9% - 8.2% non-rolling change rate, removals always equal additions, 2 flickering records.

The Takeaway (AI)

When it was done running its script, it gave its unsolicited, but almost accurate “key takeaway”:

The audit logs are not immutable. Every day, ~3-7% of records within the overlapping date window are swapped out (equal number removed and added, zero modifications). Some records flicker in and out across multiple snapshots, meaning the same record can be removed, reappear, and be removed again. This is consistent with records being retroactively added/removed from the audit log on an ongoing basis.

The Actual Takeaway

This is the straightforward explanation, but it’s not necessarily what’s happening. What could be happening is that Flock, like Axon, is distributing its database in an effort to sidestep accountability and ownership by conflating data control and data ownership.

I’ve called this nonsense out before as Flock saying the kitchen is not a central repository for pots and pans, because it has multiple cupboards.

But it may be what we’re seeing here. The log could be pulling in different entries from different “cupboards”, and not all “cupboards” may be available each time the log runs.

A distributed explanation is not any better than deleting and adding records in a centralized database. In fact, it would be a very fundamental, very fatal, flaw for records that are supposed to be immutable — like audit records — to have multiple copies in multiple places without a single authoritative copy.

Apparently log entries can go missing without Flock’s system throwing an error. If you can’t be sure that your log is complete, you can’t rely on it to show whatever it is you’re auditing for — it may have been deleted.

If you’re getting new results every day, your previous audits are automatically invalid and unreliable. A search that occurred at 9pm may look valid, but if a police officer goes off shift at 9:30pm and the next day the log shows the search happened at 9:45pm, that’s potentially unflagged off-duty use of a police system.

It could also cut the other way: the officer’s shift might not start until 9:30pm, and the logs will show improper use the first time around, but not the second (if anyone looks).

Network Logs

These observations are from transparency portal logs, which are largely performative to begin with. Whether the same holds in a network audit remains to be confirmed.

Examining older network logs, which did not have the IDs, entries can be seen disappearing between runs. Because I do not have enough overlapping data to fully confirm, I can only say that it seems very likely that the observed ID changes in West Des Moines and Johnston show a structural problem that has existed for a while now.

This finding alone should be cause to invalidate all prior audits, as well as all future audits until Flock addresses the problem.

States with mandatory audits, like Minnesota, and police departments with audit requirements, will have to redo their audits after it’s fixed. That’s a lot of phone calls.

That is, if they want to make good on their promises of accountability and oversight.

I won’t be waiting by the phone.

After writing yesterday’s feature announcement about the new cost estimate feature, as an afterthought I did a quick query to see how many agencies used “FreeForm” and how often it’s used. The result: 6,736 “FreeForm” searches in 2025 across 121 agencies. At a $50,000 annual subscription MSRP, that works out to roughly $900 per search.

Naturally, I wanted to know what, if anything, makes these searches so valuable.

Flock’s FreeForm

Flock writes that “Flock’s ALPR system cannot be used to search for human characteristics, like race or gender” on its ethics page. In another recent blog post, recently discussed here, Flock takes it a step further:

Flock products do not identify race. They do not target neighborhoods based on demographics. They do not rely on subjective descriptions. They do not expand broad discretionary stops.

Instead, they narrow law enforcement action to vehicles that have been objectively linked to reported crimes.

The FreeForm product page even promises that “[m]oderation tools help prevent biased or inappropriate searches and support responsible, community-trusted policing.”

That narrative is echoed throughout Flock’s website, and aggressively carried out by its 200 sales staff.

In Q2 of 2025, Flock launched a new feature that “is all about one thing: speed. Speed to leads.”

In a move that will transform the largest network of LPR cameras in the nation, Flock announced that every existing Flock LPR camera can soon become video-enabled at no cost to the customer.

FreeForm, Flock’s AI-powered search tool, now works not only on owned LPR cameras but also on shared ones. It also supports video searches—meaning you can now search for characteristics on people* (e.g., “man in blue hoodie with backpack”) just like you would search for vehicles. You can even set alerts on these searches: think “green ATV on a trailer” or “person in orange vest,” so you’re notified in real time when there’s a match.

Plus, FreeForm is now compatible with third-party video feeds (e.g., Genetec, Milestone), so agencies can leverage its power without needing to switch platforms.

It notes that “people characteristics cannot be searched on LPR feeds, only video feeds”.

The FreeForm report (was “Moderation Report”) has been online for a while, but with few search entries and no documentation I never paid much attention it.

Now, almost a year after Flock’s Q2 2025 product announcement, we have a collection of searches from network logs provided by Flock LPR-system users — searches that show lookups for “objectClass:person” and “objectClass:people.”

The Constitution

The 2020 memo to Congress “Racial Profiling: Constitutional and Statutory Considerations for Congress,” written after the death of George Floyd, gives an overview of the boundaries of permissible searches.

The Equal Protection Clause “bars most law-enforcement decisions based on race,” and this prohibition holds “even if members of a given race are responsible for more crimes in a particular neighborhood.”

Courts have also held that “an officer cannot meet the Fourth Amendment standard by relying on a person’s racial appearance, alone, as grounds for reasonable suspicion.” But an officer may include race when “searching for a person matching a suspect’s description and part of that description is the suspect’s race.”

The Searches: Dragnets and Military Personnel

After analyzing 3,217 searches from 124 agencies — 3,184 of which Flock’s moderation allowed, 19 it blocked, and 14 it warned about — it’s clear that the “FreeForm” system that’s implemented is not the one that Flock describes, or the one the Constitution requires. Instead, it is a digital free-for-all where cops go on fishing expeditions based on protected characteristics. Flock even blocks the most obviously constitutional searches.

Houston PD searched 53,017 devices across 3,734 networks for “white car with black front bumper” (reason: murder investigation). That is a description so generic and a dragnet so wide that it would match tens of thousands of vehicles nationally.

Houston PD also searched that same 53,000-device scope for “Marine Corps” and “volkswagen jetta U.S. marine corps” — the first of which is a bare military affiliation search with no vehicle descriptor at all.

“Marine Corps” as a standalone search term, run across the entire Flock network, is functionally a request to identify every vehicle in America displaying USMC insignia — which would include many active service members and their families.

Since December 2025, Flock redacts its network logs before providing them to its customers whose data is being searched. Those customers can’t see who ran the search. Flock, and many of its customers on the nationwide network, maintain no policies requiring background checks or prohibiting account sharing. That’s a “local decision,” says Flock.

We can’t say, or even begin to speculate, who searched the country for “Marine Corps” and for what purpose. All we know is that someone did, and that Flock’s AI-moderator approved it.

Louisville Metro PD regularly searched 39,000–42,000 devices across 2,600–2,800 networks. One search: “overloaded waste hauler” — a code enforcement query — hit 39,751 devices across 2,672 networks. Louisville is using Flock’s AI-powered search to run municipal waste-hauling compliance checks through a nationwide surveillance apparatus.

O’Fallon, Missouri PD — a city of about 90,000 people — searched 41,054 devices across 2,707 networks for the person descriptor “jeans.” No case number. Reason: “inv.” That search hit cameras in thousands of jurisdictions across the country, looking for Americans in blue jeans.

Corona, California PD consistently searched 11,400+ devices across 370+ networks for person searches including “a person,” “police badge,” and “fire” — the first of which is literally searching for the existence of a human being.

All of these are overbroad fishing expeditions using a mass surveillance system. There is no valid investigative purpose in looking up “a person” or “jeans.” Retrieving the location history of every US Marine in the nation does not prevent crime, it hurts national security.

The Moderation System: No on “white male” — Yes on “tweaker”

The most constitutionally defensible person search in the entire dataset was the California Highway Patrol’s prompt:

Looking for a white male about 6ft 1in tall, longer brown hair almost to his shoulders, slender build, will have been wearing blue jeans, boots with white paint stains on the toes and possibly carrying a black helmet

This was a search across only 91 devices and 3 networks. It is a textbook individualized suspect description: race as one of many physical identifiers, exactly as Fourth Amendment jurisprudence permits. It was run in a narrow area where this suspect was likely to be found.

Flock rejected the search. The most probable explanation, based on other searches, is that it saw “white male.”

Meanwhile, Florence, South Carolina PD searched for “all” (objectClass:people, reason: Robbery) — a search that matches literally every person on camera. Also allowed from Florence: “people,” “hoodie,” “jacket,” “jeans,” “Red.” These were searched across only 1 device and 1 network, suggesting Florence was early in deployment or testing, but the moderation system approved them regardless.

O’Fallon MO PD’s “jeans” search hit 41,054 devices. If Florence’s identical search was allowed on 1 device, there’s no scale-based restriction either.

Hemet, California PD searched for “tweaker on bike” across 1,581 devices and 30 networks. No reason given. No case number. “Tweaker” is a slang pejorative for methamphetamine users. This is the definition of a “subjective and invasive search” — targeting people by perceived social status and assumed drug use.

Unlike the search for a highly specific white male, the moderation system allowed this search for any tweaker.

The First Amendment

An objection that’s often raised is Flock’s (admitted) ability to search for bumper stickers and other characteristics. Flock regularly claims that it is only the existence of a bumper sticker that can be queried, not its content. That is not what the logs indicate.

Spokane County WA SO searched for “american flag,” “coexist sticker,” and “trump flag” on vehicles. All three triggered a warn status. The reason fields — “freeform suspicious search test” — indicate Spokane was deliberately testing the moderation boundaries.

What happens when Flock’s AI-moderator issues a warning is not entirely clear. From earlier analysis of frontend code, it is a dialog that can be clicked through. It’s possible that someone gets a notification or an email. We don’t know.

Flock’s system knew these searches were problematic, and it flagged them, but it did not block them, as its product pages promised.

Corona CA PD searched for “american flag” on people and got blocked. The same agency searched for “american flag” on vehicles and got warned.

O’Fallon MO PD searched for “vehicle with flag” across 40,235 devices and 2,642 networks. Allowed. No warning. The generic “flag” search is arguably broader and more concerning than the specific “american flag” or “trump flag” searches that triggered warnings.

CHP searched for “Hells Angels” as a vehicle descriptor nine times (8 allowed, 1 warned from San Jose PD). The allowed searches used reasons like “Investigative Follow-up” and “Traffic Collision.” Searching for vehicles displaying Hells Angels insignia — rather than a specific vehicle involved in a specific incident — targets organizational membership.

If CHP wanted a specific motorcycle involved in a traffic collision, the search would describe the motorcycle, not the association. Seven of the nine Hells Angels searches hit only 190 devices and 1 network, suggesting a narrow local scope — but the moderation principle is the same regardless of scale.

Audit Logs and Objectivity

Of course, the majority of these searches do not have case numbers. We know by now that the claim that “every search made within the Flock platform is logged and auditable, creating a tamper-proof trail of accountability” is completely false. The sensitivity of the data being searched here — like “Marine Corps” — highlights how important it is to be able to audit a search’s full context.

Only 85 of 3,217 searches — 2.6% — had a plate field that could have contained a value. None of the problematic searches discussed above were among them.

The “objective criteria” Flock allows include a descriptor like “tweaker” but not a detailed description of a white male. It allows searching for every white car, or every military member in the nation, and only lightly wags its finger at you when searching for protected political speech.

Flock’s AI-based moderation appears inconsistent and insufficient. It certainly won’t lead to “responsible, community-trusted policing.”

This is an insecure, unaccountable, and unrestricted dragnet that can be — and is — used to mass surveill Americans based on their political, professional, and religious affiliations, their protected personal characteristics, and their expression of speech. It is exactly what the Constitution prohibits.

For each of those searches, lawful or not, Flock collects $900.

First, a new report: California Out-of-State Queries.

A note on what’s here and what isn’t: some older California-specific reports were removed after suspected changes on Flock’s end began producing incorrect results. This report replaces them with a narrower, more defensible dataset.

This report contains all external searches seen by California agencies for which we have log files (which isn’t many, but if you have some, or you want to go file some requests, send them to humans@haveibeenflocked.com!).

The ~14.5M out of state searches currently documented in the report come from the four agencies listed above. Other agencies which contributed data that showed no out of state searches were the California Highway Patrol (for the period 2024-11-25 — 2025-12-01) and Buena Park, CA PD (for the period 2026-01-19 — 2026-02-23).

The point of the report is that it shows searches of cameras placed in California, that have collected data about Californians; it will tell you if a query from a non-California agency “hit” a California agency.

The report’s “source agency” column will tell you which agency reported the search. And, yes, every single one of these 14.5M+ searches may violate California’s prohibition on sharing ALPR information with agencies outside the state (SB34).^[2]

February 11, 2025, is the date was reported to have disabled all out-of-state access for non-California agencies. For Santa Cruz and Capitola, the only non-California agency appearing in the logs after that data is Blue Lake Rancheria Tribal PD. El Cajon is being sued by the AG.

Seaside strangely reported only a handful of searches. On inspection:

We have very limited logs for Seaside (approx. 2025-01-20 — 2025-02-17), so it’s possible that far more searches of Seaside by non-California agencies have occurred outside that limited visible window.

Nothing confirms “Deactivated Users” is not a California agency, but OCDETF (Organized Crime Drug Enforcement Task Forces) was an independent federal agency under the US Department of Justice, recently dissolved and rehomed under the Department of Homeland Security.

Whatever federal access OCDETF had to California ALPR data through Flock now presumably belongs to DHS. Whether “Deactivated Users” represents side-door access that Flock obscured by omitting the agency name, or straightforward federal access, the result is the same: Californians’ data ended up with the federal government through Seaside PD and Flock.

And, of course, New Mexico is definitely not in California — there’s a whole Arizona in between.

Another thing that stands out about these searches is that they both covered about 300 networks (316 for the NM search, 335–336 for the OCDETF ones), suggesting 1:1 sharing agreements.

That certainly seems like a possibility, because according to its transparency portal, Seaside CA PD currently grants access to the following non-California agencies:

• Goshen Village NY PD
• Blue Lake Rancheria Tribal PD
• CA Iipay Nation of Santa Ysabel
• Decommissioned Org / Demo

The only 7 documented searches from Goshen, NY (pop. 5,777) happened between 11/12/2022 and 4/1/2023.

The likeliest explanation: Seaside granted access to what it believed to be Orange County, California, but ended up sharing California data with Orange County New York’s county seat: Goshen.

In case you’re curious, these are the states that most searched California records:

Questions I could not answer in detail, but that are important and deserve answers.

I’ve written about fusion centers before, in the post about the federal Regional Information Sharing Systems® (RISS) program—which are federally-funded, quasi-privately-operated “fusion centers before it was cool”. That post was mainly in the abstract. Let’s examine what’s happening at NCRIC.

Fusion centers and data sharing

NCRIC is a practical example of what can go wrong when we take promises about data retention and security at face value, and what happens when we write poorly drafted bills—like HF 2161 chugging along here in Iowa, with the ACLU of Iowa’s support.^[2]

Data dissemination centers like RISS “permit federated searching across many systems without requiring the RISSNET user to have a separate user account for each partner system.” But that website copy is about as far as we get—while federally funded,^[3] these centers are operated as private corporations and are therefore not subject to the Freedom of Information Act.^[4][5]

But we don’t have to speculate for too long. The state of Colorado lays it all out cleanly for its Auto Theft Intelligence Coordination Center (ATICC):

The goal of this project is to share license plate recognition data among all contributing agencies that have established this Memorandum of Understanding with the Colorado ELSAG EOC, managed by the Colorado State Patrol (CSP) ATICC.

Participating agencies will share license plate reader (LPR) information for replication to the data warehouse or as part of a central querying system hosted by the Colorado ELSAG EOC and will have the capability to query all LPR based information from around the State of Colorado which is stored within the warehouse

Simple as that. Drop everything in CSP’s bucket, and take what you need. Cop-communism.

In case you’re wondering, ELSAG cameras are a Leonardo product.^[6] They offer stationary surveillance cameras (with cool-sounding names like “The Street Sentry™” and “The Fixed Plate Hunter™”), as well as mobile cameras disguised as roof-mounted skiboxes or construction barrels.

In the MoU, the “Denver Police Department agrees to share ALPR data with other law enforcement agencies utilizing the Colorado ELSAG EOC”, where it can be stored for up to three years.^[7]

Although Colorado State Patrol was short-sighted enough to name its own entity after a vendor product,^[8] ATICC explicitly commits to “obtaining the cooperation of any third-party contractor or vendor” that provides license plate reader systems in Colorado. Presumably this includes Flock.

@Colorado ELSAG EOC MoU

The “data warehouse” used by CSP, while only one component of a fusion center, is a much more descriptive term for what’s really happening at the backdoor of these systems.

The Northern California Regional Intelligence Center (NCRIC)

Colorado is not just similar to NCRIC—it’s the template for what NCRIC is almost certainly doing but refusing to document. NCRIC gives itself permission to store ALPR data for up to 12 months, and broadly disseminate it.

The [ALPR] information is also retained for a fixed retention period, though it is only reaccessible by law enforcement given a legitimate law enforcement purpose.

The FAQ specifies that only users with a need-to-know have access, but, from context, it’s clear that NCRIC’s version of “need-to-know” is clearly not particularized and apparently extends to all ALPR data, forever.

Although the previous version of NCRIC’s FAQ was more explicit that “most ALPR data will be stored for 12 months,” the current FAQ is silent on retention. The FAQ drones on for a bit, carefully evading its own questions, but at the end of it all, the agency essentially gives itself carte blanche to do what Colorado spelled out more clearly.

@NCRIC ALPR FAQ

The policy reveals more. Especially in light of SB 34.

In October 2023, the California Office of the Attorney General issued bulletins gently reminding police laws exist, and that they are not supposed to be sending ALPR data from California to out of state agencies.^[9] Exactly six months later NCRIC disappears from non-California log files.

NCRIC updated its ALPR policy accordingly, but in a way that created performative compliance and resulted in less oversight.

• It removed the specific security requirements for data storage—SECRET-level clearances, 24/7 security personnel, multiple secured doors—replacing them with a passing reference to “secure systems.”
• It removed the requirements for multi-factor authentication and encryption.
• It removed the requirement for audit logs to contain a “justification for access.”
• It weakened retention limits from a hard cap (“shall not be retained longer than 12 months” with explicit purge requirements) to an aspirational ceiling (“supports a maximum retention period of 365 days”), and outsourced the actual operative limit to whichever vendor NCRIC happens to be using.
• It authorized sourcing ALPR information from private sources, including “parking, tolling, private security, or other sources”—where the 2021 policy explicitly prohibited sharing data with commercial entities.
• It introduced contradictory language on visual confirmation of plate reads: one section retains the 2021 standard (“to the fullest extent possible”), while another weakens it to “should visually confirm.”
• It dropped the annual training recertification requirement entirely.

The FAQ changed in parallel. The 2015 FAQ described a multi-factor authentication process requiring a randomly generated PIN sent to a government email account. The current FAQ reduces this to “a unique username and login.” That downgrade is worth keeping in mind when we get to the part about user “a.”

@NCRIC ALPR Policy 2021 @NCRIC ALPR Policy 2024

Where the policy did not change much was its audit requirements. Those are still essentially non-existent, requiring only a report based on a “sampling” (it does not say the sampling must be random) be sent to the NCRIC director.

The Logs: Counting Searches

To get the cleanest possible data, these charts are based on only two sets of log files: Louisville, KY from March 2022 through April 29, 2024, and Capitola, CA from that date onward.

The charts show a highly suspicious trend. Here it is, close up, based on only Capitola data:

Between January 1, 2024 and May 1, 2024, the enforcement date, the number of searches NCRIC does is low, peaking at around 170. Activity stays around that level until the beginning of June, when both the number of users, but especially the number of searches see explosive growth.

NCRIC more than doubles the number of active users, going from having 5–20 weekly active users to a consistent ~40. What’s more, individual users go from doing ~5 searches/week to ~60 searches/week.

NCRIC’s insights page immediately reveals why: NCRIC’s users are nearly all identified with single, lowercase letters like “a.” or “c.”. These users show remarkably consistent around-the-clock activity.

NCRIC’s users are either bots, or shared accounts.

The Plausible Backdoor: Who is “a.”?

Of course, NCRIC’s deliberate avoidance of oversight and accountability is not direct evidence that it is sharing data in violation of California law—cops will be cops. But its behavior and context do lead directly to that question.

It’s possible that NCRIC was suddenly motivated to start doing some police work, and that it has absolutely terrible internal security practices. Maybe it logs in a terminal “a” and when the next person reports for their shift, they don’t log in with their own credentials and simply continue working.

It would violate every basic tenet of information security, not to mention, most likely, several federal and state laws, but it’s a possibility.

The other, in my opinion more plausible, explanation is that NCRIC shares its user accounts with external, out-of-state agencies—just like Loveland, CO was caught doing last year.

Another possible explanation is that these accounts are automated and serve to fill NCRIC’s data warehouse. Of course, that leads to a follow-up question: who can access the warehouse?

The Missing RISS

It is also worth noting that the other relevant fusion center, the Western States Information Network® (RISS), is conspicuously the only RISS absent from Flock’s audit logs. The other five are accounted for.

Unlike the FBI, which simply stopped showing up in log files after July 2023,^[10] WSIN does not show up in our data at all. This is the same center that covers Washington: the state most covered by the logs we have. Either WSIN is the only RISS without Flock access, or it is not being logged as “WSIN” or some other cognizable variant.

What the Logs Can’t Show

The logs can tell us that NCRIC stripped its own security and audit requirements immediately after California started enforcing its privacy laws. They can tell us that anonymous, bot-like accounts began running searches around the clock within weeks. They can tell us that the one RISS center covering the most-logged state in our dataset is conspicuously absent from every log file we have.

What the logs can’t tell us is why — and that’s exactly the point. NCRIC designed its policies to ensure that no one, including its own director, has the information needed to answer that question.

The “sampling”-based audits don’t require randomness. The access logs don’t require justification. The retention policy doesn’t require limits.

This is not a gap in oversight. It is the deliberate architecture of unaccountability. When a fusion center rewrites its policies to remove the very mechanisms that would detect abuse, the question is no longer whether the data is being shared in violation of California law.

The question is whether anyone with authority to act will bother to find out.

The students from Sequoia Union asked the right questions. The fact that a group of high schoolers can identify the problems that California’s oversight apparatus declines to investigate is not a compliment to the students — though they’ve earned one.

It’s an indictment of everyone else.

Note

May 1, 2026, update: In a follow-up conversation, the ACLU expresses an overall desire for transparency and oversight. Its current position may therefore not be fully encapsulated by this post.

I believe the critique in this post remains valid in its appropriate context, but it should not be blindly assumed to apply to ACLU’s current ongoing efforts. Be critical of both the ACLU and this post before deciding your own position.

See also this follow-up post.

In January, after a Joplin police officer was fired for stalking via Flock’s license plate reader system, I wrote about why I publish unredacted audit logs. The argument was simple: as long as Flock can collect this information without restriction, the public must be able to see how it’s used.

Today, the ACLU has joined EFF in calling for laws that would make that oversight illegal. It did so on the same day that criminal charges were filed against a Milwaukee police officer for misuse of the system — as a direct result of the very thing the ACLU is trying to ban.

The ACLU’s Position

ACLU and EFF’s assertion that records documenting police activity should be kept behind lock and key in a police station is, frankly, preposterous. The suggestion has no business coming from organizations that purport to fight for civil rights and police accountability.

In making its recommendation, ACLU misrepresents the actions of police and the contents of the logs:

The release of this kind of data is a significant privacy problem. To be clear, web sites have every right to publish data that has been released by government agencies or that they have otherwise legitimately obtained; the fault here is the police departments that collected this data on innocent drivers not suspected of any wrongdoing and then released it unredacted. But this kind of data could be used by all manner of parties to find out things about the lives of those they’re interested in \— everyone from abusive romantic partners and stalkers, to political or business rivals, to everyday busy-bodies and who-knows-who-else.

Characterizing audit logs as data the police collects on innocent drivers is flat out wrong. Yes, police do collect data on innocent drivers. But that is not the data that’s in the audit logs.

What’s in the audit logs is what a Flock user—possibly, but not necessarily, a police officer—entered into the “search” box. For example, there is a result for the plate “-.” Probably not a valid plate anywhere. I’ve also had to block a few novelty plates, like HOONIGAN, from reports because cops keep looking it up.

What is in the logs is search terms being entered into a privately owned and operated, and largely unregulated, database. Even if you were to make sharing those logs illegal, it does not solve the issue—the information, by the very nature of the system, is in the hands of a private third party.

The ACLU then tries to compare records of government officials’ search queries to bodycam footage of private citizens. Video footage of people interacting with police and evidence that someone typed the word “investigation” into a search box are not the same thing.

Following those dubious claims, the author walks the statement back by saying that “any logs by officers of the purposes of their searches (which would be subject to existing open-records exemptions for active investigations) should be considered public records.”

This is exactly how we end up with audit logs like the ones currently served up by Flock’s ironically-named transparency portals:

Flock summarizes it correctly in its form email: “There is nothing the public can gain from this report.” (“However, if you find your department’s users are not consistently searching off of incident/case numbers, that may be a reason to hide the Search Audit.”)

The Contradiction

The whole system hinges on not containing sensitive information. According to Flock and police, there are no privacy concerns when you take millions of photos of license plates on public roads. It’s why a private company can collect the information under color of law and process it without having probable cause or oversight, and it’s why police can search that same data without warrants.

That framework simply can’t co-exist with the idea that that same information is somehow too sensitive for public consumption. To claim otherwise is, at best, mistaken.

As it says in this site’s FAQ: I am willing to accept the premise that all of this audit data is too sensitive to publish, but, if accepting that premise, then the actual photos must be too sensitive as well. Ban neither or both, but don’t mistake a defense of public oversight for a defense of this website’s right to exist.

The Alternatives Don’t Work

Hiding audit logs for vague privacy concerns is a lazy approach. This website does not display license plate numbers anywhere. Instead, it provides “identifier” numbers that correspond to license plates. It’s not a complete solution, but it’s one that’s adequate for identifying patterns of misuse and abuse.

Flock knows this. It previously took a similar approach to usernames in its transparency portal logs: instead of identifying a user by name, it identified users with a string of numbers and letters. While you may not see that Officer Jones did something suspicious, if Officer AF983-90D43 did, that’s still something that can be investigated.

Flock removed those IDs from the logs.

The ACLU’s recommendation that “people should be able to request their own data” is equally shortsighted. The data is, at least on paper, owned by 6,000 different agencies. Should we all be doing monthly open records requests to those agencies? Without an up-to-date customer list, how would we even know where to file the requests? How do we prove to Flock that it’s “our” data? Do we send Flock, a private mass surveillance company, a photo copy of our ID and car registration?

Meanwhile, police departments across the country write policies saying they will manually audit hundreds of thousands of searches by downloading a CSV, going through it line-by-line, and making tens of thousands of phone calls to other departments to ask whether the “investigation” at 4:37pm last Wednesday was a legitimate search. Closing the chief’s office door won’t get him to suddenly make the calls.

The real problem isn’t that there is an attempt at public oversight — it’s that every other oversight mechanism is failing. State and local governments, police agencies, Flock, the FBI, the EFF, and the ACLU could all actually be working on this problem.

This website shows that national searches are impossible to keep up with due to sheer volume. The underlying cause is a system that is disproportionate by default—one that encourages getting nationwide 30-day location histories for the slightest of reasons, or no reason at all.

It also shows that some form of oversight may be possible, if we want it to be possible. But we need to ditch Flock and solve the actual problems.

ACLU & EFF’s changing position

In 2014, ACLU SoCal and EFF sued the Los Angeles Police Department and Los Angeles Sheriff’s Department for ALPR records.

The organizations sought actual ALPR data rather than audit logs, and, after their request for the data was denied under California’s Public Records Act, they wrote (emphasis mine):

[T]he intrusive nature of ALPRs and their potential for abuse creates a strong public interest in disclosure of data that would help shed light on how police are actually using the technology.

…

The data will reveal whether police seem to be targeting political demonstrations to help identify protestors, or other locations such as mosques, doctors’ offices or gay bars that might yield highly personal information.

Californians can only properly weigh in on whether police should be using ALPRs and what policies might be necessary if they understand how police actually use the technology.

It has been twelve years — we still don’t have that necessary transparency.

ACLU and EFF reversing their position is inexplicable.

@ACLU SoCal & EFF v. LAPD & LASD

179 Searches, Zero Oversight

On the same day the ACLU published its recommendation, a criminal complaint was filed in Milwaukee against MPD police officer Josue Ayala. An excerpt:

Through the website www.haveibeenflocked.com, VICTIM ONE became aware that City of Milwaukee Police Officer Josue Ayala used the Flock system, a license plate recognition platform, to run the license plate on VICTIM ONE’S personal vehicle to obtain location information for VICTIM ONE on numerous occasions. VICTIM ONE believed that Officer Ayala ran VICTIM ONE’S license plate over 100 times.

City of Milwaukee Police Detective Tehrangi Chapman conducted follow up investigation by having an audit trail run in the FLOCK system for the time frame of March 26, 2025, through May 26, 2025. During that time frame City of Milwaukee Police Officer Josue Ayala ran the license plate of VICTIM ONE a total of 55 times. The audit trail revealed that Officer Josue Ayala also conducted a search of a second license plate number belonging to VICTIM TWO a total of 124 times during the same time frame. During the time frames that Officer Ayala conducted the searches of each license plate, Officer Ayala was on duty working for the City of Milwaukee Police Department.

The Flock system requires the user to enter a reason for the license plate search. On each occasion that Officer Ayala used the Flock system to search for license plate of VICTIM ONE or VICTIM TWO, Officer Ayala listed the reason for conducting the search as “investigation”

I’ll spare the technical details here, but the discrepancy between the victim’s reported number (over 100) and the audit’s number (55) is explained by redactions; the inaccuracy is a direct consequence of deliberate obfuscation.

The policy violation should have been caught by Milwaukee PD during its regular audits.^[1]

If the CJIS framework applies, which Flock often implies, this should have been caught by the Wisconsin Department of Justice, which oversees Milwaukee PD. If the DOJ had missed it, the FBI’s CJIS division should have caught it.

If these were state or nationwide searches, as most searches are, this should also, independently, have been caught by all the other involved departments.

No independent auditors exist, nor does Flock audit anything.

In fact, the FBI and Flock’s recent changes were explicitly designed to make it more difficult to catch exactly this type of violation.

Nobody in an ostensibly multi-layered system of oversight caught the problem; once again it was a private citizen—the victim in this case—who had to do the job public officials promised they’d do. And again, the problem came to light as a result of complete, unredacted audit log information—including license plate numbers.

In January, public audit logs got an officer fired. Today, they got one criminally charged. The ACLU wants to make sure there isn’t a third time.

Now that Flock has deleted the information that made both cases possible, any future similar incidents will almost certainly go unnoticed. As long as there are no alternatives for effective oversight, and as long as there is unregulated privatized surveillance, public audits are the best we can hope to do.

I will continue advocating for exactly that.

2/28/2025: Updated with ACLU/EFF lawsuit information.

Location histories and the Fourth Amendment

The most pertinent discussion, or lack thereof, can be found in the lower court’s holding in Carpenter v. United States, which SCOTUS described as:

The Court declines to say whether there is any sufficiently limited period of time “for which the Government may obtain an individual’s historical [location information] free from Fourth Amendment scrutiny.” But then it tells us that access to seven days’ worth of information does trigger Fourth Amendment scrutiny […] Why seven days instead of ten or three or one? And in what possible sense did the government “search” five days’ worth of location information it was never even sent? We do not know. — Carpenter v. United States, 585 U.S. 296, 395–96, 138 S. Ct. 2206, 2266–67, 201 L. Ed. 2d 507 (2018) (internal citations omitted)

There was clearly some concern at the Supreme Court and among the parties regarding the length of the location history. The Supreme Court’s holding in Carpenter was narrow and it declined to address the confusion, writing in a footnote that “[i]t is sufficient for our purposes today to hold that accessing seven days of CSLI constitutes a Fourth Amendment search.”

Whether a cut-off exists under which retrieving location history data would no longer be a Fourth Amendment search, or where that cut-off would be, were not questions addressed by the Court, but in Carpenter, seven days of location history was enough.

Although Flock downplays the completeness of its data and the general usefulness and accuracy of its “critical tool” when it comes to defending it in the face of Carpenter, a federal court in Virginia has already found that 176 Flock cameras in Norfolk, VA “plausibly violate” the Fourth Amendment.^[1]

Courts have not yet addressed Flock’s actual network density, suspected to include more than a quarter million cameras.

Disproportionate by Default

Flock’s lookup tool, which is used for exact plate searches across the state- and nationwide networks, offers users limited options for the length of the requested location history: 1 day, 7 days, or 30 days.

Its “search” tool, which can search for partial plates, vehicle characteristics, and use “freeform” text queries, is not restricted in that way. It can do both longer and shorter searches.

It is unclear whether there is a default setting for either, what the default setting is if there is one, or who would configure the default setting. I do not recall ever seeing an ALPR policy or city council minutes that discuss this.

Examining per-state data for lookups^[2] yields the following results:

Considering this chart, a per-state or per-organization default setting seems unlikely, however, the uniformity of location history lengths has changed over time:

The high uniformity suggests a system-wide default that users are accepting. The sudden change in mid-2025, where users begin choosing different lengths for location history, may be part of the same systemwide changes that appeared in Santa Cruz in August.

The suddenness of the shift in uniformity suggests that Flock switched to a 7-day default around that time and users are less accepting of that default than they were of the earlier, 30-day default.

Regardless of any default, individual users still passively or actively choose to retrieve these histories without much apparent concern for proportionality. A seven- or thirty-day location history because an officer can’t be bothered to select a more appropriate menu option strays far from the reasonableness the Fourth Amendment demands.

Finally, for all searches in our database that have timeframe information, the average length of location histories retrieved is 18 days, 5 hours, 39 minutes. That includes “search” queries as well as “lookup” and other types of queries.

Before the Dropdown

But why are users pulling these long-term histories? “Every search must be accompanied by a reason.” Before switching to dropdowns in January 2026, Flock users were free to enter their own reasons. Although they often did not—beyond “inv” or “sus”—the reasons that were entered do provide a glimpse into what might trigger long-term lookups of location histories.

• Suspicious Person on Campus: 30 days
• stranger danger: 30 days
• Suspicious Auto (bullet holes): 30 days^[3]
• fishing violation: 33 days, 1 hour
• h&r vehicle: 217 days
• lowes theft: 366 days

It’s hard to come up with a reason why, or how this would contribute to the investigations described.

Dropdown Reasons

Maybe Flock’s new reason dropdown will live up to the marketing hype and provide more transparency. To be clear: these are the reasons that someone, somewhere, found acceptable enough as a reason for location history retrieval.

Traffic Infractions and DUIs

Through the dropdown, the Texas Department of Public Safety states it frequently uses the system for “Traffic Infraction - Criminal Justice Purpose.”

Although we can’t know what “Traffic Infraction - Criminal Justice Purpose” actually means, we know that most traffic infractions are short-lived; where someone had lunch last week has little probative value in cases where someone failed to stop at a stop sign.

Regardless, the vast majority of Texas DPS’s traffic-related location history retrievals exceeded the seven-day threshold the Supreme Court found implicated the Fourth Amendment in Carpenter.

DPS pulled histories exceeding 250 days in several cases.

The California Highway Patrol similarly uses Flock for DUI investigations.

California, of course, has much stricter controls on ALPRs and the Ninth Circuit tends to be more privacy-friendly than its counterparts elsewhere in the country. This may explain why CHP’s use appears much more restrained than Texas’.

But that restraint is relative—CHP still retrieved location histories for seven or more days in more than half of the DUI investigations where it used Flock. What evidentiary value this could possibly have is anyone’s guess.

Welfare Checks

Perhaps even more concerning is the Harris County, Texas, Sheriff’s Office use of Flock for welfare checks.

Welfare checks are not criminal investigations, and they are not generally triggered by accusations of any crime. They are also not the same as missing persons cases. They can range from neighborly concern to someone actively threatening suicide. In these cases, there may be a clear defense for the legality of retrieving a person’s current location to prevent harm, but the government does not need to know where they’ve previously been.

Yet here too, for more than half of “Welfare Checks” the Harris County, Texas, Sheriff’s Office retrieves location histories of seven days or more: a length the Supreme Court found sufficient to trigger the Fourth Amendment.

And they’re doing it in cases where there is no criminal investigation, and no evidence of a crime.

The Reason Behind the Reason

The implications of some of these long-term searches are concerning.

While a DUI suspect’s long-term location history seems like a mostly pointless violation of rights, what possible conclusion could someone draw from a shoplifter’s vehicle’s location a year ago? How does knowing where the “suspicious person on campus” has been decrease the suspiciousness of his actions today?

A 30-day history will tell you at a glance the general area where a person lives and works. That reveals information about their socio-economic status and, in many cases to a degree of statistical certainty, their race. Maybe the reasoning is that a person who lives a wealthy suburb is less “suspicious” when they’re walking around campus, while someone from the wrong side of the tracks presents more “stranger danger.”

Whether it’s laziness or active profiling, the system is designed to make disproportionate surveillance the path of least resistance. Flock could have defaulted to 1 day. They could have required more justification for longer histories. Instead, they built a system where retrieving a month of someone’s movements requires less thought than ordering a cup of coffee.

The Fourth Amendment doesn’t distinguish between malice and indifference. Neither should we.

The screenshot is from a Flock training video which shows a Flock user interface for automatic data sharing. The video was posted by ACLU of Massachusetts in October 2025, but various dates in the video suggest it was recorded in May 2024.

California’s Workaround

After Flock disabled the “nationwide network” for its California customers “1:1” sharing exploded. Rather than—or more likely, in addition to—switching to the statewide network, agencies in California increased the number of partner networks they added—from fewer than 7 new partnerships per week on average to more than 40.

When searches are done through a 1:1 sharing connection they are only logged in the originating agency’s “Organization Audit” and in the receiving agency’s “Network Audit.” This is unlike national searches, which are broadcast to the world and will almost certainly make their way into someone’s open records request. Agencies aren’t limited to actually performing 1:1 searches. They can trawl through data from all of their 1:1 connections seamlessly.

This leads to situations like those in Pittsboro, IN, where the agency entered into 3,968 partner agreements for a system it only used 17 times in the last 30 days.^[2] A slightly-outdated visualization of the 1:1 sharing network is available.

The data for this is hard to come by. Uncertainties persist due to what are presumably major data issues in Flock’s log files, as well as seemingly arbitrary redaction of the total_devices_searched and/or total_networks_searched columns both by Flock and agencies.

The available data does, however, support the idea that Flock and police have been building a shadow network, and that some restricted agencies, like those in California, have been using it.

The trend is not explained by Flock growing its customer base, or the overall number of networks. In fact, nationally the number of networks appears to be stagnating.^[3]

The Data Problem

The data must be interpreted with the caveat that Flock’s audit logs appear to be extremely unreliable.

We’ve seen the search inversion in August 2025 and the accompanying drop in log entries. Examining counts more broadly shows even more bizarre outliers, and inexplicable patterns.

The chart above shows the most popular (approximate) network pool size for “search” queries in three populous states. While Illinois and California at least appear plausible, the same can’t be said for Texas’ odd saw-pattern; I can see no plausible reason why agencies would suddenly search 50% fewer networks for a week.

There is no evidence that these anomalies have bothered auditors in any way, or that any questions have been asked. Flock certainly has not addressed it in a blog post or customer update.

The Telltale Ratios

Another piece of the puzzle that suggests this workaround is in active use is usage patterns.

The chart shows the proportion of queries made through 1:1 search connections versus TALON (the nationwide network). California agencies use 1:1 searches for 31% of their queries—three times the rate of unrestricted states like Texas (11%) or Arizona (3%). Minnesota and Virginia, which have also enacted restrictions on ALPR, show similarly elevated rates. This pattern is consistent with restricted agencies routing queries through 1:1 partnerships to bypass network limitations.

The scale of some agencies’ 1:1 networks is staggering. We have seen 358 agencies in California do searches on (a median of) 449 networks. These numbers seem realistic in the context of a national estimate of ~5,000–6,000 agencies.

Yet El Cajon PD searches 3,584 networks through 1:1 connections—ten times the number of in-state agencies. The California Highway Patrol searches 2,181, and the Riverside County District Attorney searches 2,896.

These outliers use a shadow network reaching 60–95% of TALON’s nationwide coverage, all while technically using “bilateral” sharing agreements.

Secrets and Silence

It’s important to note at this stage that although these 1:1 agreements are often understood to be reciprocal in nature, it is unclear whether they in fact are. Washington University research notes that the “shifting and sometimes inaccurate statements made by Flock about its product’s sharing features” contribute to this confusion.

To further frustrate analysis, Flock does not make its product documentation available to the public, and agencies do not generally release it responsive to public records requests. It is therefore unclear if the restrictions seen in the (presumptive) May 2024 video still apply, or if, in 2026, agencies can automatically accept requests from anyone, anywhere.

Still, while the exact scope and mechanism remain unknown, the available information does demonstrate the existence of a shadow network, powered by some form of “auto-accept” or similar feature.

California agencies are not, on average, hammering out between six and forty new agreements in any given week. Going by recent public records responses, agencies are not exchanging emails about these partnerships, let alone validating policies are in place. It has all the hallmarks of a checkbox.

That checkbox appears to be a “set and forget.” Nothing suggests that administrators are notified when a request is auto-accepted. The Washington University report highlights that many police chiefs were entirely unaware that third parties had access until notified by the researchers, who reviewed the logs.

Flock’s CEO Langley told us that “it is a local decision. Not my decision, and not Flock’s decision.”

What he built, buoyed by the FBI’s unsubtle threat of retaliation for complying with public records requests, does create local decision-makers—ones who’ve decided that laws are optional and silence is policy.

The FBI agent provided a summary of the bulletin in his email (emphasis added):

The website lists the total number of searches by an officer, when those searches were conducted, case numbers, the officer’s work schedule, how long they have been employed by the agency, and partial personal identifying information. This poses a significant officer safety risk to law enforcement personnel because suspects can determine if they are the target of a criminal investigation and potentially retaliate against law enforcement and/or those cooperating with law enforcement. Flock has committed to removing officer usernames from future audits.

@December 11, 2025 email from FBI @Houston HIDTA Officer Safety Situational Awareness Bulletin December 2025

Under Federal Pressure

This email was sent shortly after Flock’s email blast announcing reduced audit capabilities (“Flock has committed to removing officer usernames from future audits”). The agent who sent the email is based in Atlanta (as is Flock’s HQ). Flock used the same “officer safety” language.

Flock’s removal of critical auditing capabilities was clearly done in coordination with the FBI.

The FBI-endorsed bulletin recommends that, in configuring data sharing, agencies “exclude the states/agencies that release their audit logs.”

Information exchange happens on an ongoing reciprocal basis; the proposal is, in effect, to reduce the operational capabilities of the Flock system for states with effective open record laws, and specifically for agencies in compliance with those laws.

The FBI encourages agencies to violate the law by quietly threatening retaliation against those who don’t.

Follow the law, lose network access.

The Good Recommendations

Recipients of this bulletin should ensure that their agency Flock Administrators check that the agency Flock settings have limited searches to sharing within state only or exclude the states/agencies that release their audit logs. … Flock users should also limit their searches to “My Network” or draw a geofence around the area they wish to search. This will mitigate the risk of information being released by an outside agency that has different criteria as to what is redacted when responding to FOIA requests.

Agreed. Police should not default to pulling nationwide location histories for reasons like “graffiti”, “trespassing,” or “expired tag.” They should not be pulling any location history, of course, but current scopes are especially hard to justify as serving a legitimate investigative purpose.

The nationwide lookup is often cited as a “why we need Flock.” Apparently, when faced with a risk of oversight, that need evaporates. Police seem to prefer less intelligence over more accountability.

Regardless, although the reasons for wanting to reduce the scope and breadth of warrantless searches differ, we can at least agree this outcome is an improvement.

To further improve its recommendation, the FBI might consider suggesting following its own security policy. If the data and audit logs Flock stores are in fact CJI—as Flock and agencies claim whenever convenient—access and dissemination would be strictly limited to those with prior approval and a particularized “need to know.”

That does not include haveibeenflocked.com. It also does not include Flock or random users on the nationwide network (i.e. “paying customers Flock says are probably cool.”)

The Bad Recommendations

Flock Administrators/users should ensure that the reason for the query be as vague as permissible (e.g., “Investigation”).

This is one to take to your city council.

Elected officials have been promised that agencies have the ability to see the reasons for a search. The FBI is now telling agencies across the country not to enter meaningful reasons.

We’ve long known that entered reasons are borderline meaningless, but now, in addition to Flock’s new anti-transparency measures, it is federal policy.

The Ugly Recommendation

[A]gency Flock Administrators should coordinate with their respective Legal Departments to ensure that law enforcement sensitive information is redacted prior to releasing information.

The information on this website is lawfully obtained via public records. This isn’t in dispute: even after filing its takedown requests stating the opposite, Flock admits as much.

Additionally, there is a basic legal reality that license plates are not categorically exempt from open records requests. If Flock (a private corporation) can have access to the data, so can you.

Houston HIDTA appears to agree. Its recommendation is not “you should never release license plates.” Its phrasing signals an awareness that license plates are not categorically “law enforcement sensitive” or confidential for the purpose of public records requests.

At no point does the bulletin suggest that logs were leaked or improperly redacted.

Instead, the bulletin recommends agencies “coordinate with their legal departments.” On this too, we can agree, but for different reasons. The question posed to lawyers should be if sending “law enforcement sensitive” information to an unregulated private company to be disseminated through a “nationwide sharing” network where tens (if not hundreds) of thousands of people have access, would violate state law and federal regulations.

The question should not be the one implied—how agencies can get away with disclosing “sensitive” information to a group of individuals managed exclusively by Flock, while keeping it hidden from “activists” and “self-styled privacy advocates.”

The “Self-Styled Advocates”

A group of self-styled privacy advocates have filed a series of Freedom of Information Act (FOIA) requests with law enforcement agencies around the country to obtain agency Flock audit logs.

In context, “self-styled” is a deliberate pejorative. It is spook-speak used to delegitimize. It implies those seeking accountability aren’t experts or journalists, but meddling hobbyists.

Police use the language of counter-terrorism to describe citizens exercising a statutory legal right. In their framing, a citizen with a PDF reader is a “threat actor,” and a public record is a “vulnerability.”

At the same time, everything, including the actual surveillance data can be disclosed without restriction to Flock, everyone on the national network (as managed by Flock), Flock’s subcontractors, Flock’s gig-workers in the Phillipines, and the Danish corporation Flock uses to record user sessions.

We’re coming up on a year since several P1 CJISSECPOL violations were reported to Flock. Flock still hasn’t announced a patch. A vulnerability exposing real-time locations for officers went unfixed for months. If we are to take the FBI at its word, these vulnerabilities pose less of a threat to officers than public accountability.

Maybe the actual security problem here is the government contracting out the creation of a massive surveillance database based on a company’s claim that it has a “CJIS ACE Compliance Seal” (provided by Diverse Computing, Inc., of Tallahassee, FL).

Regardless, I want to assure the FBI that there is no “group of self-styled privacy advocates.” A handful of individuals have sent me audit logs, and I’ve pulled a few directly off Muckrock. The persistent belief that this project publishes information from many sources is mistaken.

Although as of right now there are 93M records in the database, they cover a limited time period and were sourced from a handful of releases. At the bottom of the daily statistics pages you can see the number of sources that cover a given month, and the number of search records for that month.

In months with more sources we see significantly more searches logged, yet out of the ~6,000 or so agencies using the system, we have logs from maybe a dozen for any given month.

This information is continuously being disseminated to Flock and by Flock. Anyone with access to the Flock system can get more complete, and more accurate, logs than this project has.

If your position is that “a group of self-styled privacy advocates”—which is really one developer in rural Iowa and the folks who have sent him emails—can use inaccurate, incomplete data to derive so much information that it “poses a significant officer safety risk,” what do you think a Flock employee or contractor—or someone exploiting documented, unpatched security vulnerabilities—could do with realtime access to accurate information?

Agencies are right to be worried. They’re wrong to worry about the messenger while ignoring the problem.

What You Can Do

Get Answers from Public Officials

• Does your PD follow the FBI’s recommendation to enter vague search reasons like “Investigation,” or does it require specific reasons and case numbers for every query?
• Has your PD stopped searching data from jurisdictions that comply with public records laws?
• Since Flock has removed officer usernames from audit logs, how does your city verify that individual officers aren’t using this system for personal or other impermissible reasons?
• Do Flock or the FBI have the right to dictate which public records your city is allowed to release?

Get Answers from the Public Record

Even without the logs, it’s worth finding out if your city complies with open records laws, if only so the FBI will continue to recommend that your city be excluded from future searches.

The FBI suggesting consequences for complying with transparency laws underscores the need to remind these self-appointed surveillance authorities that, in free societies, we don’t treat the rule of law as optional for police.

Tired of Self-Styling? Get Self-Certified

Demanding transparency, speaking at local meetings, and writing your representatives is a lot of work. You may want to be more than just a self-styled privacy advocate.

That’s why haveibeenflocked.com is offering you the opportunity to become a Certified Privacy Advocate. If the government is going to pathologize transparency, you might as well have the credentials to back it up.

This certificate is every bit as legitimate as a commercial CJIS seal and it may even fit in a frame if you print it correctly.

Get certified today!

Pay what you want to print as many certificates as you like, or don’t pay at all. If you frame it and hang it anywhere good, send me a picture.

Although the obvious headline in that debacle is the attempt to suppress public discussion and the outright rejection of transparency, another part of the sheriff’s email is perhaps even more disturbing:

The technology has also allowed us to conduct truth verification on victim and witness statements, allowing us to determine very quickly that one or more victim or witness was giving us false information about what actually occurred. This keeps us from wasting valuable resources on chasing false leads or, worse yet, investigating crimes that never occurred. — Sheriff Al Nienhuis in his March, 2024 email to Hernando County Board of County Commissioners.

The sheriff suggests he is willing to dismiss cases and leads based on information from Flock.

Does that mean he will not investigate when a citizen reports a vehicle is involved in a crime, but Flock didn’t detect it? Will he dismiss valid witness statements when a plate is misread? When a bug in the Flock software doesn’t register it?

We have no idea how accurate Flock’s technology is exactly. That’s both “for obvious reasons” and because it is being used without oversight or external audits. Governments will spend millions on these contracts without asking the question. Still, all technology is fallible, and we know Flock neither contractually guarantees any level of accuracy, nor permits validation of accuracy.

Flock is not contractually obligated to disclose information about inaccuracies, outages, or errors. It is negatively incentivized to do so; its customers don’t like hearing results are inaccurate, they prefer to assume they are.

The idea that a sheriff would use the system for “truth verification” and to direct resources should be deeply disturbing to anyone who values the integrity of criminal investigations.

A search result proves nothing. A lack of search results proves nothing. It’s Flock making an unverified, and unverifiable, claim on the basis of a compromised system.

Courts and police should treat it that way.

Only a week ago, I wrote a post titled “Flock is altering the deal. Pray it does not alter it further.”

It has altered it further.

Flock already removed useful information from its ironically-named Transparency Portals to deal with what the company termed “the burden of compliance.”

Then, as the new info box added to the haveibeenflocked.com name resolution page has noted since earlier this month:

Our ability to identify officers was clearly effective. In a direct attempt to stop us from providing transparency, Flock and police departments have dropped the unique IDs (UUIDs) in the transparency portals entirely. They now simply replace them with the word “redacted” in the public audit logs, effectively preventing oversight and individual accountability.

Now, Flock has extended that “functionality” to its own customers.

We learned from the company’s new, nonsensical takedown notice that it considers audit logs to “pose an immediate threat to public safety and expose law enforcement officers to danger.”

Apparently, that threat is also posed by Flock’s customers — the police officers themselves.

The vendor — still a privately-owned corporation — has decided it no longer trusts police with information about who has searched “their data.”

“Don’t worry,” Flock tells cops, “it’s for your own good.”

At least, that’s what we hear from an officer responding to an open records request:

Flock Safety updated the system on 12/11/2025 to protect officer safety and active investigations, Network Audit Logs no longer include officer names, license plate, or vehicle fingerprint information. This is a system update from Flock Safety not [Local] Police.^[1] With recent concerns about Flock [Local] Police conducted a review of shared networks and removed all out of state access to our system.

This, of course, comes on the heels of Flock’s announcement that the reason field is now a dropdown, from which you may select one of Flock’s expertly curated pre-approved reasons.

Which followed shortly after the announcement that Flock does not log searches that are flagged as problematic. Select another justification and try again.

If you’re a cop or a city, you no longer get to know who searched the data collected in your town. You don’t even get to know what was being searched for. If the company feels like it, you may get one of a handful of pre-approved reasons.

But only if the anonymous other party feels like making a selection — simply clicking something that will be accepted by the system is also an option … it’s not like anyone is logging your name.

Here are log entries from three different agencies (from before the dropdown was implemented):

Name, Org Name, Total Networks Searched, Total Devices Searched, Time Frame, License Plate, Reason, Case #, Filters, Search Time, Search Type, Text Prompt, Moderation
"REDACTED","Shelby Township MI PD",4341,"4341","03/31/2024, 07:22:46 PM UTC
22:46 PM UTC","REDACTED","COM-13-24","","REDACTED","04/01/2024, 07:22:59 PM UTC","lookup","",""
...
"REDACTED","Houston TX PD",5888,"5888","09/27/2024, 05:00:45 AM UTC
10/04/2024, 05:00:45 AM UTC","REDACTED","INV","","","10/04/2024, 05:00:47 AM UTC","lookup","",""
...
REDACTED,[Federal] US Postal Inspection Service,3241,54164,"11/10/2025, 11:00:24 PM UTC
11/17/2025, 11:00:24 PM UTC",REDACTED,4238996,4238996,REDACTED,"11/17/2025, 10:30:32 PM UTC",lookup,,

Newly missing:

• Name (“Operator name” as it’s referred to on this site)
• License plate^[2]
• Filters

Whether the “Text Prompt” and “Moderation” fields are empty because they’re unredacted, or because they’re simply empty and haven’t been replaced with the word redacted is unclear.

Anyway — it’s almost becoming a predictable pattern, but bear with me once again as I quote Flock’s CEO and then tell you he lied:

Why Auditing is Crucial: To underscore accountability, every single search conducted in the Flock LPR system is saved in an audit report. Every time a search is run on the Flock system, that search and search reason is preserved permanently in the audit trail of every agency whose camera was included in the search. — Garrett Langley, “Setting the Record Straight: Statement on Flock Network Sharing, Use Cases, and Federal Cooperation”, June 2025.

Actually, to change it up a little, let me also cite the section “Flock’s privacy-by-design and accountability” from the company’s November 11, 2025, impossibly boringly-titled blog post, “Automated License Plate Readers and the Fourth Amendment: A Public‑Safety‑by‑Design Perspective from Flock”:

Immutable accountability: Every user action and search reason is recorded in an indefinitely available audit trail.

And, because it’s Christmas, let’s throw in the company’s “Ethical Creed,” which it actually publishes on its webpage:

1. Transparency and accountability build trust between communities, government, and law enforcement – making communities safer and more equitable.
2. Democratic decision making and local autonomy should be encouraged and respected.
3. With the right technical and policy safeguards, public safety technology will not infringe on constitutionally protected rights.

In this case, the “immutable record” that is supposed to “build trust” has been altered (again).

Not through “democratic decision-making” or “local autonomy,” but through a decision to modify the service contracted for—a decision made unilaterally by Flock, without consulting its customers, while they are probably spending time with their families.

Because, apparently, what Flock wants now trumps “safer” and “more equitable” communities, and even if it causes a little light infringement on constitutional rights, if we can drop those annoying safeguards that keep exposing the company’s poor practices, maybe it’s worth it. For Shareholder vaOfficer Safety.

All that is to say: Flock has expunged the “permanent record.”

If Flock was talking about your city council when whoever they pay to write blogposts wrote:

Every search made within the Flock platform is logged and auditable, creating a tamper-proof trail of accountability. Agencies can trace back who accessed what information, when, and why. This audit feature is a critical deterrent against misuse and is often cited in public hearings as a reason for community support. — Flock, “The Power of Connected Intelligence”, September 18, 2025.

Then now is the time to let them know that Flock has committed a material breach of the contract — it reneged on the democratically-approved deal (however tenuous that approval might be sometimes).

Your city council may have even said, “I trust our local police department.”

Flock does not.

The company lied to you about data security, about compliance, about transparency, and even about finding missing children.

They took your city’s data and are now selling it.

Just like they said they wouldn’t.

For your safety.

PS: Flock chose not to redact case numbers (yet). Naturally, even while importing a heavily redacted dataset, the importer called out an instance where someone pasted an entire LINX entry about a fatal hit-and-run into the case number field—officer name, defendant name, date of birth, charges, and all. The haveibeenflocked system truncated and partially redacted the entry for privacy, which is more than Flock managed. This is exactly the kind of reckless incompetence Flock is trying to hide. Unfortunately, they can’t even do that right.

In the summer of 2024, months before the amber alert, sixteen-year-old Sophia “did not return home one night.” She kept in touch with her parents by phone and told them she was staying with a friend in town. Her parents talked to local police and they decided not to report her as missing, believing her to still be in the area.

In December that same year, police in Arkansas were performing a compliance check on Gary Day— a forty-year-old man who was in the middle of a six year probationary sentence for endangering the welfare of a minor.

Day’s charges stemmed from his four-month-old baby being found with a fractured femur in 2020. In 2023, he was charged with battering his then four-year-old son—those charges had been dropped a few months prior to the December compliance check.

Police discovered Sophia when she attempted to escape out the backdoor. Although a condition of Day’s probation was that he not leave Arkansas, Sophia told police that he had come to get her from Wisconsin five months earlier. She was three months pregnant at the time of that interview.

Day was charged with interference with child custody and contributing to the delinquency of a minor and released on bond, while Sophia was returned to her parents’ custody in Beaver Dam, Wisconsin.

A month later, Sophia’s parents contact Beaver Dam PD—they had caught Sophia messaging with Day online. The parents share the contents of that conversation with police.

“I stayed out past curfew. Probation. And didn’t notice. Im done. Fuck. Fucking ankle monitor is flashing and vibrating”. — Gary Day message to Sophia

Around 10 PM the next day a black Buick registered to Gary Day’s mother is spotted by a Flock camera in southeast Missouri, heading north toward Wisconsin. It has Arkansas plate BBR 20L.

The next morning, February 3 at 5:20 AM, Sophia’s sister spots the same car near their home. At 7:48 AM, their home surveillance system records Day walking near the house. At 8:30 AM, Day’s car is spotted by WI DOT cameras. They capture the black Buick traveling southbound on Highway 151 near Sun Prairie, WI. It has Pennsylvania plate KGW 5186.

At an unspecified time that same day, Sophia’s father sends local police the surveillance footage and reports the pregnant Sophia as missing. She was believed to have gone with Day — possibly to Arkansas.

That evening, at 8:08 PM, an Amber Alert is broadcast. The alert includes information on the Buick, and notes that it is “known to use multiple license plates,” listing Arkansas plate BBR 20L and Pennsylvania plate KGW 5186.

After the alert is issued, numerous agencies inside and outside of Wisconsin, including Milwaukee’s STAC^[1] fusion center and the Missouri highway patrol, begin searches for Day’s Arkansas plate— the first plate listed in the Amber alert, but not the plate he was most recently seen with.

The Pennsylvania plate seen on the Buick as it was leaving Wisconsin does not appear in search logs until the next day around noon—more than 24 hours later—when the Beaver Dam, WI, PD decides to look it up for the first time.

In total, the logs show 3,466 searches for the BBR 20L and KGW 5186 plate between February 3 and March 27. Day and Sophia were found on April 2.

Sophia tells police she and Day had stayed at hotels in various locations. She testifies they abandoned the Buick near a Culver’s in Avondale, Arizona. That particular Culver’s is right between I-10 and a Park & Ride facility. It seems like a plausible location to ditch a car, and explains why a 16-year-old from Wisconsin would recall the name “Avondale.”

Based on Sophia’s accounting of the overnight stays, they would have been in Arizona on or around February 8 or 9.

Milwaukee-based CBS 58 reports, however, that Sarpy County Sheriff Greg London, “learned the two had hitchhiked with a trucker after Day’s car broke down in Idaho.”

The criminal complaint itself is highly detailed. To an extent. Although email addresses and exact times for phone calls and license plate cameras are noted, it is conspicuously vague about how and where the car was recovered.

It provides Sophia’s highly detailed, plausible-sounding statement, following it up with a single, passive sentence, “law enforcement located the vehicle near that area.” There is no mention of who located it, when it was located, or the condition it was located in.

It leaves open the possibility that the vehicle was flagged by the P&R owner, or, if they left it at Culver’s or at one of the hotels, a business owner, shortly after February 8.

The complaint is also silent on whether the license plates were recovered with the vehicle—a strange omission for a prosecutor who is about to argue a flight risk exists based on those same plates.

A similarly vague incident occurs where the complaint includes Sophia’s statement that “they stopped at an unknown Walmart in Missouri where Gary bought food using his EBT card.”

It does not specify which Walmart, or whether the electronic transaction, where a fugitive used a government-issued benefit card, triggered an alert.

The prosecutor uses the same passive voice when she writes, “Gary Day and [Sophia] were located in Sarpy County, Nebraska.”

Omitting that it was a woman at a truck stop who called it in.

After Nebraska police responded, they notified Beaver Dam PD that Sophia had been found on April 2, at 11:40 PM — after WISN 12 ran an item marking Sophia’s 17th birthday.

Below are the searches of the Flock system during the nine-week manhunt.

They don’t tell a story of a system that is effective at locating missing children.

A man transported a child across state lines without her parents’ knowledge and got her pregnant.

While he is on probation.

Then, a few months later, he does the same thing again.

Flock’s system spots him in a state he is not supposed to be in, and before he gets to Wisconsin.

There is no Amber alert yet, so Flock does not detect this.^[2]

At the time Flock spots Day’s car in Missouri, he is either still wearing his ankle monitor, or he removed it.

He gets to Wisconsin, to the home of someone he has a no-contact order for.

No-contact orders aren’t automatically placed in Flock’s system—no alert is sent.

His car is spotted with a different plate mere hours after he is spotted violating both the no-contact order and his probation.

Not by a Flock camera, but by a DOT camera. That plate, however, is not used for lookups until more than a day later.

Police effectively stop searching only days after the alert is broadcast.

When Sophia is ultimately found, it’s not through Flock, or any other form of digital surveillance.^[3]

Day’s ankle monitor being cut off or leaving the state could have triggered a reaction from Arkansas probation or Wisconsin authorities on February 2—before he ever reached Sophia’s home in Beaver Dam.

When that monitor tripped, police could have manually placed a hotlist entry in the system.

The EBT transaction also could have sent police directly to a specific Walmart, where Day and Sophia were standing at the register.

In the nine weeks the Amber Alert was active, billions of license plates—approximately forty billion plates by Flock alone—and financial transactions were entered into police databases, on the promise that they are a “force multiplier” to find missing children like Sophia.

In the end, the only effective force multiplier was a woman at a truck stop in Nebraska who paid attention to the news and the people around her.

Additional Reporting

• https://www.jsonline.com/story/news/2025/02/05/beaver-dam-amber-alert-man-faces-felonies-in-missing-girl-case/78246544007/
• https://www.jsonline.com/story/news/crime/2025/02/07/amber-alert-arkansas-man-connected-to-missing-beaver-dam-wisconsin-teen-convicted-of-harming-child/78326952007/
• https://www.wisn.com/article/beaver-dam-amber-alert-for-16-year-old-girl-extended-to-arkansas/63692596
• https://www.kare11.com/article/news/nation-world/police-continue-amber-alert-search-pregnant-wisconsin-teen/89-1d5266cb-555c-42e4-a587-eb8418c292be
• https://www.youtube.com/watch?v=aOet6Sv9sb0
• https://www.wmtv15news.com/2025/04/03/missing-beaver-dam-teenager-found-safe-after-nearly-two-months/

Through the Curtain

The report summarizes what agencies provided:

In total, we obtained records of 13 search logs, 4 organizational audit logs, and 15 transparency portals. Agencies often claimed that these categories were confidential. For example, 10 agencies claimed their search logs were confidential, 10 claimed their audit logs were confidential, and 2 nonsensically claimed their transparency portals were confidential.

Translation for haveibeenflocked.com terminology:

1. Portal logs: Thirteen of 48 agencies provided heavily redacted portal logs containing only user UUIDs (e.g., 1dde314b-b11e-4ca1-be02-c74876615f97), search dates, camera counts, and reasons.^[1] Agencies: Carlisle, Clinton, Clive, Coralville, Council Bluffs, Davenport, Dubuque, Indianola, North Liberty, Story County, Urbandale, University of Iowa, West Des Moines.

2. Organization audit logs: Warren County Sheriff’s Department was the only agency to provide these.

3. Network logs: Zero agencies provided these.

The “transparency” portal serves its actual purpose: transparency theater. The agencies successfully exploited information asymmetry to misrepresent compliance—even the ACLU and University of Iowa accepted heavily redacted portal logs as legitimate disclosure and moved on.

Behind the Curtain

The report notes agencies “nonsensically” claimed transparency portals as confidential—only one agency, Davenport, actually made this claim explicitly, though several claimed they didn’t maintain the portal. This is despite the portals being accessible on the public internet and explicitly displaying the notice: “Data is owned by [agency].”

Davenport’s blanket denial:

Reference FOIA request PD-1759-2025, the items requested are confidential under Iowa state code and are guarded under previous rulings by the Iowa Public Information Board (IPIB).

This is lazy fabrication. Iowa law provides no confidentiality for these records. The Iowa Public Information Board has issued no formal guidance on these items. The legal term for this response is “making shit up”—evidenced by the complete failure to cite any actual legal basis.

Davenport PD’s response is a bureaucratic middle finger to the public and the law they claim to uphold.^[2]

Minor gripe: The Freedom of Information Act (FOIA) is federal. In Iowa, it’s the Iowa Open Records Act, or Chapter 22. If you’re going to ignore the law’s substance, at least get its name right.

How to Violate the Law Two Ways at Once

Clive deserves its own section for accidentally admitting to law violations through contradictory claims.

In response to the request for search logs, Clive wrote:

The City does not maintain this type of record. Even if the City were found to maintain such a record based on its ability to access the Flock Safety system, the information requested is considered “intelligence data” such that it constitutes a “confidential record” that is prohibited from disclosure pursuant to Iowa Code Section 22.7(55) and Iowa Code Chapter 692…

This contradicts Iowa Code Chapter 692, which requires agencies to maintain logs.

Specifically, Chapter 692 mandates that for every dissemination of intelligence data, “[t]he agency maintains a list of the agencies, organizations, or persons receiving the intelligence data and the date and purpose of the dissemination.”

Clive knows this. In October 2024, it denied a request for these exact logs by asserting the same basis for confidentiality and adding:

The City strictly complies with its requirements under Iowa Code Chapter 22 and Iowa Code Chapter 692, and accordingly, it must respond in the negative to this request.

By now denying it maintains the logs it claims it must keep but cannot disclose, Clive admits to violating the law—one way or another. They are either failing to create mandatory intelligence records, or they are lying about their existence to avoid public scrutiny.

Whose Law is it Anyway?

These nonsensical denials obscure ongoing violations of state and federal law. Agencies routinely disclose legally protected intelligence data, criminal justice information, and criminal history information to commercial and government partners in violation of statutory restrictions.

This falls under the purview of the Iowa Public Information Board and the Iowa Department of Public Safety. Neither has shown any inclination to enforce compliance, so agencies fabricate legal justifications to deny public access to records.

If a member of the public attempts to complain, the Iowa Public Information Board sends this notice:

The IPIB normally allows brief (under five minutes) comments from the parties. If you wish to speak at the meeting, please reply to this email and indicate your agreement to this statement:

__ I want to address the Board and respond to any questions Board members may have when the initial processing of this complaint is considered. In the event this complaint proceeds to a contested case, I waive any objection that I might have concerning personal investigation of this complaint by a Board member.

The waiver pairs well with this email from Clive’s city attorney to IPIB director Erika Eckley,^[3] after Eckley refused to investigate a complaint about Clive’s false assertion of confidentiality:

Welcome to Iowa, where the exemptions are made up and the law doesn’t matter.

Looking into this further raises more questions than it answers.

The Setup

On August 8, 2025, Santa Cruz PD search traffic plummeted, yet the number of agencies conducting searches remained roughly the same.

As a quick refresher, according to Flock documentation, the primary tools in the system are:

• Lookup: A state- or nationwide “text-only” full license plate query to obtain a 1, 7, or 30-day history.
• Search: A query to find full or partial plates, filter by car model/make, or spot bumper stickers on networks with reciprocal footage sharing enabled.

Agencies that shared footage with Santa Cruz continued searching via “portal” queries, but statewide reciprocal access via “network” queries stopped abruptly (or appeared to).

The new, much shorter list of agencies Santa Cruz shares data with is seemingly standard.^[1]

The Missing Searches

The weekly view shows the longer-term trend across nearly a year of data:

At the beginning of the year, as discussed in the previous post, Santa Cruz—like many other agencies—still permitted the national free-for-all. When Santa Cruz restricted nationwide sharing, ‘Lookup’ tool usage dropped, and ‘Search’ became dominant.

In July, however, ‘Lookup’ tool usage briefly returned to approximately pre-March levels. Before July 11, search queries sat at 7k–15k/day. Then, ‘Lookup’ queries spiked dramatically up to 20k/day, while ‘Search’ plummeted.

On August 8, ‘Lookup’ queries crashed to near-zero while ‘Search’ continued at its reduced level.

The number of organizations with access and the number of devices searched remained stable throughout this period. Yet, ‘Lookup’ searches across all organizations spiked by ~400–500% in July, while the overall volume of searches remained stable.

I compared the numbers from 81 California agencies publishing logs via transparency portals.

One of these things is not like the others. The chart above shows all queries of >10,000 devices (i.e., those that are presumably statewide searches). It shows that the number of organizations shown in Santa Cruz’s log files drops from approximately 250 to 200, but remains largely stable at a number consistent with California.

The number of searches from the 81 transparency portals remains stable at around 5,000. This stands in stark contrast to the 4–5x decrease in “traffic” that simultaneously occurs in Santa Cruz’s network logs.

Update: Capitola, CA

For my fellow Midwesterners: Capitola is a suburb of Santa Cruz and, apparently, California’s oldest beach resort town.

Although the complete import is still running (sadly without reasons), a preliminary analysis of the raw data shows a pattern that’s strikingly similar^[2] to Santa Cruz’s:

It shows the same high (out-of-state) volume prior to February, then a drop, an inversion of Lookup and Search in July 2025, and then a cliff, with nearly identical volumes across the board.

Because the cities are so close, it’s theoretically possible that there is some degree of coordination or even collusion regarding log file release, but that seems highly unlikely for a number of reasons.

The July Timeframe Anomaly

The “Lookup” tool is documented as supporting only 1, 7, or 30-day timeframes via a dropdown selector. Non-California data confirms this: in Lynnwood, WA, 98.8% of lookups use standard timeframes. The remaining variance comes from undocumented options^[3] (6h, 12h, 14d) and sketchy “month ago” logic that seems to sometimes yield 31 days instead of 30.

The chart above shows the weekly timeframe compliance rate. Before July, 96–98% of lookups use standard timeframes (green).^[4] Starting July 7, compliance drops to ~75% as ~25% of “Lookups” suddenly have impossible timeframes: 105 days, 121 days, even 365+ days.^[5]

This strongly suggests the July “inversion” (where Lookup suddenly spiked and Search dropped) is actually a misclassification: searches that should be labeled “Search” (1:1, flexible timeframes) were incorrectly labeled as “Lookup” (statewide, 1/7/30-day only).^[6]

The August Cliff as Correction Attempt

If the July inversion was a misclassification bug, the August 8 cliff may have been a botched attempt to fix it.

If the fix had been surgical—un-“flipping” the classifications—we’d expect the charts above to continue showing the same ~100–120k weekly overall volume, but with the blue and orange bars flipped back to their pre-July configuration.

Instead, “Search” volume remained roughly on par with the pre-July “Lookup” volume, while Lookups dropped by 98%^[4:1]. The top Lookup users (CHP, Riverside County, and Orange County) essentially stopped appearing in the network audit logs.

In fact, 175 organizations disappeared from the “Lookup” logs completely, even though most of them remained in the “Search” logs.

What This Means

The pattern is consistent with a ham-fisted correction attempt that, instead of fixing July’s Search–Lookup inversion, dropped all real Lookup tool usage from the network audit log.

We don’t have the most recent data, but given that the original problem started 4–5 months ago, it’s entirely possible that this situation persists today, and the state of California is not logging statewide searches.

This tracks with previous observations: Flock does not invest in QA, and police don’t audit the logs.

Based on my years in the tech industry, I would classify this as a legit five-alarm fire. Once an issue this serious—with the potential for liability and severe effects on the criminal justice system and civil liberties—is discovered, nobody is going home until it’s fixed.^[7]

That’s not what happened with Flock in California.

Either Flock has ignored reports of this problem, or, in the entire state of California, not a single police officer responsible for overseeing these systems has noticed that “their” logs got 187’d by their own vendor.

Neither situation is a great look.

Think of that next time you hear “we control the data” and “we audit the system.”

You may also have noticed what appear to be duplicate searches, or higher numbers of searches than you might expect. This isn’t a bug. It’s a reflection of the accuracy of the logs, and of how different agencies handle their audit data before releasing it.

This post explains why information is missing, how we handle duplicates, and how to interpret what you see. For agency-specific details, check the source statistics page.

Why Is Information Missing?

There are two distinct reasons you might see incomplete data: source redactions, where agencies redact information before its release, or redactions by the haveibeenflocked.com website. This post discusses the former; for details on the latter, see the “about redaction” page.

Source Redactions: Flock

Flock audit logs are partially redacted or obscured by default. Full names of operators are included only in “organizational audit logs.” Those are only accessible to the operator’s agency. Names of operators from other agencies searching the data are obscured; the “network audit log” only shows abbreviated names like “J. Smi.”

Sometimes the “Smi” in “J. Smi” is a middle name, sometimes it isn’t. Sometimes it’s “S. Joh.” Some agencies are staffed entirely by mononymic "a"s and "j"s who appear to be on the clock 24/7. Others are staffed by people like “B. 478” who do a lot of “inv” work.

Whether this is a deliberate choice because agencies don’t trust each other with their employees’ names, a way to create a degree of plausible deniability, or simply a terrible technical design choice is unclear. What is clear is that none of Flock’s customers appear to consider it an issue that there is no way to determine who the “a” or “b” is that’s looking up location histories. They find that “inv” is a good enough reason to disclose detailed location histories, regardless of “a”'s identity.

In transparency portals, Flock goes even further. By default, it omits operator names, case numbers, search timeframes, search types, filters, and text prompts. There is no way to tell whether your local agency is doing convoy analysis, whether it’s pulling long-term location histories based on bumper stickers, or whether it’s looking for people wearing a red shirt.

Flock and its customers consider this lack of transparency a feature; one the company recently expanded because “the burden of compliance shouldn’t stand in the way of public safety.”

Source Redactions: Agencies

When agencies address city councils or the public in general, invariably there are no privacy concerns in relation to bulk collection and sharing of license plates. Flock also claims not to handle PII, a false statement that agencies are happy to parrot. Agencies have no issue with shipping all of this information overseas, placing it in a system with gaping security holes, or even with Flock publishing details on murder investigations, including the victim’s Gmail password.

When a citizen requests that same data, however, it tends to be confidential. In those instances where audit logs are disclosed, they are often disclosed with the columns for “sensitive information” (like license plates), PII (like operator names), and criminal justice information (like search reasons and case numbers) removed.

It leaves a log that, at best, informs you that someone did something at some time for some reason.

Well, maybe.

This is what oversight and transparency looks like to police.

Working With Duplicate Information

This is the ideal scenario. Agency A releases a network audit for the month of August, and it perfectly matches the audit released by Agency B. This happens sometimes.

Whenever we import a record, we create a fingerprint for that record^[1]. If a future import generates the same fingerprint, we don’t store the record again, only the fact that it’s available from more than source. Whenever you see “2(+) sources” in a result, that’s what happened.

For every search of the national network, you would expect that search to show up in every participating agency’s network.

That’s what Flock claims, and that’s what haveibeenflocked’s system was designed to accommodate.

As it turns out, that was an overly optimistic design choice.

Selecting June 2025 as an example:

• There are 1,907,643 unique searches/fingerprints for that month^[2]
• We have multiple sources that cover that month.
• The most records in a single source is 382,998.

This means that either:

• No single source shows all the searches on the national network.
• Sources show different information about the same searches.

Both appear to be true.

Missing Information

When a search record for a national search is completely missing, it either means that the “national” search wasn’t actually national (which may lead to false negatives in investigations), or not all searches are logged.

While philosophically we may struggle to reconcile this with the idea of responsible use of the system, technically it is easy to deal with: we simply detect the unique fingerprint and add the record as a search. B.'s your uncle.

But partial records are where it gets trickier. Because our fingerprint is based on the exact text of the record, changing even one letter changes the fingerprint. This is the technically sound way to treat audit records: any tampering is guaranteed to be immediately evident.

But, when Agency A reports a search with the reason “Investigation,” and Agency B redacts that reason to “Inv” or blanks it out completely, our system sees two mathematically distinct fingerprints. It treats them as two separate searches, even though they likely represent the same event.

Contradictory Information

At the same time, we regularly see searches that are logged differently between different organizations.

These variations and irregularities range from small changes in organization names (“University of Iowa PD IA” vs. “University of Iowa (IA) PD”), to completely different organizations or operators.

It’s critical to understand that this is the same data Flock and its customers claim is permanent, immutable and provides the information suitable to perform audits. It’s the exact same information your local police department uses for its audits, and the exact same information available to third party auditors (if such a thing exists).

If Flock used a system to prevent tampering and guarantee their authenticity, something which is standard when dealing with secure audit logs, even small variations in logs would not be possible.

Those types of systems are standard. Literally. ISO 27001 and SOC 2—both standards Flock claims it complies with—require audit logs to be protected against tampering to ensure integrity and accuracy.^[3]

The logical conclusion, that Flock’s lack of controls permits data errors, deliberate obfuscations, technical issues, or conversion problems, is off the table. Flock and police have told thousands of elected officials across the country, as well as the general public, that these audit logs are a complete and reliable method for oversight and accountability, and that they fully comply with ISO 27001 and SOC 2.

Because HIBF can’t audit Flock’s systems to show otherwise, and agencies tasked with oversight don’t, we have to assume that Flock and police are not lying to the public about these records, or falsely purporting them to be more accurate or fit for purpose than they actually are.

So, as contradictory as it might appear to you and me, if Flock says that the exact same plate was searched for by two different people, working for two different agencies, in two different states, using the exact same case number, the evidence we have forces us to conclude that’s what happened.

The Choice

So then, how do we handle this? This is a choice.

We can:

1. Discard the record entirely.
2. Try to figure out if it’s a duplicate, based on available information—a task that is already virtually impossible even without redactions due to the unreliability of the data.
3. Assume that the information shows what the agency purports it to show: someone did something at some time for some reason.

There are arguments to be made for each option.

To maximize the utility of available data—even when those data are limited—we rejected option 1.

To minimize the chance of introducing additional errors, we did not select option 2.

Leaving option 3: present the data as-is, treating it as a new search because it could be.

The Problem

The problem with that choice is that it can, and does, lead to both over- and underreporting.

But redacted data is still valuable. Even when agencies hide operator names or reasons, the record proves that surveillance occurred—a specific vehicle was searched at a specific time by a specific organization.

When a license plate is hidden, we may not see stalking, but the reason may indicate improper access. When a case number is missing, we know the agency is uninterested in relating searches to legitimate investigations.

Agencies committed to transparency would not stand for Flock’s baked-in redactions, but would also disclose the remainder.

The Solution

We preserve and display what’s available while being transparent about gaps and limitations.

Check the source statistics page to see which agencies provide complete data and which choose to redact key fields.

Without complete information, haveibeenflocked or its users will be inclined to infer the missing data.

We strongly encourage agencies to tell their side of the story by disclosing complete records.

Through incorporation by reference of its website, Flock maintains a significant part of its customer contract in a place that only it can modify:

The reinstall fee schedule contains prices for things like “Camera replacement as a result of vandalism, theft, or damage” and “Replacement Cable(s).”

It’s worth noting that Flock maintains full ownership and control of the cameras. The reinstall fee schedule is essentially an insurance policy, underwritten by the customer, for which Flock can set the terms and coverage schedule on its website.

I have written on modifying “attachments” to the contract before in a legal brief:^[1][2]

Adding, changing, or removing an entry in the Deployment Plan creates significant contractual obligations for [Flock’s customer], including, without limitation, providing electrical power and permits, ensuring legal compliance, paying all applicable taxes, and “any other services performed [by] Flock in connection with the installation of the Hardware.”

…

The Agreement, Deployment Plan, and Reinstall Fee Schedule combined create an instrument expressing offer, acceptance, consideration, and assent, representing significant governmental interest and functional ownership, expressly incorporated into the main agreement document.

It is clearly wildly irresponsible for governments to agree to contractual terms that can be unilaterally modified, without notice, by its vendor; including when those terms are published on a vendor-managed website.

But they do. En masse.

Even worse, governments have argued^[2:1] that by storing a contract on a vendor’s website in this way, it becomes exempt from open records laws:

When customers don’t save the terms of the contracts they sign, the only way for them, and the public, to access the terms at the time of signing is through tools like the Wayback Machine.

When they are incorporated by reference into government contracts, vendor websites become part of the public record. Altering, destroying, or removing items in the public record is a crime in many jurisdictions.^[3]

And, even more importantly: secret contracts run counter to just about every principle of transparency in government. They are a path leading directly to corruption and violations of rights.

Hiding contracts is one prong of Flock’s three-step assault. It has banned EyesOnFlock from accessing transparency portal information. Like this site, EyesOnFlock downloads log files from public transparency portals to aggregate information and offer it to the public in an easy-to-consume, and, above all, immutable^[4] format.

The portals are publicly posted on the internet, where there is no expectation of privacy; as such, one would expect that private entities gathering and distributing portal information in bulk would not be a concern for the company.

But, even when able to access the portals, the audit logs posted there^[5] contain severely limited information.

In school, we are taught the 5 W’s that are needed to tell a story or describe an event. This is what that looks like for Flock:

• “Who?” This is answered with a UUID (e.g. f3af60c5-f4e1-4c50-af64-cb1bbdbf5acf).
• “When?” A time, without a timezone, is Flock’s answer.
• “What?” No search terms (license plate, text prompt, or filters) are ever included.
• “Where?” No search type is included. The device count has now been set to 0. It is impossible to infer if the search was local, statewide, or nationwide.
• “Why?” With Flock’s new feature rollout, agencies can, and do, redact reasons and case numbers.

And, finally, Flock’s blocking of the Wayback Machine is not limited to portals and contract terms. It also blocks its prior statements:

That in itself is evidence enough that the company wants to revise history and control the narrative.

The company actively develops features to remove information from public logs, and pro-actively works to remove its statements, logs, and even contractual terms from public view.

By actively concealing information about government contracts and activities from the public, the company is not only plausibly violating the law, it prevents the residents who are being watched by its cameras and judged by its AI algorithms from participating in the local decision-making process that it (implausibly) claims to value.

Flock is not the passive agent operating in the shadow of government that it claims to be.

It actively manufactures the shadows.

Update: A few hours after this article was published, Flock appears to have blocked pro-transparency site EyesOnFlock from accessing Flock Transparency Portals.

In 2021, when the company launched its first transparency portal, it wrote:

“We place privacy, transparency, and bias mitigation at the forefront of our product development, and are constantly engineering new features that encourage and align with our ethical principles." — Matt Feury, CTO Flock Safety, Flock Safety and Piedmont Police Launch First-Ever LPR Transparency Portal, June 10, 2021.

Two years later, the language hadn’t changed much:

Flock Safety enables robust auditing of its platform to promote accountability and transparency. All searches conducted on any LPR device require a search reason and are saved in an indefinitely-available audit trail. – Flock Safety, Flock Safety Achieves SOC 2 Type II Certification, June 20, 2023

Until now, it used this language to bolster transparency theater and maintain the illusion that the company was amenable to oversight.

Now, another two years later, it has launched a new blog series, Policy Pulse. In it, the company fully abandons its previous performative ethics to adopt an aggresive anti-oversight stance, writing in its inaugural post:

We’re presenting this new blog series, Policy Pulse, because the burden of compliance - navigating this messy lattice of rules and oversight - should not stand in the way of public safety

In part three, still couched in the language of performative transparency, Flock announces new features informed by its new position:

At Flock Safety, transparency is not a bug, but a feature. It’s baked into all the products we ship. For law enforcement agencies, transparency is not a catchphrase. In the past, law enforcement agencies had little choice in how public search audits were exported from the Transparency Portal … Now, that changes … With a single decision, they can … remove both [search reason and case number] entirely. — Flock Safety, Policy Pulse: Transparency, Control, and the Path Forward, October 30, 2025

These new transparency features are aimed at reducing questions, not at providing answers.

The information available through the transparency portals was always limited. The most important questions were never answered: who is looking at the data, and why?

With these new redactions and obfuscations applied, it leaves only the time that a search was conducted.^[1]

As questions continue to be raised, Flock continues to walk back its earlier stated commitment to transparency and oversight — no longer a goal, but a burden.

The company has often said that it’s only a tool-provider, or a passive facilitator of its customers’ actions. In Policy Pulse, however, it goes beyond that, by acknowledging a level of responsibility that it “will not shrink from.”

A responsibility to help its users avoid the burden of compliance.

Flock has always operated a private surveillance network configured in such a way that it optimally avoids public oversight. Policy Pulse is its admission.

The data is owned by the customer, so Flock can’t disclose it. But customers say only Flock has the data, so they can’t disclose it.

License plates and ALPR data are not private or sensitive information, so there is no issue with Flock storing them.

But audit logs that contain queries that could contain license plates numbers are private and sensitive information, so they can’t be disclosed.

For all its waxing philosophically about democracy and sovereignty, the “path forward,” as the new blog series calls it, pretends that the core values of American democracy, and the notion that democratically enacted laws and regulation are a burden “that should not stand in the way of public safety,” can be reconciled. That is not the case.

The path foward is for democratic governments, by the people, for the people, to build public trust by first demanding, and then publishing, a complete and unvarnished view of the activities those governments engage in on behalf of the people they claim to serve.

Not more obscurity, and less democratic oversight.