No ordinance passed by the Council, unless it be an emergency measure, shall go into effect until thirty (30) days after its final passage by the Council. If at any time within said thirty (30) days, a petition … be filed with the Clerk of the Council requesting that the ordinance, or any specified part thereof, be repealed or submitted to a vote of the electors, it shall not become operative until the steps indicated herein have been taken. — Cleveland Charter, § 59

This means two things: first, there will be no new contract for at least thirty days. Nor will the “guardrails” passed by Council come into effect. If the cameras stay up and Flock continues to collect data, that collection will not be constrained by local democracy.

Second, Clevelanders have roughly thirty days^[1] to deliver a petition forcing Council either to repeal the ordinance outright (no contract extension) or to put it to a referendum. A petition would need roughly 4,400 registered Cleveland voters — in a city of ~360,000 residents — to sign on.^[2]

Before the vote, Flock told Clevelanders that “there will be cameras.” In what would appear to be the first popular referendum on mass surveillance, Clevelanders — the people directly affected by the surveillance — now have an opportunity to respond.

Here’s the relevant language, as currently published:

Replacements. In the event that Flock Hardware is lost, stolen, or damaged, Customer may request a replacement of Flock Hardware at a fee as set forth in the Reinstall Fee Schedule. In the event Customer chooses not to replace lost, damaged, or stolen Flock Hardware, Customer understands and agrees that Flock is not liable for any resulting impact to the Flock Services, nor shall Customer receive a refund for the lost, damaged, or stolen Flock Hardware.

The companion clause on “Deployment Plan” changes goes further:

After installation of Flock Hardware, any subsequent requested changes to the Deployment Plan, including relocating, re-positioning, adjusting of the mounting, removing foliage, replacement, and/or changes to heights of poles will incur a fee as set forth in the Reinstall Fee Schedule. Customer will receive prior notice and confirm approval of any such fees.

A MuckRock production linked from Joey Scott’s “FOIA Friday” piece on “The case of the missing and destroyed Flock Cameras” shows Moreno Valley contracts its policing to River County Sheriff’s Department (RCSD), so a request for Moreno Valley PD records returned RCSD’s correspondence. Scott’s piece covers the theft and vandalism costs in that file — I encourage you to read it. This article will focus on the approval bypass that Flock and RCSD (and likely many other agencies) appear to be employing.

RCSD’s Flock contract, a five-year Master Services Agreement from August 2023, carried substantively the same two “approval required” provisions as above, under different section numbers.

In the emails, however, Flock unilaterally decides there’s a problem, dispatches a technician, replaces the unit, and only then tells the county an invoice is coming:

Cam #05 SB Harvill @ Cajalco, 5/1/23 (p.144):

We will need to replace the pole to ensure the location is functioning properly as soon as possible. Due to the damage being physical in nature, we will be sending an invoice for the damage in conjunction with our reinstall fee schedule. This invoice ($500) will be emailed to [redacted]@riversidesheriff.org shortly.

Cam #48 WB Ave of the States @ Washington, 5/24/23 (p.146):

The technician noticed that the location experienced third-party damage after an apparent vehicle accident. We went ahead and replaced the pole to ensure the location would be functioning properly as soon as possible. Due to the damage being physical in nature, we will be sending an invoice for the damage…

Cam #14 WB Allesandro @ Gillman Springs, 8/3/23 (p.203):

The technician noticed that the location experienced third-party damage as all equipment has been destroyed in an apparent vehicle accident. We went ahead and replaced all equipment to ensure the location would be functioning properly as soon as possible. Due to the damage being physical in nature, we will be sending an invoice for the damage in conjunction with our reinstall fee schedule. This invoice ($1,300) will be emailed to [redacted]@riversidesheriff.org shortly.

Cam #34 NB Lyon @ Esplanade, 8/14/23 (p.207/340):

The technician noticed that the location experienced third-party damage as the solar panel is stolen and the wire to the camera was cut. We went ahead and replaced the panel to ensure the location would be functioning properly as soon as possible. Due to the damage being physical in nature, we will be sending an invoice for the damage in conjunction with our reinstall fee schedule. This invoice ($350) will be emailed to you shortly.

None of these are requests. Three of the four predate the August 2023 MSA, meaning whatever earlier agreement was in force governed them — the record doesn’t establish what that agreement said, but it’s unlikely to be meaningfully different.

None of the four emails even cite a section that applies: each points to “Section 7.1” or “Section 8.1,” neither of which covers replacement fees in the August 2023 MSA (7.1 is the contract’s term length; 8.1 is manufacturer defects, a different subject). The clause has been under at least three different numbering schemes since 2023 — the 2023 MSA, a December 2025 rewrite, and the current terms quoted above. Flock support is quoting something else.

Anyway, Flock does know how to ask first … when it wants to move the pole somewhere new, at the customer’s expense:

Cam #14, second incident, 8/16/23 (p.203):

Would you like to move forward with a relocation at this time to avoid damaged equipment reinstall fees ($1,300)? … Do you agree to pay for the relocation fee of $350 to an existing pole or $750 to Flock pole?

RCSD’s fiscal staff say they can’t reconcile what they’re billed for:

RCSD has over 250 cameras, multiple networks and planning to add another 250 this upcoming FY. With these many cameras, it is very difficult to keep track of repairs and their subsequent billing. I’ve mentioned this to Tonya Crump before, but I’d like to have notes on each invoice specifically identifying the network and specific camera name, so we know which station needs to approve the invoices and have a way to track repair costs by station over time. — Andres Martinez to George Pitt (Flock A/R), 4/7/23 (p.227)

… and things even get a little spicy over it:

Your invoice has a “Notes” section already. Would it be too much to ask that this section include the network name and camera name? (CA-Riverside Sheriff – Lake Elsinore - #21 Main @ Cross St). If you can help with this and resubmit these invoices, I’d be happy to get them all process[ed] and paid immediately. — same email

Flock’s billing side seems equally clueless about what they’re billing for:

FYI, the first invoice note mentions Los Angeles/ Long Beach but is invoiced to the RSO. — Matthew Perez (Riverside Administrative Services), forwarding invoices, 4/7/23 (p.228)

and:

The relocation invoices. I do not have the camera locations for. I cc’d Tonia Crump… Maybe she can assist with the camera location for all that I did not note. — George Pitt (Flock A/R Specialist), 6/14/23 (p.227)

Whether local procurement rules require the same kind of pre-authorization before staff can pay an invoice received outside an existing contractual arrangement is a question for a city or county attorney, not me. Public contracting rules vary too much by state and agency.

But if a fee is conditioned on an approval step that didn’t happen, and staff pay the invoice without checking for that approval, they’re relying on Flock’s invoice as their only authorization. That seems like a dicey proposition for everyone involved.

If you’re using open records requests to obtain Flock contracts from your city or county, request the procurement/purchasing policy, the full invoice history, and whatever internal authorization exists for each payment. The chaos and patterns shown in these emails suggest there may be plenty of unauthorized — or improperly authorized — Flock payments out there.

Flock Forward tickets are $350 per attendee. The event is not publicly livestreamed. As its “LPR” product receives mounting criticism, the conference is expected to focus on products like the “Perimeter Pro” security trailer, Flock911,^[1] and, undoubtedly, drones.^[2]

Flock has been under increased pressure from civil rights groups, and the company has not shied away from using increasingly aggressive language in response. Its CEO Garrett Langley has called DeFlock a “terroristic organization” that is “closer to Antifa than anything else” in an interview with Forbes. In a December email to police customers, he said Flock and police are “under coordinated attack … from the same activist groups who want to defund the police, weaken public safety, and normalize lawlessness,” and that those groups are “trying to turn a public records process into a weapon against you and against us.”

As for haveibeenflocked.com: Flock told 404Media the site “is doxxing cops during active investigations” and implied it is run by “activists trying to let murderers go free.” Flock has also tried to deplatform the site, claiming it “poses an immediate threat to public safety and exposes law enforcement officers to danger” and hosts “searchable databases that expose critical operational intelligence.”^[3]

This kind of language, where critics are painted as terrorists and watchdog sites as cop-doxxers, is especially concerning given the federal government’s actions in the past year. The recent 30-year sentence for transporting “terrorist” zines, and terrorism and RICO charges for activists opposing the construction of “Cop City” in Georgia, suggest Flock’s language goes beyond mere hyperbole.^[4]

Matt Eversmann, for his part, does not appear to have a public stance on mass surveillance (yet). In 2023, he and James Patterson did publish the pro-police book Walk the Blue Line: They Walk the Line between Life and Death. Eversmann’s booking page says he “shares lessons on leadership, courage, and responsibility, drawing from his extensive experiences to inspire and educate audiences.”^[5]

The keynote itself will show whether Flock hired him to pitch a particular product, or whether they are putting him on stage in a more general attempt at “hero washing” — to project apparent authority from a company undergoing a legitimacy crisis.

Flock is no longer just talking like it’s at war; it is putting an urban-combat veteran on the stage. While the federal government wins terrorism convictions against protesters and frames its enforcers as warriors under attack, Flock casts its own critics as an enemy force and its police customers as under siege.

Against this backdrop, a keynote from the man who led soldiers through the streets of Mogadishu pins a Bronze Star on that narrative.

If that concerns you, support haveibeenflocked.com^[6] and organize in your own city: DeFlock’s National Week of Action against ALPRs runs August 16–22, wrapped around Flock’s own Flock Forward 2026 (August 18–20, Atlanta), wherever people like you are organizing for civil liberties.

The original complaint by Thornton For All alleged 19,194 searches, based on information from haveibeenflocked.com. Thornton PD acknowledged the complaint, then set the underlying data aside:

When evaluating this third-party website data, it was clear that the issues articulated in the website’s disclaimer were significant. Instead, our audit focused on internal system records of actual usage by this officer.

haveibeenflocked.com cautions against treating its data as authoritative for several reasons:

1. Information in Flock audit logs is unreliable.
2. When logs are modified — such as through redaction — they may appear as duplicates.
3. When external (network) log information is used, not all searches for an agency may be captured.

These limitations cut in multiple directions. Redaction can multiply searches — the same search by officer “A” in one log and by officer “REDACTED” in another is counted twice. At the same time, Thornton has not published its logs, so the only searches available are those that happen to appear in network logs from other agencies. That’s likely resulting in underreporting.

The discrepancy between 19,194 and 10,318 remains unresolved, and Thornton PD has not published the reconciliation — only asserted that its internal number is the correct one.

The numbers, however, are the smaller question. The substantive issues are what Thornton For All named:

… the department’s letter does not provide an explanation for the irregular search activity that occurred outside of normal working hours. Furthermore, the response does not address the targeted, long-term surveillance of a single license plate that was tracked for up to 145 days

The response also does not appear to address nationwide location history retrievals, often covering multiple months, justified in the logs by entries such as:

“Mexico Plate” · “plate” · “Misuse” · “No record” · “Ebb813b” · “See if stolen” · “n” · “no”

The logs as published cannot support a determination that these were legitimate investigations. Whatever else Thornton PD’s audit reviewed, it was not this record.

That single license plate mentioned, YZ6717D, was tracked over nearly 6 months. Flock’s 30-day retention period is marketed as a meaningful privacy guardrail; 145 days of continuous tracking on one plate moots it entirely.

Conducting long-term warrantless surveillance while representing to the public that retention limits are a real protection is the kind of thing that damages valuable community trust.

And on that issue, the Sentinel quotes Police Chief Baird:

When unverified and inaccurate information circulates, this can negatively shape public perception and damage valuable community trust. I am sharing these findings to provide necessary detail and context, as well as to ensure ongoing public discussion is grounded in fact

We could not agree more. Disclosure of accurate, complete information is essential in building community trust.

“This officer’s dedication to public safety objectives, as well as his tenacity in locating vehicles associated with victimizing members of our Thornton community, is clearly evident,” Baird states.

That’s where we will have to disagree. It is not at all clearly evident from searches justified by “no” or “Mexico plate”.

Of course, if Chief Baird wants to make it clearly evident by publishing complete, unredacted search logs — along with the basis on which “no” or “Mexico Plate” were determined to be proper uses of the system — we would be more than happy to publish that information here.

humans@haveibeenflocked.com

Council member Brad Spanbauer had asked, on the record:

“Just to be clear, does the system create a heat map of a vehicle’s movement using the multiple aggregated images for a specific searched vehicle?”

Flock’s representative answered: “No, that is not available.”

It is available. It has a name. Flock calls it pattern of life.

What Pattern of Life is

Pattern of life is the Flock feature that turns a string of camera reads into a behavioral profile. You pick a plate. Flock plots every camera that captured it — across a jurisdiction, across a region, across the nationwide network — onto a map, with a heat map overlay that brightens where the vehicle spends its time. You toggle the window: 14 days, 30 days, longer. What comes back is the shape of a driver’s week: home, work, church, doctor, lover, gun range, union hall, rally — each node glowing in proportion to how much of a life is lived there.

It is not a theoretical capability. It is not a roadmap item. It is a marketed, shipped, demonstrated feature of FlockOS, and Flock’s own staff describe it in their own training materials.

“We do not and cannot track vehicles”

The Oshkosh denial was not one rep having a bad night. It is the company’s house talking point, repeated in its corporate marketing, its blog posts, its press statements, and the materials it feeds to elected officials considering contracts.

On a February 26, 2026 blog post titled Is Flock Mass Surveillance? Here’s What 30 Courts Decided, Flock states, in its own voice:

“Flock ALPRs do not and cannot track vehicles, much less individual people. ALPRs take a point-in-time image of the rear of vehicles on public roadways. They are incapable of tracking the whole of anyone’s movements…”

Not “do not, absent a warrant.” Not “do so only in narrow investigative contexts.” Cannot.

Now set that next to a Flock product staffer walking a customer audience through the search interface: “you can change and see 14 days of pattern of life or 30 days of pattern of life … the heat map that you know and love.”

The marketing department is contradicting the product department. A system that “cannot track vehicles” does not ship with a 30-day pattern-of-life toggle and a heat map its users already know and love. One of those sentences is the product. The other is the pitch.

Flock Webinars Confirm the Feature

From a Flock product demo of the search interface. A Flock staffer walks through the suspect drawer in the UI:

“you can change and see 14 days of pattern of life or 30 days of pattern of life. So you can, once you’ve zoomed in on your suspect, you can start to see what have they been doing? Where have they been going? And you have the heat map that you know and love, which you can toggle on and off.”

@vSearch interface with pattern of life

In another webinar, Flock explains why a user would extend a hot list’s retention window:

“you might wanna know long-term where that car has been in a week … you kind of wanna figure out what its pattern of life is.”

@vPattern of Life via Hotlist

Finally, in a Q&A on FlockOS, Flock is asked whether the system can generate “a map-based report reflecting all of the hits for a specific vehicle … a pattern of life scenario,” a Flock trainer defers to another team member, then reads the answer:

“FlockOS allows you to see the historical locations of a specific vehicle, including a map-based view and heat map as part of license plate search.”

@vFlockOS Pattern of Life

Each Flock employee in these three webinars references “the heat map that you know and love” — the same feature Flock told Oshkosh’s council didn’t exist.

Beyond Oshkosh

Oshkosh is the first council we know of to catch Flock in a lie on the record and actually act on it by reversing a vote because of it. It wasn’t the first council to be told a lie, nor will it be the last. It was the first to so publicly call a spade a spade — a move that makes me feel some Midwestern pride. Three things follow for everyone else.

First, every jurisdiction that approved a Flock contract based on sales representations should re-interrogate those representations. The problem isn’t confined to one rep in one Wisconsin council chamber. Flock’s corporate marketing tells the public the system “cannot” track vehicles. Its trainers tell paying customers how to track vehicles for thirty days at a time. If a council relied on the former to approve a contract, it bought the latter. Pull the minutes. Pull the recordings. Ask the chief what he was shown in the back office that was not shown at the dais.

Second, Flock’s public response — that its statements were “misinterpreted and weaponized by activists” — is not a denial. It’s a complaint that someone noticed. The chief did not misinterpret anything. He said he “visually confirmed” the heat maps the next morning. It’s Flock’s canned repsonse to claims it doesn’t like but can’t refute: “these are just false”.

Finally, “pattern of life” is what makes Flock Flock. A single camera that reads a plate and checks it against a list of stolen vehicles is a tool — a narrow one, with narrow uses. A network of hundreds of thousands of cameras aggregating every read on every plate into a queryable history of where a driver has been, brightened into a heat map, is something categorically different.

The cameras are the sensor — Flock owns these, and its customers don’t care. The pattern-of-life database is the product actually sold to police departments. It’s why the cameras exist, and why the feature is built, taught, and demoed.

An “ALPR camera lease” may be the easier sell for its reps, but it’s not a product Flock offers.

The Language

Flock did not invent the phrase “pattern of life.” It is a counterterrorism and military-intelligence term of art for building a behavioral template of a target by tracking their movements over time. Flock markets counterinsurgency tooling to local police departments because it sells.

When that product is pointed at every driver on an American road — and the company’s sales staff then tells elected officials it does no such thing — “misinterpreted” is not the word for what happened in Oshkosh.

Almost two months ago, I titled a section “Flock Promises More Violations.” It has now made good on that promise. Back then, I wrote:

the gradual narrowing is interesting to watch. In a span of weeks, Flock’s messaging shifted from “Flock does not sell data,” to “Flock does not sell data to the federal government” to “Flock does not sell data to DHS agencies.”

Federal agencies have been appearing more in audit logs, tagged with [Federal]. Flock has added a toggle to its product to grant/deny federal access to data.^[1] These have largely been federal prisons, and parks like the Presidio of San Francisco.

Now, the FBI has direct access.^[2]

Flock will keep insisting that licensing data isn’t selling data. The distinction matters to surveilled citizens about as much as Netflix’s licensing model matters to a movie studio — and the studio, at least, sets the terms.

Contractually, Flock is not prohibited from granting the feds access. For that matter, it’s not prohibited from granting anyone access. Numerous private corporations and universities have access to what Flock markets as a “law enforcement only” network, and entire police departments are regularly granted access without a contract.^[3]

But communities that were sold the system by Flock and their local PD on the promise that the feds did not have access to the data now have a system deployed that does grant direct, federated access to the FBI and other federal agencies.

It’s what those cities signed up for. Flock manages access to the network. Not the city. Not the PD.

If you want to know if your city grants access to the FBI, you will have to file an open records request. It is unclear at this time whether the “federal access” configuration switch is separate from the “shared networks” file — the configuration that governs which outside agencies can query a department’s cameras (reach out if you know).

Police departments generally don’t inform elected officials or the public when they enable a software toggle—even when it comes with constitutional and liability implications. They certainly don’t seek the public’s approval before subjecting it to federal mass surveillance.

Via IPVM and KSHB

• Traffic Infraction
• City Planning/Traffic Analysis - test
• Welfare Check
• Larceny/Theft Offenses - Unauthorized use of a vehicle

VIPD appeared in recently imported log files. It’s not uncommon for new agencies to show up, but this may be the first instance of an agency outside the continental US we’ve seen. It raises some interesting questions. First and foremost: why?

It’s always been highly questionable for an agency in, say, Washington to claim that it has any legitimate purpose for querying data from Florida. The Virgin Islands being, well, islands, takes it from “questionable” to “downright ridiculous.”

At least someone in Washington could steal a car or run a red light and flee to Florida. In fact, I’d put money on at least a handful of people having done that or something similar. Is it likely? No. Is it possible? Sure, I guess.

But the argument here would be that someone stole a car in the Virgin Islands, left the plates on, shipped it to the mainland via commercial freight — which presumably checks VINs — and then drove it around Rogers, Arkansas. You couldn’t get that fiction published in a creative writing course.

It’s another instance of Disproportionate by Default.

This is also a department operating under an active Department of Justice consent decree for unconstitutional policing practices.^[1] The combination — a department with documented civil rights problems, plugged into a nationwide surveillance network, running searches with no apparent investigative nexus — is exactly the scenario that audit requirements are supposed to catch.

Flock’s contractual standard limits use to “legitimate public safety and/or business purpose[s]” — a bar so low it’s practically subterranean. And VIPD still managed to limbo under it.

VIPD’s searches were visible to Flock and every network they queried. Each of those 5,000+ receiving agencies claims to audit its incoming queries. Every one of them should have flagged a Caribbean police department searching for traffic infractions on the mainland. None did.

The department didn’t discover this. Citizens did—by reading audit logs that haveibeenflocked.com published, finding patterns that fourteen months of agency oversight had missed, and reporting them.

@Joplin, MO Statement

Today, 404 Media ran an article about this site and Flock’s takedown attempts. The reporting is accurate. But both 404 Media and the EFF frame unredacted license plates as “leaked” or “missed redactions.”

They’re wrong. The plates are the point.

The legal reality

Flock’s entire business model depends on license plates being unprotected information. If plates were regulated like SSNs or medical records, Flock couldn’t operate—collection would require warrants, sharing would require consent, and the nationwide dragnet would be illegal.

Flock chose this legal regime. They benefit from it every time a camera captures a plate without a warrant, every time that data flows to thousands of agencies without restriction, every time a cop searches the network without probable cause.

But that same legal framework means audit logs are public records.

As I’ve documented, agencies have no lawful basis for redacting plates precisely because plates aren’t protected information. You can’t claim data is too sensitive for public records while simultaneously arguing it’s not sensitive enough to require a warrant.

Flock wants regulatory immunity and operational secrecy. That’s not a coherent legal position—it’s lobbying.

This legal vacuum enables the abuse we’ve seen in Georgia, Kansas, Colorado, and now Joplin. It also makes unredacted audit logs the only functional check on that abuse.

Where I part with the EFF

The EFF has done—and continues to do—important work. But on this, we disagree.

Their position treats plate exposure as a privacy harm to be minimized. Mine treats it as the precondition for accountability. As long as Flock can collect this information without restriction, the public must be able to see how it’s used—including who searched whom, and when.

Redacting audit logs doesn’t protect the surveilled. It protects the surveillers.

As long as Flock can have the information, you should too.

“License Plate Reader Company Flock Said It Does Not Use Dark Web Data. My Analysis of Their Code Tells a Different Story”

(If the site doesn’t work well for you, try your browser’s “reader” mode)

Flock made a public statement on May 30, 2025. It is still on their website, titled “Correcting the Record: Flock Nova Will Not Supply Dark Web Data.” In it, the company wrote:

Following the lengthy, intentional process described above, we have decided that Flock Nova will supply the following data sources: public records information, Open-Source Intelligence (OSINT), and License Plate Reader (LPR) data. The Flock Nova tool can also enable agencies to connect their Records Management Systems (RMS), Computer-Aided Dispatch (CAD), and data from jail systems, as well as all of the above from other agencies who agree to share that data.

The policy decision was also made that Flock will not supply dark web data. This means that Nova will not supply any data purchased from known data breaches or stolen data.

Joshua now writes that:

The Nova codebase suggests a very different story. Nova’s front end defines, fetches, stores, and displays a data source explicitly named Dark Data, with selectors for extremely sensitive identifiers like Social Security Numbers, credit card numbers, crypto wallets, IP addresses, usernames, and more.

How much more will it take to finally get our elected officials to hold police and Flock accountable for betraying the public’s trust?

Read the full article on Nexanet.ai.

To be clear, as this type of “click this link” article is unusual for this website: this is not a paid or a promotional/affiliate link, and haveibeenflocked.com is in no way affiliated with Nexanet.

Needless to say, I took issue with what amounts to retaliation—denying access to public records—for protected First Amendment activity on this website.

So I changed the User-Agent (the string that identifies your browser to websites) for our importer from "HaveIBeenFlocked/1.0 (Transparency Portal Archival)" to "Privately-owned Tool Archiving Public Records for Non-Commercial Purposes to Support the Exercise of Protected First Amendment Rights".

You know, so we’re all on the same page.

Flock didn’t appreciate the circumvention. Its response: ban all VPN users.

Viewing public records about government surveillance now requires disclosing your identity to that government’s surveillance vendor. The portals exist to let citizens see who’s being tracked in their community. Flock has made accessing them contingent on being trackable yourself.

This isn’t a policy choice made through democratic process. When legislators have proposed VPN bans—even narrow ones targeting age verification—they’ve faced immediate constitutional challenges.^[1] Flock skipped that step. It simply implemented the restriction on government records it hosts.

The company talks constantly about transparency and local control. It might start by accounting for the 90% of California logs that have vanished—an analysis only possible through data from these same portals.