These Are Just False

On February 18, 2026, Flock Safety’s policy and compliance manager, Amy Palumbo, joined paying customers on a webinar Flock titled Public Safety Technology Policy, Compliance, and Legislative Updates. The first item on the agenda was what Palumbo described as “the media reports that have been going on for the last few months.” Her opening was categorical.

#False Claims and Fundamental Changes

The claim that Flock enabled backdoor access to customer data and other claims that have been in the media — these are just false. All of the sharing that happens in the Flock system happens through permissions in the system controlled by you and your admins. It’s your data. Contractually, you control it. Flock does not own it, does not share it, does not sell your data.

The facts Palumbo called false are well-documented on this site, as well as on Flock’s blog.

A CBP pilot ran May 9 through August 24, 2025, during the same summer in which Flock CEO Garrett Langley published a blog post titled Setting the Record Straight, where he denied federal cooperation — “not my decision, and not Flock’s decision,” he wrote — while that pilot was live.

A January 2026 Flock blog post repeated that “ICE does not have direct access to Flock cameras, systems, or data” while, in the same post, listing the CBP pilot as an arrangement that “effectively enabl[ed prospective customers] to test the product before committing.”

Throughout all of this, audit logs continued to show searches by federal agencies, while agencies like Mountain View, CA, said federal sharing was enabled without their consent.

The only time Flock accesses customer data, Palumbo went on, is to respond to “legal process” — a subpoena, a search warrant, a court order — and the customer is notified when that happens.

She made that statement around the same time Flock employees were, according to Flock, using a gymnastics room, a pool, and a daycare in Dunwoody for a sales demo. A practice Flock says it intends to continue, but “in more public locations.”

Such contradictions are routine at this point. Less than ninety seconds may be a record. Right after the “just false” line:

So where is the misinformation in the media coming from about backdoor access? It’s a misunderstanding about some of our previous pilot programs and sharing within the system. So over the summer, as these issues came to light about access from federal partners who were pilot customers, we made a lot of changes to the system in response to some of that feedback.

From “no backdoor” to a “misunderstanding” about “previous pilot programs.” A pilot program that gave access to federal agencies. Without other agencies knowing about it. If there is a falsehood anywhere, Palumbo does not mention any details.

Palumbo may dislike “backdoor” as a label, but she can’t deny the architecture it describes. Federal agencies, including immigration agencies, hooked into Flock’s sharing apparatus running searches against cameras across the country, including in states like California which restrict such use of surveillance networks.

Either way, you do not appoint a chief legal officer, expand your policy team, stand up new trust and safety programs, and create a dedicated compliance product-manager role to fix a media narrative that is false. You respond to reporters asking for comment and attach a receipt or two.

#No FOIA, No Problem

Palumbo goes on a bit to encourage the, presumably, Wisconsin-based audience to apply “a balancing test” when “facing public records requests.” The information agencies are allowing Flock to collect can lead to stalking and could be misused — according to Palumbo. The dangers of releasing this information — to the public; not to Flock, its contractors, its customers, or its pilot programs, of course — can’t be overstated (when it comes to public records requests).

The next speaker was Ashley Haber. She delivered the list of “changes to the system in response” to the supposedly false information.

Last summer, we made a change so that federal organizations at Flock are handled a bit differently than a typical state or local law enforcement agency. They are properly called out throughout the system with a label that says federal organization. They also are not included in statewide or national lookup…

Which is to say: before the summer of 2025, federal organizations were indistinguishable from local police departments in Flock’s search and sharing interface. A query run from a federal account reached every shared camera within the network’s scope, state by state, without the querying agency being explicitly flagged as federal in the audit. There was no statewide-lookup exclusion. There was no opt-out, beyond the “all or nothing” of the state- or nationwide network.

There is more.

We did a lot of work last year on cleaning up network and org audits to both be more useful for you all and also protect you all as these PRAs and FOIAs were becoming more popular and they were risking officer safety and active case investigations falling apart.

We cleaned up what we call system-generated searches so that there was not an excessive amount of records here. If someone opened a drawer, zoomed in on the map, technically on our back end it may have created another search record but it really wasn’t a user generated action… we also added the functionality starting August 8th of last year… you’re able to see if your cameras produced any results from lookup searches… the last piece is we masked certain sensitive data in response to what happened close to end of last year to protect interagency sharing.

“What happened close to end of last year” may refer to the December emails from the FBI and Flock in response to logs appearing on haveibeenflocked.com.

“Mask certain sensitive data” is the network-audit redaction feature that strips officer names, agency identifiers, plates, filters, and case numbers from the logs agencies are supposed to review for improper access.

The non-hit-search filter, added in August, lets an agency exclude queries that did not produce a plate match — and, by extension, lets them view which queries did produce a match.

So far, no agency has included this information on whether there was a hit in a network audit log. That information is not categorically exempt from open records laws, and requesters generally ask for complete logs, not ones with partial information.

“System-generated searches,” per Haber, are now filtered from the audit “to avoid confusion and too much noise,” directly contradicting Flock’s public narrative of “every search is logged.” Flock decides what is logged and what is “noise” or “confusing,” based on undisclosed and likely fluid criteria.

And finally, she discusses the “filter” that handles immigration and reproductive health searches in states that prohibit such searches.

The last bullet point on her slide informs the audience that details will remain a secret, “in order to protect the effectiveness of this feature.” Maybe Flock thinks a user of the system couldn’t figure out, without a Flock-published list, that writing ‘suspicious vehicle’ in the reason field defeats the filter.

Or maybe publishing the list would remove their ability to lie about how long they’ve been filtering any particular term. One of those explanations seems much more likely than the other.

#Flock’s Solutions

Addressing false claims is easy: you correct them. Flock holds all the information and all the evidence; it has a PR team and a blog. It knows when filters went into effect and how many searches are being filtered. It’s not that hard to rebut false claims and build trust through transparency.

But if the claims happen to be true, you may have to roll out several audit-obstruction features, a bevy of new filters, and restructure your entire compliance organization.

Flock’s response is telling.