Feature: Mismatch Highlighting in Search Results
Audit log entries that disagree with their duplicates are now flagged directly in search results, reports, and license-plate lookups.
Audit log entries that participate in a mismatch are now flagged wherever they appear — text search, the record reports, and the home license-plate lookup.
#What is being flagged
Flock’s “tamperproof” audit logs contain groups of entries that describe the same search yet disagree on other fields. Entries are grouped when they share the same search time, to the second, and the same license plate.[1]
Where no plate is available — including entries whose plate is redacted — entries are grouped by the searching agency together with the search’s network count, device count, and time window. These conflicting groups have, until now, only been shown in the Irregular Records report.
Any entry belonging to such a group is now marked with a mismatch badge. The fields that differ from the group’s other members are highlighted in the row, and the full list of differing fields is shown when the entry is expanded.
Changing logs are further documented in The More the Logs Change, the More the Oversight Stays the Same.
#Details
- Every member of a conflicting group is flagged, not only the first record in the group.
- A field is counted as a disagreement only where two entries hold different, non-empty values. A field that is blank or redacted in one entry — shown as
***orREDACTED— is treated as redaction, not as a mismatch. - Only the names of the differing fields are shown. The conflicting values held by other records in the group are not exposed; those remain available in the Irregular Records report.
- Other known false positives are excluded before an entry is flagged. Abbreviated operator names, October date-format variants, scientific-notation reason codes, and zero device counts are not treated as mismatches.
- The mismatch data is refreshed nightly. Entries added since the last refresh may not yet be flagged.
We have also seen instances of what appears to be the same search logged at different times, varying by export. These are not currently flagged — distinguishing them is too resource intensive. ↩︎