Come on in, the side door is open!

In May 2026, Flock published the results of its “2025 Impact Census”, a survey of about 700 of its law enforcement customers. The analysis is a blog post where the top line result needs to call 42% “nearly half” to seem meaningful.^[1] One paragraph still stood out:

We also found that more than 3 out of 4 Flock agencies assist neighboring departments at least monthly, with 1 in 5 doing so daily, extending the technology’s reach well beyond our own customer base.

This is side-door access: an agency with Flock logins runs searches for one without.

#The side door

Flock’s website promises oversight: transparency portals list which agencies data is shared with, every search is logged, and data is shared only with approval. None of it matters when someone can pick up the phone, or type in a password, and use another agency’s login.

The side door also compounds. An agency that shares its cameras with a trusted partner also shares them with everyone that partner will run searches for. ICE has no Flock contract; 404 Media documented local police running plate lookups for it anyway. Cleveland let outside departments search its camera network, and audit logs showed nearly 2,000 immigration-related searches through that network in 2025, before the city blocked such searches in November. The logs don’t show whether federal officers asked for those lookups.

#What that looks like in Iowa City

Iowa City, where I live, has banned police ALPRs since 2013. The University of Iowa Police Department (UIPD) is not subject to the ban; 29 Flock cameras are on university property across the city. UIPD’s log files suggest the Iowa City Police Department (ICPD) regularly runs queries through UIPD’s account, bypassing the ban. Some example UIPD search reasons: “Drugs/Narcotics - IC14 Narcotics Inv”, “Welfare Check - ICPD SUICIDE/LAW REF ATL”, “Motor Vehicle Theft/Stolen - ICPD STOLEN VEHICLE”.

The UIPD logs do not say who at ICPD requested a lookup, or whether any investigation was open. The University of Iowa couldn’t say either, if it tried to audit its own users. Flock’s promise that every query is logged is technically fulfilled and practically broken.

And this is the best case: UIPD at least recorded which agency it was searching on behalf of and under which offense category. Thousands of searches record only “assist”, or worse, “inv”.

This is what “local control,” “accountability,” and “data ownership” look like in practice: unnamed third parties with no Flock contract run queries through your local police department, with no adequate logging and no oversight. The official policy, meanwhile, presents unique logins and user authorizations as meaningful safeguards: they don’t apply to outside requesters.

These are the best guardrails Flock can offer. By Flock’s own count, more than three out of four surveyed customers step around them at least monthly, and one in five does so daily.