Flock Writes Its Own ALPR Rulebook After Stalking Reports

TL;DR: Flock Safety announced on August 13, 2026 that it is cutting default license-plate-reader retention from 30 days to 7, requiring a case code on every police search by year-end, making its Audit Assistance tool mandatory with an automatic lockout, and promising a summary of a security review it commissioned itself. No regulator ordered it. The ACLU called it a “thinly veiled PR attempt.”

What Flock Changed

The centerpiece is retention. Flock wrote: “Today, we are updating our recommendation and default to a 7-day retention, and introducing ‘Evidence Mode.’” The default it set nine years earlier was 30 days, and the new one is still a company setting rather than a legal cap: state or local policy can run longer or shorter ^[1]. It also governs new configurations rather than sweeping the network, because Flock said existing customers “will keep their current, democratically approved retention periods” ^[1]. Evidence Mode preserves data tied to active investigations beyond the standard window ^[1]^[6].

The justification is Flock’s own search data: “Our analysis shows that over 90% of searches without a full plate are done within a week.” ^[1] That measures a subset, the searches run without a complete plate, and it is an internal count rather than an audited figure.

The rest lands by year-end. Case codes become mandatory on all law-enforcement searches ^[1]^[2]^[6]. So does Audit Assistance, a tool that flags abnormal search activity and can automatically suspend a user’s access through a proactive lockout, which ABC News reported had previously been taken up by about one-third of customers ^[1]^[2]. Cities also gain a control over each other, which Al Jazeera described this way: “Cities can choose which type of offences are permissible for other agencies to access their cameras.” ^[6] A city could allow stolen-vehicle or missing-person searches while blocking immigration-related ones, an opt-in setting configured city by city ^[1]^[2].

On security, Flock said: “At the beginning of this month, we also made multi-factor authentication (MFA) mandatory for anyone logging into Flock.” It also said: “This year we retained Bishop Fox, a leading independent security firm, to conduct a thorough review of our products and capabilities.” What it committed to release is narrower than the review itself: “We will publish its summary of findings and our remediations in September.” A new Coordinated Vulnerability Disclosure program launches alongside it ^[1].

The Reporting Behind the Announcement

ABC News relayed the reporting behind the announcement: “Last week, The Washington Post reported that at least 50 officers had been accused, charged or convicted of using Flock’s system and other license-plate readers to spy on the unsuspecting”. ABC said the targets were often girlfriends or former partners, and that the Post confirmed more than a dozen additional cases after publication ^[2]. That count spans Flock and other plate-reader vendors, not Flock alone ^[2].

Al Jazeera, relaying the same Post investigation, carried a narrower count: “at least 46 law enforcement officers across the US have been accused of using the license-plate cameras for unauthorised tracking, including to stalk wives, girlfriends and exes” ^[6]. Both counts trace back to the same Washington Post reporting at different scopes, one spanning multiple vendors and one limited to Flock’s cameras. They are not the same measurement and are not additive. Al Jazeera also put the network at some 120,000 cameras across the United States ^[6], the scale at which a default becomes national policy.

The pattern is not new here. Prior coverage documented police chiefs using Flock to track ex-partners ^[7], and the wider record sits in the Flock and ALPR surveillance hub ^[12]. What is new is the actor: earlier stories were single cities and departments, a council vote in Norman, Oklahoma ^[9], cameras removed in Verona, Wisconsin ^[10], an audit of one department’s stop data in Los Angeles ^[8], a competitor launching a Flock replacement ^[11]. This time the vendor rewrote the rules for every customer at once, which MIT Technology Review framed as a response to a growing surveillance backlash ^[5].

Who Verifies the Case Code

Every control here is defined, operated and graded by the company selling the cameras. A case code is typed in by the officer running the search, and neither Flock’s announcement nor the reporting on it describes any check that the code is accurate at the point of entry ^[1]^[2]. An officer who wants to look up a former partner now needs a code, not a reason.

The backstop for that is Audit Assistance, Flock’s own product running on Flock’s own definition of abnormal ^[1]^[2]. The backstop for the product is the Bishop Fox review, which Flock retained, and what reaches the public is a summary of its findings plus Flock’s own account of what it fixed ^[1]. The public layer is the portal: “More than 1,500 agencies have published a Flock Transparency Portal.” ^[1] That counts agencies that chose to publish, not agencies that use the cameras.

The Numbers Flock Published

The announcement also carried the company’s case, addressed to its police customers: “Today, Flock technology assists your officers in more than one million crimes solved annually.” And: “In July alone, with your help, we detected over 1,000 missing people and over 20,000 stolen cars.” Those are two different measurements over two different periods. On accuracy: “This combined system of safeguards results in fewer than 9 human-reported errors for every 1 million alerts.” That is self-reported, counted from human-reported errors against alerts, not an audited false-positive rate ^[1].

Chief executive Garrett Langley put it more plainly in an interview with Bloomberg: “We’re not Big Brother,” he said, and separately, “We’re focused on protecting people.” ^[3]

What Civil-Liberties Groups Said

The ACLU said the changes “seem to be a thinly veiled PR attempt to counter communities’ genuine privacy concerns with its mass surveillance system with largely hollow security promises, rather than an earnest effort to address them” ^[4]. On whether the product can be fixed, the organization’s senior policy counsel Chad Marlow said that “transforming an exceptionally dangerous mass surveillance system into one that is fully protective of civil rights and civil liberties is a difficult, if not impossible task” ^[4].

Tom Bowman, policy counsel at the Center for Democracy & Technology, told ABC News: “While this measure contains some meaningful improvements, such as the shortened retention policy, ultimately it is the same ‘Just Trust Us’ policy with a fresh coat of paint.” ^[2]

ABC News, quoting Langley’s blog post, reported that he wrote: “These changes reflect years of work and deliberation. They are not the end of that work, but simply the continuation of our commitment to both safety and privacy.” ^[2]

What to Watch

Whether the Bishop Fox findings appear in September. Flock retained the firm and set the date itself ^[1]. How much of the report is published is the first test of whether the review is an audit or an endorsement.

Whether case codes get verified, not just required. The requirement lands by year-end, and the code is entered by the officer running the search ^[1]^[2]. Any check on accuracy at entry would go beyond what was announced.

Whether cities use the offense-type restriction. The control that lets a city block categories of searches by partner agencies, including immigration-related ones, is opt-in ^[1]^[2]^[6]. Until councils switch it on, nothing changes.