🦅 Flock Safety in 2026 — Documented Abuses & Legal Fight-Back

What Flock Safety actually is in 2026

Flock is no longer just an ALPR company. In three years it has stacked five product lines into a single connected surveillance stack, and understanding what each does is the prerequisite to understanding the fight over it.

• Falcon / Sparrow LPR cameras. Solar-powered, LTE-connected pole units that photograph every passing vehicle, run OCR on the plate, and log plate + timestamp + location + a "Vehicle Signature" (make, model, color, roof racks, bumper stickers, damage). Independent teardown of a typical unit describes a small black rectangular box, roughly nine inches long, mounted eight to twelve feet up on an existing utility or light pole (State of Surveillance).
• Condor PTZ cameras. Pan–tilt–zoom cameras marketed alongside the LPRs. Per the Wikipedia article's current revision, they can automatically zoom in on people's faces as they walk by (Flock claims manual control only).
• Raven audio detection. Pole-mounted microphones marketed as gunshot detection with the slogan "Safety you can see and now hear." In October 2025 Flock added "human distress" detection, initially advertised with a screenshot of a police alert for "screaming." After EFF criticism, the ad copy was quietly changed from "screaming" to "distress" but the capability remains. Flock claims Raven holds no more than 50 seconds of rolling audio at a time.
• Alpha drones (Drone as First Responder). Docked drones deployable to the coordinates of a 911 call, an LPR hit, or a Raven alert. Alpha reads license plates from up to 2,000 feet away and streams HD/thermal/night-vision video. Powered by Aerodome software, which Flock acquired in October 2024.
• Bravo edge-AI compute box. Local compute unit that runs classification and event correlation on-device.

• FlockOS. A real-time crime-center-style hub that unifies LPR, video, drones, gunshot detection, CAD, and RMS into a single searchable interface.
• Nova. The investigative platform. As originally announced in May 2025, Nova would combine Flock data with data from breaches, public records, and commercially available data to build searchable profiles of individuals — a product the EFF called "a dystopian panopticon". After 404 Media reporting, Flock said it would remove breach data from Nova, but the platform still ingests OSINT, credit information, and other commercial datasets alongside its own vehicle records.
• Flock's own scale. Company-stated 12,000+ clients including 5,000+ law-enforcement agencies, 1,000+ businesses, and numerous HOAs. Total funding stands at roughly $1.2 billion at a $7.5 billion valuation as of a September 2025 raise. Independent estimates place deployed U.S. ALPR cameras at 75,000–100,000. Flock claims to process on the order of 20 billion license-plate scans per month.

Timeline: how the 2025-2026 backlash actually built

Documented abuses (with citations)

These are not hypothetical harms. Each is a specific case documented in court filings, government audits, or reporting corroborated by public records.

• An Oregon city found federal immigration agents searched its Flock database 279 times in three weeks during a pilot (Rural Privacy Coalition).
• Dayton, Ohio: an audit found the city's Flock cameras had been searched 7,100+ times for immigration-enforcement purposes in violation of city policy. Dayton then physically covered the cameras with black trash bags while the review continued (State of Surveillance).
• The University of Washington Center for Human Rights found at least eight Washington law-enforcement agencies allowed reader networks to be shared with U.S. Border Patrol in 2025 — a finding that helped drive SB 6002.
• San Francisco Chronicle: SFPD's Flock data was searched from out of state more than 1.6 million times over seven months, per a filing in the class action (Gibbs Mura).
• California Attorney General Rob Bonta sued the City of El Cajon in October 2025 for systematically sharing Flock ALPR data with out-of-state agencies in violation of state law.

• Sedgwick, KS 2023: police chief Lee Nygaard resigned after using Flock cameras to track his ex-girlfriend and her new boyfriend 200+ times over several months.
• Jerome County, ID 2025: Sheriff George Oppedyk searched his wife's vehicle 700+ times in three months, labeling each search "test," before retiring.
• Milwaukee, WI 2025: Officer Josue Ayala allegedly tracked a woman he was dating and her ex ~180 times in two months.
• Braselton, GA Nov 2025: police chief arrested following GBI audit-log review — after the abuse.
• Joplin, MO: a single officer ran one woman's plate nearly 400 times, entering generic reasons like "DWI" or "Warrants" with no case numbers.
• Prairie Grove / Holiday Hills, IL June 2026: officer/chief William C. Copp charged with two counts of official misconduct after using Flock to track six people he knew personally, three of them former partners (IPVM).
• Cherokee County, GA May 2026: proactive audit turned up three officers using Flock for non–law-enforcement purposes in one week (IPVM).

• Protests. EFF's analysis of ~12M Flock searches from 3,900+ agencies between December 2024 and October 2025 identified hundreds of searches explicitly tied to the 50501 protests (February), Hands Off (April), and No Kings (June and October). Roughly 20% of all reviewed searches listed only "investigation," "suspect," or "query" — cover language that could conceal protest, abortion, or stalking searches.
• Abortion. The Johnson County TX 83,345-camera search noted above is the definitive documented case; it hit states where abortion is protected by law.
• Roma targeting. EFF's audit-log analysis found search queries that used slurs to target ethnic Roma populations.
• Mission creep. Buford City Schools (GA), serving ~6,000 students, ran 375+ Flock searches for school-district residency verification between January 2025 and March 2026 (EFF).

• The ACLU notes roughly 1 in 10 reads misidentifies the plate's issuing state and that under 1% of ALPR scans connect to an actual crime.
• Documented cases include a Colorado officer who wrongly accused a woman of theft based on a Flock hit and refused to look at exculpatory evidence, and a mother and children held at gunpoint after a plate was misread as stolen.

The legal landscape is shifting fast

Signed March 30, 2026 by Governor Bob Ferguson, SB 6002 is the country's first comprehensive statewide ALPR law and the template that Colorado (SB 26-070) and Minnesota (HF 4205) are copying. The key provisions:

• Norfolk, VA (Institute for Justice v. City of Norfolk). A federal district court granted summary judgment for the city in January 2026; the Fourth Circuit appeal was argued in the spring with the ACLU, EFF, Cato, and EPIC filing on IJ's side. The state amici brief that leaned on United States v. Chatrie was undermined when SCOTUS vacated that decision on June 29, 2026.
• San Jose, CA. Two suits: an EFF/IJ-backed state-constitution case (fall 2025) and a federal Fourth Amendment class action (April 16, 2026) targeting the city's 470+ Flock cameras.
• Los Angeles. Stop LAPD Spying Coalition sued LAPD in May 2026 to force disclosure of contracts and MOUs; LAPD had produced a single expired 2025 memo despite what activists say is a seven-year Flock relationship.
• El Cajon, CA. California AG Rob Bonta sued the city in October 2025 over illegal out-of-state ALPR sharing.
• Flock Safety directly. Gibbs Mura's amended class action was filed against Flock on April 3, 2026 for allegedly using its ALPR cameras to track millions of Californians and share data with out-of-state law enforcement in violation of California privacy law.
• Berkeley (contemplated). Brian Hofer of Secure Justice was prepared to sue over surveillance-ordinance violations enabled by Flock; the city pulled its expansion, mooting the immediate suit but not the underlying issue.

Cited direct from Flock's LPR Policy, Flock Evidence Policy, and Privacy & Ethics pages, all last verified July 2026:

• Default 30-day rolling retention; hard-deleted after that unless local law requires a different schedule. Up to a one-year extension is available if the agency's elected officials approve it in public.
• Flock characterizes customers as owners/controllers of data; Flock casts itself as processor/service provider.
• Every search is logged with user identity — but audits are optional and only surface abuse when a supervisor or third party actually looks. IPVM: in Cherokee County GA, one week of proactive review tripled the number of officers under discipline.

What you can legally, ethically do

The cameras track vehicles on public roads, which under prevailing case law and the third-party doctrine limits the personal countermeasures available. Community and legal action have canceled 82+ contracts; personal countermeasures have canceled zero. The list below is ordered from highest to lowest actual leverage.

On the physical side, a typical Flock camera is a small black rectangular box, roughly nine inches long, mounted eight to twelve feet up on an existing utility or light pole, often with a small solar panel on top and no visible cabling because the units run on LTE. They are commonly placed at town entrances, main intersections, school zones, and increasingly on private property (Home Depot and Lowe's parking-lot entrances, HOAs, business districts).

Public-records requests are the single most productive lever in the entire fight. Cities like Mountain View, El Cerrito, and Coralville canceled contracts specifically after residents obtained audit logs. Here is the standard request pattern, sourced from the Rural Privacy Coalition's cleaned-up version of a working request:

1. Ask for the Organization Audit from Flock's Insights tab — every search made by your agency inside its own network.
2. Ask for the Network Audit — every search made of your agency's cameras by any other agency in the Flock system, including all search terms and the searching-agency name.
3. Ask for the network share settings: with whom is your city sharing? Is National Lookup enabled? Which NCIC hot-lists are turned on — specifically Immigration Violator?
4. Ask for the contract, any MOUs, and the written use policy governing Flock (if one exists — many agencies operate without one).
5. Ask for images of your own vehicle and any searches performed against your plate. This has the strongest legal footing because it is your own data.
6. Request expedited processing — Flock hard-deletes at day 30, so late responses moot the request.

The ACLU (Get the Flock Out), ACLU of Massachusetts, Rural Privacy Coalition, and Fight for the Future all publish full letter templates and model ordinances.

Flock refuses individual deletion requests by claiming processor/service-provider status and redirecting to "the organization that engaged Flock Safety's services." A California resident tested this in April 2026; the reply is now widely quoted. There are two practical follow-ups:

• Direct the request to your local law-enforcement agency — the ACLU-WA and Have I Been Flocked argue this is the data controller in most jurisdictions and therefore the correct target under CCPA/CPRA (California), CPA (Colorado), CTDPA (Connecticut), VCDPA (Virginia), UCPA (Utah), MCDPA (Minnesota), and similar state laws.
• The government-entity exemption is real. Most CDPAs exempt state and local government bodies from their scope, which is a real legal wall. Where that wall applies, the remedy is legislative (SB 6002-style statute) or constitutional (San Jose, Norfolk-type litigation), not a data-subject request.

Every canceled Flock contract in 2025-2026 came out of local politics, not federal action. If your city has Flock, the contract has a renewal date — that is your window. Basic tactics that have worked:

• Get on the public-comment list before contract-renewal or oversight-committee agenda items.
• Bring the actual audit logs from your records request; abstract concern loses, "here is what your officers searched" wins.
• Ask specifically whether National Lookup and the NCIC "Immigration Violator" hot-list are enabled. EFF documents this as the single simplest policy fix — "uncheck the box" — while noting it does not dismantle the underlying infrastructure.
• Point to peer cities: Mountain View, Santa Cruz, South Pasadena, El Cerrito, Bandera, Bend, Denver (unanimous rejection), Evanston, Coralville, Lane/Eugene/Springfield sheriffs, Los Altos Hills, Braselton. GovTech's 82-in-28-states number is now the standard comparison.
• Push for a surveillance-oversight ordinance if the city does not already have one — Berkeley's is a model, and it was Berkeley's own ordinance that gave civil-liberties attorneys standing to force the pull-back.

ALPRs collect one channel — where and when your vehicle was seen. That data is only powerful in combination with other feeds. The rest of the picture is where individual OPSEC actually returns leverage. See our OPSEC guide for the full treatment; specifically for the vehicle case:

• Phone location. Locate X, Google Location History, ad-ID data, and other tracker feeds can produce trip data even when the car itself is not on a road with cameras. If the concern is aggregate movement tracking, the phone is often the bigger channel.
• Toll and telematics. E-ZPass, SunPass, connected-car telematics, and dealer black-box data are the other place your vehicle's movements are logged.
• Ring/Nest/private cameras. These do not always feed ALPR, but Flock's brief partnership with Ring, its "Neighbor" and business-camera products, and Amazon's request-for-assistance system through Axon mean private-camera footage can enter the same pipeline. See our Ring & Sidewalk OPSEC guide.
• Data brokers. A plate is only useful if it can be tied to you. Removing your address, phone, and vehicle information from people-search sites reduces the joinability of any ALPR hit against your identity. Automated removal services can save the 15–20 hours a full manual opt-out costs.

• Suspected officer stalking through Flock. File with the agency's internal affairs and your state attorney general. In some states (WI, GA, IL, ID) this has produced criminal charges. Contemporaneous records help — screenshots of what you noticed and when.
• Illegal out-of-state or federal sharing (California). California AG Rob Bonta's office is the operative venue; Bonta's El Cajon suit is the template.
• National-scope patterns / systemic misuse. EFF's aos@eff.org is actively collecting records people receive back from these requests.

What is not a legal option

A steady drumbeat of ads pushes IR-absorbing plate coatings, reflective covers, tilted mounts, and "ALPR jammers." These are not a workable answer for two reasons:

• Every U.S. state requires plates to be clearly visible and legible. Products designed to defeat ALPR reads violate those display laws and, in many states, an additional plate-tampering offense on top. A jammer that broadcasts also implicates FCC rules.
• They are ineffective against modern IR-flash-plus-vehicle-signature systems anyway. Flock uses vehicle fingerprint (make/model/color/rack/sticker/scratch) to track a car even when the plate itself is unreadable.

Independent security research (context, not instructions)

Because the question comes up: the Flock hardware itself has significant documented security exposure. Independent researcher Jon Gaines ("GainSec") published a formal white paper in November 2025 documenting 51 findings across the Falcon/Sparrow ALPR, Raven audio detector, and Bravo compute box, of which 22 have assigned CVEs and 8 more are pending. Highlights (redacted per the researcher's own responsible-disclosure convention):

• A Java keystore file (flock_rye.bks) bundled inside a shipped Android application, with the unlock password (flockhibiki17) also hardcoded in cleartext (salvacybersec analysis).
• Falcon/Sparrow devices shipped with development Wi-Fi credentials in cleartext and a universal hotspot password enabling ADB-over-TCP root access via a specific button-press sequence — under 30 seconds of physical contact (CVE-2025-59409). Wigle.net had recorded 900+ hits from cameras with the hotspot active in the wild in 2025.
• A misconfigured Flock demonstration site publicly exposed an administrative ArcGIS API key with full write access to 50+ private data layers and a $120,000 map-credit budget. In parallel, PRC state-sponsored group "Flax Typhoon" was documented compromising ArcGIS instances (Simeon on Security).
• Hardcoded DataDog API token (CVE-2025-59405) and unauthenticated administrative API endpoints on the Collin's internal API server (CVE-2025-59403).
• Flock's response: "None of the vulnerabilities detailed in the report have an impact on our customers' ability to carry out their public safety objectives. Exploitation would require physical access and intimate knowledge of internal device hardware."
• Senators Ron Wyden (OR) and Raja Krishnamoorthi (IL) sent a formal letter to the FTC in February 2026 requesting an investigation.

GainSec's white paper (GitHub, Zenodo DOI 10.5281/zenodo.17529423) also ships a Defender's Checklist meant for agencies operating these devices. This is defensive research on devices the researcher owned. It is included here for situational awareness — if you sit on a city council reviewing a Flock contract, "your vendor ships CVEs" is a citable fact.

Model language for city-council testimony

If you have three minutes at a public-comment podium, the following facts are the ones that consistently move votes, drawn from the coverage that has actually flipped contracts in 2025-2026:

• 82 Flock contracts have been terminated in 28 states between August 2021 and May 2026 (Government Technology / San Francisco Standard).
• Flock's Chief Legal Officer publicly conceded that officers using the system to track ex-partners is "the most common form of platform abuse" (IPVM, May 2026).
• An Institute for Justice tally found 22 documented officer-stalking cases as of April 2026, calling that "almost certainly an undercount."
• The University of Washington's Center for Human Rights documented federal-agency access to Washington ALPR databases in 2025 in apparent violation of state Keep Washington Working provisions.
• A single search from Johnson County TX queried 83,345 cameras in 6,809 networks over an abortion investigation (EFF / 404 Media, May 2025).
• An Oregon city found federal immigration agents searched its pilot Flock database 279 times in three weeks.
• Independent security research has assigned 22 CVEs to the hardware, with 8 more pending.
• The retention default is 30 days but Washington's SB 6002 has now proven that a shorter statutory floor is politically workable.

Related resources

Frequently asked questions