What Flock's defenders are missing about its surveillance design
Flock, the police-tech company behind a US network of roughly 120,000 automatic license plate readers, announced changes to its platform last Thursday meant to stop officers from using it for illegal or illegitimate purposes, including stalking. The Washington Post had identified 50 cases in which officers misused systems from Flock and its competitors, often to stalk and harass women; in one case in Wisconsin, a woman alleged her officer ex-boyfriend searched for her car 179 times, and in another, a woman was stalked by her local police chief with no one to report him to. Flock's response includes software meant to flag abnormal searches and a requirement that officers enter a criminal case number before running a search.
MIT Technology Review argues these fixes have a major loophole: Flock confirmed to the publication that it does not verify the case numbers officers enter, so an officer can simply type in a bogus one, the same way officers have gotten around other Flock safeguards before. The piece frames the deeper problem as a set of design choices Flock made about what data to collect, who can search it, how long to keep it and how widely to share it, choices that set the terms of the bargain between crime-solving and civil liberties. It offers two alternative designs Flock could have chosen instead: requiring case numbers to actually match police department records rather than accepting any string, and restricting broad, cross-city searches to active emergencies like Amber Alerts rather than allowing officers everywhere to tap the whole nationwide network for any purpose.
On data retention, Flock operates largely as a national network, letting police in one city or state search data collected by another, with agencies able to keep that data for months or years. Yet Flock's own figures show 90% of searches happen within a week of an incident, which the article says undercuts the case for holding data much longer than that. Flock recently changed its recommended retention period to seven days, but the piece notes agencies remain free to keep data as long as they want regardless of that recommendation.
Chad Marlow, a senior policy counsel at the ACLU, told the author that by his standards the most acceptable Flock contract is 'one that is never signed,' and argued that real limits on surveillance should come from new laws rather than new Flock guidelines. Flock CEO Garrett Langley responded that he will 'probably always have a different view than the ACLU.' The article notes that license plate readers have existed since the 1990s for tolls and ticketing, and that narrowing Flock's design would undercut the company's business model and its recent $8 billion evaluation, which rests on turning cameras into a shared, richly searchable national network rather than isolated local tools. Some cities have already canceled Flock contracts, switched to competitors, or paused to write their own rules, which the article suggests could ultimately let communities set their own terms for the trade-off between crime-solving and surveillance.
Key facts
- Flock's US network covers about 120,000 automatic license plate readers, and the company announced new safeguards last Thursday after The Washington Post found 50 cases of officers misusing Flock and rival systems, including one Wisconsin officer who allegedly searched for his ex-girlfriend's car 179 times.
- The new safeguard requiring officers to enter a case number before searching is undermined because Flock told MIT Technology Review it does not verify those numbers, so officers can enter bogus ones.
- Flock's own data shows 90% of searches happen within a week of an incident, even though agencies can retain data for months or years; Flock recently made seven days its recommended retention period, but agencies can still keep data longer if they choose.
- ACLU senior policy counsel Chad Marlow says the most acceptable Flock contract is one that is never signed and argues real limits should come from new laws, not Flock's own guidelines; Flock CEO Garrett Langley says he will probably always see it differently than the ACLU.
- Some cities have already canceled Flock contracts or switched to competitors, and the article ties this to Flock's recent $8 billion evaluation, which depends on the network staying broad and widely shared rather than narrowly scoped.
Why it matters
Flock's response to documented stalking cases reframes a familiar surveillance debate: the company is not being accused of building nothing, but of building a specific, broad version of a license-plate network when narrower designs were available. The article's point is that 'more safeguards' announcements can look responsive while leaving the underlying architecture largely intact: nationwide sharing, long retention, unverified search justifications.
Who it affects
It affects the roughly 120,000-camera network's US users directly: police departments that rely on Flock, officers whose searches are now nominally logged against case numbers, and the people whose movements the cameras record, including the women in the Washington Post's 50 identified misuse cases. It also affects Flock's business, since cities are already canceling contracts or pausing to write their own rules, and lawmakers in states considering limits on license plate readers.
How to use it
There is no product or purchase angle here: this is an accountability piece about an existing law-enforcement vendor, not a tool for readers to adopt. The practical takeaway for the affected audience is that current Flock safeguards, the case-number requirement and anomaly-flagging software, do not by themselves prevent misuse, since case numbers go unverified.
How solid is it
The load-bearing claim, that Flock does not verify officer-entered case numbers, comes from Flock's own confirmation to MIT Technology Review, giving it firsthand sourcing. The 50 misuse cases and the Wisconsin 179-search figure are attributed to a Washington Post investigation rather than reported firsthand here. The $8 billion figure is described in the source's own words as an 'evaluation,' and Flock's 90%-within-a-week statistic is the company's own claim, not independently verified in the piece.
Risks and caveats
The article does not say how many cities have canceled contracts, which states are pursuing legislation, what share of Flock's total contracts have been affected, or when Flock's business might be forced to change as a result; these remain open questions. It also does not specify whether the new seven-day retention period is enforced in any way beyond being a recommendation, noting only that agencies can retain data longer regardless. No absolute date is given for the reported safeguard changes beyond 'last Thursday.'
“Flock confirmed to MIT Technology Review that it doesn't verify those case numbers, so an officer can simply enter a bogus one.”
— MIT Technology Review, citing Flock's confirmation