many possibilities blog: How to solve the Flock camera privacy problem of misuse of Flock cameras

Solving the privacy problem of Flock cameras

Using PCOM, the best solution is not “better training” or “slightly stricter policies.” The core problem is the existence of a persistent, searchable mass-tracking system for innocent people. So the highest-leverage solution is to end dragnet retention and dragnet searchability, while preserving only narrow, case-specific uses tied to concrete investigations.

1) Define the problem objectively

The problem is not merely that some officers misuse Flock. The problem is that ALPR networks can create a retrospective movement history of ordinary drivers without individualized suspicion, and that this has repeatedly enabled abuse, hidden sharing, and error-based harms. Flock says its default retention has been 30 days, though it has more recently said it is recommending 7 days and introduced other guardrails. (flocksafety.com)

A concrete definition of the problem:

Large-scale collection of location-linked vehicle data on everyone, not just suspects.
Search access often occurs without a warrant.
Audit trails and policy controls have proven insufficient to stop misuse.
Sharing settings and interagency access have at times exceeded what local officials believed they authorized. (ij.org)

2) Goal and standard

Outcome goal

Reduce or eliminate:

warrantless mass tracking,
non-investigative searches,
hidden interagency/federal sharing,
stalking and personal-use abuse,
and false-hit harms.

Principle goal

Any solution should respect:

the Fourth Amendment principle against unreasonable searches,
due process,
and the broader rights principle that government should not maintain dossiers on innocent people absent individualized cause.

Under PCOM, a “solution” that preserves universal tracking but promises nicer oversight is inadequate, because it leaves the primary rights-threatening mechanism intact.

3) Separate the given from the man-made

Metaphysically given

Cars move in public.
Plate numbers are visible.
Police can observe a car they happen to see.
Technology can now aggregate observations at scale.

Man-made

Whether every passing plate is stored.
How long it is stored.
Whether searches require suspicion, a case number, or a warrant.
Whether data is shared nationally.
Whether agencies can query for immigration, protest, abortion-travel, or other sensitive purposes.
Whether cameras are placed near sensitive locations.

That means the real solution space is legal and institutional, not technological wishful thinking.

4) Causal map: symptom to root cause

Symptoms

Stalking and personal-use queries by officers.
ICE-related or other unauthorized searches.
Chilling effects on protest, religious practice, medical privacy, and associational freedom.
Wrongful stops from misreads.

Immediate causes

Huge searchable databases of innocent people’s movements.
Broad user access.
Weak ex ante limits on what may be searched and why.
Broad or opaque sharing defaults.
Retention windows long enough to reconstruct patterns of life.

Deeper cause

The system is designed around collect first, search later. That architecture treats the movements of ordinary people as a standing law-enforcement resource.

Root cause

Government has been allowed to convert plain-view observations into mass retrospective surveillance without the constitutional friction that would normally apply to tracking someone over time. Courts are still grappling with how ALPR databases fit Fourth Amendment doctrine. (supremecourt.gov)

5) Validate the causal claims

The abuse pattern is not hypothetical. The Institute for Justice says it has cataloged more than 100 incidents of ALPR abuse, including stalking, wrongful stops, and unauthorized uses, and has separately described dozens of romantic-stalking cases in recent years. (ij.org)

The “guardrails failed” claim is also grounded in facts. Flock itself acknowledged that some California agencies had their networks inadvertently accessible to out-of-state agencies for a period in 2025 and says it changed its controls afterward. (flocksafety.com)

So the evidence points to this conclusion: misuse is not an edge case detached from the system; it is a predictable result of retaining and broadly querying location data at scale.

6) Best intervention: change the architecture, not just the policy manual

The strongest PCOM answer is a three-layer solution:

Layer 1: Ban generalized historical retention of innocent drivers’ data

This is the cleanest fix.

No storage of ordinary plate reads beyond a very short technical buffer, such as hours or at most 24 hours, unless the plate matched a preexisting, narrowly defined hotlist.
No building of a searchable historical database of everyone’s movements.
No extension to 30 days, much less longer, absent a specific, case-based preservation order.

Why this works: it removes the raw material needed for stalking, fishing expeditions, and pattern-of-life reconstruction.

If you want the blunt version: if the architecture is the problem, ban the architecture.

Layer 2: If cameras are allowed at all, convert them to a hit-only system

If a jurisdiction will not ban them outright, the next-best model is:

Cameras compare plates locally to a tightly limited hotlist:
- stolen vehicles,
- AMBER/Silver alerts,
- vehicles tied by articulable facts to a specific violent felony warrant.
Non-hit data is immediately discarded.
No retrospective free-text or exploratory search of non-hit traffic.
No “show me every car that visited X area” type queries.

This preserves the strongest public-safety use cases while ending dragnet dossier building.

Layer 3: Require judicial process for any historical tracking

For any access to historical location trails:

Require a warrant based on probable cause, or at minimum a court order with specific and articulable facts if the legislature uses a lower threshold for limited cases.
Require minimization rules.
Require notice to the tracked person after the investigation closes, except in narrow delayed-notice cases.

This restores constitutional friction to long-form tracking.

7) Additional guardrails that actually matter

If any ALPR program survives, these should be mandatory:

A. Ban sharing outside the local agency unless explicitly approved

No default national sharing.
No federal sharing absent a publicly approved policy.
No immigration-enforcement sharing unless expressly authorized by local law.
No private backdoor access.

This directly targets the hidden-sharing problem described by critics and audits. (ij.org)

B. Sensitive-location exclusion zones

Ban placement or query targeting near:

houses of worship,
reproductive health clinics,
mental health and addiction treatment centers,
schools,
domestic violence shelters,
protest sites,
and gun shows or political events.

C. Real query friction

Flock says it has introduced measures like case code requirements and auditing, but those are not enough by themselves. (flocksafety.com)
Require by law:

unique case number,
named offense category,
supervisor approval for non-emergency searches,
sworn attestation under penalty of perjury,
immutable logs reviewed by an independent auditor.

D. Automatic user sanctions

First intentional misuse: termination and criminal penalties.
Supervisors liable for patterns of negligent oversight.
Civil cause of action for people improperly queried.

E. Accuracy protections

No stop or arrest based solely on an ALPR hit.
Mandatory visual confirmation by the officer.
Confirmation of state, plate, make/model, and context.
Disclosure obligations when ALPR data contributed to a stop.

Given documented misreads and wrongful stops, ALPR should be treated as an investigative lead, not proof. (ij.org)

F. Security and transparency

Annual third-party security audits.
Public map of camera locations, except narrow temporary exceptions.
Public quarterly reports:
- number of cameras,
- searches,
- hit rates,
- agencies shared with,
- misuse incidents,
- retention settings,
- and number of searches tied to each offense type.

8) Contradiction check

PCOM rejects fake solutions such as:

“Protect privacy by storing everyone’s movements but promising not to look too much.”
“Prevent stalking by keeping the same database and just offering more training.”
“Preserve liberty by making all movement permanently searchable.”

Those are contradictions. They leave intact the condition that makes abuse possible.

9) Operational program

If I were turning this into an actual reform package, I’d sequence it like this:

Phase 1: Immediate moratorium

Within 30 days:

Freeze new camera deployments.
Suspend historical searches not tied to active violent-felony investigations.
Disable national sharing by default.
Preserve existing logs for independent audit.

Phase 2: Independent audit

Within 60–120 days:

Audit all searches from the last 2 years.
Count personal-use queries, immigration-related access, out-of-policy sharing, and searches lacking case-specific basis.
Publish results.

Phase 3: Legal redesign

Within 6 months:
Pass ordinance or state law that does one of these:

Best option: prohibit retention of non-hit data and prohibit historical pattern-of-life searches.

Fallback option: allow only hit-based use, with immediate deletion of non-hit scans and warrant requirement for any retained historical data.

Phase 4: Enforcement structure

Within 6–9 months:

Create inspector general or civilian auditor authority.
Mandate quarterly transparency reports.
Add suppression remedy and private right of action.

10) Metrics for success

A real solution needs measurable outputs:

Retention of non-hit data: target $0$ beyond brief technical buffering.
Unauthorized sharing incidents: target $0$ .
Queries without case-linked justification: target $0$ .
Misuse cases: sharp decline, ideally $0$ .
Stops based solely on ALPR hit: target $0$ .
Serious-crime recovery via narrow hotlist hits: maintain or improve relative to pre-reform baseline.

The key metric is not “how many searches were run.” It is how much innocent-person data no longer exists to be abused.

Bottom line

The good solution is:

Ban or radically limit historical ALPR retention for non-suspects.
If cameras remain, make them hit-only and delete non-hit data immediately.
Require a warrant or court order for historical tracking.
Prohibit default national/federal sharing and enforce real penalties for misuse.

That is the causal fix because it attacks the root problem: a searchable movement-dossier system for ordinary people.

Learn more:

In addition:

Here are a few additional angles that matter a lot.

1) The issue is bigger than Flock

Even if a city drops Flock, the underlying civil-liberties problem can remain if it switches to another ALPR vendor. The ACLU’s recent position is basically: don’t confuse “anti-Flock” with “pro-privacy”; the deeper issue is mass plate-tracking architecture itself. (aclu.org)

So if you’re arguing policy, it helps to say:

Vendor-specific abuses matter
but vendor replacement alone does not solve dragnet surveillance

That keeps the focus on structure, not branding. (aclu.org)

2) There is now an organized national pushback

Opposition has moved beyond scattered local complaints. The ACLU describes a nationwide movement against Flock and similar ALPR systems, and says cities across the U.S. have terminated contracts after public scrutiny, especially over immigration-data sharing and mass-surveillance concerns. (aclu.org)

That means if you’re organizing locally, you are not isolated. There is already:

a legal framing,
model legislation,
public-comment strategy,
and community organizing language you can borrow. (aclu.org)

3) The legal fight is increasingly about “patterns of life”

The strongest constitutional argument is not just “a camera saw my plate in public.” It is that a networked ALPR system can reconstruct patterns of life over time. In Schmidt v. Norfolk, the ACLU/EFF position is that these systems enable retrospective tracking of sensitive movements and therefore raise serious Fourth Amendment issues. (aclu.org)

That distinction is important rhetorically:

single observation in public ≠ especially invasive
aggregated searchable history of everywhere you drove = much more invasive

That is the key conceptual bridge for people who otherwise say, “But license plates are public anyway.” (aclu.org)

4) Abuse is not theoretical anymore

The Institute for Justice says it has cataloged more than 100 incidents of ALPR abuse, including stalking, wrongful stops, and non-law-enforcement use. It also highlights specific personal-use cases, including one officer allegedly searching an estranged wife’s car more than 700 times. (ij.org)

That matters because defenders often present misuse as:

rare,
anecdotal,
or solvable with training.

But the recurring pattern suggests a more structural point: if you create a searchable movement database, some users will use it for personal targeting. (ij.org)

5) “Guardrails” are being updated because prior controls failed

Flock has publicly described adding stronger controls, including changes around California sharing and other guardrails. The existence of those changes is itself evidence that prior settings and controls were not enough. (aclu.org)

Critics’ point is not merely “Flock is evil.” It is:

if local governments did not fully understand how sharing worked,
and if networks could be exposed beyond intended limits,
then the governance model was too weak for the sensitivity of the data. (aclu.org)

6) The policy debate is shifting from retention to inference

A newer concern is not just storing plate reads, but what can be inferred from them. The ACLU has warned about AI-style features that flag “suspicious” movement patterns, which could widen surveillance from “find a known plate” to “algorithmically identify behavior.” (aclu.org)

That is a major escalation:

from lookup-based surveillance
to behavior-scoring surveillance

And that makes false positives, bias, and mission creep even more serious. (aclu.org)

7) There are model legislative tools already available

If you want practical reform text instead of just criticism, the ACLU has published an ALPR privacy model bill. That can be useful whether your position is:

full ban,
hit-only use,
short retention,
warrant requirement,
or strict transparency and audit rules. (aclu.org)

This is useful because many city councils say, “What exactly do you want us to pass instead?” A model bill helps answer that concretely. (aclu.org)

8) One good strategic distinction: public safety use vs dragnet use

A lot of people are persuadable if you separate:

targeted hotlist alerts for stolen cars, missing persons, or a specific serious case
from
historical dragnet querying of everyone’s movements

Even civil-liberties groups often focus on limiting or banning the second, rather than denying that the first can ever have value. (eff.org)

That distinction can make your argument sound more serious and less absolutist.

9) A strong local question to ask officials

If you are speaking to a city council, privacy board, sheriff, or police chief, one of the best questions is:

“What exact categories of non-suspect data are collected, how long are they retained, who can query them, who can receive them, and what independent audit proves those limits are real in practice?”

That question goes straight to the causal core:

collection,
retention,
access,
sharing,
verification.

10) The most important framing sentence

If you want one compact summary line, I’d use this:

The real issue is not whether police may ever read a plate; it is whether government may build and search a retrospective location database of innocent people at scale.

That is the cleanest way to frame the entire dispute.