Flock’s Surveillance Network: Who Can Search Your Movements?

You can drive past a camera without becoming a criminal suspect. The record of that journey can still become searchable. With Flock, the central question is not simply where the camera stands: it is which accounts can retrieve its records, for what purpose, and for how long.

The Senate Judiciary calendar lists a hearing for 23 September 2026 at 2:30 p.m. in Washington. Hawley has invited the CEOs of Flock, Axon, Motorola Solutions and Verkada. As of 20 September, that is a scheduled hearing and a set of invitations—not completed testimony or proof that every invitee will attend.

Flock’s published access policy says agencies assign approved roles, require an investigative purpose and log searches against individual users. Participating agencies can see data that another customer chooses to share. These are the company’s stated rules, not an independent test of every account.

Private customers can choose to share camera access with law enforcement; Flock says their existing account terms continue. A business or residents’ association owning a camera is therefore a separate decision-maker from the motorist it records. The vendor’s private-sector explanation is explicit about that distinction.

Flock says its ALPR records include plate images, vehicle characteristics, time and camera location, rather than driver identity or facial recognition. That limits what a single record proves: a vehicle sighting does not establish who was driving, why they travelled or whether they committed an offence. Repeated sightings can nevertheless reveal a pattern. That is the privacy significance of connecting records.

Flock’s 13 August announcement changed its recommended/default retention from 30 days to seven and proposed Evidence Mode for preserving case-related records. It also said existing customers would keep their chosen periods.

The September clarification narrows the point further: the new default applies to new law-enforcement customers. Private-sector customers keep their account terms. Reading a general seven-day statement as a guarantee about a particular camera would be a mistake.

Retention also has more than one location. Flock’s Evidence Policy discusses images downloaded and stored beyond the platform retention window. A record disappearing from routine search therefore does not establish that an exported evidential copy has disappeared from an agency’s systems. That copy needs its own retention and access rules.

Illinois: a sharing failure acknowledged

In August 2025, the Illinois Secretary of State reported that an audit found Customs and Border Protection access to Illinois plate-camera data, which the office said violated state law. It ordered access shut off. This was a state oversight finding, not a court judgment described here.

Flock’s response acknowledged inaccurate public communications and insufficiently distinct federal permissions. It said limited CBP and Homeland Security Investigations pilots had been paused. The lesson is specific: a claim about having no current federal contract did not settle whether federal access had occurred. That historical episode does not prove the same route remains open today.

Savannah: arrests are not convictions

The Georgia Bureau of Investigation announced on 21 August 2026 that four former Savannah Police Department employees had been arrested and charged following an internal Flock audit. Investigators alleged access for non-law-enforcement purposes. The agency described an active investigation. This establishes charges and an investigation; it does not establish guilt or a final outcome.

Search logs: a reason field is only as useful as its contents

EFF’s September analysis of records obtained through public-records requests highlighted frivolous or incomplete reasons. Agency replies matter too: some said the underlying searches had legitimate investigative purposes or that rules had changed. Bad entries undermine auditability, but they do not alone establish that every associated search was unlawful. EFF is a civil-liberties advocate and the researcher behind this analysis.

Flock’s August plan calls for all law-enforcement customers to adopt Audit Assistance and case codes by the end of 2026, with abnormal-activity lockouts and review of emergency exceptions. It also announces offense-based sharing filters. Those dates matter: an announced requirement is not evidence of universal implementation today. Read the rollout commitments.

Flock’s September explanation says multi-factor authentication is required for all users. That helps protect an account from outsiders. It cannot, by itself, establish that an authorised user has a legitimate reason to search. The company describes both security and accountability measures.

There is a public-safety case to weigh. Associated Press reporting records police crediting the technology with finding missing people and investigating violent crime; it also reports Savannah’s misuse being surfaced through auditing. Useful investigations and serious access risks can coexist. Neither a success story nor an abuse case measures the overall effect.

1. Access: which agencies can search each camera, and can residents inspect the current sharing list?
2. Retention: how many customers actually use seven days, and what limits apply to exports and Evidence Mode?
3. Misuse: how quickly do alerts trigger review, and what proportion lead to restrictions or disciplinary referrals?
4. Exceptions: who reviews emergency searches and whether the stated offence matches the real investigation?
5. Independent scrutiny: what can outside auditors verify, rather than accepting a company or agency assurance?

These are tests for the promised protections, not allegations that every protection fails. Residents can start with the local contract, written ALPR policy, sharing list and most recent audit. If those records are unavailable, the gap itself should remain explicit.

The strongest case for scrutiny is the gap between a camera’s local purpose and the reach of the accounts allowed to search its records. Public policy should make that reach inspectable, constrain retention and make misuse discoverable with consequences.

The evidence does not justify calling every search abusive, every user authorised to see everything, or every announced reform complete. It does justify asking for proof that the controls work in practice. The scheduled hearing offers a chance to obtain that proof; it has not yet supplied it.

For the related question of who sets limits when AI analyses sensitive information, continue to the Pentagon–Anthropic standoff. This file concerns plate-location access, not that separate contract dispute.