Product1 publisher3 min readPublished
Flock answered Senate scrutiny of plate readers with a dropdown menu and a case number field
Republicans and Democrats on the Senate crime subcommittee both objected that plate reader vendors leave abuse detection to the police departments buying the cameras, and the four invited chief executives did not appear.
The Product Desk · Product desk
What happened
- The Senate Judiciary Subcommittee on Crime and Counterterrorism criticized automatic license plate readers on Wednesday, saying they enable warrantless searches that could target certain groups and lack cybersecurity guardrails.
- The scrutiny follows recent Washington Post investigations into police officers' abuse of Flock's readers, which have drawn mounting criticism of the vendors selling to state and local agencies.
- The chief executives of Flock, Axon, Motorola and Verkada were invited to testify and declined, according to Hawley.
- Asked by Sen. Alex Padilla how to close the loophole that lets ICE get informal help from a single local officer, the ACLU's Chad Marlow said: "You ban them, sir, you ban them."
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- constraint A justification dropdown records a reason at the moment of the search, so it limits an officer only as far as someone with authority over that officer reads the entries afterwards.
- decision Departments that own these cameras have to write and staff the review step themselves, because the vendor's new guardrail ends at the data the searching officer types in.
- exposure On Marlow's account, one officer's informal query can put a local department behind a federal immigration enforcement action without any 287(g) agreement on file.
- precedent The nearest federal lever in play is Justice Department guidance aimed at state and local agencies. Guidance of that shape binds the buyers and leaves vendor security testing to the vendors.
Both of the new controls Flock described in its letter to Sen. Josh Hawley are typed by the officer running the search: pick a justification from a dropdown, then enter a case number [14]. The step that would give those entries force is the one Hawley said the vendors hand to their customers. He faulted makers of automatic license plate readers for relying on agency customers to self-police the systems for wrongdoing [2], and for claiming their products do not use facial recognition when they do [3].
"Practically every state in the union now has [ALPRs]," Hawley said. "Hundreds of thousands of them, recording billions of images every single month." [4]
Hawley also challenged Flock's claim that it has never been hacked [6]. Benn Jordan, a cybersecurity engineer who sounded the alarm on Flock last year, said in response: "I would say that's inaccurate ... in the general definition of accessing unauthorized data, yes, I would say they've been hacked." [7]
Democrats on the subcommittee shared the privacy concerns and added one about immigration enforcement [18]. Chad Marlow, senior policy counsel at the American Civil Liberties Union, said Immigration and Customs Enforcement could reach the systems through formal 287(g) agreements with local agencies, and could also field the informal help of a single officer [8]. Marlow also said the readers could be used to track and eventually prosecute women seeking reproductive care across state lines, and Hawley said he was worried about surveillance of gun stores and pregnancy care centers [11].
Two things separate a control that constrains a search from one that only describes it. The first is timing: whether anything has to happen before the results come back. The second is the reader: whether the person reviewing the record works for the agency doing the searching. The witnesses' proposals move on both. Jordan asked for independent security testing and inspections of ALPR vendors, paired with a federal data privacy law on par with the European Union's GDPR [12]. Alasdair Whitney, legislative counsel at the Institute for Justice, said Congress could require federal agencies to get a warrant before searching historical location data and cap how long the data is kept [13].
For a department that already owns these cameras, a justification dropdown is worth something only if a named person reads the entries and the department has decided in advance what happens when one is bad. The cost of taking it seriously is real. A required case number slows a search that sometimes has to be fast, and officers work out quickly which dropdown option draws the fewest follow-up questions.
Some witnesses urged Congress to pass a law protecting citizens' data from the readers, and senators discussed possible safeguards [16]. The most concrete federal step in the hearing record is another letter: Sen. Katie Britt said she and Sen. Raphael Warnock asked the Justice Department to write guidance for state and local agencies on preventing misuse [15]. That guidance would land on the buyers. The four vendors invited to answer for their own controls sent no one [5][1].
What to watch
- Whether the Justice Department answers Britt and Warnock with written guidance, and whether it reaches vendor practices or only agency policy.
- Whether Flock's letter to Hawley is published in full, showing if the case number is checked at search time or after the fact.
- Whether any subcommittee member introduces a bill carrying the warrant requirement and retention cap Whitney described, or subpoenas the four CEOs.