Flock's local camera buyers carry the risk of federal searches like CBP's 80,000-camera pilot

Flock answers the misuse reporting with a ratio. The Washington Post has identified at least 100 police employees charged with or accused of misusing plate readers ^[7], and Flock says such people are a tiny share of its more than 140,000 monthly users ^[8]. On those figures the share is about 0.07%, or one user in 1,400 ^[1]. How the 100 were found matters more. Indianapolis police did not regularly audit Flock searches until the Post flagged thousands of questionable inquiries by one officer, and a systemwide audit then found alleged misuse by four more ^[9]. Other departments also learned of misuse from reporters ^[9].

None of it required a break-in. Braselton's police chief, Michael Steffman, searched the plates of his ex-girlfriend and her teenage daughter roughly 600 times, according to the Post ^[14]. "Each user walked through the front door," wrote the criminal procedure scholar who set out these cases in Fortune ^[18]. "Logs record misconduct only after it happens, and only if someone reads them," the scholar wrote ^[19].

The agency that pays for a camera and the agency that searches it can be different. Flock's design lets agencies that never bought the cameras query them across jurisdictions, according to the scholar ^[13]. Immigration and Customs Enforcement, for one, had no Flock contract ^[17]. Reading every outside query is staff time the camera owner pays for, and Indianapolis was not spending it ^[9].

Flock's August changes cut the recommended retention window by 77% ^[5]. At the rate of the one camera whose data hackers copied, about 2,400 vehicles a day and roughly 32 images for every vehicle logged ^[4][3], seven days still comes to about 533,000 images per camera ^[2]. Flock said it lacked enough information to assess the hackers' technical claims ^[15]. Customers may also keep data longer than recommended, emergencies can bypass case codes, and a case number can be entered without judicial approval ^[16].

Three outcomes look plausible. Flock's new misuse detection could begin catching outside overreach before reporters do, holding misuse near the share Flock cites. States could restrict plate-data sharing by statute, and buyers there would have to narrow the network they paid to join. Or the courts could settle it. "The law remains unsettled on ALPR use," the scholar wrote ^[12].

In my view the governance risk stays with the buyer in all three, because the buyer owns the local cameras while other agencies run the searches ^[13]. The reporting does not include a lawsuit, settlement or contract term, so the liability side is still a reading of state law, not a booked cost. The view is wrong if a department catches the next federal pull in its own logs before a reporter, a records request or a researcher does. The Indianapolis, Danville and campus cases came to light through the Post, public records and a study ^[9][3][4].