Flock wants a privacy-safety compromise. The 46 misuse cases are an access-control bug.

"Compromise" describes a dial between two goods, set at population scale: how much watching buys how much safety ^[1]. The 46 accusations the Washington Post identified do not sit anywhere on that dial ^[3]. An officer running his ex-girlfriend's plate is an authenticated user doing something the system let him do, which makes the question narrower and less flattering than national policy: who may run a query, and who signs off before it runs.

Flock's two published remedies answer half of it ^[6]. Dropping default retention from 30 days to seven removes 23 of the 30 days ^[2] and narrows the window of data available to trawl, without changing who is allowed to trawl. The case code requirement is aimed at the right layer and is still self-service, a field filled in by the person doing the lookup. Both settings can be overridden, and Evidence Mode is the documented route to keeping data longer ^[7]. A control the user can switch off is a default with better branding.

Set the seven days against the ACLU's number. The group asked for 48 hours, so the new default is 3.5 times the shortest window Flock's loudest critic would accept, and the ACLU said whether this is a real change depends on how Evidence Mode operates ^[8][1].

Then the order of events. Langley apologised to CBS News after hearing one alleged victim's account ^[4], and in the same interview said Flock did not create police abuse and was "the first company to ever shine a light on it and build the tools to find it" ^[5]. The count that forced the issue reached the public through a newspaper ^[3], and the requirement to enter a case code before accessing data arrived as a response to the criticism that followed ^[6][3]. Tooling that finds misuse is worth having. Shipping it after the misuse is catalogued makes it remediation, and remediation is priced differently by the official signing the renewal.

His regulatory ask runs the same way. Langley wants state legislatures to make illegal use of Flock data a criminal offence, and calls the current absence of regulation and accountability wrong ^[11]. That puts the penalty on the officer who typed the plate. It leaves the console that accepted the plate where it is.

For a department renewing a contract, the useful test is not the balance between privacy and safety. It is whether the system can name the officer behind a given lookup, and whether it can refuse him.