Security1 publisher3 min readPublished
A Flock-owned account searched live cameras for masked people and crowds during sales demos
Audit logs obtained by a Dunwoody resident put an entity called Flock City PD on real plate readers in Georgia and Texas, running free-text AI searches for masks, crowds and political stickers while Flock pitched police.
The Watch · Security desk
What happened
- Public records show Flock created a fictitious police department, Flock City PD, and used it to search live automated license plate readers in several U.S. cities during demonstrations of its system.
- Audit logs tie Flock City PD - Law Enforcement Demo, Flock Intelligence and Flock Safety - Commercial Sales Demo to searches in Dunwoody, Georgia, Bryan, Texas, and other jurisdictions the logs do not identify.
- The logs, shared with 404 Media, record searches on real cameras for people holding signs, crowds and people wearing masks, among others.
- 404 Media reported in April that Flock employees regularly accessed live Dunwoody cameras at a children's gymnastics room, a playground, a school, a pool and a Jewish community center while demoing to police.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The searching entity sat inside the vendor, so the people whose cameras were queried in the other cities have no agency record to request and no way to learn they were searched.
- constraint In this record the only control between a sales engineer and a live camera is Flock's own moderation layer, which outsiders cannot inspect, and a warning prompt still lets the search proceed.
- contradiction Flock says the sensitive queries were run to prove the system would refuse them, yet the logs show the vehicle-side Star of David search going through after a warning.
- precedent Every remedy in this record followed publication. For other cities on the platform, the discovery route runs through their own audit logs and who was searching in them.
A plate reader search usually starts from a plate, or from a vehicle description the system already understands. A FreeForm query is free text, and Flock's image recognition algorithm decides what comes back [6]. That is how "crowd" and "person wearing a mask" become search terms at all [5]. The account typing them in belonged to the vendor [1].
Flock's moderation did fire in places. The logs list "vehicle a pretty girl would drive" as a block [8]. A search for a person with a Star of David was blocked, while the same term aimed at vehicles raised a warning box and then ran [9]. 404 Media names ten queries from the Dunwoody and Bryan logs and gives the moderation result for two, so for the other eight the report does not say whether the search returned images [19].
Flock's explanation is that this was the point. A spokesperson told 404 Media that some searches were run specifically to show officers the sorts of searches they should not do, and the guardrails the company had put in place [11]. The sensitive queries, the spokesperson said, were meant to prove the system would refuse them [10]. The same spokesperson said the Flock City PD account no longer searches any real cameras [12], and that "the Flock City PD demo environment is now isolated, and law enforcement agencies cannot form a sharing relationship with it" [13]. A recent Flock training webinar seen by 404 Media shows an employee logged into Flock City PD with access to cameras that appear to be for training: "Flock Warehouse - LPR Demo Cameras," "Circle K - Demo," "Tennessee Demo Cameras," "Scottsdale AZ Demo Video Cameras," and "ALPR Demo" [17].
The oversight built around ALPR assumes an agency: agency audit logs, agency policy, agency sharing agreements. Flock City PD sits inside the vendor. Dunwoody found out what had been run against its cameras because Jason Hunyar, the resident who first spotted the employee access, obtained the logs [3]. Residents have repeatedly told the city council that they feel their privacy is being violated as an experiment and sales demonstration for a private company [16]. After Hunyar and 404 Media reported, Flock and the city said Dunwoody's cameras would no longer be used for sales demonstration purposes [15].
The pattern extends past one demo account. 404 Media has reported that Flock explicitly taught police how to surveil the No Kings protests, and that some of the FreeForm searches in these logs resemble searches real departments ran themselves [18]. Employee access to live cameras for sales work, and showing police how to run dubious searches, are already flashpoints in the backlash against the company [20].
What to watch
- Whether the other cities are named, and whether they pull their own audit logs.
- Whether Bryan, Texas bars demo use of its cameras the way Dunwoody did.
- Whether any city writes vendor demo access out of its Flock contract instead of relying on the isolation Flock describes.