A cop, a hot list, and a query log: where ALPR actually fails

Body camera footage obtained by 404 Media shows Florida officer Lamar Roman explaining why he used government motor vehicle databases and license plate reader cameras to research, stalk and pull over a woman he met on the set of the Apple TV show Bad Monkey ^[1]. "I mean, I saw a shiny thing, teasing and all that," Roman says in the footage ^[2]. For anyone who operates a surveillance system, the salient fact is that nothing was hacked: every step was a credentialed user typing into a box he was permitted to type into.

Detective Jenna Moeller, who investigated, questioned and arrested Roman, reconstructed the sequence for the victim in an interview 404 Media obtained ^[3][4]. According to Moeller, Roman looked the woman up multiple times in DAVID, the department of motor vehicles system, viewing her driver's license information, her signature, her vehicles and her photo, and she could tell he had opened vehicles and photos individually to confirm he had the right person ^[5]. He then used a second system to run her name, plate number, address and date of birth, on the day of the filming ^[6].

Then the escalation that matters. Moeller told the victim that Roman entered her tag into the agency's license plate reader system, the highway cameras the department uses to locate vehicles, so it would alert him when she drove past ^[7][8]. Moeller noted the county has one highway, which makes finding a car straightforward ^[9]. That is the transition from a read query to a standing subscription to a private person's movements, and it happened inside normal permissions. Roman went on to nearly cause a head-on collision while speeding to track her down, and illegally pulled her over ^[10].

The control in place was verbal. Moeller told the victim that "we've had deputies misuse databases, we've told them over and over again, 'That's not what it's for. You see a hot chick, you don't look them up in a database'" ^[11], and said this was not the first database misuse case she had investigated ^[12]. Detection arrived only after the stop: the footage 404 Media obtained covers station interviews with Roman, the victim interview, and his arrest outside his home ^[13], and Moeller was the person who told the victim how far the surveillance had gone ^[4]. The subject of a hot list entry learns about it from a detective, if at all.

Roman used an ALPR product called Guardian, made by Turing, not Flock ^[14]. But Flock is where the counting has happened, and the counting is instructive. Dozens of officers nationally have been caught abusing Flock and other ALPR systems to stalk ex partners and strangers ^[15]. In early July, Flock said it was "aware of 15 incidents of abuse" ^[16]; 404 Media, local outlets and an Institute for Justice report had already found more ^[17], and the Washington Post subsequently found at least 50 ^[18], at least 35 above the vendor's figure and more than triple it ^[19]. Flock CEO Garrett Langley now says the system has "caught a lot of bad cops. It's a ton. It's more than I ever would have hoped" ^[20]. Read carefully, that is a statement about forensics, not prevention.

The handling afterwards is its own data point. The investigating detective told Roman "you'll get past this bro" during the arrest ^[21], and later told the victim he was remorseful and urged her not to post about the incident on social media ^[22].

What to watch: whether any ALPR vendor requires a case number or supervisory approval before a plate can be added to a hot list, whether audits run continuously rather than after a complaint, and whether the national tally keeps climbing past 50 while vendors describe each discovery as evidence the system works.