A required reason field accepted 'idk' before searching 6,474 Flock networks

A required field with no validator has exactly one requirement. Three characters satisfy it. The field is supposed to create a record of intent, and what the logs hold is whatever string gets a user to the results page fastest.

Barberton's "LOL" entries recur across a 26-month stretch of logs ^[15]. Either nobody with authority read that column for 26 months, or somebody read it and nothing followed.

The sales pitch and the search log describe different products. ALPR systems from vendors including Flock Safety, Motorola Solutions and Axon go to city councils as essential tools for solving carjackings and kidnappings ^[14]. The uses EFF documented include checking whether a student lives in a specific school zone, employment background checks, loud music complaints, and a motorcyclist targeted for holding a cell phone ^[11]. Officers have also used these systems to stalk past and potential romantic partners, to surveil protests, and in one case to try to track down a woman seeking an abortion ^[12].

Other fields are just as open. Harris County Sheriff's Office employees put "LOL" or "lol" in the case number field on several searches between April and May 2026 ^[6].

Flock's answer is the dropdown. An enum does make aggregate review possible, since you can count how many searches claim vehicle theft and hold that against the agency's actual theft reports. Techdirt, writing up the EFF analysis, argues the dropdown instead makes it easier for officers to hide improper searches behind a veneer of uniformity ^[9]. The system does not require proof that the selected reason matches the true purpose of the search ^[8].

The difference between an audit trail and a UI element shows up in two places. At write time, is the entry bound to something outside the user's keyboard: a case number that exists in another system, a statute code, a named approver. At read time, does someone sample entries, and can that person impose a consequence. Write-side binding with no reader produces entries that look uniform and that nobody has checked. Without binding, a reader at least sees entries that are visibly meaningless, and those are the entries EFF got.

You can run the same test on any logged-access product you own. Pull twenty entries from last month at random, hand them to someone who was not involved, and count how many let that person reconstruct why the access happened. A sample is the only review anyone performs anyway: Flock network audits are spreadsheets in which even a small agency records millions of searches from thousands of outside agencies ^[13].