Increasingly over the last 18 months throughout the United States, concern with regard to the civil liberty threat posed by surveillance systems developed by Flock Safety, also known as Flock Group Inc. has, in pockets throughout the country, escalated to a fever pitch.
The Atlanta, Georgia-based company, founded in 2017 by Garrett Langley, Matt Feury, and Paige Todd, has grown in leaps and bounds through its successful product line of automated license plate readers, video cameras, surveillance technology and public safety software.
But inevitable bugs in the system, not all of which have been worked out and the consideration that more than 130,000 active license plate readers and an unknown number of other types of surveillance cameras developed by the company have been installed in approaching 6,000 communities across 49 states has sparked worries that invasions of privacy and unwarranted, unconstitutional and outright illegal data sharing are routinely taking place in areas in which more than 67 percent of the entire country’s population lives.
The introduction of ever more advanced surveillance tools, including the expansion of artificial intelligence features, such as searching vehicle attributes, clothing, or physical descriptions beyond standard license plates has created, a sizeable number of people fear, an Orwellian comprehensive tracking infrastructure.
That uprating in capability has come as there has been extensive publicity about the technologies misuse by law enforcement agencies and personnel. There have been documented cases of police officers utilizing the cloud database to track residents absent court-issued warrants, carryout discriminatory or idiosyncratic searches, including the stalking of their own wives or girlfriends.
In addition, predictable manifestations of the data being made available, by virtue of “agency-to-agency privilege” by one governmental entity to others have emerged into the public consciousness. Data collected by local agencies has been, in some cases, commandeered by state law enforcement agencies, federal law enforcement agencies and other federal agencies, including the Department of Immigration and Customs Enforcement.
Opposition to not only the ubiquity of the technology but to the use of data of the type gathered by Flock in any degree has popped up among civil liberty groups such as the American Civil Liberties Union and the Electronic Frontier Foundation.
Beyond the authoritarian misuse that carries with it the potential, at least in the minds of some, that Flock and companies completing with it for surveillance industry dominance could become the foundation an American totalitarian state, is the possibility, which may have already manifested, of criminals – including criminal networks and organized crime – tapping into the data Flock is compiling and using it for its own or their own nefarious purposes.
Flock Safety maintains its core cloud platform and central database have never been nor will ever be hacked or subjected to massive or even limited data exfiltration.
The reality, however, is such breeches, ones of unknown seriousness, depth or breadth – because of the aura of secrecy that surrounds Flock – have already occurred. Security professionals and cybernetic researchers, as well as investigators who are not connected with and therefore have no motive to protect Flock or its reputation have detected, found and exposed significant vulnerabilities and data exposure issues in the devices Flock sells along with the software those devices use to coordinate with the law enforcement agencies using those products.
More than one set of security researchers, perhaps most famously collaborators Benn Jordan and Jon “GainSec” Gaines, in multiple contexts have shown elements of Flock camera and surveillance systems can be tapped into. On more than one occasion, it was clearly demonstrated flock products in use by law enforcement agencies, have been left open to on-line access, either because the password protections or encryption used could be defeated or no such protection was in place at all. This has resulted in live feeds and/or stored local footage to be accessed by means of simple uniform resource locator.
Flock Safety is adamant: None of its central cloud infrastructure has ever been compromised and no customer (i.e., law enforcement agency) data has been offloaded by bad actors. The few documented cases of exposed camera feeds that have taken place were, Flock maintains, isolated configuration errors or stand-alone units that broke down or were broken into and were not the outcome of a successful systemic cyberattack on the company’s database. Those who are knowledgeable about such systems who are not employed by Flock and who have examined those “isolated” failures say the manner in which some live feeds have been penetrated and administration interfaces tapped into is a clear indicator that the Flock system is less than fully secure and vulnerable to unauthorized access.
There are confirmed accounts of instances, including an infamous one locally, in which a law enforcement agency’s account link protocol and/or credentials were compromised via third-party infostealer malware and shared or sold on cybercrime forums, prompting calls for stricter mandatory multi-factor authentication.
Earlier this year, there was a not insignificant outcry at the local level in San Bernardino County against Flock, including a very spirited push by the Warehouse Worker Resource Center, members of which locked arms with concerned residents, asking various city councils in the county to cancel their contracts with Flock Safety.
Nevertheless, unlike in at least some communities elsewhere, that civil libertarian sentiment was met by and ultimately smothered throughout most of San Bernardino County by a degree of pro-law enforcement zeal that has prevented the Anti-Flockers from achieving any real traction.
San Bernardino County, the largest such jurisdiction in the lower 48 states at 20,105 square miles, consists of 22 cities, two incorporated towns and no fewer than 56 distinct unincorporated towns, communities, villages, hamlets and districts and at least that many wide spots in the road. Ten of those cities – Chino, Montclair, Upland Ontario, Fontana, Rialto, Colton, San Bernardino, Redlands and Barstow have their own police departments. Twelve other cities and the two incorporated towns contract with the San Bernardino County Sheriff’s Department for the provision of law enforcement services. The sheriff’s department covers the remaining unincorporated portions of the county as well.
The sheriff’s department has a contract with Flock for the use of its automated license plate readers and accompanying software and some other limited devices. The sheriff’s department has installed those license plate readers in most, though not all of its contract cities and towns. In virtually all such instances, the contract city, as part of the contract, reimburses the sheriff’s department for at least a portion of the sheriff’s department’s purchase of the technology from Flock.
The City of Twentynine Palms hosts a network of Flock cameras under a contract tied to the San Bernardino County Sheriff’s Department deployment of the devices that extends through 2027.
Yucca Valley utilizes Flock license plate readers through the sheriff’s department.
Rancho Cucamonga uses Flock’s automated license plate readers and local surveillance networks, through the sheriff’s department.
The city of Needles uses Flock’s automated license plate reader technology operated by the San Bernardino County Sheriff’s Department.
74-square mile Victorville has heavily invested in expanding an extensive network of over 100 high-speed license plate reading cameras to create a functional perimeter around roadways and intersections.
The cities of Hesperia and Adelanto and the Town of Apple Apple host, through the sheriff’s department, Flock cameras.
Chino Hills, a sheriff’s department contract city, originally used license plate readers designed by Vigilant Systems, and now utilizes Flock’s solar powered cameras trained on vehicles to catch their license plate numbers.
The city of Big Bear Lake does not have an independent municipal contract for Flock automated license plate reader cameras, but law enforcement in the area, consisting primarily of the sheriff’s department with back-up by the California Highway Patrol, utilizes regional and portable license plate reading infrastructure manufactured by Flock and deployed by the sheriff’s department. While the San Bernardino County Sheriff’s Office utilizes and deploys Flock’s license plate reading technology in various parts of the county, Big Bear Lake itself has not directly contracted or publicly installed a dedicated municipal network of Flock cameras.
Most of San Bernardino County’s cities which have their own independent police department’s use Flock systems, though in a few of those cities, they have more substantial contracts with other surveillance equipment companies, which are actually Flock’s competitors. One city in particular purposely has spurned Flock in favor of other companies.
The City of San Bernardino operates license plate readers through an active contract with Flock Safety and features dozens of active cameras within city limits, which has been a point of active local community discussion and debate.
The City of Ontario uses Flock automated license plate recognition technology as do the cities of Upland, Barstow and Chino.
Redlands residents and civil liberties advocates have questioned the expanding network of Flock Safety cameras over concerns regarding warrantless mass surveillance and Fourth Amendment privacy rights. Nevertheless, Redlands has an active contract with Flock Safety for
The Fontana Police Department deploys Flock’s automated license plate readers, and city records show approvals for purchasing and expanding contracts with Flock Group Inc. to monitor major intersections and roadways like Foothill Boulevard and Sierra Avenue. The Fontana PD Transparency Portal and official city policies state the cameras are used for official law enforcement needs, such as tracking stolen vehicles, locating missing persons, and investigating major crimes.
The Colton Police Department utilizes real-time Flock alerts to identify vehicles linked to crimes and assist units like the Multi-Enforcement Team during traffic stops and pursuits. The Colton Police De also maintains a community camera registry, allowing residents and local businesses to voluntarily register private security cameras to help investigators request footage during an incident
The City of Rialto, which was the first city in San Bernardino County to outfit its officers with body cameras, in doing so initiated a relationship with Flock’s primary competitor, Axon.
Rialto Police Chief Mark Kling has spoken glowingly about Rialto’s broader use of Axon’s AI‑driven surveillance tools — including systems that can link police to participating businesses’ security cameras with owner permission — as part of the city’s most recent $14.3 million Axon contract. The Rialto City Council approved a nine‑year Axon Enterprise deal that expands the department’s surveillance, software, and artificial intelligence capabilities. This package includes upgraded body‑worn and in‑car cameras, digital evidence platforms, automated video analysis, license‑plate readers, and Rialto’s first drone‑as‑a -first‑responder program. Chief Kling has gone on record as saying the $14.3 million contract has succeeded in assuring the department can “arm our officers with the best technology… to help officers do the job… and serve our community better.” That contract gives the city the use of FUSUS, an Axon system that connects police to participating businesses’ security cameras with the owner’s consent, saying it “reduces delays in obtaining footage and can generate more investigative leads.”
In recent months, Rialto’s use of surveillance equipment brought it some unwelcome scrutiny when it was disclosed by John Oliver with HBO that HBO had, through a public records request, ascertained individual Rialto police officers’ monitoring of the civilian videos the police department had access within the city had monitored 1,138,585 passages of unknown duration caught on those security cameras, which had in turn been logged into the department’s data base. The print-out of that log ran to 30,413 pages, with no fewer than 45 video passages registered on each page. According to Oliver, officers spent over 100 hours monitoring cameras at the Days Inn hotel for “hundreds of hours,” including the one facing the pool.
While it has been emphasized that Rialto does not contract with Flock or utilized Flock’s cameras or its data base and that the datacollected in Rialto is managed on city-owned servers rather than through third-party vendors like Flock, there are civil liberties advocates who point out that Rialto’s abuse of surveillance capability available to it more than equals that by nearby cities making use of Flock’s systems.
The American Civil Liberties Union has noted that Flock’s system records and shares vehicle data indiscriminately with and among law enforcement agencies contracting with it nationwide, based upon so-called agency-to-agency privilege, raising privacy concerns, including what limitations on the distribution of the information exist.
With local police defending automated license plate readers as a vital tool for solving retail thefts and locating stolen property, community pushback mirrors a broader statewide and national backlash against Flock any regarding data tracking and potential misuse.
In San Bernardino County, where in excess of 50 percent of the population is Hispanic and and oughtly 119,000 of the county’s 2.2 million population are undocumented foreigners in the country illegally, advocates for immigrants have expressed worry that the collected data could potentially be accessed or shared with federal immigration enforcement agencies such as the Department of Immigration and Customes Enforcement and the Department of Homeland Security. iCE and DHS.
There is no state or federal limitation on police departments sharing law enforcment networks, and individual departments and officer can choose to share data with other law enforcement agencies.
At issue in the use of automated license plate reading technology are operational effectiveness, privacy concerns transparency and the law. In some ways, efficiency, transparency and privacy rights are incompatable.
Some cities, like Chino, have a “Flock transparency portal.” Clever criminals or those looking to invade people’s privacy can take advantage of that.
Searches of the surveillance system used by police agencies are logged and tied to a specific user account so supervisors can review who searched for what and when, but thee is no legal leverage for those outside the realm of law enforcement agencies to audit those uses or use patterns. Public oversight and tracking tools are slim or nonexistent. Audits can only be done internally or by the California Attorney General’s Office of the U.S. Justice Department.
There have been attempts to create public records databases by civil liberties groups such as the American Civil Liberties Union or the Electronic Frontier Foundation to monitor how law enforcement agencies use and share automatic license plate reader data. Some of these have proven to be of limited effectiveness. Tools like Have I Been Flocked? compile public records and search logs obtained from government agencies so citizens can check if their license plates have been run through the system.
Those civil libertarians are dupes of the criminal class, several of San Bernardino County’s law enforcement professionals have suggested.
According to Chino Police Chief Kevin Mensen, video cameras set up all around Chino have proven an irreplacable factor in the about half of the cases solved by the detectives in the department he oversees. Chino has 86 Flock automated license plate readers within its city limits.
The civil libertarians in San Bernardino County have learned that when it comes to dictating whether law enforcement agencies can or cannot use electronic means to keep an eye on everyone, the law enforcement agencies, in the personages of their chiefs of police are boss.
When the question of whether those agencies and their police chiefs or Flock is the boss on the territory they commonly inhabit is asked, it seems Flock is higher up the totem pole.
There are a few examples of the tail wagging the dog when it comes to surveillance technology. Within the last six to eight months, Flock has imposed on law enforcement users mandatory security measures, which extend to reducing the standard data retention window from 30 days to seven days, requiring an opt-in for audit assistance to detect abnormal search behavior and case code searches from the records management system.