In Dayton, Ohio, a city audit found that data from the city's network of automated license plate readers had been searched more than 7,100 times for immigration enforcement purposes, directly against the city's own policy. Dayton wanted out. The problem was that it couldn't exit its vendor contract right away. So while officials worked through a legal path out, they covered all 72 cameras in trash bags. It's a strange image for a city that bought the system to make itself safer, physically blinding its own public safety infrastructure because it had lost control of who was allowed to look through it.
A Scale Nobody Fully Audits
Dayton isn't an isolated case. Flock Safety, the company behind the cameras, is now the largest automated license plate reader provider in the country, with more than 120,000 cameras deployed across thousands of local agencies. A lawsuit filed in April against San Jose, California, found that the city's network of 474 Flock cameras had been searched nearly 2.5 million times in the second half of 2025 alone, an average of more than 15,000 searches a day, with what the plaintiffs describe as almost no oversight of who was searching or why. A separate class action filed in San Francisco in February alleges that federal agencies, including ICE, CBP, the FBI, and the ATF, queried the city's Flock database more than 1.6 million times over seven months. Numbers at that volume make manual review close to impossible, and that's before accounting for accuracy. An inspector general audit in Los Angeles found the city's pilot program had falsely flagged 161 vehicles as stolen over a two month span, a finding that contributed to the LAPD letting its contract lapse.
FlockSafety - Introducing, Flock’s national and statewide law enforcement search network - Aug 2020
When the Misuse Wears a Badge
The other half of the problem has nothing to do with unauthorized outsiders and everything to do with authorized ones. In Georgia alone, arrests over Flock database misuse have reached at least 20 this year, in a pattern that's shown up county by county: a Habersham County deputy fired and arrested for allegedly searching plate data tied to someone he had a personal relationship with, three Cherokee County deputies, a DeKalb County deputy, and six Savannah police staff under investigation, among others. The Institute for Justice has documented at least two dozen similar cases nationwide since 2024, describing them as officers using the system for unauthorized surveillance of people they knew personally rather than anyone connected to an actual investigation. In Dunwoody, Georgia, the Marcus Jewish Community Center had agreed to share its own cameras with police on the condition that access stayed limited to real time incident response. Audit records instead showed a Flock employee, not a police officer, opening a live feed from inside the center's children's gymnastics room, and a second Flock employee accessing three of the center's cameras, including the gym and pool in a separate instance two months prior. Flock and Dunwoody city officials described both as a sales demonstration, though the city has been unable to produce anything to support that.
Cities Are Choosing Architecture, Not Just Vendors
What's notable is that most of these cities aren't abandoning camera based public safety tools altogether. According to the ACLU, more than 55 localities ended their Flock contracts between mid-2025 and mid-2026, and a lot of them replaced the cameras rather than removing them outright. Denver's contract lapsed in March, and the city came back with fewer cameras, 50 Axon cameras instead of 110 Flock ones, but under a different set of rules: a 21 day retention limit instead of 30, no participation in a shared national searchable database, and a mandatory audit trail attached to every single query. The camera count fell by more than half. The surveillance itself didn't stop. What changed was who could reach the data, and how long a trail was left behind when they did.
What the Reform Wave Is Actually Asking For
The response to all this hasn't stayed at the level of individual cities swapping vendors. States have started writing specific design requirements into law. Washington's Driver Privacy Act, signed by Governor Bob Ferguson at the end of March, is the most comprehensive ALPR statute passed so far: a statewide 21 day retention cap, an explicit ban on using the data for immigration enforcement, a warrant requirement before law enforcement can obtain ALPR data from a private entity, restrictions on camera placement near schools, churches, and healthcare facilities, and gross misdemeanor penalties for violations. The bill exists in large part because reporting found at least eight Washington law enforcement agencies had been sharing Flock data directly with federal immigration authorities before the law passed. Even the ACLU of Washington, which pushed for the bill, has been upfront that 21 days is a compromise rather than a win, arguing it isn't meaningfully different from the 30 day status quo it replaces.
That's a fair complaint, and it points at a more useful way to think about this than any single number. Industry guidance aimed at the agencies actually running these systems describes roughly the same checklist regardless of which state a department sits in: every query tied to a documented case number or reason instead of left blank, access tiered by role instead of handed out on one shared login, an audit trail that records who searched what and when and can't quietly be edited afterward, independent periodic review instead of a department auditing itself, and retention windows that purge automatically rather than depending on someone remembering to delete the data. None of that requires giving up the underlying capability. It just requires deciding, on purpose, who gets to use it and how the record of that use gets kept.
The Lesson Isn't About One Company
To its credit, Flock hasn't ignored any of this. The company launched an internal Audit Assistance tool this spring that flags unusual search patterns to the agencies using it, and points to a growing string of resulting firings and arrests as evidence it's working. It's since rolled out a public transparency portal displaying local department policies, camera counts, and search statistics. Flock's founder, Garrett Langley, has said any misuse is unacceptable and that responsible technology should help expose it rather than hide it, and the company's own framing is direct: the technology doesn't create misuse, people do. That's true as far as it goes. But an attorney with the Institute for Justice who reviewed the audit tool described it as something closer to a black box, built and run by the same company selling the product to the department it's auditing, and pointed out that at millions of searches a month across thousands of departments, catching misuse after the fact is a very different thing from designing a system that makes it harder to happen in the first place.
That's really the design question sitting underneath all of this, and it isn't unique to one vendor or one city. A camera catching something in real time is only half the job in a municipal deployment. The other half is who gets to search what it caught, whether that search leaves a record, and whether the answer to both of those questions is something the city actually chose, or something it discovered after the fact. We've written more about how multi-agency access control and jurisdiction locked data fit into that picture on our smart cities page, for anyone thinking through what that governance design should look like before the cameras go up, not after.