A Washington Post investigation found at least 69 police officials who had been accused, charged, or convicted of misusing Flock Safety or other automated license plate reader systems for unauthorized purposes. Reported cases included officers searching for vehicles belonging to spouses, former partners, friends, and other people with whom they had personal relationships. In several departments, the questionable searches were discovered by journalists, activists, or victims rather than through the agencies’ own oversight.
Flock records searches and provides auditing tools, and the company has since announced tighter safeguards including mandatory case codes, automatic review of abnormal activity, proactive lockouts, and stronger security requirements. The broader lesson reaches well beyond policing: when people have powerful legitimate access, policy alone is a fairly thin control if nobody checks how that access is actually being used.
What happened with Flock Safety camera misuse?
Flock Safety provides automated license plate reader, or ALPR, technology used by thousands of law-enforcement agencies across the United States. Its roadside cameras capture vehicle information that authorized users can search to help locate stolen cars, investigate crimes, find missing people, and support other law-enforcement work.
The technology also gives users considerable visibility into where vehicles have appeared. That capability becomes sensitive when someone with legitimate access decides to use it for a personal purpose.
The Washington Post found at least 69 police officials who had been accused, charged, or convicted of misusing Flock or other license plate reader systems. In at least 15 cases, the potential misuse was first identified by somebody outside the department, including journalists, activists, or affected individuals. The Post subsequently examined publicly available Flock search logs itself and identified suspicious patterns that prompted investigations by three police departments.
One Indianapolis officer appeared to have searched vehicles used by his wife and two close personal acquaintances 3,759 times over roughly ten months. The department told the Post that it had not previously conducted regular audits of officers’ Flock searches and opened administrative and criminal investigations after the newspaper raised the activity with officials. In Haines City, Florida, another officer was charged after investigators found he had repeatedly searched his wife’s vehicle over nearly two years while recording reasons suggesting the searches were connected to criminal investigations.
More recently, WIRED reported that a former Alpharetta, Georgia, officer searched for a former romantic partner’s vehicle 56 times and another officer’s vehicle 29 times. Internal investigators concluded that his use was inconsistent with department policy, and he resigned in August.
These are individual cases with different facts, and they should not be treated as evidence that most officers misuse ALPR systems. They do, however, expose a familiar problem wherever organizations give people access to powerful information: authorization answers whether someone can use a system. Governance still has to answer whether they should be using it for that particular purpose.
Why is Flock Safety misuse an insider-risk issue?
Insider risk tends to conjure up images of disgruntled employees stealing customer databases before disappearing to a competitor. In reality, the category is much broader. Sometimes the person already has legitimate access and uses it for a reason that falls outside the purpose for which that access was granted.
That distinction matters because conventional access controls may work perfectly in these situations. The account belongs to the correct employee. Authentication succeeds. The system records a valid query. Nothing necessarily looks like an intrusion because there has not been one.
The risk sits in the relationship between privilege, purpose, and accountability.
This applies across almost every modern organization. An administrator can inspect user accounts. An HR employee can see workforce records. A security analyst may have access to monitoring data. Customer-service staff can view personal information. Finance teams can see transactions, managers can access employee performance information, and increasingly, AI and analytics systems can make large volumes of organizational data easier to search.
Most people need that access to do legitimate work. The interesting control question is what happens when somebody uses it for something else.
Our article on the Psychological Perimeter: Human Risk, AI, and Cyber Resilience looks at this intersection of identity, access, context, and human motivation in more depth. Insider risk emerges partly because trusted people necessarily operate inside the perimeter we are trying to protect.
Why audit logs are not the same as oversight
One of the more useful details in the Flock reporting is that the system already created audit records. Flock logs searches, including information about when a search was conducted and the reason entered by the user. The Washington Post was able to identify suspicious patterns from available records, including extraordinarily frequent searches of individual license plates.
The awkward part is that several departments were not routinely reviewing those records.
That is an organizational control problem rather than a logging problem. An audit trail creates evidence that something happened; oversight requires somebody to examine that evidence, recognize when a pattern looks unusual, investigate it, and have the authority to act. The distinction sounds obvious until an organization discovers that it has been diligently collecting several years of excellent evidence nobody owns.
The Post reported that some agencies had no regular audit process, formal training program, or written policy governing the technology. Before Flock’s August changes, its automated Audit Assistance feature was voluntary and, according to the company, used by only about one-third of its roughly 7,000 law-enforcement customers.
This is where organizational norms start to matter as well. People behave differently when the permitted use of a system is clear, unusual activity is likely to be reviewed, and misuse has predictable consequences. A policy sitting somewhere in a document repository does not create the same operating environment as visible, routine accountability.
What has Flock Safety changed?
Flock has responded to concerns about misuse with a substantial set of changes to its platform and policies. In August, the company announced that Audit Assistance would become mandatory, allowing its systems to review searches for abnormal activity rather than leaving that capability optional. It also introduced required case codes, proactive account lockouts where misuse is suspected, stronger offense filtering, mandatory multi-factor authentication, and a recommended seven-day default retention period for ALPR data.
Those changes are interesting from a human-risk perspective because they move some of the burden away from expecting every agency or supervisor to notice misuse manually. Requiring a case code creates more friction around why a search is being made. Automated analysis can help surface patterns worth reviewing, while stronger authentication makes it harder for another person to borrow an authorized user’s access.
None of those measures can guarantee appropriate behavior, and Flock itself describes privacy and accountability as continuing work. They do make the control environment less dependent on everyone remembering to behave correctly and somebody eventually deciding to inspect the logs.
That is usually a better place to start.
What can companies learn from the Flock Safety cases?
The obvious lesson is to review privileged access, but organizations should go further than asking who has it. They should understand what legitimate use looks like, which activities carry greater privacy or security consequences, and where unusual patterns would be visible if somebody started looking.
Sensitive systems should have an accountable owner for access and oversight. High-risk activity may need to be linked to a case, ticket, customer request, or other business purpose so that employees are not simply typing something plausible into a free-text box. Access should also change when roles change, and monitoring should concentrate on patterns that are genuinely anomalous rather than turning ordinary employees into permanent suspects.
Training has a role, particularly where employees work with privileged data or surveillance capabilities. People need to understand not only how to use a system, but the ethical and organizational boundaries around that access, how misuse is monitored, and what to do if they see another person crossing those boundaries.
The wider Human Risk Management question is whether the organization has created conditions in which appropriate use is clear, misuse is difficult to hide, and people believe that rules around sensitive access are real rather than ceremonial. Our article The Hidden Human Risks That Won’t Show Up in Your Audit—Until It’s Too Late explores the same problem across privileged accounts, vendors, credentials, and other areas where formal controls can look reassuring while everyday behavior tells a different story.
The Cybermaniacs take
The Flock cases are uncomfortable because the technology can be useful for exactly the same reason it can be misused: it gives authorized people powerful information when they need it.
Removing all access is therefore not a serious answer. Hospitals, banks, technology companies, governments, retailers, manufacturers, and security teams all depend on trusted employees having access to systems and information that would be problematic in the wrong hands. The challenge is designing that trust so that legitimate work remains easy while unauthorized use becomes visible and consequential.
That requires more than cybersecurity awareness. Competency matters, but so do access design, role clarity, leadership expectations, monitoring, management behavior, reporting channels, culture, and the perceived likelihood that inappropriate activity will actually be noticed. Those are Company OS conditions as much as individual Human OS conditions.
Flock’s own response is instructive. Adding stronger technical guardrails helps, but many of the reported cases were ultimately governance failures around an authorized user rather than outsiders defeating the security perimeter. The software had records of what people were doing; several organizations had not built the operating practice that turned those records into oversight.
That is a human-risk problem worth paying attention to.
How Cybermaniacs can help
Cybermaniacs helps organizations understand human risk across competency, behavior, psychology, culture, and the organizational conditions surrounding how people actually work. Our Human Risk Baseline goes beyond training and phishing metrics to identify where risk exists, what is contributing to it, and which populations or conditions need attention.
For organizations building or maturing the broader capability, HRM Advisory & Program Management connects human-risk strategy with governance, measurement, learning, culture, communications, engagement, targeted interventions, and ongoing program operations.
Cybermaniacs also delivers continuous cybersecurity awareness and competency development, managed phishing and social-engineering simulations, policy learning, cyber-culture programs, employee engagement, champions programs, and targeted communications. As organizations introduce AI and more powerful data-driven tools into everyday work, those programs increasingly need to address the judgment, authority, access, and accountability surrounding the technology as well.
Giving trusted people powerful tools is part of running a modern organization. Making sure the trust has some adult supervision is part of running one well.
FAQ
What is Flock Safety?
Flock Safety provides automated license plate reader technology used by law-enforcement agencies and other organizations. Its cameras capture vehicle information that authorized users can search for purposes such as investigating crimes, locating stolen vehicles, and finding missing people.
What did the Washington Post find about Flock Safety misuse?
The Washington Post found at least 69 police officials who had been accused, charged, or convicted of misusing Flock or other license plate reader systems for unauthorized purposes. In at least 15 cases, potential misuse was first identified by people outside the relevant police department.
How were Flock Safety cameras allegedly misused?
Reported cases included authorized users searching for vehicles associated with spouses, former romantic partners, friends, and other personal contacts without a legitimate law-enforcement purpose. Some investigations also found misleading reasons entered for searches.
Was the Flock Safety misuse a data breach?
The cases discussed here are primarily examples of alleged or confirmed misuse of legitimate access rather than an external attacker breaching Flock’s systems. That makes them particularly relevant to insider risk and privileged-access governance.
What has Flock Safety changed to prevent misuse?
Flock announced changes including mandatory Audit Assistance for detecting abnormal activity, required case codes, proactive lockouts, stronger offense filtering, mandatory multi-factor authentication, and a recommendation that ALPR data be retained for seven days by default.
Why is Flock Safety misuse an insider-risk issue?
Insider risk can occur when someone who is legitimately authorized to access sensitive information uses that access for an unauthorized purpose. Reducing the risk requires appropriate access controls, monitoring, audits, clear policies, management oversight, and a culture of accountability.
What can companies learn from the Flock Safety cases?
Organizations should know who has access to sensitive systems, define acceptable use, connect high-risk activity to legitimate business purposes, review anomalous behavior, maintain meaningful audit processes, and ensure that changes in roles or responsibilities result in changes to access.
