A recent roundup of the American tech news cycle contained an item that, at first glance, seemed mundane: a federal judge in Oklahoma called queries of a street-camera database “indiscriminate mass surveillance.” Behind that dry phrase sits a specific machine and a specific business almost nobody knows outside the United States. Flock Safety is a private company from Atlanta that owns the country’s largest network of license-plate-reading cameras: around 120,000 devices, every car on the road, every plate fed into one shared database accessible to police.
The case itself is almost anecdotal. In May 2026, a sheriff’s deputy in Tulsa County was driving down the highway when he spotted a Mazda crossover with California plates. He had exactly one reason to stop the car—the plate was not local. He ran the plate through the Flock system, got more than fifty records of where the car had been over the previous month, then pulled over the woman driving it, made her reconstruct her route over the past few days from memory, and checked her account against the camera data. He considered the discrepancy sufficient grounds for a search. The car contained 91 pounds of methamphetamine.
Looks like clean police work. Judge Sarah Hill ruled otherwise: the vehicle search was illegal, and all evidence—from the cameras and from the car—was excluded from the case. Not because the cameras are bad, and not because the woman is innocent. Because before asking that single question of the machine, the officer should have obtained a warrant—and the line between a lawful query and an unlawful one had never yet been drawn. That was what caught me: a device that is legally harmless on its own becomes something else when you install 120,000 of them and link them into one database. A nine-year-old company worth billions now exists only for as long as judges decide it is not one device, but something else.
A camera on a pole, a solar panel on top, a plate reader inside—Flock’s device looks modest and, on paper, does something straightforward: photographs the rear of passing cars, recognizes the characters on their plates, and sends them to a server along with the time and location. That is exactly how the company describes itself: “focused on cars, not people,” simple technology—“a car drives by, we take a picture, read the plate.” When Flock started running into trouble in 2026, its founder Garrett Langley repeated exactly that in interviews: nothing complicated, just a still image.
Then come the details that add up to a very different story. First, the camera remembers more than the plate; it also records what Flock calls the vehicle’s “fingerprint”: make, model, color, dents, bumper stickers. Second, there is a tool called FreeForm, which lets users search using an ordinary written description—“white pickup truck with a sticker,” “person in a mask”—and the system itself returns matching images from across the entire network. So it searches not only by plates, but by any visible trait.
Third, the product line has long since outgrown a single reader. There are Condor pan-tilt-zoom cameras that automatically zoom in on faces, phone screens, and objects; Raven acoustic sensors that recognize gunshots—and, since 2025, “human distress,” meaning screams; “first responder” drones with standard, thermal, and night optics that can see a plate from 600 meters away; and the OS Investigate program, discussed separately below. The point is that we are not looking only for plates. The plate is simply the easiest of the traits the system knows how to use to find a car.
What makes Flock unusual is who it sells to. Historically, license-plate cameras were almost always installed by police. Flock started differently: its first customers were homeowners associations—groups of residents in private developments. In the company’s early years, they accounted for more than 40% of its business. The logic is simple: the neighborhood chips in, installs a camera at the entrance, and it costs the police nothing. The community voluntarily gives its data to police.
From this model grows a network with no single owner, but one shared memory. Any police department with a contract can use a single query to view not only its own cameras, but cameras in neighboring cities, counties, and entire states. As attorney Michael De Dora put it when speaking with reporters, one city merely agrees to share data with another—and suddenly there is “a searchable, hand-me-down repository of Americans’ movement histories,” one that remains entirely unregulated. A retention limit written into one city’s contract means nothing if the neighboring department has already taken a copy of the data.
The scale of this memory is striking even in disclosed leaks. One database assembled from police responses to records requests contained data on more than 2.3 million license plates and tens of millions of searches. In data released for June 2025 alone, there were more than 700,000 individual queries from hundreds of agencies, including hundreds from the Border Patrol. These records are structured as a log: date, time, officer’s name, reason, number of cameras searched—and the car’s plate. The plate is the link that ties a person to reasons like “drugs,” “illegal alien,” “wanted.”
Flock’s legal problem grew out of arithmetic. American law has long rested on a reasonable rule: what a person exposes to public view, on a road or street, is not considered private. Judge Sarah Hill did not overturn that rule—she showed why it breaks down at scale. One photograph of your car on one street says nothing. But when a system passively, without cause and without distinction, records all your movements for a month, then hands them to police at the click of a button, that is no longer a photograph.
“The factors upon which the government relies are precisely the circumstances ordinary Americans encounter on long trips,” she wrote, rejecting the theory that a long route is inherently suspicious. The judge explicitly compared Flock to Carpenter, where the Supreme Court found that location tracking was a search requiring a warrant, and stressed the difference: Carpenter targeted one person, while this tool gathers information on every car passing any camera in the network and produces it on request. The phrase “indiscriminate mass surveillance” in the ruling is a legal conclusion: a query of such a database is itself a search.
What is new about that conclusion is that it runs counter to dozens of similar rulings by other courts. The Oklahoma case does not create binding precedent, and several other cases about the legality of warrantless queries are being heard across the country at the same time. There will almost certainly be an appeal. But Judge Hill put into words what only civil-liberties advocates had said before her: the courts inherited an old understanding of technology, while the technology has changed since then.
It is worth explaining what “excluding evidence” means here. America’s “fruit of the poisonous tree” rule works simply: if the search was illegal, the court admits nothing that grew from it. The severity of what was found does not matter: both the result of the car search and the camera data go in the trash. That is the cost of procedural error, and the judge’s opinion says so plainly: the law must draw a line where the price becomes too high.
The most interesting part of this case is the standard itself. The 91 pounds of methamphetamine are secondary to the story. Search the web for cases like this and you find that excluding evidence is rare; civil-liberties groups usually argue over rules for data access, leaving the fate of any particular defendant aside. Here, the reverse happened: the prosecution was left without evidence, while the defense gained a precedent-setting formulation. And the main question now hanging in the air was posed by the practice itself: how do you distinguish “the cop ran a plate for a case” from “the cop ran a plate because he felt like it”—when both look like the exact same line in a log?
The search logs police disclose to the public in response to records requests are documents called “network audits.” Their tables include a column in which an officer must state the reason. That column told the whole story.
The civil-liberties organization EFF examined those logs and found that the “reason” column is filled in with anything at all. One officer in Indiana entered “LMAO,” while managing to search 19,000 cameras across 1,558 cities and towns with a single request. Another wrote “idk”—short for “I don’t know.” There were “LOL,” “Haha,” “Hehe,” “blah,” and “TBD.” At the Priceville Police Department, the entry “TBD” alone was used in nearly 1,950 queries. Someone settled on the word “sexy”; someone else used the phrase “FUN KID.” One officer offered a comprehensive explanation: “robbery, don’t remember case number, leave me alone.” Others simply pounded the keyboard: “asdfg,” “jhjhjkhj,” “nmbvcbnm.”
Formally, Flock is said to have improved the process by forcing users to pick a reason from a drop-down list. EFF objects: the list merely gives the appearance of order—it does not require the selected reason to match the query’s actual purpose. Put simply, the system checks that the officer clicked a button, not that they searched for what they said they were searching for.
A separate story is how the company demonstrated the system. Documents obtained by journalists showed that Flock created an account called “Flock City PD”—a police department that does not exist. From this “department,” company employees searched real, live cameras in actual cities for “crowd,” “person in mask,” “vehicle with pro-Trump sticker,” “Star of David,” and “cars a pretty girl would drive.” The system blocked or warned against certain searches; others went through without a hitch.
The company explains these logs by saying it was demonstrating to police precisely which queries cannot be made, while testing its own filters. The logic of that defense is clear, but it carries an unmistakably unpleasant implication, one articulated by local resident Jeff Hoonjar: if the product proudly blocks a search for “Star of David,” then it is, in principle, capable of finding cars by religious and political markers—and a private company decides whether to allow access to that information. The same premise had already led to other incidents: a live camera was used to peer into a children’s gymnastics room and at the grounds near a Jewish community center—and those, too, were sales demonstrations, after which the city extended its contract anyway.
In the wake of the scandals, cities and counties began terminating contracts. The civil-liberties group Secure Justice counted 214 cities and counties that have left the system since 2021, 90 of them in August 2026 alone. That is nearly three terminations a day. Flock itself responds that new customers are arriving faster, citing a ratio of ten to one, up from seven to one before.
The numbers contradict each other, but the everyday details that do not fit inside them are more interesting still. In Verona, Wisconsin, the council voted against renewing the contract, but the cameras remained on the poles: the company was in no hurry to take them down, so the city pulled trash bags over them, and the devices were not removed until February. In Roanoke, Virginia, a camera was found in someone else’s yard—on the lawn of a woman whose address was not on the list of approved installations; of the 41 devices installed, 30 turned out to be somewhere they were not supposed to be. In Grass Valley, the cameras returned less than a month after the city removed them. And in West Hollywood, the contract was renewed despite packed meetings full of furious residents—because the city has no police department of its own, it is policed by the county sheriff, and the city’s view on the cameras turned out not to be the only one that mattered.
Most revealing of all was how the system broke its own promise of transparency. When it emerged that police departments were publishing search logs online without redacting plates, an enthusiast named Chris van Pelt built HaveIBeenFlocked.com from them—a site that, essentially, held a mirror up to the company. Through these “unredacted” exports, data on more than a million surveillance targets and hundreds of ongoing investigations entered the public domain: one mistake in any small town in the country could expose both search targets and active police operations on the other side of the United States. Flock’s response came in two stages: first, through a third-party firm, it tried to knock the site off hosting services, citing an infringement of intellectual-property rights; then it simply removed from the logs the very information they had been requested for in the first place—officers’ names and license plates. Not only from outsiders, either: police officers themselves stopped being able to see the names and plates. A tool designed to control access became a means of concealing it.
To understand how high the stakes are, look at the company’s numbers. Flock was founded in 2017 by three Georgia Institute of Technology graduates; the three of them assembled the first cameras by hand on the founder’s dining table. Today the company is valued at more than $8 billion, has raised over $1.2 billion in investment, and its annual recurring revenue has passed $500 million—and, by its own admission, more than half of its new money now comes from video, gunshot detection, and drones. Its investors are big names: the a16z fund, Tiger Global, entities associated with Peter Thiel. The company spends millions on lobbying: around $840,000 at the federal level in 2025, with another $1 million spread across 34 states.
That is why the scandal stopped being technical. Both political camps came out against the cameras. Texas Governor Greg Abbott, a Republican, ordered Flock procurement for state needs suspended—after it emerged that the state budget had already put at least $30 million into the network. Florida revoked permits for license-plate cameras on state roads. August alone brought three bills with telling names—the Ban Flock Act, the Flock-Off Act, and the No Flock Act—and they were pushed by progressives led by Bernie Sanders as well as Republicans, including Thomas Massie and Greg Steube. One important detail: neither the Ban Flock Act nor the others bans Flock by name as such; they prohibit federal agencies from buying, using, or sharing license-plate-camera data without a warrant. The penalty is financial leverage: a state or city that violates the rules loses up to 10% of certain federal highway subsidies.
Public opinion has gone the same way. Polling shows that about 46% of Americans oppose the use of license-plate cameras in their neighborhood—13 percentage points more than a year earlier. Residents in at least 36 states have removed, sawed down, painted, and set fire to the devices. One person in New York cut down a camera with a power saw, another in Idaho rammed one with a truck, a third in California sat on the lawn holding a piece of cardboard on a stick in a way that blocked the lens. Others went to court; in total, the civil-liberties Institute for Justice has collected more than 150 documented cases of abuse involving such systems in its database.
But the most serious divergence is not between the company and its critics. The two figures, head-to-head, simply do not match. The company says it is growing without question; its critics say the opposite. Both rely on their own reports, and there is no way to reduce them to a single chart: their definitions of customer and termination are too different.
The second divergence is far more serious. As soon as Flock began talking about its drop-down list of “proper” reasons for a query, EFF called it a substitution of the question: it sees a checker for the reason, but no check that the reason matches the real case. Meanwhile, the company insists that the data belong to the customer and are “usually” deleted after 30 days—while the Los Angeles inspector general, after opening the contracts of one of Flock’s largest customers, found a clause allowing the data to be retained for five years and used “for any purpose at the company’s sole discretion.” Thirty days in a public policy versus five years in a signed document is not a minor detail. It is the very line from Judge Hill’s ruling, drawn on paper rather than in a courtroom: the customer thinks they bought one thing, but they are buying another.