Flock Safety Cameras: Crime Tool or Privacy Risk?

Somewhere between your house and wherever you drove today, there's a good chance a camera clocked your car. Not to ticket you. Not to watch you. Just to note that you existed, at that spot, at that time — and file it away.

That's the quiet reality of Flock Safety's Falcon automated license plate reader, a device that retired Microsoft engineer Dave Plummer dissects in a recent video with the methodical patience of someone who spent decades tracing bugs through operating systems. His breakdown is worth your time not because it reaches a verdict, but because it maps the terrain well enough that you can form one yourself.

What the camera actually does

The Falcon is solar-powered, cellular-connected, and requires no trenching for power or network cable. That last detail matters more than it sounds. Traditional municipal camera installations are infrastructure projects — permits, poles, fiber runs, and committees arguing about conduit ownership. A self-contained IoT node on a subdivision entrance or rural road skips all of that. It's why the network has spread quickly.

When your car rolls past, the camera freezes the frame, isolates the plate region, corrects for angle, runs optical character recognition, and produces a candidate plate number. Simultaneously, computer vision models classify the vehicle: body style, make, approximate color, and visible distinguishing features like roof racks or body damage. Flock calls this collection a "vehicle fingerprint." The plate number plus that fingerprint, plus timestamp and location, gets transmitted to Flock's cloud infrastructure.

Plummer's clearest concern isn't the camera itself — it's what happens next. "That database of images and metadata is where the system stops being merely a camera and starts becoming something more like Google for cars." One detection is a data point. A network of thousands of cameras, all feeding the same searchable index, is something else. As Plummer puts it: "One photo, not very exciting. But link thousands of those cameras into one database, and each photo becomes a breadcrumb. Connect enough breadcrumbs and you've got an interesting trail."

This is what makes the privacy debate harder than a simple yes/no on cameras. Flock describes its product as capturing point-in-time images of vehicles on public roads — and that's accurate. Critics respond that aggregating thousands of point-in-time observations is functionally a travel history — and that's also accurate. The distinction erodes as camera density increases, which it is doing.

The alerting side

The system's other major function is real-time hot list matching. Law enforcement agencies subscribe to lists of plates associated with stolen vehicles, Amber alerts, wanted suspects, or active investigations. Flock says its system integrates with the National Crime Information Center. When a matching plate passes a camera, the system pushes an alert to officers almost immediately.

The practical value here is genuine. Police departments credit these systems with recovering stolen vehicles, locating missing persons, and corroborating timelines in investigations. When a witness describes only a vague vehicle, the camera network can narrow a field of candidates that would otherwise take hours of manual footage review.

But Plummer is careful to separate case utility from crime reduction: "A screwdriver can unquestionably repair a machine, but proving that buying more screwdrivers reduce mechanical failures throughout the city is a much larger statistical problem." That's a useful frame. Individual success stories are easy to document. Whether the network produces a measurable reduction in overall crime rates is a harder, largely unanswered question.

There's also the accuracy problem. ALPR is an inference engine, not a certainty engine. Rain, glare, dirt, motion blur, unusual plate fonts, and viewing angle all degrade reads. A seven becomes a two. An O becomes a zero. The system produces a confidence score alongside each candidate — tighten the threshold and you reduce false matches but miss more legitimate reads; loosen it and you catch more but introduce more false positives. This is the same precision-recall tradeoff baked into spam filters, medical screening tools, and antivirus software. It's well understood. It's also inescapable.

What isn't inescapable is acting on an unverified alert. Plummer cites Redmond, Washington as an example of a jurisdiction requiring officers to visually confirm a plate match before taking action. That procedural step is not bureaucratic ceremony — documented ALPR errors and stale hot list entries have resulted in innocent drivers being stopped at gunpoint. The human verification layer is the difference between a useful investigative lead and a terrifying encounter caused by one misread character.

The data question

Flock's default retention period is 30 days. Images and metadata are encrypted in transit and at rest. After the retention window closes, data is hard-deleted from the platform — unless local law or the agency's contract specifies otherwise, in which case retention can extend up to a year with approval from an elected official or governing body.

Thirty days is a meaningful constraint. A shorter window limits retrospective searches and reduces the consequences of a breach. But it isn't universal, and there's a caveat Plummer flags clearly: once evidence is exported from the platform into a case file, it lives under that agency's own evidence retention policies. Flock's deletion clock doesn't reach into someone else's file system.

The company says customers own their data, sharing is opt-in, and it doesn't sell data to third parties. Its security posture includes role-based access controls, audit logging, SOC2 Type 2 review, and ISO 27001 controls — a reasonable baseline for a system handling sensitive law enforcement data.

The audit log deserves its own paragraph. Every search is recorded: who ran it, when, the stated purpose, the case number if required, offense type, and which camera networks were queried. Flock's transparency portal exposes portions of this publicly. That's a meaningful accountability mechanism — and one that the broader Flock ecosystem has struggled to make consistently enforceable across jurisdictions.

But Plummer's Windows administrator analogy is pointed: "A log is a witness, not a guard. Logging a misuse does not prevent it unless somebody reviews the log, recognizes the pattern, and imposes some consequences." Every security professional has seen organizations with beautiful audit infrastructure that nobody actually monitors. The log is only as good as the process attached to it.

The Illinois episode in 2025 illustrates both the risk and the accountability mechanism simultaneously. A state Secretary of State audit found that US Customs and Border Protection had accessed Illinois plate reader data outside the terms of the state's data-sharing agreement. Illinois shut down the access. Flock paused its federal pilot and added additional controls. Plummer reads this correctly: critics see proof that policy guardrails failed; supporters see the audit trail detecting the problem and the system self-correcting. Both are true. That's the uncomfortable territory security people live in — you learn about a failure, you respond to it, and you hope the response holds.

The federation problem

A city that approves 50 local cameras may, through data-sharing agreements with neighboring jurisdictions, gain search access to a regional or statewide network far larger than anything its residents debated. Plummer draws an honest parallel to the internet: independent networks agreed to exchange traffic and the combination became more powerful than any individual node. The difference, as he notes, is that internet packets belong to willing participants. Cars passing public cameras don't negotiate peering agreements.

This matters for how communities should think about deployment decisions. Approving a local camera installation is not a self-contained choice anymore. The effective surveillance footprint may be considerably larger than what appears on the agenda at a city council meeting.

What the camera cannot know

The system records a vehicle, not a driver. The registered owner may not be behind the wheel — the car could be borrowed, rented, sold without updated records, or displaying a stolen plate. Flock says the core ALPR product doesn't use facial recognition. Some municipalities report their deployments don't connect directly to DMV databases. But law enforcement retains access to other authorized databases, meaning a plate observation can still get associated with a person during an investigation.

Plummer's IP address analogy holds up: a license plate isn't personally identifiable information in the strict sense, but it isn't anonymous either. It identifies a vehicle, and vehicles — with enough context and database access — usually lead back to people.

The question underneath all the others

Plummer's framework for thinking about governance is worth sitting with. The camera is a sensor. The cloud service is an index. The hot list is an alerting rule. The sharing network is a federation. None of those components know why the person at the keyboard is running the search. Finding a kidnapped child and monitoring a political protest both look identical at the query level.

That's not an argument against the technology. It's an argument for treating it the way engineers treat systems with a large blast radius: the more powerful the query, the narrower the permission should be; the broader the sharing, the more visible the audit should be; the more consequential the alert, the more essential the human verification becomes.

Communities deciding whether to deploy these systems have more useful questions available than "cameras: good or bad?" Who can authorize a search, and for what offense? Who reviews the audit logs, and how often? Which agencies can access the network? Are residents told where cameras are installed and what capabilities are enabled? Can exports outlive the platform's deletion window — and if so, under what rules?

The answers don't eliminate the tension. A Flock camera may help find a missing child and record a thousand unremarkable grocery runs in the same week. Both things happen on the same hardware. The machine's usefulness and its privacy implications are the same feature, viewed from different angles.

The question is whether the governance around it is as capable as the technology itself. So far, in most places, that's the weaker half of the equation.

---

Rachel "Rach" Kovacs is Buzzrag's cybersecurity and privacy correspondent.