Flock Safety's New Privacy Rules Do Little To Ease Concerns Over ALPR Surveillance
The company’s attempts to protect Americans’ privacy “will do nothing to protect innocent people from warrantless mass surveillance,” says an Institute for Justice attorney.
Amid mounting public backlash, Flock Safety, the largest provider of automatic license plate readers (ALPR) in the United States, released a statement on Thursday touting new policies "strengthening privacy, accountability, and security." But the changes still fail to address the constitutional concerns held by civil liberty and privacy advocates.
Over the last few weeks, debate over ALPR systems has reached a new high. Privacy and data security concerns over the mass surveillance technology have prompted an anti-Flock movement, including websites that map more than 130,000 ALPR cameras across the country and a search engine that can find whether a particular license plate number has been looked up in Flock's database. In at least 23 states, activists have resorted to destroying the tech, according to The Guardian. And in July, over 20 local jurisdictions cancelled their contracts with Flock Safety entirely.
Adding fuel to the anti-Flock fire, reports began streaming in on the growing number of police misusing ALPR data, including conducting wrongful stops at gunpoint and using the data for purposes unrelated to law enforcement, such as stalking romantic interests. The Institute for Justice (I.J.), a nonprofit law firm that fights for strong Fourth Amendment rights, has tracked over 100 incidents of ALPR abuse so far.
In response, Flock Safety recently announced new data security policies. The reforms include lowering the default data retention window from 30 to seven days unless the data is tagged for preservation, making the company's auditing tools mandatory for all customers, and requiring case numbers for all law enforcement searches by the end of 2026. The company also reiterated that Flock customers are the ultimate owners of their ALPR data, choosing who may access it and when, and underscored that police leads stemming from the technology should always be confirmed by an officer.
Flock defenders argue the technology has helped drive down the crime rate and that "smart regulations" like the ones proposed by Flock could be enough to mitigate privacy concerns. However, Flock's own study on the impact of its technology on crime relies on cases in which ALPR cameras "supported," "helped," or "contributed" to investigations, and does not clearly show any marginal impact.
Civil liberty advocates aren't buying any superficial attempts to quell the nationwide outcry against Flock's massive invasion of privacy.
"This is yet more window dressing," according to Robert Frommer, a senior attorney at I.J., who argued Flock's proposed reforms merely place the onus on local police departments to police themselves when it comes to Americans' data security and privacy.
Similarly, Chad Marlow, senior policy counsel at the American Civil Liberties Union (ACLU), said, "Flock's latest announcement still appears more focused on addressing a PR problem than the significant privacy and other harms its products create." The ACLU's analysis of the reforms shows how the company's changes can be easily circumvented and provide little reassurance that the new data security policies will work consistently or as promised.
For example, although Flock will soon require a case number for each search conducted by law enforcement, the announcement fails to explain what measures will be in place to ensure that the case codes entered are legitimate. This is concerning, according to the ACLU, particularly since Flock's earlier attempt to crack down on police misuse by requiring officers to input a reason for each data lookup did little to ensure privacy protections. Instead, the police quickly adjusted to using such vague search rationales as "criminal justice," "investigation," or even "hehehe."
In a previous interview with Reason, I.J. attorney Michael Soyfer likened Flock's soon-to-be-mandatory auditing tool to a "black box" with little public information available on how the tool works. Soyfer also expressed skepticism over relying on a private company to hold the police accountable, particularly given that "Flock's ultimate customer is the police department."
However, the Constitution provides a framework for protecting Americans from unreasonable search and seizure by police.
"One word you don't see mentioned anywhere in Flock's proposed reforms is the word 'warrant,'" Soyfer said in a statement. "And until police are required to get a warrant based on probable cause to search ALPR databases, these half measures will do nothing to protect innocent people from warrantless mass surveillance."
