Flock Safety promises your city's data stays local. San Francisco found out the FBI, ICE, the DEA, and a dozen other federal agencies had searched its database 1.6 million times in seven months — nobody asked permission. Mountain View discovered 250 agencies had run 600,000 searches on their residents. The class action lawsuit seeks $2,500 per violation. Do the maths on 1.6 million violations. A security researcher found the skeleton key to America's largest surveillance network. Flock's cameras — the ones photographing 150 million vehicles a day — had hardcoded passwords baked into the firmware. Anyone with a screwdriver and 60 seconds could take control. Then 67 cameras were found streaming live, unencrypted video of playgrounds and parking lots to the open internet. Senator Wyden called for an FTC investigation. Flock said the flaws "pose no risk to customers.".
What they claim: Flock claims to uphold the highest standards of data integrity and maintains SOC 2 Type II and ISO 27001 certifications.
What we found: GainSec researcher disclosed 51 security findings with 22 CVEs assigned. CVE-2025-47823: hardcoded password in LPR firmware. Root shell in under 60 seconds with physical access. 67 Condor cameras streaming unencrypted video of playgrounds and parking lots to the open internet. Senator Wyden requested FTC investigation. Flock said flaws pose no risk to customers.
What they claim: Flock Safety says allegations of reproductive healthcare surveillance would raise profound constitutional concerns and implies adequate safeguards exist.
What we found: EFF obtained documents showing a Johnson County TX deputy ran ALPR searches with the note "had an abortion, search for female." The second search probed 6,809 Flock networks, accessing 83,345 cameras across nearly the entire country. Both Flock and the Sheriff claimed she was a missing person. EFF proved this was false through court records.
What they claim: Flock markets Raven as gunshot detection technology.
What we found: In Oct 2025, EFF discovered Flock planned to expand Raven microphones to listen for human distress including screaming. Remote software update — no new contracts, no public notice, no community vote. EFF fought 9 months. Flock abandoned Jul 2026. Microphones remain installed and continue to analyse all sounds.
What they claim: Flock says data collection stops when contracts end and that cameras follow customer directives.
What we found: Evanston IL ordered cameras removed Aug 2025. Flock reinstalled all 18 cameras without authorisation. City issued cease-and-desist. Last 2 removed Mar 2026 only after journalist inquiry. Cambridge MA: Flock installed NEW cameras after city ordered removal — called a material breach of trust. Eugene OR: cameras still active weeks after officials ordered them off.
What they claim: Flock argues courts have repeatedly and uniformly upheld ALPR as constitutional.
What we found: Supreme Court ruled 6-3 in Chatrie v. United States (Jun 29, 2026) that geofence warrants are Fourth Amendment searches, extending Carpenter privacy principles. Fourth Circuit case Schmidt v. City of Norfolk directly challenges Flock with ACLU/EFF amicus briefs. Georgia State Patrol officer already wrote CAPTURED ON FLOCK CAMERA on a traffic citation for holding a phone.
What they claim: Flock Safety says it will never share or sell data and requires explicit written permission for any data sharing.
What we found: FBI, ICE, DEA, CBP, ATF, and other federal agencies queried San Francisco's Flock database more than 1.6 million times in seven months without permission. Mountain View found 250 external agencies conducted 600,000 searches. Class action filed Feb 2026 seeking $2,500 per violation under California ALPR Privacy Act.
What they claim: Flock markets built-in audit trails and accountability safeguards, claiming every search is recorded and tied to a specific user.
What we found: Institute for Justice documented 28 cases of officers abusing ALPR to stalk people. Joplin MO: officer ran one woman's plate 395 times in 10 months. Sedgwick KS: Police Chief tracked ex-girlfriend 228 times, followed her in patrol car. Milwaukee: detective investigating stalker cop was himself arrested for using Flock to stalk two people. Five Albany GA officers arrested by GBI. Almost none caught by audits — victims reported the stalking.
What they claim: Flock markets itself as a tool for objective evidence that helps communities without compromising individual privacy.
What we found: EFF obtained 12+ million searches by 3,900+ agencies. More than 80 law enforcement agencies used language perpetuating harmful stereotypes against Romani people, performing hundreds of searches using terms such as "roma" and racial slurs — often without mentioning any suspected crime.
What they claim: Flock maintains SOC 2 Type II certification and claims no evidence of risk to customer data.
What we found: Unredacted audit logs released via public records requests exposed 2.3 million license plates and 184 million search queries. HaveIBeenFlocked.com built as searchable tool. Flock's fix: strip officer names from future logs — making abuse harder to detect. Flock tried to take down the website; Cloudflare refused. 70 Flock URLs with full plates indexed by search engines.
What they claim: Flock claims to be trusted by more than 6,000 communities with community-controlled data.
What we found: By mid-2026, 53+ cities had cancelled or deactivated contracts citing unauthorised federal access, privacy violations, and cybersecurity failures. Austin, Cambridge, Mountain View, Denver, LAPD, Santa Cruz, Charlottesville, Evanston, Olympia, Salem. Despite cancellations, Flock crossed 100,000 cameras. CEO initially denied federal contracts, then admitted CBP pilot. 35 customer accounts reportedly stolen by hackers.
What they claim: Flock markets real-time intelligence and accurate vehicle identification to solve crimes.
What we found: 98-page LAPD inspector general audit found 32.3% error rate on stolen-vehicle alerts. 161 false alerts triggered armed stops on innocent drivers in two months. LAPD let contract expire Jul 2026. Flock failed to provide feedback on required data security terms for two months.
What they claim: Flock claims strict access controls and says every search is recorded and tied to a specific user.
What we found: 404 Media obtained records showing Flock employees accessed cameras at the Marcus Jewish Community Center of Atlanta including a children's gymnastics room and pool as sales demonstrations. VP Bob Carter accessed the Gymnastics camera. Parents had no idea their children were being watched as part of a corporate pitch. CEO apologised. City renewed contract.