cross-posted from: https://infosec.pub/post/48960815
The ACLU documents how an automatic license plate reader company has lied about its operations, signaling a need for reputable governments to avoid working with Flock Safety.
During a city council meeting in a suburb of Wisconsin in April, the city of Oshkosh considered whether it should approve a contract to use automatic license plate readers (ALPR) from Flock Safety, a prominent company that provides ALPRs to law enforcement agencies across the country. During the meeting, one city council member asked Flock if the company’s ALPR system created heat maps that could reveal where a particular vehicle had driven over a period of time. Flock’s chief information security officer, who was in attendance, told the council that Flock’s system did not “create a pattern or heat map of an individual’s movement” through the tracking of their vehicles. At the end of that meeting, the Oshkosh City Council approved a contract with Flock. The very next morning, the city learned that Flock had lied.
...
The company has demonstrated a pattern of treating legitimate operational questions and concerns not as problems to be solved, but rather as mere public relations issues.
In Colorado, Loveland Police Chief Tim Doran raised concern that federal agents were accessing the town’s ALPR data. Flock responded by telling the chief that federal agencies no longer had access to Loveland’s license plate readers, and had their CEO reiterate to the press that federal data sharing was a non-issue because Flock had no federal contracts. After contradictory information later came to light, the company was forced to admit that it did, in fact, have contracts with U.S. Customs and Border Protection (CBP) and Homeland Security (DHS) for pilot projects that gave those agencies direct access to license data. “We clearly communicated poorly,” Flock’s CEO said, acknowledging that Flock’s “public statements inadvertently provided inaccurate information.”
...
Flock knew that, despite not being a customer, ICE had indirect access to Flock’s data and system through the company’s state and local law enforcement customers. The issue was never about having direct access to Flock’s data, it was about having any access to the data. But rather than address these data security and control issues on their merits, Flock released a misleading blog which reads as an attempt to confuse the public and create a false sense of security among its potential government customers. Ultimately, Flock was forced to accept that its denials were simply not credible. The CEO admitted Flock was used for immigration enforcement but argued that such matters were not Flock’s problem.
...
While Flock claimed its new oversight tool would “significantly” reduce the risk of improper uses like abortion enforcement, in reality the tool doesn’t work. As an investigation by our colleagues at the ACLU of Massachusetts found, Flock network audits showed police frequently enter vague terms like “investigation” or “susp” instead of information about the substance of the investigation into the search reason field. In September 2025 alone, a local Oregon police department was allowed to search Flock’s ALPR system after entering “investigation” into the search reason field 111 times and “hehehe” into the field on 20 occasions, which demonstrates how easy it is to search Flock’s system while avoiding security-triggering words like “abortion.” Flock certainly would have known, if it conducted even a rudimentary test of its system, that the search field’s protections were extremely simple to circumvent. Nevertheless, Flock’s financial interests appear to have been better served by the company misrepresenting the efficacy of its security features to the public and its potential government customers.
...
Flock has even made false claims to the public and elected officials about working with the ACLU. Earlier this year, after the ACLU of New Mexico and Flock supported the same state-level ALPR legislation — albeit for very different reasons — Flock’s Senior Director of Public Affairs took to social media to claim that Flock partnered with the ACLU of New Mexico to craft the bill and pass it.
...
Ultimately, reputable governments should not do business with disreputable companies. While governments should think long and hard about not using ALPRs, if local governments insist on doing so, at a bare minimum, they should adopt strong guardrails governing future ALPR use – including strictly limiting data retention, data sharing, and what crimes they can be used to enforce. And, of course, they should refuse to partner with any company that regularly misleads the public, elected officials, and even its own customers.