Overview
Flock Safety sells solar-powered cameras that photograph every vehicle passing a fixed point, read the plate, log the make, model and colour, and push the result into a cloud database that police can search. The company was founded in Atlanta in 2017, raised at an 8.4 billion dollar valuation in April 2026 with Andreessen Horowitz and Tiger Global on the cap table, and says it now operates in more than 6,000 communities across 49 states with over 5,000 law enforcement agency partners. Its own figure for volume, as of July 2026, is 20 billion vehicle scans a month.
ABC News reported more than 135,000 automated plate-reader cameras identified nationwide, four in five of them Flock’s. The crowdsourced DeFlock project puts the number far higher, and The Intercept reported in September 2026 that Flock had asked for that map to be taken offline.
The decision in front of most readers is not whether to install the app. It is a vote: a city council agenda item, an HOA board motion, a police department budget line. List pricing is roughly 2,500 dollars per camera per year plus a 300 dollar installation fee, and real contracts run into six figures. College Station voted on a 400,000 dollar renewal for 84 cameras. Tracy, California approved a 44-month agreement not to exceed 639,467 dollars for 49. Those are the numbers that appear on the agenda. What does not appear is that buying one camera enrols the town in a national search surface.
What It Knows About You
Your plate, the time, and the exact spot you were at that moment. Also the make, model, body type and colour, and what Flock markets as vehicle fingerprinting: roof racks, bumper stickers, dents, ladders, anything that makes a car identifiable when the plate is obscured. You do not need to be suspected of anything. The camera photographs everyone, and the database is the point.
We know more about what sits on the device than the marketing says, because someone took one down. On 16 September 2026, 404 Media and Distributed Denial of Secrets published a joint investigation with WIRED into a Flock camera physically removed from a road by a group calling itself stegan0gram. The device held about 1.6 million images and 27,321 video clips covering 21 days, roughly 50,200 vehicles. Researcher Micah Lee’s analysis found the on-device encryption key sitting in an unprotected partition next to the data it was supposed to protect, on a Linux 3.18.71 kernel whose security patches stopped in 2018. The clone also showed the camera classifying people and bicycles, not only cars, though no working facial recognition was found on it. Flock’s position is that the wider network was not compromised, and on the evidence published that is correct: one camera was cloned, not the cloud.
Retention defaults to 30 days under Flock’s standard master services agreement, with longer periods sold as an add-on. After the 2026 backlash the company said it now advocates a seven-day default. Advocating is not the same as shipping, and the contracts signed before that shift still govern the cameras already on the poles.
The Real Risks
The risk is the network, not the camera on your street. In 2025, 404 Media reported that a Texas sheriff ran a nationwide query across roughly 83,000 Flock cameras while looking for a woman who had had an abortion. The Illinois Secretary of State’s office found that a suburban Chicago department had answered it, violating a 2023 state law that bans sharing plate data to track abortion seekers or undocumented immigrants. Secretary of State Alexi Giannoulias referred the matter to the attorney general and began building an audit programme. Flock’s response was to block 62 out-of-state agencies that had sought abortion- or immigration-related data and to start flagging those words in access requests. The mechanism worth noticing is that no one hacked anything. The system did exactly what it was built to do, for a user with valid credentials, across a state line.
Federal access arrived without a federal contract. Flock published a blog post titled “Does Flock Share Data With ICE?” answering no, and as a statement about corporate partnerships that is accurate. The route was local departments. Federal officials from ICE, CBP and Homeland Security Investigations queried the Bend, Oregon police department’s Flock data 279 times in the first three weeks of a June 2025 pilot. Records obtained by the University of Washington’s Center for Human Rights showed at least eight Washington agencies enabling direct sharing with Border Patrol during 2025. The Star Tribune found Minnesota and out-of-state agencies searching Twin Cities data for immigration enforcement. This is not uniform: an audit of the Columbus, Ohio network found ICE had run zero searches against it over two and a half years. Whether federal agencies see your town’s data has depended on settings your police chief controls and you probably cannot see.
A misread character becomes a felony stop. In April 2024 a Flock camera in Toledo read the 7 on Brandon Upchurch’s plate as a 2, matched a stolen vehicle, and Toledo police ran a high-risk stop without visually checking the plate against the alert; a police dog injured him on the ground. In South Carolina, Iraq War veteran Steven Melvin was held at gunpoint after a camera misread one letter of his tag, and his federal civil rights suit notes that Flock cameras had read that same plate correctly 13 times before. The Institute for Justice has documented 26 innocent motorists detained at gunpoint or jailed over plate-reader errors since 2018, and found that in nearly two thirds of them officers did not realise the mistake until after they had drawn their weapons. Optical character recognition will always miss occasionally. The damage comes from a workflow that treats a machine alert as probable cause.
Where the cameras go is not neutral. A 2026 study of 614 Flock cameras across Hampton Roads, Virginia found predominantly Black neighbourhoods under plate-reader surveillance at close to four times the rate of white ones. Investigative Post found two thirds of monitored intersections in Buffalo sat in predominantly Black neighbourhoods. Louisville Public Media reported that half the people charged in plate-reader cases there in 2025 were Black. Placement follows historical enforcement patterns, and in Oakland the cameras clustered in Black and Latino neighbourhoods even though vehicle crime was concentrated elsewhere. A camera is not biased. A map of cameras can be.
Alternatives
- Change the contract rather than the vendor. The levers that matter are set in the agreement, not the hardware: retention cut to seven days, federal sharing switched off with no per-agency exception, case codes required and logged for every search, and an audit published somewhere residents can read it. Several of these exist as options Flock now offers. Most are not on by default.
- Switching brands is not an exit. Military.com reported that communities cancelling Flock are quietly replacing the cameras with Axon and other vendors. Same scans, same retention question, different logo on the pole. If the objection is to the national search surface, a competitor with one does not answer it.
- Cameras you own and do not network. A doorbell camera or a private lot camera keeps footage under one owner’s control and out of a cross-state database. It brings its own problems, including police requests and cloud storage you do not administer, but the blast radius is a street rather than a country.
- The boring options. Street lighting, road design and directed patrols are unglamorous and have advocates with evidence. Worth saying plainly: the academic work I found concentrates on where these cameras get installed rather than on whether they reduce crime, so anyone claiming a settled answer in either direction is ahead of the published research.
- As an individual, almost nothing. You cannot opt out of being photographed on a public road, and there is no consumer setting here. The available moves are civic: the DeFlock map shows what is already near you, and the contract renewal is a public meeting. The ACLU publishes a guide for people who want to raise it at one.
Our Verdict
D. The scores that drive it are privacy at 9 and autonomy at 8, and both come from the same place: a system with no consent step for the people it records, wired to a national search surface whose documented misuses were carried out by authorised users rather than intruders.
It is not an F, and the reasons matter. Retention defaults to 30 days rather than forever. The data belongs contractually to the agency that owns the camera, and agencies that switch federal discoverability off can make it stick. Flock has shipped real changes under pressure during 2025 and 2026: a federal organisation designation that labels the origin of requests, default undiscoverability for federal law enforcement, state-level blocks for Virginia and California, mandatory case codes for searches, and automatic lockout on anomalous query patterns. A federal judge in Norfolk, Virginia, Mark Davis, ruled in early 2026 that the city’s 176-camera network was not an unconstitutional search, while warning that the balance could tip the other way as the technology spreads. Compare that with an entry like Tesla’s FSD, where the company’s own claims were the problem; here the claims are mostly narrow and mostly true, and the gap between what the vendor promises and what a credentialed user can do is where the damage lives.
The market is voting anyway. More than fifty localities ended or paused Flock contracts in the year to mid-2026, Denver pulled all 110 of its cameras, and Oshkosh rescinded a contract 7-0 less than a day after approving it.
What would move this to C: seven-day retention as the shipped default rather than a recommendation, federal access unavailable without an affirmative local vote on the record, published per-agency search audits, and hardware that is not running a kernel abandoned in 2019. What would move it to F: a compromise of the central network rather than a single roadside device, or retention defaults moving the other way.