JimmieJoe / KC6YRU

Flock Automated License Plate readers have been increasingly in the news recently, as problems with the surveillance system have come to light. Many communities have begun to re-think their use of Flock. Los Angeles PD is one large agency that has decided to revisit their use, and has put renewing their subscription on hold for now. Here are my thoughts on Flock and other similar license plate reader operations.

In a perfect world, computer-based information systems like Flock would be a powerful tool for law enforcement. Put in a license plate number, or a vehicle description, and given enough cameras in the system, pinpoint where a stolen car went (or is), find a missing elderly person who drove off and has become confused on how to get home, or a myriad of other scenarios that might benefit from accessing such a database.

The problem is, we don’t live in a perfect world.

News stories have been plentiful, and more frequent, as Flock has become the major player in the license plate reader field these past several years, of authorized users accessing the system to stalk former romantic partners or spouses, to track new romantic partners, and to harass those who have found themselves on the wrong end of someone’s hostility.

While those incidents are serious, and prosecution of those involved is required, it’s not my primary concern with, in Visalia’s case, Flock Safety. Have you read the contract the City of Visalia signed with Flock? I have, and while I’m certainly not a lawyer, I’m concerned about some things.

“Customer hereby grants to Flock a limited, non-exclusive, royalty-free, irrevocable, worldwide license to use the Customer Data and perform all acts as may be necessary for Flock to provide the Flock Services to Customer. Flock does not own and shall not sell Customer Data.”

Why would Flock need a license to use customer data to provide services to the customer? I’m concerned about “use customer data”. We’ll come back to the “shall not sell Customer Data” in a moment.

“Customer grants Flock a non-exclusive, irrevocable, worldwide, royalty-free, license to use the Customer Generated Data for the purpose of providing Flock Services. Flock does not own and shall not sell Customer Generated Data.”

Again, another instance of a license to Flock to use the data, and another “shall not sell” line. That “for the purpose of providing Flock Services” could be interpreted to allow Flock to use the data generated for whatever it likes, as long as that use is part of “providing Flock Services”. Training an AI using Visalia’s data would certainly fall under this line.

Anonymized Data. Flock shall have the right to collect, analyze, and anonymize Customer Data and Customer Generated Data to the extent such anonymization renders the data nonidentifiable to create Anonymized Data to use and perform the Services and related systems and technologies, including the training of machine learning algorithms. Customer hereby grants Flock a non-exclusive, worldwide, perpetual, royalty-free right to use and distribute such Anonymized Data to improve and enhance the Services and for other development, diagnostic and corrective purposes, and other Flock offerings. Parties understand that the aforementioned license is required for continuity of Services. Flock does not own and shall not sell Anonymized Data.

“Including the training of machine learning algorithms.” That’s AI. That would be a red flag for a lot of people, if the phrase was “including the training of artificial intelligence” programs. And again with that “shall not sell” line.

Here’s where it gets deep. California law prohibits any law enforcement agency from sharing data like that collected by the Flock Safety System with any organization outside of the state. (Civil Code §§ 1798.90.5–1798.90.55)(SB 34)

Theoretically, this prevents agencies like ICE, the FBI, or Homeland Security from using (in our case, Visalia’s) data to pursue targets. With the Flock Safety contract, however, all this means is that Flock can’t provide them with user access. In other words, ICE can’t get a user name and password and simply log into the Flock system and search wherever they please, at least for anything in California. They are (again, theoretically) blocked from access.

So, fine. Flock won’t let unauthorized users access to Visalia’s data. However…

Compliance With Laws. Parties shall comply with all applicable local, state and federal laws, regulations, policies and ordinances and their associated record retention schedules, including responding to any subpoena request(s).

Regardless of California law, if, for instance, an agency of the U.S. government were to subpoena Flock for data recorded in Visalia, Flock would hand it over. It might be slower than being able to log on and gain access directly, but it is an option. We’ve seen this administration repeatedly use “administrative warrants” and other means to bypass usual legal restrictions.

Flock may use the services of one or more third parties to deliver any part of the Flock Services, (such as using a third party to host the Web Interface for cloud storage or a cell phone provider for wireless cellular coverage).

Another fly in the privacy ointment – in 2025, a “third party vendor” misconfigured the servers, and allowed any user anywhere to have access to all the data in their system. Any user outside of California had access to prohibited files for an unknown amount of time. Flock says that was fixed, and would not happen again, but it’s a simple setting toggle to implement. It can happen again.

It’s simple. Visalia’s data is not secure. It can be used to train Flock’s AI, and be used to generate profits for Flock. While Las Vegas Metro Police may not be able to follow you back home after something happened there (what happens in Vegas doesn’t really stay in Vegas), ICE could easily decide you aren’t “American” enough, and go after information about you stored in Flock’s servers with a “subpoena”.

Oh, and that “shall not sell” line, repeated three times in the contract? It doesn’t prevent them from simply providing the data to a business partner or other entity for their own profit-generating operations. “We didn’t sell your data! Just like our contract says! You gave us a non-exclusive, world-wide license to use it, as long as we don’t sell it! We didn’t!”

The reason Flock and similar systems have flooded the United States (and California agencies have bought into the hype in droves) is their business model. For, what cities and counties perceive as, low initial costs, users can gain access to a nation-wide system. They don’t have to maintain any computer servers or related infrastructure.

To sweeten the pot, and induce governments to accept the program, many jurisdictions, including Visalia, receive grants to pay for the entire cost involved. Visalia’s system is being paid for by two grants from the Edward Byrne Memorial Justice Assistance Grant (JAG) Program, administered by the California Board of State and Community Corrections (BSCC). After the four years of grant-funded operation, the City will have to come up with the money some other way. Either by finding new grants, pay for the system out of the police budget or general fund, or cancel the service. Current rates are $2,500 to $3,000 per year per camera. Visalia will have 22 cameras in service at the end of the grant funding cycles. That’s at least $55,000 a year to maintain them after the grants run out.

Police tout the ability to solve crimes, find missing persons, and track criminals. This is all true. Flock claims “up to 70%” reduction in crime after the installation of their cameras. That’s probably a big stretch, but no doubt the cameras do help.

The downside is secrecy, and constant surveillance of individuals without warrants, or even suspicion. The data is supposed to be deleted after 30 days (and storage capacity would incentivize Flock to be strict about that, freeing up previously used space), but your movements around your city are logged and stored. Do you trust the police, the state, or the Feds to always follow the law, and not abuse the system?

The system requires a “reason” to search the data, and that reason is logged. However – (there’s that word again) – Visalia has allowed “investigation” (of what?) and “836” to be reasons to search the data. “836” by itself is meaningless, as it is a penal code that allows an arrest for a crime not committed in an officer’s presence. It’s usually used as something like “836-245” or “836-187” (suspicion of assault, suspicion of homicide). The “reason” field can be whatever they like. The law says it has to be for a legitimate law enforcement reason, but only each jurisdiction enforces that requirement at the time of the search.

So now the decision is clear. How much government surveillance are you OK with? Do you trust your local police department to not violate your rights? The County Sheriff’s Office? The California Highway Patrol? Any law enforcement agency in the entire state of California? Do you trust Flock to keep your data confidential? Not to use it to train their AI? Not to provide it at the merest whiff of a subpoena from the Federal government?

I generally trust Visalia PD, even though they’ve been making some unfortunate decisions that I disagree with lately. The same with the Tulare County Sheriff’s Office. Beyond them, however, I’m much more wary. And don’t get me started (too late?) about ICE or the Feds.

Here are the prior blogs I’ve written about Flock, if you want to see them.

1. What the Flock?
2. Well, Flock Me!
3. More Flock, More Fun
4. Flock you later
5. Flock the Lawyers
6. Tick Tock Tick Flock
7. The Final Flock – and the answer is “NO”