Image credit: Flock Safety
Police officers who left the force, or were suspended, kept searching Flock Safety's license plate camera network because nobody switched off their accounts, according to a Washington Post investigation published today. The Post counted at least 11 incidents in which people without authorization got into Flock's database, which records the plate, time, and location of every car that passes one of the company's 120,000-plus roadside cameras.
In four of the cases, officers kept using their logins after leaving their jobs or while serving a suspension. In six others, police gave their passwords to officers at different agencies, which officials later ruled violated state law, department policy, or Flock's contracts. Some of the searches were aimed at romantic partners.
Andrae Wright left Georgia's Effingham County Sheriff's Office in 2021, and the Post reports his Flock login kept working for the next five years. After an internal audit by the sheriff's office, the Georgia Bureau of Investigation said Wright searched the system more than 60 times between June 15 and July 5 for non-law-enforcement purposes. Flock audit logs reviewed by the Post show repeated searches for a vanity plate bearing his wife's middle name; the couple divorced this year.
Wright has been charged with stalking, computer invasion of privacy, misuse of a license plate reader system, and violating his oath of office. A sheriff's office spokesman told the Post the agency had not regularly audited who had access to its Flock account but plans to start.
In Indianapolis, a police recruit who was never authorized to use Flock searched with a senior officer's credentials for more than two years. The senior officer had opened Flock on the recruit's laptop and never logged out.
According to a court affidavit, that recruit, Matthew Binford, ran more than 1,000 searches for his estranged wife's plate over a 12-month period. Prosecutors charged Binford and four other Indianapolis officers last month, after an August inquiry from the Post prompted an agencywide audit.
Two more former officers, one in Georgia and one in Michigan, are under investigation for allegedly running searches after their employment ended. The Georgia case involves a woman who resigned from the Fulton County Police Department, which shared a Flock subscription with the county sheriff's office. Police Chief Wade Yates told the Post that no one told the sheriff's office to remove her access.
Sharing was common, too. Covington, Louisiana's police chief found during an August audit that a previous chief had given access to Louisiana State Police and two neighboring agencies, leaving him unable to verify why any of them ran a search. In Cobb County, Georgia, a review last month found that about 200 of the sheriff's office's 900 staff members, including jail employees, could use Flock. The office subsequently reduced the number to about 50.
Flock's recently enacted safeguards address some of this. The company announced on August 13 that it had made multifactor authentication mandatory at the start of the month; so, a password alone is no longer enough to access the system. It is also requiring agencies to adopt Audit Assistance, a tool that flags unusual search patterns, and attach a case code to every search by the end of the year.
Flock's contract requires official government email addresses, which a department can deactivate when someone leaves, but the company acknowledged to the Post that it had not widely enforced the rule until recently. Spokesman Paris Lewbel said Flock has been working with customers since earlier this year to remove accounts tied to non-agency emails and shared logins.
To prevent issues of stale logins, as was the case in Indianapolis, Flock plans to require users to log back in every 12 hours, starting next year. Security researcher Jon Gaines told the Post, "There's zero reason you can't prompt a cop to put in his password."
The Post also reports that three former Flock employees said company leaders resisted internal calls for stricter controls because they did not want to hinder sales to agencies that objected to them. Flock told the Post that when it finds security gaps or policy violations, it acts, and that it did so in several of the incidents described.
Drivers cannot opt out of being recorded, but residents can see how their local department handles access. Flock says more than 1,500 agencies publish a transparency portal showing their policies, retention period, sharing partners, and search activity.
Concerned residents can also ask the department who has access, whether former employees and outside agencies are removed promptly, and whether it requires individual logins, multifactor authentication, and case numbers. A public-records request for the department's retention, sharing, and audit policies may turn up what the portal leaves out.
