The Black Box 006: Flock Logs Every Search. Reading the Log Is Optional.
Bot Mutiny |
Twelve million logged searches, felony stalking charges, stolen passwords, and the audit system a surveillance giant is quietly rebuilding
The Black Box 006: Flock Logs Every Search. Reading the Log Is Optional.
Twelve million logged searches, felony stalking charges, stolen passwords, and the audit system a surveillance giant is quietly rebuilding
August 28, 2026
Every time a police officer searches Flock Safety's license plate database, the system writes a line: the agency, the operator's name, the date and time, and a free-text box where the officer types a reason. The reason can be a case number. It can also be the word "protest." In at least one documented set of searches, it was an ethnic slur.
That line goes into an audit log. The log is the entire accountability architecture of the largest surveillance camera network in the United States. And in August 2026, the most important fact about that log is who has actually been reading it.
Twelve million searches.
That is what the Electronic Frontier Foundation obtained through public records requests: datasets covering more than 12 million searches logged by more than 3,900 agencies between December 2024 and October 2025. Ten months of the network talking to itself.
What was built
Flock operates cameras for more than 5,000 police departments, roughly 1,000 businesses, and an unspecified number of homeowners associations across 49 states, according to a November 3, 2025 letter that Senator Ron Wyden and Representative Raja Krishnamoorthi sent to the Federal Trade Commission. The cameras photograph every passing vehicle and record the plate, the vehicle's characteristics, and the time and place. The letter states the network generates and stores billions of vehicle scans each month. An officer can search by plate, but also by make, model, and bumper sticker. A "Convoy" feature identifies vehicles that frequently travel together. Roughly 75 percent of Flock's law enforcement customers have opted into the National Lookup Tool, which lets any enrolled agency search data collected by every other enrolled agency, anywhere in the country, without a warrant.
The check on all of this is the audit log. Flock's position, and the position of most departments that buy the cameras, is that every search is recorded and attributable, so misuse can be caught and punished.
In August 2026, that theory got its best possible test result, and its worst.
The best case
The Bibb County Sheriff's Office in Macon, Georgia now audits its Flock queries monthly. The August audit found searches with no law enforcement purpose. On August 10, the office arrested three of its own deputies. Coznavian Stubbs, Joseph Callaway, and Toni Lewis were charged with felony stalking and violation of oath by a public officer after the audit showed each had repeatedly run plates belonging to people they had personal relationships with, according to the sheriff's office. Callaway, a former K-9 deputy, faces three stalking counts. All three resigned. Sheriff David Davis told 13WMAZ: "There is a line that you do not cross."
Bibb County is what the accountability architecture looks like when it works. An agency reads its own log, finds its own people abusing the system, and charges them.
Now count how often that has happened, and who did the reading everywhere else.
Who actually reads the logs
Georgia Public Broadcasting reported that the Bibb arrests came amid similar cases across the state: five officers arrested in Albany, and six people dismissed from the Savannah Police Department during a Flock misuse investigation. A Conyers police dispatcher was also arrested, per WGXA. That is at least fifteen Georgia law enforcement personnel arrested, charged, or dismissed over plate-reader misuse within weeks, in the one state where agencies started systematically auditing.
Outside Georgia, the pattern holds, with one difference: the person reading the log is almost never the agency.
In Dayton, Ohio, a city audit found its cameras had been searched more than 7,000 times for immigration enforcement, which the city's own policy explicitly prohibits, according to the ACLU's Chad Marlow. In Ferndale, Michigan, a city councilmember's audit found the Ferndale Police Department accounted for less than 1 percent of all searches run against the city's own cameras; the rest came from out-of-state and federal agencies including ATF, Border Patrol, and Homeland Security, as reported by Northern Express. In Illinois, Secretary of State Alexi Giannoulias opened an audit after EFF research showed Flock had allowed U.S. Customs and Border Protection to access Illinois data in violation of state privacy law. In San Jose, EFF and the ACLU of Northern California sued the city in November 2025 after records showed San Jose's database had been searched 3,965,519 times in a single year, without warrants.
And the national dataset itself, the 12 million searches, was not assembled by any oversight body. EFF filed the records requests. The searchable public version, haveibeenflocked.com, was built by Footnote4a, a nonprofit watchdog, from the same kind of FOIA'd audit logs; a volunteer in Dunwoody, Georgia helps compile them. The EFF data showed hundreds of searches logged in connection with political demonstrations, including the 50501, Hands Off, and No Kings protests, with the Tulsa Police Department alone logging at least 38 protest-related searches, some hitting roughly 650 networks with the reason field reading "Protest." More than 80 agencies ran searches using terms targeting Romani people, including slurs.
Every one of those findings came out of the logs. Not one of them was surfaced by Flock, and outside Georgia, almost none were surfaced by the agency that generated them.
The innocent reading deserves its full strength
The audit log did, in the end, produce every discovery above. Deputies are being prosecuted because the record existed. Flock can fairly say its system is more auditable than the paper-era alternative, where an officer following an ex-girlfriend left no record at all. On this reading, the scandals of 2025 and 2026 are the transparency working, painfully and in public.
Why that reading fails
Three structural features, each documented.
First, reading the log is optional. No federal rule requires Flock's law enforcement customers to audit their queries at any interval. Bibb County's monthly audit is a local policy choice; the discoveries in Dayton, Ferndale, Illinois, and San Jose each required an outsider, a councilmember, a state official, or a nonprofit to force the record into the open. The known cases are the cases where someone looked.
Second, the log's attribution cannot be trusted, and that is documented in the congressional record. The Wyden-Krishnamoorthi letter describes a Drug Enforcement Administration officer using the Flock account of a local detective in Palos Heights, Illinois, to run searches, and the detective confirming that members of a DEA task force commonly used his credentials. Every one of those searches entered the audit log under the wrong name. The letter also states that a congressional staff search of Hudson Rock's public infostealer database found passwords for at least 35 Flock customer accounts already stolen, and that security researcher Benn Jordan provided a screenshot of Flock accounts apparently offered for sale on a Russian-language cybercrime forum. Flock confirmed to Congress in October 2025 that it does not require multi-factor authentication. An audit log entry is only a confession if you know who is speaking.
Third, the log records the reason an officer chose to type. The free-text justification field is what let EFF find "Protest" and let auditors find slurs, but it equally permits a case number that exists, a case number that does not, or nothing informative at all. The instrument measures candor, not conduct.
What the instrument cannot see
Haveibeenflocked's own methodology page is candid about the gap: the site's data arrives through public records requests, sometimes months or years after the searches occurred, and represents a fraction of activity on the network. Agencies that deny records requests do not appear. Searches run on shared or stolen credentials appear under the wrong operator. The 12 million searches are the visible portion of a network that, by Flock's own account to Congress, generates billions of scans a month.
The tell
Flock knows the audit architecture failed, because Flock is rebuilding it. In August 2026, the company announced reforms: offense-based filtering so cities can restrict what other departments may search their data for, and what EFF describes as enhanced auditing with proactive lockouts of officers who file suspicious queries. CEO Garrett Langley, who last year called the anti-Flock movement "terrorists," has since apologized and shifted to a conciliatory tone. A company does not add proactive lockouts to an audit system that was catching people.
The record
What the documents establish: that Flock's network logged more than 12 million law enforcement searches in ten months across 3,900+ agencies; that systematic examinations of those logs in Georgia, Ohio, Michigan, Illinois, and California each surfaced violations, including felony charges against sworn officers; that Flock does not require MFA and that credential sharing and theft have put searches into the log under the wrong names; that hundreds of logged searches referenced protest activity and more than 80 agencies used ethnicity-targeted search terms; that at least 47 cities have terminated or rejected Flock contracts, per DeFlock's tracker.
What they do not establish: how many of Flock's 5,000+ agency customers audit their logs at any interval, because no comprehensive data on audit practices exists; the rate of misuse at agencies whose logs no one has examined, which cannot be inferred from the examined ones; that Flock knew of any specific officer's misuse before an audit or records request surfaced it; and the exact Dayton search count, which this piece states as a hedge because the precise figure circulating publicly traces to a single syndicated report.
The stalking charges in Macon are being described as the system working. They are more precise than that. They are what happens in the one county, out of five thousand customers, that decided to read what the machine had been writing down all along.
Sources: Letter from Sen. Ron Wyden and Rep. Raja Krishnamoorthi to FTC Chair Andrew Ferguson, Nov. 3, 2025; Electronic Frontier Foundation, "How Cops Are Using Flock Safety's ALPR Network to Surveil Protesters and Activists" (Nov. 2025) and "Too Little, Too Late" (Aug. 2026); Bibb County Sheriff's Office statements via Georgia Public Broadcasting, 13WMAZ, and the Atlanta Journal-Constitution; ACLU's Chad Marlow, Democracy Now (July 2026); Northern Express (Aug. 2026); haveibeenflocked.com methodology, Footnote4a; DeFlock contract tracker via The Texas Tribune (Aug. 3, 2026).