Three takeaways from the Senate hearing on Flocks camera network

Flock Safety, the largest U.S. seller of automated license plate reader (ALPR) cameras, continues to draw national scrutiny. That debate now includes the halls of Congress, as a Senate Judiciary subcommittee examined how the company's data is secured, searched, and shared.

Flock's network of privately owned and operated cameras and its nationwide database have drawn bipartisan concern over the past several months. Beyond mass surveillance concerns, critics have pointed to incidents of false positives, cooperation with federal agents on immigration enforcement, and even tracking women seeking abortions across state lines.

The Subcommittee on Crime and Counterterrorism, chaired by Sen. Josh Hawley (R-Mo.) with Sen. Dick Durbin (D-Ill.) as ranking member, heard from five witnesses: a Florida woman wrongfully jailed in a case that began with a Flock camera image, an Arizona sheriff who ended his county's Flock contract, a security researcher, and policy attorneys from the American Civil Liberties Union and the Institute for Justice.

No one from Flock testified. Invitations were also extended to Axon, Motorola, and Verkada. Flock's CEO, Garrett Langley, sent the subcommittee a letter instead of appearing.

The note, read aloud by Hawley, stated: "Flock acknowledges it conducts very little oversight of client searches and instead relies on its clients to police themselves. The underlying search records are owned and controlled by each customer agency. Flock clients control the data retention. Until last year, Flock customers could enter the reason for a search into a free text field."

The absence was notable, though not necessarily unusual for this kind of proceeding. Wednesday's session was a legislative hearing, designed to gather facts on an issue rather than to investigate a specific company's conduct. Hearings like this can seem performative, with senators often asking questions they already know the answers to so that expert witnesses can state them on the record.

However, if the subcommittee moves to an investigative hearing, lawmakers would have the power to subpoena Flock's CEO rather than simply invite him, and they could question him about the claims already on the record. Despite the absences, the concerns put on the record point to some key takeaways about Flock and its partnership with law enforcement.

1. The biggest gap may be in how police use the data

Much of the hearing treated Flock as the source of the harm. But in many of the cases witnesses described, even though Flock's cameras gathered the data, law enforcement officers still made the decisions.

Case in point, the committee heard the testimony of Lindsey Isaacs, a young woman in Florida whose Dodge Durango was photographed by Flock cameras and later linked by investigators to a crash that killed three people in October 2025. Six months later, she was in a jail cell charged with vehicular homicide. It took 13 days and photos of her undamaged, impounded SUV to get her out.

According to her testimony, the Flock camera placed her vehicle two to three miles from the crash scene. Investigators were searching for a black Durango. Witnesses had described a maroon one, and 911 callers had provided a partial plate. Troopers impounded her SUV and said it had collision damage she could not see. Months later, a warrant was issued anyway, and she was denied bond. The case fell apart only after her attorney showed the court photos of the vehicle sitting undamaged in the impound lot. Prosecutors declined to charge her, and another person was later charged.

Sen. Durbin raised this point directly, questioning why the investigation moved forward when the vehicle itself showed no signs of a crash.

The same pattern appeared in the discussion of how officers search the network. Per Langley's letter to Hawley, the search records belong to the customer agencies; those agencies set their own retention rules, and Flock does little oversight of individual searches and relies on clients to police themselves. And until recently, law enforcement officers could type in reasons for a search in a free-text field — though Hawley pointed out examples such as "search" and "lol" appearing in those boxes.

Alasdair Whitney, a witness from the Institute for Justice, told the committee that the organization cataloged more than 240 incidents of ALPR misuse, including officers tracking current and former partners. In Norfolk, Virginia, he wrote in his opening testimony, no one audited hundreds of thousands of searches until a lawsuit forced the city to. In a Virginia survey of agencies after the state passed limits on ALPR use, many agencies admitted they weren't following the law, and nearly a third didn't respond at all.

Whitney also cited a California department that found that most of its stolen-vehicle and felony alerts over two years were due to misread plates. Later in the hearing, Whitney described what he called "side door" access to Flock's database, in which federal agents ask local officers to run searches that state law would not allow federal agencies to run directly.

When Sen. Alex Padilla (D-Calif.) asked whether Flock shares data with Immigration and Customs Enforcement, ACLU senior policy counsel Chad Marlow said the company does not provide data to ICE directly. He argued that any local officer with access could run searches on the federal agents' behalf, with little to stop it.

All in all, the testimony reveals several truths about Flock's camera network and its relationship with law enforcement. First, cameras flagging the wrong car is unmistakably a failure. But second, stopping a family at gunpoint without first checking the plate is a decision someone makes. Using the database to stalk an ex is a decision someone makes. Skirting state laws to give information to federal immigration officers is a decision someone makes. Putting a young woman in jail for vehicular homicide despite evidence to the contrary is a decision someone makes.

None of the policy proposals presented at the hearing focused on officer discipline or on the systemic failure of law enforcement to properly do their jobs. Although it must be said that the Institute for Justice's model bill does include mandatory supervisor approval, 30-day audits, and suspended database access for violators.

2. The data is only as safe as the weakest camera

The second takeaway is about security. Security researcher Benn Jordan, who was present as a witness, described research he conducted with fellow researcher Jon Gaines, who has published 55 vulnerabilities related to Flock's systems.

Data from American Community Media states that Flock's network of 120,000 cameras has conducted 20 billion scans monthly across the country. A database of where millions of people drive is valuable to more than the police. According to Jordan, a common camera model could be taken over in under a minute by someone with physical access. He also said he found exposed administrative interfaces on more than 60 of the company's newer pan-tilt-zoom cameras, and Flock law enforcement accounts listed for sale on a dark web marketplace.

Hawley asked Jordan about a statement attributed to Flock's CEO that the company had never been hacked. "Flock has never been hacked. Ever," read the quote that Langley sent to a Staunton, VA police chief.

Jordan said that was false. He testified that the cameras run on a modified, older version of Android and aren't held to federal cybersecurity standards. Jordan also said that he had been able to make out the contents of a person's phone screen in a camera image. Flock has said in past statements that its license plate readers capture vehicle details and do not use facial recognition. Flock's system uses purpose-built, high-resolution cameras to capture moving objects instead of recording video.

Whitney added more recent examples. Last December, internal materials showed Flock sending U.S. camera images to overseas gig workers to train its AI. Last week, hackers reported pulling a camera off a pole and recovering an encryption key stored on the device itself. He noted that in a city like Norfolk, home to major naval installations, a record of service members' daily movements is exactly what a foreign intelligence service would want.

Jordan did say Flock recently invited him and other researchers to review its systems. While there hadn't been time for a full review, he said the company seemed to be taking security more seriously than a year ago.

3. Flock is the face of the problem, not the whole of it

The third takeaway is that mass license plate collection is neither new nor unique to Flock.

Private plate-scanning networks have operated for more than a decade, largely through the repossession industry. A 2015 federal appeals court decision described cameras sold to repossession companies and mounted on tow trucks, automatically logging plates with the date, time, and GPS location, with the data then sold to auto finance and insurance companies. It's similar to a scheme Flock wanted to pursue through Uber and Lyft drivers.

A 2014 ABC7 Los Angeles investigation reported that companies outfitting repo cars with these cameras were feeding the scans into private databases and selling them without drivers' knowledge. That network, Digital Recognition Network, is now owned by Motorola. According to the ACLU, it claims to collect 500 million plate reads a month, makes the data available to law enforcement customers for an added fee, and is "subject to no apparent data retention policy."

Witnesses at the hearing warned against treating Flock as the only target. Jordan said Axon and Motorola are rolling out the same kinds of features Flock is being criticized for. Marlow pointed to Denver, which he said dropped Flock and immediately signed with Axon.

However, while all parties present were concerned about Flock cameras, there was a disagreement over how surveillance camera laws should be written. Marlow wants Congress to bar any federally funded law enforcement agency from using ALPRs at all. Meanwhile, Whitney urged a warrant requirement for location data more than two hours old, a seven-day retention cap, and conditions on federal grant money. Real-time alerts for stolen cars and missing children would stay in place.

Speaking as a security researcher, Jordan called for mandatory independent security inspections of surveillance vendors and a broad federal privacy law. Finally, Pinal County Sheriff Ross Teeple supported basic plate reading and asked for statutory limits on AI-driven tracking. Teeple, when questioned during the hearing, said that he dropped Flock partly because he believed the company misled him about its capabilities.