k074m4n
◂ BACK TO ARCHIVE

2026.09.03DECRYPTED

Watching the watchers: Flock and the license-plate dragnet

  • SURVEILLANCE
  • ALPR
  • OSINT
  • PRIVACY

If you drive in the US there is a good chance a camera already knows your car. Not one camera. A network of them. Flock Safety makes small automated license-plate readers that sit on poles at intersections and neighborhood entrances. Over the last few years they have spread into more than 5,000 American communities, usually without residents being asked. Now people are pushing back. Some of that pushback looks a lot like the wardriving I grew up reading about.

What Flock actually is

Flock cameras read license plates. That part is obvious. What is less obvious is that they also log a “vehicle fingerprint”: make, color, body type, bumper stickers, the dent on your rear quarter panel. Every read becomes a row in a database: plate, description, location, timestamp. Line those rows up and you get a map of where a car has been.

The reads do not stay local. Flock runs a national lookup. One department’s cameras can be searched by thousands of other agencies. That is where it gets ugly.

In May 2025 a sheriff’s office in Johnson County, Texas searched roughly 83,000 cameras across more than 6,800 separate networks to find one woman. The reason typed into the search field was “had an abortion, search for female.” The sheriff later said it was a welfare check after a family report. Flock called the coverage misleading. A sworn affidavit from the lead detective described it as a death investigation opened after someone reported the abortion. Whatever you call it, one deputy pointed a national camera network at one woman’s car, including cameras in states where abortion is legal.

The same network feeds immigration enforcement. 404 Media reviewed Flock search logs pulled from the Danville, Illinois police and found more than 4,000 lookups run for federal immigration purposes. ICE has no contract with Flock. It does not need one. Local police run the searches on its behalf and hand over the results, which gives a federal agency a side door into a tool it never signed for. Customs and Border Protection had access to more than 80,000 Flock cameras.

That is what people are reacting to. Cities have started pulling the cameras. In 2026 the town of Dumfries, Virginia voted 4 to 2 to remove eight Flock cameras before they were ever switched on. Los Angeles let its Flock contract lapse. In Norfolk two residents backed by the Institute for Justice sued the city over its 176 cameras, arguing that logging every driver’s movements without a warrant breaks the Fourth Amendment. A federal judge ruled in January 2026 that the cameras do not yet capture “the whole of a person’s movements,” then warned the answer could change as the network grows. The residents plan to appeal. Some people have skipped the courts and taken angle grinders to the poles.

From wardriving to flock driving

Wardriving is old. You put a WiFi adapter in a car, run something like Kismet and drive around logging every access point you pass: SSID, signal, GPS fix. The name comes from wardialing in the 1980s, calling every number in a range to hear what picks up. The point was never to break in. It was to map. You cannot reason about something you cannot see. Wardriving made the invisible RF world visible.

People call it flock driving or flock running. It is the same idea pointed at surveillance hardware. Instead of access points you log cameras: where each one sits, which way it faces and which vendor made it. You spot them by eye, photograph the pole and note the cross street.

Most of that work lands on DeFlock, a crowdsourced map of ALPR locations built on OpenStreetMap. Anyone can add a camera. Anyone can read the map. By early 2026 the project had passed 336,000 tagged cameras worldwide. It is the same move as the old wardriving maps, aimed at the cameras watching the street instead of the routers leaking out of apartments.

Why bother. Because a surveillance network you can see is one you can argue about. A map turns “there are some cameras around here” into “there are eleven of these on my commute, here are the coordinates, here is the department that runs them.” That is the version you can bring to a council meeting or staple to a records request. Mapping is boring work. It is powerful for the same reason: it makes the thing legible.

The problem with mass surveillance, even if you have “nothing to hide”

Here is what gets me about ALPR. Any single read is trivial. Your plate is public, you are on a public road, fine. The harm is not the read. It is the aggregation.

Stack six months of reads and the database knows your doctor, your church, the union hall, the clinic, whose driveway you park in overnight. It knows the protest you drove to. None of that needed a warrant or a suspicion or anyone deciding you were worth watching. It gets collected on everyone and stays searchable backward in time. It sits there until someone queries it or leaks it or repurposes it for something the town never agreed to.

These systems are also wrong often enough to hurt people. The Institute for Justice has documented more than two dozen cases of innocent drivers pulled over or held at gunpoint after a camera error. In Toledo a Flock camera read a 7 as a 2. A man was stopped at gunpoint, bitten by a police dog and jailed for hours. In Tennessee an O became a 0. Two grandparents were held at gunpoint with their three-year-old granddaughter in the back seat. In Arkansas this year police surrounded a family’s SUV with guns drawn over a single misread character. Their six-week-old was in the car. One audit found roughly one in three Flock hot-list alerts it reviewed were wrong.

What you can actually do about it

On your own there is not much you can do about your own plate. It is mandatory. It is public. Covering it or flipping it or spraying it is illegal in most states and mostly does not work anyway. I am not going to pretend there is a clever trick.

The leverage is collective. It is also unglamorous.

Find out what is deployed near you. DeFlock is a decent first look. A public-records request to your police department for its Flock contract and audit logs is better. Most of the reporting above started from exactly those logs.

Then push it through the same doors the cameras came in. City councils, HOA boards and police budgets put these systems up. They can take them down. Towns have passed retention limits and audit rules and bans on sharing data with federal agencies once enough residents showed up to a meeting.

Lean on the people already doing the work. EFF’s Atlas of Surveillance maps who runs what across the country. The ACLU has reported on plate readers for years and 404 Media is where most of what I wrote here comes from.

The rest of your normal privacy hygiene still matters because ALPR is one feed among many. Do not let anyone sell you a gadget as the cure for a policy problem. The camera on the pole is a decision your town made. Undoing it is a decision your town can make too.

Sources